python – devel0pment.de

13. May 202113. May 2021

Hacky Easter 2021 writeup

HackyEaster was awesome again. From a technical point of view there weren’t too much new things, but the creativity of the provided challenges made it really fun. Including the little teaser challenge there were a total amount of 37 challenges. These challenges were divided into different levels. You could only proceed to the next level, if you have earned enough points in the current level. I really liked that new idea.

HE21.00 Teaser Challenge HE21.01 Intro HE21.02 Basement Cat HE21.03 Easy One HE21.04 Beehive HE21.05 Unicorn HE21.06 Mystical Symbols HE21.07 Caesar’s Meme HE21.08 Sunshine HE21.09 Cafe Shop HE21.10 Ghost in a Shell 1 HE21.11 Hidden HE21.12 Ansi Art HE21.13 No No No HE21.14 Haxxor what? HE21.15 Social Checker HE21.16 LOTL HE21.17 Digizzled HE21.18 Bunny Beat HE21.19 😈 HE21.20 Run Me, Baby! HE21.21 Memeory 3.0 – The Final HE21.22 46 Apes HE21.23 Eggcryptor HE21.24 Tacocat HE21.25 Lots of JWTs HE21.26 Lost HE21.27 Ghost in a Shell 2 HE21.28 Haxxor what 2? HE21.29 Sailor’s Knot HE21.30 Pix FX HE21.31 Hunny Bunny HE21.32 Two Yolks HE21.33 Finding Mnemo HE21.34 The Five Seasons HE21.35 The Snake HE21.36 Doldrums

1. January 202124. January 2021

HACKvent20 writeup

This year’s HACKvent hosted on competition.hacking-lab.com has been as great as every year.
There was a total amount of 28 awesome challenges with varying difficulties.

23. May 202024. May 2020

Hack The Box – Rope

This article contains my writeup on the machine Rope from Hack The Box. I really enjoyed the box, since it provides a total of three custom binaries, which are supposed to be exploited 🙂

The article is divided into the following parts:

→ User
    – Initial Recon
    – httpserver
    – Leak Memory Address
    – Exploit Format String Vulnerability
    – Escalating from john to r4j (readlogs)

→ Root
    – Local Recon
    – contact
    – Bruteforce
    – Libc Leak
    – Final Exploit

1. January 20201. January 2020

HACKvent19 writeup

This year’s HACKvent was hosted on the brand new Hacking-Lab 2.0 plattform. Each day from the 1st of december until the 24th a new challenge is published raising in difficulty. The flag format changed from HV18-xxxx-xxxx-xxxx-xxxx-xxxx to HV19{...}. After all I managed to solve all 28 challenges 🙂

	Hidden
HV19.H1 Hidden One HV19.H2 Hidden Two HV19.H3 Hidden Three HV19.H4 Hidden Four
	Easy
HV19.01 censored HV19.02 Triangulation HV19.03 Hodor, Hodor, Hodor HV19.04 password policy circumvention HV19.05 Santa Parcel Tracking HV19.06 bacon and eggs HV19.07 Santa Rider
	Medium
HV19.08 SmileNcryptor 4.0 HV19.09 Santas Quick Response 3.0 HV19.10 Guess what HV19.11 Frolicsome Santa Jokes API HV19.12 back to basic HV19.13 TrieMe HV19.14 Achtung das Flag
	Hard
HV19.15 Santa’s Workshop HV19.16 B0rked Calculator HV19.17 Unicode Portal HV19.18 Dance with me HV19.19 U+1F385 HV19.20 i want to play a game HV19.21 Happy Christmas 256
	Leet
HV19.22 The command … is lost HV19.23 Internet Data Archive HV19.24 ham radio

Continue reading “HACKvent19 writeup”

1. July 20191. July 2019

Google CTF 2019 (Quals) – Quantum Key Distribution

This years online qualification for the Google Capture The Flag finals (ctftime.org) ran from 22/06/2019, 00:01 UTC to 23/06/2019 23:59 UTC.

As last year, there were plenty of diversified challenges, which were worked out very well.

I tried to take at least a look at as much challenges as possible and solved the challenge Quantum Key Distribution, which was relatively easy based on the amounts of solves. Within this article I want to share my writeup on this challenge.

The writeup is divided into the following sections:

Challenge description
BB84 protocol
Source code
Outlined process
Solution

31. March 201931. March 2019

VolgaCTF 2019 Qualifier – Blind

The VolgaCTF 2019 Qualifier (ctftime.org) took place from 29/03/2019, 15:00 UTC to 31/03/2019 15:00 UTC.

There has been a really interesting RSA crypto challenge called Blind, which I would like to share with you in this writeup.

The article is divided into the following sections:

→ Challenge description
→ What does the script do?
→ Blind RSA Signature
→ Retrieving the Flag

Continue reading “VolgaCTF 2019 Qualifier – Blind”