Google CTF: Beginner Quest: MOAR

Key Takeaways

Hey, what's up internet? This is John Hammond and I want to showcase more of the Google capture the flag competition that just happened recently. Um, a shout out first of all to Live Overflow. Um, I played this game with him and he took a look at some of the legitimate challenges. Um, JSafe 2 or like JavaScript safe 2.0. Um, and he did some incredible work with it. It was super cool to watch him work. Um, but he's a great guy. He has incredible content on YouTube. You should totally check out some of his stuff um, if you haven't already. but we do similar things like cyber security, computer science, hacking, capture the flag stuff. So hopefully he's already on your radar. Um, but let's get to the real content here. Let's get to the Google capture the flag. So I want to check out the beginner's quest. Uh, and this challenge here uh the green dot that became available just recently after we've solved a couple of the challenges. This challenge is called more m o a r uh and it's a pone uh binary exploitation challenge. However, it's not that much. Um, it's not the classic hardcore binary exploitation thing. It's a baby quest one. So, the challenge prompt is finding yourself on the Fubanizer 9000, a computer built by 9,000 foos. This computer is complicated. Luckily, it serves manual pages through a network service. As the old saying goes, everything you need to know is in the manual. So, we can copy this netcat connection script. Um, let's get a terminal that we can work with this stuff in. I've been working out of GCTF because I like to have a folder for every single game I play. And I like to have a folder for every single challenge I do, too. So, let's make a directory more. Move into it. And let's create a connect script just because I always forget the host name and port for everything that I do. So, I do want a connect script that lets me just easily run through the net connection. Now, I can dot /connect. And what we have here is what looks like a manual page for socat or the socket cat multi-purpose relay blah blah blah. And there's nothing else we can do with this. It's just printing out that page and that's it. So the gimmick here is that this man page is trying to run a pager program like less or more. And thankfully those command those those programs let us do interesting things like open up editors or read another file or etc etc. One of those things is actually running commands. If we give it a special key a exclamation point we can actually start to type things that will run in the shell that in the service we're connected to. So if I run who am I we'll get the output more. Okay. If I were to run ID, we can run and see, oh, I am this this user here. So, if I go to actually ls, see what's in the current directory. Hm, this looks like a root directory. Let's check out what's in home. Anything? Okay, looks like we just have a uh more user. So, let's see what he has. He has a file disabled DMZ.sh. Looks like a shell script. Um, let's check out what that actually is. Home more. Oh, it looks like I lost connection there. So, let's cat out home more. Disabled DMZ.sh. Um, oh, I had a forward slash in there. My bad. I'm going to copy this because I'm lazy. Run this. And we can see the output and see the contents of this script. A shebang line here. It says disabling DMZ using password CTF something catastrophic. Here is the flag for this challenge. So, not super hard. Um, I didn't end up writing a get flag script for this. I just took note of the flag and wrote down a solution. I like to do that. Just a super easy thing so I have my own mental write up like um use exclamation point for rce cat home directory scripts or something. And just a super uh mental note for myself. Um, rather than writing a get flag script for these things that I can't easily automate things for, we could try and connect to it and then use XTE to send keys. Um, I don't even know if we could just like echo a dollar sign or an exclamation point into this connect script. Let's try it just to see, I guess. Disabled DMZ.sh. Pipe that into connect and we'll see what happens. No, it looks like it breaks. Yeah. Okay. So, like I said, not an easy candidate for writing a get flag script, but we can still grab the flag, save it, take note of what we did to get it, and mark this challenge as complete because that's good CTF practice here. Sweet. Thank you guys for watching. Hope you enjoyed this uh simple stuff, right? Beginner's quest, baby challenges, noob stuff, but a little bit here for everyone. If maybe doing some techniques you haven't seen before or just good practice, I don't know. I like to showcase some of this stuff. Thank you guys for watching. Um, I'll see you in a later tutorial or video, but extra shout out, check out Live Overflow. He's awesome. Uh, and I'm really, really thankful we were able to get together and do some of this stuff together. Uh, maybe do a collaboration in the future, and I hope we can work together on some of these CTF stuff soon. All right, if you did like the video, please do press that like button. Um, if you want to give me some feedback, let me know what you think, what else you'd like to see. Leave a comment if you're willing. subscribe and if you really really want to help me out, please just Thanks again.