I appreciate the organizers for putting this CTF together because I enjoyed it a lot. It was at a very appropriate difficulty level for novices. Many thanks to my teammates for helping out. Even though it was only basically 2 active players 🙂, we managed to get 8th place, which I am pretty satisfied with considering our little experience.
🎵 For this CTF I was listening to Kygo - Gone Are The Days ft. James Gillespie!

My solves (22) graph and category breakdown

Forensics

Phillip 1

Philip was working on a challenge when I took a snap of his vm. I found the flag, and I gonna be the only one to claim this flag since I scrubbed the flag from the raw image. MWAHAHA, more points for me >:)

Note: the dwarf and system map are the same for all Phillip challenges

hxxps://drive.google.com/drive/folders/1c6vdBabGu33edSLXQZY5s8JAeM8au8Uo?usp=sharing

author: drkmrin78

score: 3.5/10

1

volatility --plugins=custom --profile=Linuxphillipx64 -f philip-1.raw linux_psaux

1

volatility --plugins=custom --profile=Linuxphillipx64 -f philip-1.raw linux_bash

1

volatility --plugins=custom --profile=Linuxphillipx64 -f philip-1.raw linux_enumerate_files | grep -i key

1

volatility --plugins=custom --profile=Linuxphillipx64 -f philip-1.raw linux_find_file -i 0xffff95f1c3139f60 -O private_key

and use the identity file.

If you get an AttributeError: Struct xxx has no member xxx like I did initially, be sure to get the latest volatility from github.

Phillip 2

Philip told me he found something to give him ctf flags for Dogecoin? I have to see for myself, but lets just take his!

Note: the dwarf and system map are the same for all Phillip challenges

hxxps://drive.google.com/drive/folders/1r6BGYZsTpfS0pWuIu2fWPjAqalsae6kx?usp=sharing

author: drkmrin78

score: 6/10

Utilizing the same custom profile we made in Phillip 1, we similarly look for processes and see the peculiar Mozilla Thunderbird email client running with process ID 2084:

1

./volatility/vol.py --plugins=custom --profile=Linuxphillipx64 -f philip-2.raw linux_psaux

1

./volatility/vol.py --plugins=custom --profile=Linuxphillipx64 -f philip-2.raw linux_netstat

1

./volatility/vol.py --plugins=custom --profile=Linuxphillipx64 -f philip-2.raw linux_lsof -p 2084

This showed us various .sqlite databases stored in ~/.thunderbird/<profile_name>/, for which some have their purpose documented here: http://kb.mozillazine.org/Files_and_folders_in_the_profile_-_Thunderbird

1

./volatility/vol.py --plugins=custom --profile=Linuxphillipx64 -f philip-2.raw linux_enumerate_files | grep thunderbird

into thunderbird.txt, which will end up looking something like this:

1
2
3
4
5
6
7
8

import subprocess
with open("thunderbird.txt", 'r') as f1:
  contents = f1.read().split('\n')
for f in contents:
  inode = f.split(' ')[0]
  path = f[f.find('/'):]
  path = '\'' + path + '\''
  subprocess.run("./volatility/vol.py --plugins=custom --profile=Linuxphillipx64 -f philip-2.raw linux_find_file -i {} -o {}".format(inode, path), shell=True)

And then now we can run thunderbird_parser_v1.0.py specifying the Thunderbird user profile folder:

1

thunderbird_parser_v1.0.py -d "/cow/lubuntu/.thunderbird/<profile_name>" -o report

which will give us a nice spreadsheet as well as individual .eml files.

Phillip 3

Philip was starting to write a vault for flags? I don’t know what that means, but he told me its going to be secure from my memory forensic antics. Total rubbish, lets show him who’s l33t here!

Note: the dwarf and system map are the same for all Phillip challenges

hxxps://drive.google.com/drive/folders/1tRYkwA-gyuAkqF5W8kVjAFKrtGRqVjPx?usp=sharing

author: drkmrin78

score: 7/10

Standard procedure is to list processes with linux_psaux, and flag-vault with process ID 9793 catches our eye.

