{"id":20703,"date":"2016-10-06T17:00:19","date_gmt":"2016-10-07T00:00:19","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=20703"},"modified":"2016-12-09T10:55:56","modified_gmt":"2016-12-09T18:55:56","slug":"unit42-labyrenth-capture-flag-ctf-random-track-solutions","status":"publish","type":"post","link":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/2016\/10\/unit42-labyrenth-capture-flag-ctf-random-track-solutions\/","title":{"rendered":"LabyREnth Capture the Flag (CTF): Random Track Solutions"},"content":{"rendered":"

Welcome back to our blog series where we reveal the\u00a0solutions\u00a0to\u00a0LabyREnth, the Unit 42 Capture the Flag (CTF)<\/a>\u00a0challenge. Over the last several weeks, we revealed the\u00a0solutions\u00a0for each of the challenge tracks. The time has come for us to share the solutions to our last track, the Random track.<\/p>\n

Random 1 Challenge: OMG Java<\/h3>\n

Challenge Created By: Jacob Soo @_jsoo_<\/a> <\/em><\/p>\n

We are given a Java file that we can decompile with ByteCodeViewer.<\/p>\n

\"labyrenth_random-1\"<\/span><\/div><\/a><\/p>\n

We can see that we need an environment variable Admin and there is an if condition (if \u2013isDrunk) in the contents of the variable. If we run it with that variable, we get the following output.<\/p>\n

