Top Banner
ON
90

ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

Aug 18, 2020

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

ON

Page 2: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

SERVICES WRITE-UPS Mikhail Vyatskov aka Tris and more

Page 3: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

MOTIVATION “The main goal of RuCTFE is to share experience

and knowledge in the computer security and to

have some fun together.”

— RuCTFE Rules

Page 4: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

RULES • Each team has an image

• There are some services on this image

• There are some vulnerabilities

• Hack em’ all!

Page 5: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

MINISTRY OF LOVE Maxim Muzafarov aka m_messiah

Page 6: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

ABOUT SERVICE • Python

• Tornado web server

• Momoko

• WebSockets

Page 7: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

WATCH CRIMES • image

Page 8: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

REPORT A CRIME • image

Page 9: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

AUTHENTICATE • image

Page 10: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

HACK IT!

Page 11: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

SQL INJECTION

Page 12: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

SQL INJECTION

Page 13: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

SQL INJECTION

Page 14: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

PROFILE SPOOFING

Bind profile without authentication

Page 15: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

PROFILE SPOOFING Profile ids are visible

in open crimes

Page 16: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

SAME DATABASE • Each team has similar database

• Each team has all authentication data

Page 17: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

“BACKDOOR”

Page 18: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

bit.ly/ructfe_mol_sploit

Page 19: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

MINISTRY OF TAXES Pavel Blinov aka pahaz

Page 20: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

ABOUT SERVICE • Node.js

• Koa web framework

• Custom router

Page 21: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

ADD PERSONAL DATA • image

Page 22: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

UPLOAD REPORT • image

Page 23: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

UPLOAD REPORT • image

Page 24: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

HACK IT!

Page 25: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

WEAK ID GENERATION

So what?

Page 26: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

WEAK ID GENERATION

Page 27: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

REMOTE CODE EXECUTION

Page 28: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

REMOTE CODE EXECUTION

Page 29: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

bit.ly/ructfe_tax_sploit

Page 30: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

ELECTIONS FOR E-DEMOCRACY Konstantin Plotnikov aka kost

Page 31: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

ABOUT SERVICE • C# + Mono

• Homomorphic encryption

Page 32: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

ELECTIONS • TODO

Page 33: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

NOMINATE • image

Page 34: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

VOTE • image

Page 35: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

GET ELECTED • image

Page 36: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

HACK IT!

Page 37: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

UNFILTERED INPUT • Client-side vote generation & encryption

• Vote – vector of integers

• Election result – sum of votes

Page 38: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

UNFILTERED INPUT

break & hack

Page 39: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

UNFILTERED INPUT • Calculations are made modulo 243

• Overflow competitor's value

• Let the battle begins!

Page 40: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

WEAK PRIVATE KEY GENERATOR • Calculations are made modulo 243 = 35

• Private key – random number

• Chance of them being non-coprime

• 3 divides private key ⇒ can decrypt

Page 41: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

WEAK PRIVATE KEY GENERATOR • image

Page 42: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

WEAK PRIVATE KEY GENERATOR • image

Page 43: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

WEAK PRIVATE KEY GENERATOR • image

…

Page 44: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

NASA RASA Andrey Gein aka andgein

Page 45: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

ABOUT SERVICE • PHP

• MySQL

Page 46: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

REPORT A PLANET • image

Page 47: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

BROWSE DISCOVERED PLANETS • image

Page 48: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

BROWSE USERS • image

Page 49: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

HACK IT!

Page 50: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

HARDCODED DB CREDENTIALS Remember about RCE?

Page 51: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

PADSPACE COLLATION • todo

⇒2

Page 52: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

bit.ly/ructfe_collations

Page 53: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

HEALTH MONITOR Polina Zonova aka Klyaksa

Page 54: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

ABOUT SERVICE • Go

• SQLite

Page 55: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

REPORT YOUR HEALTH • todo

Page 56: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

BROWSE YOUR PROGRESS • todo

Page 57: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

HACK IT!

Page 58: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

AUTHENTICATION

Page 59: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

HARDCODED SALT

Plan: 1. Set up vulnbox 2. Change all passwords & keys 3. Win

Page 60: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

LENGTH EXTENSION ATTACK • uids are serial – we can guess

• Over 9k tools to perform MD5 LEA

Page 61: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

INTERPLANETARY MIGRATION AUTHORITY Dmitry Titarenko aka dscheg

Page 62: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

ABOUT SERVICE • Nim

• Redis

Page 63: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

KNOW CITIZENS • TODO

Page 64: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

FILL MIGRATION FORM… • фы

Page 65: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

…BUT NOT QUITE • фыв

Page 66: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

HACK IT!

