Skip to content

Latest commit

 

History

History
216 lines (175 loc) · 8.47 KB

Trivial_Flag_Transfer_Protocol.md

File metadata and controls

216 lines (175 loc) · 8.47 KB

Trivial Flag Transfer Protocol

Challenge information

Points: 90
Tags: picoCTF 2021, Forensics
Author: DANNY

Description:
Figure out how they moved the flag.

Hints:
1. What are some other ways to hide data?

Challenge link: https://play.picoctf.org/practice/challenge/103

Solution

The challenge name suggests that we should focus on the Trivial File Transfer Protocol (TFTP).

Open up the PCAP-file in Wireshark.

Wireshark can extract any files transfered with TFTP for us. In the File-menu, select Export Objects -> TFTP.
Then click Save All.

Analyse the transfered files

We now have six files

┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2021/Forensics/Trivial_Flag_Transfer_Protocol]
└─$ file *          
instructions.txt: ASCII text
picture1.bmp:     PC bitmap, Windows 3.x format, 605 x 454 x 24, image size 824464, resolution 5669 x 5669 px/m, cbSize 824518, bits offset 54
picture2.bmp:     PC bitmap, Windows 3.x format, 4032 x 3024 x 24, image size 36578304, resolution 5669 x 5669 px/m, cbSize 36578358, bits offset 54
picture3.bmp:     PC bitmap, Windows 3.x format, 807 x 605 x 24, image size 1466520, resolution 5669 x 5669 px/m, cbSize 1466574, bits offset 54
plan:             ASCII text
program.deb:      Debian binary package (format 2.0), with control.tar.gz, data compression xz

Let's start with the text files

┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2021/Forensics/Trivial_Flag_Transfer_Protocol]
└─$ cat instructions.txt                       
GSGCQBRFAGRAPELCGBHEGENSSVPFBJRZHFGQVFTHVFRBHESYNTGENAFSRE.SVTHERBHGNJNLGBUVQRGURSYNTNAQVJVYYPURPXONPXSBEGURCYNA

┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2021/Forensics/Trivial_Flag_Transfer_Protocol]
└─$ cat plan                                           
VHFRQGURCEBTENZNAQUVQVGJVGU-QHRQVYVTRAPR.PURPXBHGGURCUBGBF

Hhm, this looks like ROT13.

Decode the text files

We can decode them with a prepackaged rot13 tool from either hxtools or bsdgames.

┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2021/Forensics/Trivial_Flag_Transfer_Protocol]
└─$ rot13 plan    
IUSEDTHEPROGRAMANDHIDITWITH-DUEDILIGENCE.CHECKOUTTHEPHOTOS

┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2021/Forensics/Trivial_Flag_Transfer_Protocol]
└─$ rot13 instructions.txt 
TFTPDOESNTENCRYPTOURTRAFFICSOWEMUSTDISGUISEOURFLAGTRANSFER.FIGUREOUTAWAYTOHIDETHEFLAGANDIWILLCHECKBACKFORTHEPLAN

It's a bit hard to read without spaces but the files contain:

plan: I USED THE PROGRAM AND HID IT WITH - DUE DILIGENCE. CHECK OUT THE PHOTOS

instructions.txt: TFTP DOESNT ENCRYPT OUR TRAFFIC SO WE MUST DISGUISE OUR FLAG TRANSFER.
   FIGURE OUT AWAY TO HIDE THE FLAG AND I WILL CHECK BACK FOR THE PLAN

Unpack the program.deb file

Analysing the program.deb file I saw that it contains a control.tar.gz file

┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2021/Forensics/Trivial_Flag_Transfer_Protocol]
└─$ head -n 4 program.deb
!<arch>
debian-binary   1413331375  0     0     100644  4         `
2.0
control.tar.gz  1413331375  0     0     100644  1250      `

We can unpack it with ar and then gunzip and untar it

┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2021/Forensics/Trivial_Flag_Transfer_Protocol]
└─$ ar x program.deb 

┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2021/Forensics/Trivial_Flag_Transfer_Protocol]
└─$ gunzip control.tar.gz         
gzip: control.tar: Value too large for defined data type

┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2021/Forensics/Trivial_Flag_Transfer_Protocol]
└─$ tar xvf control.tar 
./
./md5sums
./control