env Admin=\"Tyler-isDrunk\" java omg\r\nK5SSA2DPOBSSA6LPOUQGK3TKN54SA5DINFZSASTBOZQSAYLQOAQGC4ZAO5QXE3JNOVYC4ICUNBSSA4TFON2CA53JNRWCAYTFEBWXKY3IEBWW64TFEBZWK6DDNF2GS3THEEQFI2DFEBTGYYLHEBUXGICQIFHHWRBQL5MTA5K7IV3DG3S7IJQXGZJTGJ6Q\u00cd\u00cd\u00cd\u00cd\r\ndropped flag: K5SSA2DPOBSSA6LPOUQGK3TKN54SA5DINFZSASTBOZQSAYLQOAQGC4ZAO5QXE3JNOVYC4ICUNBSSA4TFON2CA53JNRWCAYTFEBWXKY3IEBWW64TFEBZWK6DDNF2GS3THEEQFI2DFEBTGYYLHEBUXGICQIFHHWRBQL5MTA5K7IV3DG3S7IJQXGZJTGJ6Q\u00cd\u00cd\u00cd\u00cd\r\n<\/pre>\n
 <\/p>\n
If we base32 decode the output, we get the flag.<\/p>\n
We hope you enjoy this Java app as a warm-up. The rest will be much more exciting! The flag is PAN{D0_Y0u_Ev3n_Base32}<\/p>\n
Random 2 Challenge: Can you express yourself regularly?<\/h3>\n
Challenge Created By: Richard Wartell @wartortell<\/a> <\/em><\/p>\n
For this challenge, we\u2019re handed two files: server.py and omglob_what_is_dis_crap.txt. Taking a quick look at server.py, it looks like this is a server running somewhere, accepting connections, checking a regex, and then returning a key if the passed information doesn\u2019t match the regex.<\/p>\n
class DoAThing(SocketServer.StreamRequestHandler):\r\n    def handle(self):\r\n        self.request.sendall(\"Enter your key:\\n\")\r\n        msg = self.rfile.readline().strip()\r\n\r\n        if not r.match(msg):\r\n            self.request.sendall(\"Correct key. Here's all the passwords: %s\\n\" % FLAG)\r\n        else:\r\n            self.request.sendall(\"Failure...\\n\")\r\n<\/pre>\n
So what\u2019s the regex that it tests against? Well, we see that it reads in the string from omglob_what_is_dis_crap.txt. So let\u2019s take a look at that\u2026<\/p>\n
^(.*[^0mglo8sc1enC3].*|.{,190}|.{192,}|.{97}[cgClm]|.{135}[so1l803]|.{81}[e]|.{81}[c3nl8]|.{102}[e]|.{58}[cos]|.{129}[meCln3sc]|.{132}[Cslco]|.{77}[1]|.{173}[l1e30cmg8]|.{166}[m0nle]|.{158}[sngl03c81m]|.{140}[o]|.{68}[g]|.{121}[e1]|.{121}[m8cn]|.{53}[18]|.{123}[1]|.{167}[s]|.{2}[C]|.{171}[c1ms0]|.{76}[03ge]|.{108}[nm8ge301C]|.{11}[0Cec8s3on]|.{50}[18]|.{56}[c]|.{37}[3l1n0]|.{166}[c3]|.{20}[g1]|.{6}[C]|.{115}[13cnm8eg]|.{95}[mo]|.{133}[Cmo0l]|.{53}[0osCm3]|.{147}[gnlme3C81c]|.{18}[3Clcom0n8]|.{154}[egmsCnc8lo]|.{54}[g]|.{144}[1]|.{43}[3Clnec8]|.{138}[3c1sl]|.{104}[0oe]|.{45}[l0C8]|.{103}[c38ol]|.{16}[oc3nC8e0l]|.{31}[C]|.{105}[1col3]|.{150}[g1]|.{124}[38]|.{78}[cmel0sCn1g]|.{183}[m8co30s]|.{145}[o]|.{49}[o1e03sC8]|.{85}[sn]|.{2}[e]|.{150}[moe]|.{57}[le]|.{17}[ne8sm3]|.{185}[om]|.{115}[l]|.{102}[om3Cc8]|.{40}[cnl8gCm]|.{189}[3m1gle]|.{137}[es]|.{178}[C13msneo0g8]|.{136}[C]|.{37}[og]|.{100}[m]|.{64}[mo8]|.{41}[g]|.{87}[3]|.{57}[g]|.{27}[sncl]|.{157}[1emn]|.{55}[83lmson0g1ce]|.{29}[slmcn]|.{53}[l]|.{22}[lgoc]|.{113}[3]|.{132}[83]|.{164}[el3o]|.{148}[eC]|.{30}[m]|.{152}[g]|.{49}[m]|.{87}[l]|.{44}[e1038nolmcC]|.{47}[ec1sngom]|.{90}[ln8o0c]|.{180}[ln0em3oCc1g8]|.{138}[8]|.{178}[c]|.{30}[s3l]|.{73}[c]|.{1}[en]|.{161}[e0g]|.{114}[1g0es8n]|.{154}[0]|.{37}[sec]|.{166}[1C8]<\/pre>\n
From this regex we can see three different types of conditions:<\/p>\n
    \n
  1. .*[^0mglo8sc1enC3].*
    \n<\/strong>This condition tells us that the regex will match on any string containing characters other than \u201c0mglo8sc1enC3\u201d<\/li>\n
  2. .{,190}|.{192,}
    \n<\/strong>This condition tells us that the regex will match on any string that is not 191 characters long, giving us the correct key length.<\/li>\n
  3. .{97}[cgClm]
    \n<\/strong>The rest of the conditions look like this one. Each of them gives us a position in the key string, and tells us characters that that position will match on. Essentially, each one is telling us what characters don\u2019t work at certain positions.<\/li>\n<\/ol>\n
    So, we need to create a string that is 191 characters long, and use the third type of condition to tell what characters each position can be. We can create a python script that parses the regex and gets out all of the appropriate conditions, then creates a string for us that won\u2019t match those conditions. So feast your eyes below on a regex to parse a regex.<\/p>\n
    import re\r\n\r\nwith open(\"omglob_what_is_dis_crap.txt\", \"r\") as f:\r\n    r = f.read()\r\n\r\nstuff = re.findall(r\"\\.\\{(\\d+)\\}\\[(\\w+)\\]\", r)\r\nsolution = [list('0mglo8sc1enC3')] * 191\r\n\r\nfor pos, s in stuff:\r\n    solution[int(pos)] = list(set(solution[int(pos)]) - set(list(s)))\r\nprint \"\".join(map(str, [item[0] for item in solution]))\r\n<\/pre>\n
    When we run this, we get the following output:<\/p>\n
    gg0ssgccCn8ggs83sggC01n8lecgs311eocc0m0n3C81gmoC1nm1Cn0Cs1g330sgnc0mCc18l18Cco8em0mC80m88csogceemoClCl00nC3gocn0egconsCcm3Clmeglo1lensgmsgnssslels10sglom31mlleg0le80csmnC033nm8oglgs0cellgmmns<\/pre>\n
    We can now test this regex to see if it works with the server and it will give us the key:<\/p>\n
    \"key_1\"<\/span><\/div><\/a><\/p>\n
    Which returns the key to get us to the next level:<\/p>\n
    PAN{th4t5_4_pr311y_dum8_w4y_10_us3_r3g3x}<\/p>\n
    Random 3 Challenge: I'm not sure how they got in or what they were after but they left some cookie crumbs.<\/h3>\n
    Challenge Created By: Anthony Kasza @anthonykasza<\/a> <\/em><\/p>\n
    Opening the provided network trace file with Wireshark and observing the IPv4 conversations, participants found only two systems communicating in the pcap. By observing the TCP tab of the conversations menu, participants could see the pcap file contains many<\/strong> connections from a single source port to almost all destination ports. This is indicative of a port scan.<\/p>\n
    This hypothesis can be confirmed by looking at the content of the TCP connections; there is none. Each SYN packet (except for 7) is responded to with an RST. The remaining seven connections, which responded with a SYN+ACK, were immediately closed with a RST by the originating side of the connection. This pcap definitely contains a TCP SYN port scan.<\/p>\n
    From this point, participants were required to hunt around in the pcap for the next step of the challenge. The only thing that changes between SYN packets in the trace file are:<\/p>\n