About Writeups, and CTFs Sep 27th, 2013 by Valodim At the point of this writing, 13 out of 16 of our blog entries are writeups for challenges from various CTFs. In fact, they were taking up so much space we reduced their visibility on the front page slightly compared to regular blog entries, and also gave them their own archive page. I felt we owe an explanation to our readers on what is up with those, and CTFs in general. Read on to find out about what a CTF is, and how we at Stratum 0 are involved. What is a CTF? This acronym stands for “Capture The Flag”, which is the common term for a type of hacking slash security contest. CTFs are regularly organized for conferences, other types of events or sometimes just stand-alone. During a CTF event, which usually lasts for two to three days, hackers organized in teams all over the world try to competitively solve as many challenges as possible to maximize their score. There are commonly 20 to 25 challenges in a CTF, ranked by difficulty and grouped together in categories, which differ between contests but almost always include Pwning, Crypto, Reversing, Forensics and Web. Crypto challenges are all about understanding and consequently breaking insecure crypto ciphers, protocols, and signatures. Forensics usually covers recovery of files or information from different data sources like broken file systems, memory dumps or captured network traffic. Pwning challenges provide the binary or code of an application, which must be dissected to exploit and ultimately discover the flag from a remotely running instance of the same application. Reversing challenges require analysis of a compiled binary file to either find information or modify its behavior in order to discover the flag from it. Web challenges involve hacking of web services, especially HTTP. This includes SQL injection, analysis of service vulnerabilities and bypassing authentication schemes in general. There are a plethora of other categories coming up irregularly which range from trivia and recon types to shellcode, guertilla programming or just plain “misc”, serving a challenge spectrum from pure execution to out of the box thinking. Difficulty also varies wildly between tasks, from mindbendingly difficult requiring 10+ hours of thorough contemplation and hacking by seasoned players or “just plain impossible”, to solvable by newbies in an hour or two. Writeups Solutions to the challenges are usually not given by the organizers of an event even after it is over, but instead provided in the form of writeups from the playing teams. Since oftentimes there is no single obvious way to solve a problem, there is a certain diversity to the approaches taken by different teams and reading writeups often provides interesting in- or at least hindsight. So that’s what we are doing here. Each writeup post is the solution to one challenge in a CTF event we participated in. We don’t write one for every challenge we solve, obviously, but pick the ones we found particularly entertaining, consider interesting technically, or were the only ones to solve. Our CTF Team We started playing CTFs some time around May 2012. At first there were three and a half people attending regularly, stumbling their way through the levels without much of a clue of what we were doing. This changed over time, we found more players, everyone learned a lot and we are now about six regulars plus a couple of on and off players, and some of us even know what they are doing. The website CTF Time tries to keep track of the scoreboards of all CTF events, assigning points to teams based on rating weights for all events. It established its status as a global CTF ranking. In 2012, the Stratum 0 team ended up in place 45 of this ranking despite participating only in a relativly small number of events. In 2013, we are the highest ranking German team on position 21st, so far. In a recent development, the Stratum 0 team joined efforts with the team from CCC Aachen, forming the new team Stratum Auhuur. The experiment worked well with online collaboration at ASIS CTF and CSAW CTF, and we are currently planning to visit Aachen for the hack.lu CTF event. If all goes well, we might play as a joint team for the entire season of 2014, and are shooting for a place in the Top 10 at CTF Time. Come visit! I would also like to point out that while a certain level of computer literacy is required to participate in CTFs, we are always happy about potential new players and generally open to guests. All CTF events are announced on the Normalverteiler and Stratum News mailing lists and are open to anyone who feels like breaking weak rsa keys, injecting sql, going wild with buffer overflows, learn what those things even mean, cheer us on, or just look at a bunch of nerds thinking real hard for extended periods of time.