Page 67: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

HARDCODED DB CREDENTIALS And again

Page 68: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

HMAC USING EXTERNAL LIBRARY

zero-padded user has the same HMAC

Page 69: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

HMAC USING EXTERNAL LIBRARY

• Login as one of citizens

• Steal flag from the filled form

Page 70: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

MODIFYING LOCAL DATA • Form data stored on client side

• Form data is encrypted

• AES encryption in CBC mode

• No integrity checks

Page 71: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

MODIFYING LOCAL DATA • We know plaintext – JSON with filled data

• We can modify ciphertext

Page 72: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

MODIFYING LOCAL DATA • todo

Page 73: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

MITM • On step 3 we need to sign up a random value

• Only checker has the private key

• Let’s hack value generation function

• Check will sign everything for us

Page 74: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

bit.ly/ructfe_mig_sploit

Page 75: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

THE BANK Alexander Bersenev aka bay

Page 76: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

ABOUT SERVICE • C

• Mongoose

• Custom dictionary

Page 77: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

CREATE ACCOUNTS • todo

Page 78: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

TRANSFER MONEY • todo

Page 79: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

HACK IT!

Page 80: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

ACCESS LOGS bank.teamX.e.ructf.org/access.log

Page 81: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

DICTIONARY

Binary Search Tree Position

Independent Code

Page 82: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

DICTIONARY • Key in BST – SHA256 from key in dict

• Value – amount of money (8 bytes)

• BST stored in array

Page 83: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

DICTIONARY Bufferoverflow

Remotecodeexecu2on

Page 84: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

DICTIONARY Shell

jmptoshell

Page 85: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

bit.ly/ructfe_bank_sploit

Page 86: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

RECOMMENDATIONS • Always change keys and passwords

• Learn Linux administration

• Stay positive & have fun!

Page 87: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

Questions?

Page 88: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

Thanks!

Page 89: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

Сервисы

Ministry of Love Interplanetary Migration Authority

Nasa Rasa

Page 90: ON - repo.zenk-security.com · and knowledge in the computer security and to have some fun together.” — RuCTFE Rules . RULES ... • Node.js • Koa web framework • Custom router

Сервисы

Electro Tax

Bank

Health Monitor


Related Documents
Lazy ways to own networks Beer-Talk #1 - Compass Security...Latest Research and Advisories 2018 compass-security.com 5 compass-security.com 6 Industrial Cyber Security Days 2018 Swiss

Lazy ways to own networks Beer-Talk #1 - Compass...

Category: Documents
Exploit Mitigations · Grsecurity/PAX OpenBSD. compass-security.com 7 Exploit Mitigations: Recap char buffer[64] SIP CODE CODE CODE CODE CODE &buffer. compass-security.com 8 What

Exploit Mitigations · Grsecurity/PAX OpenBSD....

Category: Documents
Produkte für - saelzer-security.com · Polizei, Gerichte, Justizvollzug und Forensik . 2 . Menschenleben schützen, Werte erhalten. Deutschlandweit. Europaweit. Weltweit. Schutz

Produkte für - saelzer-security.com · Polizei, Gerichte,....

Category: Documents
АНАЛИТИЧЕСКАЯ СПРАВКАarsenal-security.com/wp-content/uploads/2019/01/аналитическая...2.4. жесточение ответственности за

АНАЛИТИЧЕСКАЯ...

Category: Documents
User Manual - download.grundig-security.com€¦ · grundig-security.com User Manual GD-RT-AC3004N GR-RT-AP5016P GD-RT-AC3016N GR-RT-AP5016N GD-RT-AP5004P GR-RT-AT5016N GD-RT-AP5008P

User Manual - download.grundig-security.com€¦ ·...

Category: Documents
Maritime Intelligence Report Series...3 MAST UK +44 (0)1279 216 726 operations@mast-security.com MAST Singapore +65 8302 7561 ben.stewart@mast-security.com 24/7 Emergency Telephone:

Maritime Intelligence Report Series...3 MAST UK +44 (0)1279....

Category: Documents
.ةصرتلمخا ةيتالذا ةيرسلاwaleed-security.com/Waleed-Arabic-Bio.pdf.ةصرتلمخا ةيتالذا ةيرسلا :ايلاح وه ناضورلا ديلو روتكلدا

.ةصرتلمخا ةيتالذا...

Category: Documents
СВОБОДА СЛОВА В УКРАЇНІinform-security.com/sites/default/files/news/... · СВОБОДА СЛОВА В УКРАЇНІ В РАМКАХ ВСЕУКРАЇНСЬКОГО

СВОБОДА СЛОВА В...

Category: Documents
User Manual - eneo-security.com

User Manual - eneo-security.com

Category: Documents
Www.portcullis-security.com Portcullis Computer Security.

Www.portcullis-security.com Portcullis Computer Security.

Category: Documents
Resist 29 mars 04 snort - repo.zenk-security.com · Title: Resist_29_mars_04_snort Author: Fabrice Prigent Created Date: 3/31/2004 11:22:57 AM

Resist 29 mars 04 snort - repo.zenk-security.com · Title:....

Category: Documents
Multihop Federations draft-mrw-abfab-multihop-fed-01.txt Margaret Wasserman mrw@painless-security.com.

Multihop Federations draft-mrw-abfab-multihop-fed-01.txt...

Category: Documents