{"id":16735,"date":"2016-08-11T10:00:53","date_gmt":"2016-08-11T17:00:53","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=16735"},"modified":"2016-08-11T08:30:24","modified_gmt":"2016-08-11T15:30:24","slug":"labyrenth-capture-the-flag-ctf-hints","status":"publish","type":"post","link":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/2016\/08\/labyrenth-capture-the-flag-ctf-hints\/","title":{"rendered":"LabyREnth Capture the Flag (CTF) Hints"},"content":{"rendered":"

\"Unit<\/span><\/div><\/a><\/p>\n

The LabyREnth<\/a> capture the flag challenge is only open for four more days, but you still have a chance to participate. To help you get started, or move on to the next challenge, our threat research team put together a number of (sometimes cryptic) hints. Whether you\u2019ve been stuck on a challenge and want to move on to the next one, or want to jump in during the final stretch, look no further:<\/p>\n

<\/p>\n

Windows 1:<\/h3>\n

Watch out for those debugging checks, these XORs aren\u2019t too hard\u2026<\/p>\n

Windows 4:<\/h3>\n

Try harder, with a vengeance! \u2026 Or a napkin! \u2026 Or a brute forcer!<\/p>\n

Unix 1:<\/h3>\n

How many levels deep does it go?!?! I\u2019d say script it, or maybe bash one liner if you\u2019re extra cool\u2026<\/p>\n

Unix 2:<\/h3>\n

The Program only does one thing, HTTP request and print. Figure out how that HTTP request works\u2026<\/p>\n

Docs 1:<\/h3>\n

Use the URL for hints on how to decode part of the URL this naughty macro attempts to download from. \u00a0Could be base64 and XOR \ud83d\ude09<\/p>\n

Docs 4:<\/h3>\n

\"LabyREnth<\/span><\/div><\/a><\/p>\n

Mobile 1:<\/h3>\n

That seems like a lot of bytes for a call\u2026what do you think RDX?<\/p>\n

Mobile 3:<\/h3>\n

Decompile -> Find -> Replace -> Profit<\/p>\n

Threat 1:<\/h3>\n

sed -e 's\/\\&L4bry1nth_.*\\?\/\/g'<\/p>\n

Threat 2:<\/h3>\n

AAAAAAAAAAA!!!! Compression AAAAAAAAAAA!!!!<\/p>\n

Random 1:<\/h3>\n

Give that environment variable a drink!<\/p>\n

Random 3:<\/h3>\n

Step 1: SYN packet sequence numbers; Step 2: Embedded ZIP; Step 3: Profit!<\/p>\n","protected":false},"excerpt":{"rendered":"

The LabyREnth capture the flag challenge is only open for four more days, but you still have a chance to participate. To help you get started, or move on to the next …<\/p>\n","protected":false},"author":138,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[133],"tags":[2145,2142,586],"coauthors":[1312],"class_list":["post-16735","post","type-post","status-publish","format-standard","hentry","category-events","tag-ctf","tag-labyrenth","tag-unit-42"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/16735","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/users\/138"}],"replies":[{"embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/comments?post=16735"}],"version-history":[{"count":5,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/16735\/revisions"}],"predecessor-version":[{"id":16756,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/16735\/revisions\/16756"}],"wp:attachment":[{"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media?parent=16735"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/categories?post=16735"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/tags?post=16735"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/coauthors?post=16735"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}