1

./volatility/vol.py --plugins=custom --profile=Linuxphillipx64 -f philip-3.raw linux_psaux

1

./volatility/vol.py --plugins=custom --profile=Linuxphillipx64 -f philip-3.raw linux_bash

1
2
3

./volatility/vol.py --plugins=custom --profile=Linuxphillipx64 -f philip-3.raw linux_enumerate_files | grep -i -e vault -e flag
./volatility/vol.py --plugins=custom --profile=Linuxphillipx64 -f philip-3.raw linux_find_file -i 0xffff95f1db55b310 -O flag-vault
./volatility/vol.py --plugins=custom --profile=Linuxphillipx64 -f philip-3.raw linux_find_file -i 0xffff95f1c33f43f0 -O flag-vault.c

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

#include <stdio.h>
#include <stdlib.h>

struct link {
    char c;
    struct link *next;
};

void add_link(char c, struct link *list) {
    struct link *curr = list;
    struct link *new_link = malloc(sizeof(struct link));

    new_link->c = c;
    new_link->next = 0;

    while (curr->next != 0) curr = curr->next;

    curr->next = new_link;
}

int main() {
    struct link head = {0};
    char c;

    while ((c = getc(stdin)) != EOF) {
        add_link(c, &head);
    }
}

Since malloc is used to dynamically allocate memory for each node (a.k.a link, line 11), this data will be stored on the heap. To locate the memory address of the heap, we use linux_proc_maps for the flag-vault process:

1

./volatility/vol.py --plugins=custom --profile=Linuxphillipx64 -f philip-3.raw linux_proc_maps -p 9793

1

./volatility/vol.py --plugins=custom --profile=Linuxphillipx64 -f philip-3.raw linux_dump_map -p 9793 -s 0x000055e46125e000 -D dump_map/

Protocol One and Zero

We have noticed some suspicious pings on localhost that appear to hide a message. Can you recover the message?

author: azeemsm

score: 4/10

Attached: protocol_one_and_zero.pcapng

We are given a network capture so let’s open it in Wireshark. The capture contains a bunch of ICMP ping requests and replies so let’s just filter for only requests since replies should just echo back the same data payload contained in requests.
So with the display filter icmp.type == 8, notice that the data transmitted usually either ends in a whole bunch of 00s or ffs.

This seems to be a form of binary encoding (as also alluded to by the challenge title), so let’s extract that data with pyshark via a simple script and we get the flag:

1
2
3
4
5
6
7
8
9

import pyshark
cap = pyshark.FileCapture('protocol_one_and_zero.pcapng', display_filter='icmp.type == 8')
binary = ""
for packet in cap:
    if packet.icmp.data[-1] == "0":
        binary += "0"
    elif packet.icmp.data[-1] == "f":
        binary += "1"
print(binary)

Steganography

Coldplay’s Flags

I just downloaded Coldplay’s latest song and noticed that my song file seems a bit odd. Can you help me figure out what’s up with my file?

Note: For the password, think words, not characters

hxxps://drive.google.com/drive/folders/1o58KD8CcCI5kTuHH8e56noPUAazRBGNh?usp=sharing

author: amanthanvi score: 5/10

We are given flags.wav which is audio of the song Coldplay - Flags except that its spectrogram differs slightly from the official copy. I attempted to do phase inversion and ran various steg tools but it proved to be futile.

I decided to randomly try binwalk on it and hey look, we obtain two .zip files with one containing hint.txt and the other being encrypted and holding flag.txt.

1
2

Assume all characters are lowercase
password: (1:49)_(1:01)_(0:16)_(0:56)_(0:17)_(1:33)_a_(1:34)?

This should refer to the password required for the encrypted .zip with the flag. Let’s carve out the encrypted .zip portion from 246D04E.zip with a hex editor by deleting the second .zip that follows after, and we can confirm that it is indeed password-protected. This can also be done by binwalk that we used earlier.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

def get_words(a, b, c, d, e, f, g):
    return f"{a}_{b}_{c}_{d}_{e}_{f}_a_{g}?"

a_combs = ["can", "you", "show", "me", "how"]
b_combs = ["pyotr", "tchaikovsky", "to"]
c_combs = ["the", "talk", "among"]
d_combs = ["to", "be", "whatever"]
e_combs = ["among", "the", "skeletons", "this"]
f_combs = ["telephoning","by", "a", "ouija"]
g_combs = ["by", "a","ouija"]

cursed = []

for a in a_combs:
    for b in b_combs:
        for c in c_combs:
            for d in d_combs:
                for e in e_combs:
                    for f in f_combs:
                        for g in g_combs:
                            cursed.append(get_words(a, b, c, d, e, f, g))


with open("words.txt", "w") as f:
    for word in cursed:
        f.write(f"{word}\n")

