
Post 3 already and I still can't find a proper intro...

Oh God, Winter is here.

Yes. The challenge creator goes by that name and indeed, when you are not shivering from the cold heart break his challenges will give you, you are contemplating on throwing your laptop in the freezer because it seems to be going bad.

This challenge is  a Windows CTF challenge. The goal is to get the flag from the shared memory.

Aight! Let's Begin!

## Understanding The Question 
This is The Question.

![alter-text](/images/post/Shared/Question.png)
*Screenshot of the "Shared" challenge question*

We can see the Code :
```
#define SHARED_MEMORY_NAME "Local\\FlagSharedMemory" 
#define FLAG_SIZE 64
```

We have also been given a .zip file which contains a program "Shared.exe"

### What does it mean?

Well The ``` SHARED_MEMORY NAME ``` sets the name of a shared memory region to ``` Local\\FlagSharedMemory ``` 

This shows that this is where the flag we need to retrieve is stored by the program.

The ``` FLAG_SIZE 64 ``` is self explanatory, it sets the size of the shared memory to 64 bytes.

So, What Next?

Logically, Our first course of action will be running the Shared.exe and see the program in action

Since I use Linux,  I will use Wine to run the program.

Wine adds a compatibility layer to allow Linux and MACOS Users run windows Programs

![alter-text](/images/post/Shared/runshared.png)
*Running Shared.exe with Wine*

After running the program, it prints the text
``` Flag decrypted and stored in shared memory. Waiting... ```

This Means 2 Things:
1. We can reverse engineer the  program to see how it decrypts the flag, then get the encrypted flag and attempt to decrypt it ourselves or
2. We can access the already decrypted flag that has been dumped on the Shared Memory.

We will go with method 2. Why? Well... It's Easier, and also, Based on the hints the challenge creator gave, it seems like the challenge creator wants to test our ability to gain access to shared memory.

## Accessing Shared Memory

I decided to use C to write a small program to help me get access  to the flag stored in the shared memory.

![alter-text](/images/post/Shared/shared_c.png)
*C Program to retrieve flag*

Let me explain why I used that Logic.

From our provided hints, we saw that  the shared memory object is ``` SHARED_MEMORY_NAME. ``` 

Therefore, I used the ``` hMapFile = OpenFileMappingA(FILE_MAP_ALL_ACCESS, FALSE, SHARED_MEMORY_NAME); ``` to open the shared memory object with full acsesss permissions. The `FALSE` Parameter simply means that we are not creating a shared memory, but opening an already existing one.

What follows is basic error handling

Then I mapped the shared memory object into the current process's (This C  program) memory space using the `MapViewOfFile` function.

Those are the most important bits of our program.

So, Let's compile our program. 

Compiling with the conventional GCC on linux will result in errors because our program calls Windows APIs with the `#include <windows.h>`. So I used `x86_64-w64-mingw32-gcc` Compiler accompanied with the `-luser32` flag to tell the linker to include the "User32 library" which will provide access to the windows functions


![alter-text](/images/post/Shared/compiling.png)
*Compiling the Program*

After Successfully Compiling,  I ran the program with Wine and it printed the flag

![alter-text](/images/post/Shared/flag.png)
*Retrieving The Flag*


Here is the Flag:
```flag{so_we_can_actually_share_memory_like_this}```

So. Once again, We've reached my most dreaded moment. 
I've ran out of creative ways to end these things.  So, I'll just say that this was a fun challenge and I'm glad I could solve it. 

See you on Shared2 which actually made me cry!!!

**REMEMBER**: *__Bsides Nairobi Challenge is happening this November and would really use you financial donations to help make the
event a success. You can donate here: [Bsides Nairobi 2024](https://paydexp.com/contribution/bsides-2024-conference)__*


'Shared' CTF Challenge by Winter (BSIDES Nairobi 2024)


This is actually my first ever blog post. So do I start with the National Anthem or how do these things even work. Just Assume I said
some really cool stuff.... Thanks!

Let's Begin!
This challenge we are about to walk through was written by Vold3m0rt in the OSINT Category for the BSIDES Nairobi CTF 2024.
The challenge creator has a habit of making grown men cry with his seemingly simple OSINT challenges, that often prove otherwise.

So how did I solve it?

## Understanding The Question
This is The Question.
![alter-text](/images/post/Time_Will_Tell/Question.png)
*Screenshot of the challenge question*

It seems to be some kind of poem that reads:

>  In fleeting moments, time's song rings, With echoes of the past, the future sings. Who charted days in a sunlit shell? Can you discover who first learned to tell?

Let's disect this poem and understand it

> In fleeting moments, time's song rings, With echoes of the past, the future sings.

This part indicates that the  challenge is about time or It's about something that has to do with time. 
Let's move to the next part and see if we can get more clues

>  Who charted days in a sunlit shell? Can you discover who first learned to tell?

The phrase "Who charted days in a sunlit shell" seems to be a metaphor for the earlier methods of counting days(time) using sundials

"Can you discover who first learned to tell?" This Mean we are looking for who were the first people to use sundials

Let's do a simple google search
![alter-text](/images/post/Time_Will_Tell/Google-Search.png)
*Screenshot of the Google Search*

We will go to the first link  and see if we can find the answer from Wikipedia
![alter-text](/images/post/Time_Will_Tell/Answer-wikipedia.png)
*Screenshot of the Wikipedia*

As we can see, The earliest sundial's were found in 2 Places:
1. Ancient Egypt
2. Ancient Babylonian Astronomy

Let's see what the question expects as the answer
![alter-text](/images/post/Time_Will_Tell/Format.png)
*Something Something*

The Question expects 2 words in Camel Case
So the answer is: Ancient Egypt

Thank You for reading! Assume I am writing a very emotional goodbye, but I know I'll see you on my next post. Adios!

