Week_2

I spent a good 10 minutes trying to figure out the challenges before reaching for help. Eventually was told that the challenge location was “on the end of our slide deck is a link to katacode, thats where Olliver is doing his Challenges https://www.katacoda.com/0xollie/scenarios/0x01"

Signed up for Katacoda and nativated to the URL.

WARNING: Like all my CTF notes, this contains spoilers.

Challenge 1 - Normal files - 10pts

These are just regular files flag syntax: flag{insert_flag_here}

Week_1

WARNING: Like all my CTF notes, this contains spoilers.

How_2_Flag - 0 pts

For our CTF challenges this year we will be using the format: flag-{example_flag} Please note that all flags are case-sensitive!

• Submitted: flag-{example_flag}

Community - 5 pts

Have you joined our discord server yet? https://discord.gg/kRbcVnP

• Joined discordapp
• Clicked on Add a server
• Used the URL in the challenge
• Checked #flag channel
• Submitted: flag-{welcome_1337_haxor}

Stay_Informed - 10 pts

Our website - https://qutwhitehats.club is a vast treasure trove of information. Have a look and see if you can find the hidden flag!

Intorduction

Picked character name, then walked to the computer, the text ‘Somebody changed my password’ appeared, walked out the door to

General Skills

The Factory’s Secret - Points: 1

There appear to be some mysterious glyphs hidden inside this abandoned factory… I wonder what would happen if you collected them all?

• Fragment 1 - When exploing the first room, accidently happened upon a glyph
  • Manual review of inventory shows an image, which appears to be a fragment of a QR code
  • Inspect your swords\nElements of fire\nHome of hearth\nPage and squire
• Fragment 2 - Went into web exploitation door
  • Navigated past the computer into the door through the top
  • Moved the boulder into the lava and accessed hidden door through the bottom
  • Collected the glyph
• Fragment 4 - Went into the binary exploitation door
  • Didnt find anything, and gave up for days, then returned and continued to go through alternating red and blue door, until music intensified and yellow door appeared
  • Entered yellow door and collect the fragment
• Fragment 5 - Went into the forensics door
  • Moved around and explored the room, until I spotted waves in the top left hand corner of the room
  • Approached the waves and collected the fragment
• Fragment 3 - Entered the cryptography door
  • Manually inspected each grave stone until I got to the fifth one across from the left in the right hand plot in the sixth row from the bottom

Lets Warm Up

If I told you a word started with 0x70 in hexadecimal, what would it start with in ASCII

Introduction

I was fortunate enough at attend an Australian Women in Security Networ (AWSN) session. Following the session there was a beginner level capture the flag (CTF) hosted off http://149.28.182.32:8000. These are my notes from the CTF. Additional things to note are, firstly, that for the Web challenges, challenge 4 is called flag5, and challenge 5 references flag4. Secondly, the submission for the Cryptography password challenge expects the flag in the format flag{flag_value}. Finally, the notes below contain spoilers, and actual flags submitted.

Introduction

I was fortunate enough to attend a JCSC Incident Response training sessions today in Brisbane. Even more fortunate since Yaleman allowed me to join his team. The incident response scenario was that of responding to an incident for the Wind in case of no daylight (WIND) corporation where an information security incident appears to have occurred and a wind turbine has stopped operating.

We were provided some artefacts to perform analysis on and submit responses to to get points for the CTF. I had never used volatility, so the exercise provides an excellent opportunity to learn to use volatility.

Is GPG/OpenPGP really Better than Zip ?

I attended a local conference yesterday (2019-03-29) and during one of the talks a senior analyst from one of the world’s first CERT said that the preference was to use GPG for symmetric key encryption of files to transfer confidential information to their clients over zip. The reason presented was that zip did not provide the desired level of confidentiality and integrity. This comment got me thinking as I had thought that zip used AES for encryption, so now I am awake at 0100hrs in the morning and curious to understand the encryption used in zip.

Installation

# yum update
# yum install squid

References

• https://elatov.github.io/2019/01/using-squid-to-proxy-ssl-sites/

Penetration Test Assessment

A penetration test assessment was a requirement of a short cource on Penetration Testing from the Charles Sturt University. As part of the assessment, students were provided an ova image of a virtual machine. The virtual machine was to be the target of a penetration test, and students were expected to obtain flags for submission. A walkthrough of the assessment is presented here.

For the benefit of other students, the names and values of the flags have been redacted, and replaced with the string REDACTED

For this walk-though I use the Metasploit framework to attempt to perform a penetration testing exercise on Metasploitable 2. I employ the following penetration testing phases: reconnaisance, threat modelling and vulnerability identification, and exploitation. Since this is a mock exercise, I leave out the pre-engagement, post-exploitation and risk analysis, and reporting phases.

Set-up

This metasploitable walk-through is performed in a virtual lab environment. Two virtual machines (VMs) are used. The first is a Kali VM and the second is the Metasploitable2 VM. Both VMs have their network interfaces connected to an internal Virtualbox network called vlabnet. There is a DHCP server on the virtual lab network to dynamically allocate IP addresses to hosts.

This post is about getting an Ansible control node configured on an Ubuntu VM within Virtualbox to be able to rapidly stand up and deploy other virtual machines within Virtualbox for a virtual lab environment, along with some examples. Since this is a lab environment, and we are running ansible off a guest virtual machine within virtualbox, the closing of machines is outside the scope of this post and assumes that the machines are already installed and provisioned to be on the management network.