smpCTF (reto informático)

Durante las fechas de la final del mundial se organizó un nuevo reto informático (wargame, CTF) en Internet, esta vez por parte del grupo Spider Monkey Phenomena- SMP, la "tarea" consistía en pasar 20 niveles que se iban liberando poco a poco y resolver 7 preguntas relacionadas con el mundo de la seguridad informática.

Para jugar nos unimos a uno (SecTrack) de los dos grupos colombianos registrados, pero solo estuvimos dos personas tratando de pasar los niveles. Entre final de fútbol y otras actividades logramos realizar 8 retos que nos dejaron en la posición 37 .

Al principio el CTF estuvo muy desorganizado, se fugó alguna información, tambien se tuvieron algunos errores en los niveles iniciales, pero luego todo se normalizó. La parte quizas que no me gustó mucho fue el diseño de algunos niveles, pues aunque uno tuviera la respuesta no habia forma de encontrar la bandera ya que estaban esperando un ingreso de datos sumamente especifico. Pero bueno, seran cosas para mejorar, de todos modos fue un gran wargame y pasamos un buen rato.

Algunos apuntes en el chat a la hora del cierre.

Sobre el nivel relacionado con el CSSdescrambe:

[pwn0rz]sk: dude, that sucks, i copied EXACTLY the CSSdescrambe function and sha1'd it, didn't work
[18:06] [smp]j5_: Google won't help for this challenge
[18:06] [smp]j5_: Copy/paste won't help, some writing will be required
[18:06] [smp]j5_: It's a small text box for a reason, so full code is not required

Sobre el reto más raro que haya visto:

[18:10] [smp]j5_: THINK GREEN -> SSL EV certificates (browser bar goes green when you surf traffic
[smp]j5_: THINK GREEN -> SSL EV certificates (browser bar goes green when you surf traffic
[18:11] [smp]j5_: millions of people per day -> verisign ads 175 million hits a day
[18:11] [smp]j5_: search on EV certs on verisign, and you get their Intermediary certificates on their website
[18:11] [smp]j5_: search on EV certs on verisign, and you get their Intermediary certificates on their website
[18:11] [smp]j5_: if you ever implemented EV certs, you sometimes need to include the intermediary certificates in your appliance or else the browser complains
[18:11] [smp]j5_: they have primary (1) certificate and secondary (2) certificate
[18:12] [smp]j5_: (1,2,1) and (2,1,2) are a 2-stage encrypt
[18:12] [smp]j5_: (a,b,c)
[18:12] avatare: Nahhh
[18:12] [smp]j5_: a= first public key to transpose
[18:12] [smp]j5_: b= second key to transpose
[18:12] [smp]j5_: c= reverse output
[18:12] [smp]magikh0e: lol
[18:13] [smp]j5_: with 1,2,1 you start with the primary intemediary certificate and then use secondary
[18:13] [smp]j5_: you take every 3rd, but not 9th, nor 21st character
[18:13] [smp]j5_: and if it's even, use from 1
[18:13] [smp]j5_: if it's odd, use from 2
[18:13] [smp]j5_: the end result is a 103 length string
[18:13] [smp]j5_: which is conveniently prime
[18:13] [smp]j5_: with inputs of 2,1,2 you start with secondary intemediary then primary intemediary, and reverse your answer at the end
[18:14] [smp]j5_: had anyone got far enough, help would have been provided to deal with the reversing
[18:14] [smp]j5_: people got as far as SSL EV certs
[18:14] [smp]j5_: and started looking at verisign
[18:14] [smp]j5_: people got as far as SSL EV certs
[18:14] [smp]j5_: and started looking at verisign
[18:14] [smp]j5_: and suggested to those teams to consider values longer than 103 chars (ie public keys)
[18:15] [smp]j5_: i know SSL is practically uncrackable (for now) so any standard implementation of RSA was not on the table, even for my craziness
[18:16] [smp]j5_: oh, and the strings were rot13'd which many people figured out
[18:16] [smp]j5_: k, pretty much done
[18:16] [smp]j5_: i have java source to build the solution if anyone cares (for c14)
[smp]magikh0e: hehe

LOL

[18:51] [smp]magikh0e: my head is pounding
[18:51] [wod]bios: hrhr
[18:51] [smp]magikh0e: but not tired
[18:51] [smp]magikh0e: its weird
[18:51] [smp]magikh0e: over tired i guess

---

magikh0e: its gonna be so lonely after smpctf
[14:39] magikh0e: everyone will go back to life
[14:39] magikh0e: lol

...

Felicitaciones al equipo ganador del concurso que una vez mas se posiciona como uno de los mejores teams en competiciones CTF: http://nibbles.tuxfamily.org/

Y nuevamente quiero hacer la invitación a que participemos de forma coordinada en próximos retos como equipo colombiano. Todas las personas que sientan curiosidad por los temas de hacking, reversing, forense y quieran recibir y aportar conocimientos son bienvenidos.

La lista donde compartimos información sobre estos temas es:
http://groups.google.com/group/ctf-colombian-team?pli=1

Algunas soluciones del reto:
http://nonroot.blogspot.com/2010/07/smpctf-smpchallenges-writeups.html

Saludos y hasta la próxima.