Juniors CTF 2016 :: ROFL

hello everyone and welcome back to another YouTube video my name is John Hammond still checking out the junior CTF or Capture the Flag uh game and competition that was going on last weekend um so I want to showcase this rfl rolling on floor laughing challenge apparently is a trivial admin task whatever that means uh 400 points so a few people solved it um and there's a a gif a gif or whatever of uh rolling around and if you he is actually a link if you click on him it leads you to the B 64 Wikipedia article um and we get this included PDF file which is apparently a bunch of b64 strings or a giant Bas 64 string who knows uh let's take a look at it and and and let's download it so I actually view the source here um I go ahead and I grab the URL for this because I just want to straight up download it I think you can can you just click on it or can you like specify download no that's a zoom in button so I guess you would just have to save it text up PDF and let's put it in juniors let's create a new folder for this one rafle so let's sit over there CD rafle oh almost got some seam locomotive twice in a row damn all right so there's the text PDF is that an actual PDF file now did they did they just fool me with that I don't want the viewer I want the actual URL okay so now let's save this let's save this I just want to be sure let's get rid of the text files okay so we have this giant PDF which we want to be able to get the text out of I'm not going to like copy and paste all this because that would be dumb although it would probably work maybe can I control a yeah and select all just like that sweet maybe that actually isn't too bad of an idea I had used PDF to text and just scraped out everything out of here uh pdf2 txt and that's get that gets it all but it includes the new line characters which may not be you want all the time because it's going Page by Page and there are 73 pages so um it's. text if you do this does this include new lines it does it looks like I mean all of these are new lines regardless we should be able to save this one now so there's our text in all in base 64 what just happened did I just delete it C it yeah guess I guess I deleted it what the heck just happened okay whatever let's put it back and we can B 64 code this now we can um b 64- d it but it gives us more base 64 which I'm assuming if we base 64 decode that it will give us more Bas B 64 so right now we have like recursive base 64 so I try to like whip out a small easy thing to be able to keep track of that so I created a like zero file and I cat zero right so now what I'm going to do is I'm going to create a while loop or a for Loop actually because I can do this like let's say 100 times for I in range of one to 100 and I can do let's let a variable um P equal I the value of I minus one so I I use let so I can do some math and actually subtract one from this guy so P will be the previous thing and I will be the current file that I'm looking at because I want to be able to keep decoding again and again and again but I don't want to overwrite everything that I've done if I append or if I overwrite the file that I'm currently processing and looking at because bash does that sometimes so we let this new variable and then we can base 64 decode um the uh previous and we append it to or we uh redirect it to a new file the I file so it's done and now we have a bunch of files which I can all file if I wanted to and I get asky Tex asky Tex asky Tex all the time until I get this 32 one which apparently has ISO 8859 Tex if you actually cat out all these now or if like you did for Iron Range some of them are actually are empty like you saw like everything after almost after 32 is empty so we know we're at the very end we can display them all 0 to 32 do cat I done but again it's just the recursive base 64 until we get to the very end which is this ISO encoding see I googled this for a little bit like what is this thing but it's just in their character set so it took a lot of lurking around in the telegram like IRC chat conversation Channel thing uh begging administrators and mods um and asking like what are we supposed to do with this what is this this is clearly not the flag this is clearly not the hex bites for it like if I just hexedit that file we've got some things here but these are a unit there's a specific character set so what they tell us eventually is that oh we didn't expect like this challenge wasn't intended for any other International Players this was just for a Russian because it was a Russian CTS this was just for this is not for non-russian players so they didn't expect any to actually like get get this one that it was outside of the Russia or whatever they were they were putting it on for so apparently this ISO 8859 Tex is koi which is another uh quite eight which is an 8bit character encoding designed to cover Russian so that it it is it it's just being interpreted as the iso 8859 one right now so we have to convert it from Koi to utf8 or something we can actually read or so like a real Russian text flag so literally the flag is in Russian I would not have been able to get in this I would never have gotten this unless they straight up told me this is what I have to do which is why they straight up told me this is what I had to do so again if I have not yet made my point clear about how much this was a crazy stupid and sometimes really bad CTF and there was a lot of guessing and a lot of weird language barriers yet again again the flag is in Russian so okay let me explain what I what I did uh end up solving it and getting it out of the that koi encoding RL my get flag script uses ion to force the COI 8 file into changing the type to utf8 so that's the command I ended up running the convert convert text from one character encoding to another so I convert COI 8 R the 32 file to a new file the flag. text and I can cat that file and literally this Russian text is your flag I don't know if it actually translates anything that's actually a interesting point uh does this translate to anything at all Huts wonders yeah whatever that is or means um but literally you would submit this that's literally what you would submit and get your points um so peculiar peculiar challenge but really cool uh the recursive b64 encoding um I hadn't done that tactic before where I had like a simple Wild Loop previous uh number that I can B 64 out of and just crank that out in a in in a while loop and then I can just see where the offset is and what I hit all the empty um files that way I know okay this 32 was the last one in in recursive base 64 so that was kind of cool so not too bad of a challenge although what the heck not too bad in the technical sense and I did some cool bash scripting while Loops for recursive bas6 4 but why is the flag in Russian whatever I realized it's a Russian CTF and but I was hoping for international players we could still be cool so enough of me Jibber jabbering and and and blabbering on uh thanks for watching the video guys I hope to see you in a later video