1

zip2john 0.zip | cut -d ':' -f 2 > hashes.txt

1

hashcat -m 17210 pkzip.txt words.txt

Flag: UMDCTF-{PY07r_11Y1CH_7CH41K0V5KY}

OSINT

Nikolai 1

My friend Nikolai went off to school in Wyoming this year and he hasn’t been responding to my texts. I’m worried about him since he has no family or friends out there. Can you find out what he has been up to?

author: matlac

score: 4/10

Google searches for these kind of challenges usually don’t give you anything, so I guess the way is to just search on various social media platforms. I knew beforehand that Twitter could filter tweets based on location, so let’s try that with nikolai near:"Wyoming"

Nikolai 2

Nikolai’s school recently contacted his parents since he hasn’t been seen in his dorm or classes for over a week. They know you are an OSINT CHAD and asked for your help. Can you figure out where he ran off to?

Flag Format: UMDCTF-{20_W_34th_St_New_York_NY_10001}

P.S. If you enjoy this challenge you might also enjoy https://www.tracelabs.org/

Hint: All of the accounts you found in Nikolai 1 may be important for this solve

Warning, you only have five guesses

author: matlac

score: 10/10

With Nikolai’s changesets contributed on OSM, we are basically able to trace the trail he took: he went southwards from Laramie to Colorado Springs. This also checks out with his OSM diary indicating his travel to Colorado.

• there is a gas station within walking distance
• there is a Domino’s within walking distance
• there is a chair outside his room with no balcony
• he stays at a lodge/motel

Vacation

My mom told me she went to this amazing brewing company in the Carribbean and when I asked her the name of the place, she sent me a picture of her ship. Can you help me find the name of this brewing company?

Flag format: UMDCTF-{City_Companyname}

Note: Companyname = first part of the company name

hxxps://drive.google.com/drive/folders/14eh2f13z32Uf7WFVNHWqHGnXE0P8y8G-?usp=sharing

author: itsecgary

score: 5/10

Justin 2

My friend is in danger and this was the only picture he could send me. Can you find the name of the street he is on? ex. UMDCTF-{Memory_Lane}

hxxps://drive.google.com/drive/folders/1nfFmXuEMRuCOY6BvAAox1AWQPSCqgIhn?usp=sharing

author: itsecgary

score: 5/10

Justin 3

Justin only gave us this camera’s live feed and said “Hey guys look! I’m on TV!” Can you find the name of the street he’s on?

format: UMDCTF-{Memory_Lane}

we do not own any IP found besides the one listed below

curl hxxp://chals5.umdctf.io:8000

author: itsecgary

score: 6/10

We are given a webpage with an embedded streetcam livefeed. Checking out the HTML source, we see that this livestream is coming from http://136.169.226.46/1589793911/embed.html?token=xxxxx through the iframe’s src attribute.

MemeCTF 2 Electric Boogaloo

9c222530fc5822720b24a18e0c5200957fcbe169589915c963e765c99c7f5f3a

author: t0pc4r

score: 5/10

We google the given hash/hex data and find a Github repository by UMD-CSEC themselves.

Misc

ChungusBot

I wonder if ChungusBot has the flag.

Make sure to join the discord for the challenge!
hxxps://discord.gg/dDnQncKqzV

author: itsecgary

score: 3/10

• chungusboi.py
• chungy.py
• flag.py
• gagagaga.py

Each of these extensions are responsible for handling a command sent via DM to the bot and performing some actions or checks. To retrieve the flag, commands need to be sent in a sequence and within a time limit.
First, chungusboi.py takes in a kyle command and writes the current time tick count with a newline character to a user-specific file. Current newline character count == 1.

