• Simple CTF tasks
• Introduction to Python scripting
• Introduction to basic security-related tools

• man, find, file
• base64
• gzip, bzip2, tar
• hexedit, xxd, binwalk
• john, zip2john

You may use the UPB's OpenStack cloud to spawn a Virtual Machine to be used for this lab! Read this guide.

Download the task archive for this section. Each exercise lives in its own folder.

Useful tools (already present on the ISC VM image):

sudo apt update
sudo apt install -y john zip2john binwalk p7zip-full gifsicle zbar-tools xxd
# note: everything else (base64, file, zcat, xxd, find, python3)
# should already be installed in any recent distro!
 
# note: install Python libraries inside a virtual env:
python3 -mvenv .venv        # create the py3 VENV
source .venv/bin/activate   # run this every time your terminal shell is restarted!
pip3 install requests  # HTTP client library for the last task

We recommend doing the following tasks using python3 and/or bash. Though feel free to explore the files and their contents using shell tools (e.g., xxd, file) or any GUI viewer (especially for images / PDF / audio documents) beforehand!

• One of your friends gave you this string which looks encoded… Figure out what encoding was used and decode it. Be patient, it may take a couple of decoding rounds :)
• Hint: Spot the encoding: chars A-Z a-z 0-9 + / = with length a multiple of 4 :? …

<info important> Also check out ex1-encodings/ for a quick python3 tutorial on encodings. This is especially important when manipulating binary data using Python! </info>

<spoiler Spoilers: scratch to reveal…>

• The encoding is… 🥁… base64!
• Do one round by hand:

  echo 'Vm0weE5GVXhTWGhpUm...' | base64 -d

• If the output is still base64-looking, run it again!
• Please automate it using Python:
• Python

  import base64
  s = b'YOUR_STRING'
  while True:
      try:
          s = your_decode_snippet(s)
      except Exception:
          break
      print(s)   # print at each step

Expected: 5 rounds; the last printed line is the flag.

• The archive contains the flag. What is the password?
  • Hint: the password is in the wordlist

• The flag for this exercise is found in a file under the inhere directory. The file has the following properties:
  • human-readable
  • 987 bytes in size
  • not executable

• We've found this file on a confiscated machine, but we can't figure what it is. Can you help us?

• During a transmission, one of our files got corrupted. Take a look and see if you can do something about it.

Maybe there is something wrong with the header.

• Hint: use a hex editor to check the file's header

• There is something wrong with the size of this image. Is there anything else there?
  • Hint: use Binwalk. ”-e” option is buggy sometimes.

• We stared at this gif for the last hour but nothing is happening. Would you like to join us and stare at it for the next hour?

• You are being given a file which is a hexdump of the flag that has been repeatedly compressed. Reverse the process and get the flag :)
  • Hint: hexdump, man

• Start this task by opening a specific docker container on your VM:

  docker run -d -p 8080:80 ghcr.io/cs-pub-ro/isc-lab-intro-web

• You can now access a webserver on local port 8080 (try it with curl localhost:8080). Your task is to retrieve the hidden flag by trying all web paths inside the given wordlist (write your own fuzzer in Python, check the lab archive for resources!).
  • Hint: use the Python requests library to issue web requests! Check their HTTP status code to know when you successfully found an existing web file ;)

• ex1: keep the base64 string on ONE line — a line break in the middle breaks decoding.
• ex3: without the c suffix, -size 987 means 987 x 512 bytes ⇒ you find nothing.
• ex6: if binwalk -e produces a broken extracted dir, slice manually with tail -c +<offset+1>.
• ex7: the flag is not text — strings finds nothing; it's rendered as a QR image.
• ex8: xxd without -r *creates* a hexdump; with -r it *reverses* one.
• ex9: if port 8080 is already allocated: docker rm -f <container> and rerun, or use -p 8081:80 and adjust TARGET_URL.