We are given an endpoint which we can connect to. The endpoint gives the following banner right after we connected:
---------------------------------------------------
- Welcome to AEG (Automatic Exploit Generation) -
---------------------------------------------------
I will send you a newly compiled binary (probably exploitable) in base64 format
after you get the binary, I will be waiting for your …We are given a Linux Kernel Module named rootkit and a remote QEMU guest over
ssh. Inside the remote QEMU guest, there's a file named flag which we can't
open. There's also rootkit.ko which has the same hash digest as rootkit.
Inspecting the syslog, there's a line which says …
We are given a file, encrypt.py, which looks as follows.
import os
from flag import flag
message = os.urandom(8) + flag
cipher = ''
for i in range(0, len(message) - 1):
cipher += chr((ord(message[i]) + ord(message[i+1]) + ord(message[i+1])) & 0xff)
print cipher.encode('hex')
# 4c8f7236c7b259b4e9b792929f2d59534437394530392a2547645958522d3d3b4e3e412c2f2a47314b604d483849342534413e516673 …We are given a file, encrypted.txt, which looks as follows.
encrypted = flag^e mod N
N=929412161736416785602626791790087761924898902195151595398647919800777946023488971853180598176692598583294061182260536041579346366926172653588840221567273437362595402878942949261351013183228816076787208298761416393920642857987212821185440640229264390419503134199675174977584782229111062529809687171117150001744486594819183472678424697917104835410391461624730889726473874533632011783818612095039231758588125644714046393001791112810853913402405581873909038522129835207451007166051445611924869493431837474285007276641743601868212445343248507996492168302629410158793171095836266438216336450410161777445930018295413880788397817212920901086111768107584700273194248624078825784962833148389339669672770486880797307481695588172832838731072379885756990402094668632885608688308703281839275920814948615941253077843879626529478150269189961487485485588639730236538541375331823636862137530268960752698621771461443704327244021041422495986281380147586211470392418121029373841474934960486004859939618776068437679091746000882065500417603392927878932556252121339876316869065207294672799230304843433288112308586240048684735313520164083326788976779830776801482533953926103609143333554819874985879730182046630820535196380040115825136940584589556785820159343472924511678054586101279599213597041601780382296431834866858061507446104315668473990065085836000677940559666983863740858655209448321924892616633958276590031999377342119486934203280802950550853609192641981061152748812514091191340011124311081998324364749868579702401217654561296975509502208974088057282185982036347055436781944503659441121489871215835821003778237875885585700465817962525400543288824177317817062453958271388228532199292458847881512536878190894921450789438099744648090308652667907702590059579778875658483803814963849425246348271265297992326326941649385344794434378497144236903691683724320406798550633839076630007346411875416248546336032185298058900521975982336237334536607755792300625619630545602773119916582573302060747209289533363253570250473519076096695447047922887567718357635771477087257951066557774977631702031440524698209045937363875790679216746249380353174688379191327766840638039388162445662493445777856792810700198251083685207125399710828301628160312264601730356710220261724123846339093165967118971272821247106002282782902865842552867964918068336459439425481643750939492002728297110520672697512136349144736715821664013325546531282992945883469394942896186838909299361507395054625609900948608639067118377943217351
e=65537
encrypted=920588809098419925304898815996779959024923992725236480766957762101020068092418642972569896909288446822625160018245995852395637010359546968987469161375560974732331888587499575726726591661288086170102991231536351472553667136912003817645761994113867006023358064959804334508836786614546373318854185561928539181380849135202589436399469446278977853873976388512625983066695071220448389094452382204859072246204132607199499483725325567718766144169704838594296010882715656390868083309425868664311629487870655537301587586264593373623106904074718645449224372238734853263892364592224060906009118410260996474851170094609808378917112241913945371712277407646776651895736210620267993703347840913541477388590431559378925211730392071715903857032396752409447351784452479847357247902830713107054131920974381233928620873147787352397722780557371121588138822734422526916591197108637109219278170352817301806094020568558870258047526598307845757398567950006581582539714075107753798978096510308355532420719999999220855138247162168113460577910905929588333387729891130789423649360964154825883032891254447994769161274294764104742371937868945566163338795266034258979330588673875819190729858101607459440752551327488554472157318363257082223209451608433992248074386159317605908434880514654833712622074369971266584704933749205856068601008066620986626613108276972360189307015131946572931252688986331609366041663453234811061216223134001974803179901785278084643248758399580372104073097458529704426905971473072151381373448553361414418342456280135383419519503028786544292302907897461141075166092520323444990854104372309393440260002551733596011221728567186544196673107818614484776574487330137101004134890658956591489639306529923386792687879390716232617992555567785121188340568023697639047632424964759610425447619800320974777755083401005364154241941027256239760103909197224362499684459388821532418774937557650857921765385859799914470867641296667037230734819015690775890840326939101061216700887599083952915657512483532308094437422732323767769158944259841802993244806549824743056280460644331001819024060314281381987785996895717885719094296415336981352928519848848055894963780262847910621421107636554884980968204334872719316159028387134320156378724268116858255133532724522370999208549105477046537264757515852756867521989580046767357180880003025052171778061564683996167899012373574038101166777008676727628024284803295629377550189159115681868387149280045459828574367106610925183390170585407262031209717446921115630
Since there's no gimmick in the encryption process, let's try factorize N. Factoring N with
Fermat's factorization included
in Yafu yield p and q used to create N …
We are given a network dump file, network_dump and a service that we can connect to. After we
open the file, we find two file was transmitted. The first one is the keys file which contains
the following:
{
"n":142592923782837889588057810280074407737423643916040668869726059762141765501708356840348112967723017380491537652089235085114921790608646587431612689308433796755742900776477504777927984318043841155548537514797656674327871309567995961808817111092091178333559727506289043092271411929507972666960139142195351097141,
"e": 3
}
The second one is a python script file …
read more