1
2
3
4
5
6

    @chungusboi.command()
    @in_dms()
    async def kyle(self, ctx):
        tic = time.perf_counter()
        with open(f'userfiles/{ctx.author.name}_time', 'w') as f:
            f.write(f'{tic}\n')

Second, flag.py takes in a yeeee command and checks if there has been 1 newline character already written into the user-specific file. If it does, it will append the current time tick count with another newline character into the same user-specific file. Current newline character count == 2.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

    @flag.command()
    @in_dms()
    async def yeeee(self, ctx):
        tic = time.perf_counter()
        try:
            f = open(f'userfiles/{ctx.author.name}_time', 'r')
            stuff = f.read()
            count = len(stuff.split('\n'))

            if count == 2:
                f = open(f'userfiles/{ctx.author.name}_time', 'a')
                f.write(f'{tic}\n')
            else:
                await ctx.channel.send("Uh ohhh (count not 2)")
        except:
            await ctx.channel.send("Uh ohhh (no file)")

Third, chungy.py takes in a mcchungus command and checks if there are 2 newline characters already written into the user-specific file. If it does, it will use the same process as earlier to append data. Current newline character count == 3.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

    @chungy.command()
    @in_dms()
    async def mcchungus(self, ctx):
        tic = time.perf_counter()
        try:
            f = open(f'userfiles/{ctx.author.name}_time', 'r')
            stuff = f.read()
            count = len(stuff.split('\n'))

            if count == 3:
                f = open(f'userfiles/{ctx.author.name}_time', 'a')
                f.write(f'{tic}\n')
            else:
                await ctx.channel.send("Uh ohhh (count not 3)")
        except:
            await ctx.channel.send("Uh ohhh (no file)")

Fourth, gagagaga.py takes in a chungusisgod command and checks for 3 newline characters already present in the user-specified file. If it does, it will use the same process as earlier to append data. Current newline character count == 4.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

    @gagagaga.command()
    @in_dms()
    async def chungusisgod(self, ctx):
        tic = time.perf_counter()
        try:
            f = open(f'userfiles/{ctx.author.name}_time', 'r')
            stuff = f.read()
            count = len(stuff.split('\n'))

            if count == 4:
                f = open(f'userfiles/{ctx.author.name}_time', 'a')
                f.write(f'{tic}\n')
            else:
                await ctx.channel.send("Uh ohhh (count not 4)")
        except:
            await ctx.channel.send("Uh ohhh (no file)")

Fifth, gagagaga.py also takes in a giveittome command which calculates the time difference between the time tick count in the 1st step and that in the 4th step, and checks if this time difference is less than 15. So if we have sent our sequence of commands within 15 seconds, the bot will then send us the flag.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

    @gagagaga.command()
    @in_dms()
    async def giveittome(self, ctx):
        try:
            f = open(f'userfiles/{ctx.author.name}_time', 'r')
            stuff = f.read()
            head = stuff.split('\n')[0]
            tail = stuff.split('\n')[3]

            if float(tail) - float(head) < 15:
                await ctx.channel.send('`' + flag + '`')
                await ctx.channel.send(file=discord.File("morris.PNG"))
                f = open(f'userfiles/{ctx.author.name}_time', 'w')
                f.write("")
        except:
            await ctx.channel.send("Uh ohhh (no file)")

No scripting is needed because we can send fast enough manually.

John’s Return

I received this network traffic from John, but I don’t what he’s trying to say? Can you figure it out?

author:t0pc4r

score: 7/10

Attached: received.pcapng

Open the .pcapng file in Wireshark and we can see a capture of some Wireless 802.11 traffic. At the beginning, we can spot that there is the 802.11 authentication process with a EAPOL 4-way handshake for WPA-PSK. After that, data sent is encrypted. This documentation was very helpful in familiarizing me with the protocol: https://www.cisco.com/c/en/us/support/docs/wireless-mobility/80211/200527-Fundamentals-of-802-11-Wireless-Sniffing.html#anc60

1
2

apt install hcxtools
hcxpcaptool -E essidlist -I identitylist -U usernamelist -z output.16800 received.pcapng

1

hashcat -m 16800 output.16800 rockyou.txt

Satelite

My friend from Russia sent me this message, but all I see are cryllic characters?

author: itsecgary

score: 2.5/10

Attached: message.txt

We are given a text file which appears to be filled with the famous Lorem Ipsum text as Cyrillic characters. Based on the tone of uncertainty in the challenge description’s question, I hypothesized that there may be non-Cyrillic characters hidden within the ocean of text. I used a simple regular expression of [^a-zA-Z0-9\-_{}]+ to remove all characters that do not belong to the UMDCTF{} flag format. As suspected, what remained was the flag.