Oh! One Sec. **Bsides Nairobi Challenge is happening this november and would really use you financial donations to help make the
event a success. You can donate here: [Bsides Nairobi 2024](https://paydexp.com/contribution/bsides-2024-conference)**


Time Will Tell CTF Challenge by v0ld3m0rt (BSides Nairobi 2024)


Damn! We are already on Post 2?😱😱😱

I guess I'm really doing this huh?😏😏😏

Aight! Let's Begin!

## Understanding The Question 
This is The Question.

![alter-text](/images/post/Buds/Question.png)
*Screenshot of the "Buds" challenge question*

We can see the text :
> Please cover my ears with buds and help me read the flag!

So this challenge has something to do with music

But we are also given a zip file which upon downloading and extracting we see:

![alter-text](/images/post/Buds/ls.png)
*ls command on the extracted folder*

We can see the zip file contains a file called 'buds' 

Let's identify what type of file this is
![alter-text](/images/post/Buds/binwalk.png)
*binwalk command on "buds" file*

The binwalk tool tells us that "buds" file is an ELF format meaning it is an Executable and Linkable File Format
This tells us 2 things:
1. We can interact with it by executing/running it
2. That  it is a binary file which we can reverse engineer and get the source code.

### Let's start with 1

We first give executing permissions on the file, then we proceed to interact with  the program and see
what it does.

![alter-text](/images/post/Buds/test1.png)
*executing the buds program*

Well! pretty disappointing, but still useful. 
The program asks us for a song name and seems to check for a specific song
So what next?

### Method 2

We will need to call upon the mighty dragons From NSA, and see if they can help us out.

Yeah, that's right We will use Ghidra to disassemble our buds file and hopefully get the  source code.

So I fired up Ghidra, created a project and imported the buds file.

After analysis, this was the source code for our point of interest: (The Main Function)

![alter-text](/images/post/Buds/sourcecode.png)
*source code of the buds program*

### Understanding the source code

The program seems to prompt the user for a song name, then checks if it matches a specific hardcoded string and then generates a "lovely.wav" file if the song entered does not match.

Pretty weird right? Like who does that??????

Okay, Let's move on


The first point of interest is this weird string just before the printf statement 
``  local_18 = "l~WadpxWl~WadggWqnoWl~W`pa~rfW{z|{"; ``

We see this is what the  program checks for, and if it doesn't match, it generates a lovely.wav file. But not that simple.

It reads the input into `local_128` and removes the newline character
It then performs an XOR operation with the byte 8 of each character of the input string
Then Reverses the XORed string and compares it to the hardcoded weird string 
``l~WadpxWl~WadggWqnoWl~W`pa~rfW{z|{``

If the input matches the string, it prints "You have it!"

### Deciphering the String

I wrote a python script that helped me perform the XOR Operation with the byte 8, on the weird string


![alter-text](/images/post/Buds/xor.png)
*Python Script to XOR String*

First I reversed the string then XORed each charachter to get the original input

Running the script returned this:


![alter-text](/images/post/Buds/runxor.png)
*running the Python Script*

Pretty weird right?... It shows some kind of flag but we are definitely sure that this is not the expected flag.
Why?... Well, unless we started listening to K-POP music. It's not even remotely related to a song. 

`flag{strs_nzvixh_vd_gfy_ooli_vd_pxli_vd}`

Remember this part of the question?.... That's right 
Atleast we know we are on the right direction

![alter-text](/images/post/Buds/hint.png)
*hint*

I tried deciphering the string `strs_nzvixh_vd_gfy_ooli_vd_pxli_vd` with ROT but it didn't work 

![alter-text](/images/post/Buds/rotdecipher.png)
*ROT Decipher Script*

The Output was:


![alter-text](/images/post/Buds/runROT.png)
*running the ROT Deciphering Script*


So The next course of action was deciphering with Atbash

### Atbash Deciphering
Atbash is a simple substitution cipher that replaces each letter with the letter at the opposite end of the alphabet

E.g A becomes Z and B becomes Y... You gerrit? If you don't gerrit well....

I wrote a simple Atbash Deciphering Script

![alter-text](/images/post/Buds/at.png)
*Atbash Deciphering*

and upon running it, I got the output:


![alter-text](/images/post/Buds/atbash.png)
*hint*

So we got this text:
`hgih_maercs_ew_tub_llor_ew_kcor_ew`

Let's Write it from the right to left
`we_rock_we_roll_but_we_scream_high`

Voila!... This actually makes sense!
And this is our flag:
`flag{we_rock_we_roll_but_we_scream_high}`

So, I guess that's it. I really don't know how to end this things. Amen?... Adios?
Adios seems good.

So, Adios Muchachos!

**REMEMBER**: *__Bsides Nairobi Challenge is happening this november and would really use you financial donations to help make the
event a success. You can donate here: [Bsides Nairobi 2024](https://paydexp.com/contribution/bsides-2024-conference)__*


Showing posts fromreverse engineering

Buds CTF Challenge BSIDES Nairobi 2024