Check out the md5sums file

┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2021/Forensics/Trivial_Flag_Transfer_Protocol]
└─$ cat md5sums 
71bdab1263ab4b8d28f34afa5f0ab121  usr/bin/steghide
11db80c2a5dbb9c6107853b08aeacc49  usr/share/doc/steghide/ABOUT-NLS.gz
57deb17212483b49f89587180d4d67d4  usr/share/doc/steghide/BUGS
72c7831222483f5c6d96ac2a8ca7ad48  usr/share/doc/steghide/CREDITS
adbb29f44a5e5eefda3c3d756cc15ab1  usr/share/doc/steghide/HISTORY
fe7cac39a1a1ef0975d24dfcf02f09b7  usr/share/doc/steghide/LEAME.gz
85587b9213ca2301eb450aad574d5f87  usr/share/doc/steghide/README.gz
a9e03fa8166b8fa918c81db1855b68d1  usr/share/doc/steghide/TODO
09d7710e276a06c4a3f3bc81b3b86a41  usr/share/doc/steghide/changelog.Debian.amd64.gz
e454b20fdc2208f8170e28b90b6d43f7  usr/share/doc/steghide/changelog.Debian.gz
1a2e10366a3a55d7a4cb5fc3c87a6bf7  usr/share/doc/steghide/changelog.gz
df8c0ea893b3f6f64a917824c6c9d224  usr/share/doc/steghide/copyright
fc53645374c583f11f628331be710d9a  usr/share/locale/de/LC_MESSAGES/steghide.mo
b8ceabc96f9bffd9157103e1a86be33f  usr/share/locale/es/LC_MESSAGES/steghide.mo
87ee9a19bb49b217dad67b5a889bb1d1  usr/share/locale/fr/LC_MESSAGES/steghide.mo
dbc3a8e974ccf7e91da81aca4a5c1605  usr/share/locale/ro/LC_MESSAGES/steghide.mo
921a5afd279097e4ed359ce3767068f5  usr/share/man/man1/steghide.1.gz

And the control file

┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2021/Forensics/Trivial_Flag_Transfer_Protocol]
└─$ file control
control: ASCII text

┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2021/Forensics/Trivial_Flag_Transfer_Protocol]
└─$ cat control
Package: steghide
Source: steghide (0.5.1-9.1)
Version: 0.5.1-9.1+b1
Architecture: amd64
Maintainer: Ola Lundqvist <[email protected]>
Installed-Size: 426
Depends: libc6 (>= 2.2.5), libgcc1 (>= 1:4.1.1), libjpeg62-turbo (>= 1:1.3.1), libmcrypt4, libmhash2, libstdc++6 (>= 4.9), zlib1g (>= 1:1.1.4)
Section: misc
Priority: optional
Description: A steganography hiding tool
 Steghide is steganography program which hides bits of a data file
 in some of the least significant bits of another file in such a way
 that the existence of the data file is not visible and cannot be proven.
 .
 Steghide is designed to be portable and configurable and features hiding
 data in bmp, wav and au files, blowfish encryption, MD5 hashing of
 passphrases to blowfish keys, and pseudo-random distribution of hidden bits
 in the container data.

Ok, so steghide have been used to hide the flag in one of the pictures.

Get the flag

First I tried to extract without a password (that is an empty password)

┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2021/Forensics/Trivial_Flag_Transfer_Protocol]
└─$ steghide extract -sf picture1.bmp
Enter passphrase: 
steghide: could not extract any data with that passphrase!

┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2021/Forensics/Trivial_Flag_Transfer_Protocol]
└─$ steghide extract -sf picture2.bmp
Enter passphrase: 
steghide: could not extract any data with that passphrase!

┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2021/Forensics/Trivial_Flag_Transfer_Protocol]
└─$ steghide extract -sf picture3.bmp
Enter passphrase: 
steghide: could not extract any data with that passphrase!

But that didn't work.

So I went back to the text files looking for clues about the password.
From the plan file

IUSEDTHEPROGRAMANDHIDITWITH-DUEDILIGENCE.CHECKOUTTHEPHOTOS

So I tried the password DUEDILIGENCE and that worked

┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2021/Forensics/Trivial_Flag_Transfer_Protocol]
└─$ steghide extract -sf picture1.bmp
Enter passphrase: 
steghide: could not extract any data with that passphrase!

┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2021/Forensics/Trivial_Flag_Transfer_Protocol]
└─$ steghide extract -sf picture2.bmp
Enter passphrase: 
steghide: could not extract any data with that passphrase!

┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2021/Forensics/Trivial_Flag_Transfer_Protocol]
└─$ steghide extract -sf picture3.bmp
Enter passphrase: 
wrote extracted data to "flag.txt".
   
┌──(kali㉿kali)-[/mnt/…/picoCTF/picoCTF_2021/Forensics/Trivial_Flag_Transfer_Protocol]
└─$ cat flag.txt 
picoCTF{<REDACTED>}

For additional information, please see the references below.

References