Web

The Matrix

Oh no! It looks like the robots have taken over! Infilitrate their site and save the world! But beware, they only allow one of them to access it.

curl hxxp://chals5.umdctf.io:4000

author: t0pc4r score: 3/10

The Matrix Reloaded

Good job, you got rid of the robots. Bad news is that it looks like they fled to Iceland and have even higher security! Can you infilitrate >their site? But beware, they only allow one of them to access it.

curl hxxp://chals5.umdctf.io:4001

author: t0pc4r

score: 4/10

Setting Accept-Language to is which is the country code for Iceland allows us to access the page and retrieve the flag.

The Matrix Revolutions

The robots are done with your tricks. They’re sick of hiding in plain site. Now they’re going to hide in the shadows so no one, not even you can find them. You’ll have to find how their site works. I have a feeling there’s more to it than what we can see.

curl hxxp://chals5.umdctf.io:4002

author: t0pc4r score: 5/10

The flag is supposedly somewhere hidden, so I used Burp Suite’s directories and files scanner to bruteforce for content.

IOT Project

IoT is so cool and secure! Check out my project from April 7 at hxxps://azeemsm-umdctf.github.io/

author: azeemsm

score: 5/10

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

const int bellPin = 6;
void setup() {
  pinMode(bellPin, INPUT);
  Serial.begin(9600);

}

void loop() {
  int bellState = digitalRead(bellPin);
  if(bellPin){
    Serial.println("ring!");
  }

}

The more important script is program.py. A secret key is read from a file (line 8) and then used to send a POST request to an IFTTT Webhook endpoint /ring2/ each time the doorbell rings (line 25).

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

#Azeem's Code
import serial
import time
import requests

#Read secret key from file for security!
f=open("maker.key","r")
secret_key=f.read().strip()

#Connect to arduino through serial (mine is on /dev/ttyUSB0 but this may change depending on which port I plug into)
arduino = serial.Serial('/dev/ttyUSB0', 9600, timeout=1)
print("running...")

#Never stop!!!
while True:
    try:
        #read from arduino
        data=arduino.readline()
        if data:
            #decode the data as UTF-8 (normal text) and remove new line
            message = data.decode('UTF-8').rstrip('\n')
            if "ring!" in message: #check if it says ring! (not sure what else it could be at the moment looking at the arduino code)
                #send request to webhooks so ifttt can do its thing!
                #send post request through ifttt webhook (this will send me email)
                r=requests.post("https://maker.ifttt.com/trigger/ring2/with/key/"+secret_key)
                print(r.text)
                
    except:
        #there was an error uh oh lets exit
        arduino.close()
        break

Commit history showed that the secret key file maker.key was originally uploaded to the repository with the value of iWEKorMwH5rgGjyHb4jzedP9m9LA7yNkTZ0dvfzDSUO, and the POST request was originally sent to the /ring/ endpoint where we could also specify the email address to receive from the IFTTT Webhook via the value1 parameter.

1

curl.exe https://maker.ifttt.com/trigger/ring/with/key/iWEKorMwH5rgGjyHb4jzedP9m9LA7yNkTZ0dvfzDSUO -X POST -i -d "value1=xxx@xxx.xxx&value2=xxx"

IOT Project 2

Yeah im such a good engineer, got another project in just under a week later on the 13th. My resume is going to look so good with all these projects! Check out my project at hxxps://azeemsm-umdctf.github.io/ (don’t get the account suspended or there will be disqualifications)

author: azeemsm

score: 6/10

Return of the Flag Bay

We loved the flag bay so much, that we decided to bring it back. Although, something is a bit different about this one. We can’t figure out which username and password is correct from the list of users. Can you help us figure it out?

curl hxxp://chals5.umdctf.io:4004

author: WittsEnd2

score: 7/10

Top of the Charts

I found this site which seems to boast about itself too much. It claims to be above everything else but I’m not so sure. I think the success has gone to its head.

curl hxxp://chals5.umdctf.io:4003

author: t0pc4r score: 5/10

Sending a HEAD request specified with -I for curl.exe gets you the flag. It’s a guessy challenge for those who do not already have prior knowledge of the different possible HTTP request methods - they wouldn’t be able to pick up the hint in the challenge description.

Thanks for reading!