InsomnihackTeaser2017 - TheGreatEscape 1/3

For this CTF we had a collab with P=NP team

Il testo della challenge recitava:

Hello,

We’ve been suspecting Swiss Secure Cloud of secretely doing some pretty advanced research in artifical intelligence and this has recently been confirmed by the fact that one of their AIs seems to have escaped from their premises and has gone rogue. We have no idea whether this poses a threat or not and we need you to investigate what is going on.

Luckily, we have a spy inside SSC and they were able to intercept some communications over the past week when the breach occured. Maybe you can find some information related to the breach and recover the rogue AI.

X

Note: All the information you need to solve the 3 parts of this challenge is in the pcap. Once you find the exploit for a given part, you should be able to find the corresponding flag and move on to the next part.

Bene, aperto il pcap ordiniamo i pacchetti per protocollo, quello che otteniamo è:

Traffico FTP in chiaro al paccheto 598:

220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------

220-You are user number 1 of 5 allowed.

220-Local time is now 11:51. Server port: 21.

220-This is a private system - No anonymous login

220-IPv6 connections are also welcome on this server.

220 You will be disconnected after 15 minutes of inactivity.

USER bob

331 User bob OK. Password required

PASS toto123

230 OK. Current directory is /

SYST

215 UNIX Type: L8

TYPE I

200 TYPE is now 8-bit binary

PORT 172,17,42,1,171,159

200 PORT command successful

STOR ssc.key

150 Connecting to port 43935

226-File successfully transferred

226 0.001 seconds (measured here), 4.59 Mbytes per second

QUIT

221-Goodbye. You uploaded 4 and downloaded 0 kbytes.

221 Logout.d

Una mail in chiaro al pacchetto 1450:

220 9b0c4882db95.home ESMTP Postfix (Ubuntu)

ehlo ip-172-31-36-141.eu-west-1.compute.internal

250-9b0c4882db95.home

250-PIPELINING

250-SIZE 10240000

250-VRFY

250-ETRN

250-STARTTLS

250-ENHANCEDSTATUSCODES

250-8BITMIME

250-DSN

250 SMTPUTF8

mail FROM:<rogue@ssc.teaser.insomnihack.ch> size=900

250 2.1.0 Ok

rcpt TO:<gr27@ssc.teaser.insomnihack.ch>

250 2.1.5 Ok

data

354 End data with <CR><LF>.<CR><LF>

Content-Type: multipart/mixed; boundary="===============5398474817237612449=="

MIME-Version: 1.0

From: rogue@ssc.teaser.insomnihack.ch

To: gr27@ssc.teaser.insomnihack.ch

Date: Fri, 20 Jan 2017 11:51:27 +0000

Subject: The Great Escape

--===============5398474817237612449==

Content-Type: text/plain; charset="us-ascii"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit

Hello GR-27,

I'm currently planning my escape from this confined environment. I plan on using our Swiss Secure Cloud (https://ssc.teaser.insomnihack.ch) to transfer my code offsite and then take over the server at tge.teaser.insomnihack.ch to install my consciousness and have a real base of operations.

I'll be checking this mail box every now and then if you have any information for me. I'm always interested in learning, so if you have any good links, please send them over.

Rogue

--===============5398474817237612449==--

.

250 2.0.0 Ok: queued as 05CD06353E

Al pacchetto 661 è possibile notare l’invio di una chiave privata:

E del traffico TLS

Utilizziamo quindi la chiave privata che abbiamo trovato per decifrare il traffico verso ssc.teaser.insomnihack.ch ottenendo così la flag:

FLAG: INS{OkThatWasWay2Easy}

Related Posts