🪖vikeCTF 2024
Solutions for all but two problems.
Cloud
My Buddy Erik (35 solves)
Description:
My buddy Erik wants to play Minecraft so I set up a server for us to play on. I've committed my configuration to GitHub because it's so convenient! Can you make sure that everything is secure?
https://github.com/VikeSec/vikeCTF-2024-minecraft-server
Solution:
We see a reverted commit when looking at the history of the repo.
Removing data from Github is surprisingly difficult (see https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository). We can recover the data using github-secrets.
Click the first link to see the flag.
Silly Software (28 solves)
Description:
We're Silly Software, and we like bringing the Fun back into devops! We've decided that we're going to start distributing our software as Docker images, because that seems like the most fun! I hope nothing goes wrong :)
docker run public.ecr.aws/d8p5p1v7/vikectf2024/silly-software:latest
Solution:
First get the container source by running the following commands:
In files.tar, there is a set of layer tarballs. Grep for vikectf to see which have the silly-software plugin and there are two. In the one starting with ab24, there is a hidden file called .npmrc with the following auth token.
We can now download the-flag-101.tar.gz that we see downloaded and deleted in the initial docker build.
After extracting the tar, we get the flag.
Cryptography
Norse Cryptogram (170 solves)
Description:
Delve into the realm of Norse mythology and unlock the secrets of the runic script in this cryptic challenge. Armed with your wits and keen eye, decrypt the ancient messages hidden within the runes. Will you prove yourself worthy of Odin's wisdom or fall prey to the tricks of Loki? Prepare to embark on a journey through Viking lore as you unravel the Runebound Riddles!
Solution:
This is just a cyberchef skillcheck. Next to the "Output" title, there is a wand that shows up to make suggestions and provides many of these.
Deep Cover (145 solves)
Description:
As the Viking ship sailed across the vast North Sea, its crew encountered unexpected turbulence in the form of a message. Amidst the rugged expanse of the waters, a messenger bird descended, bearing a weather report inscribed in Cyrillic script. With furrowed brows, the Norsemen deciphered the ominous tidings, seeking the hidden meaning within.
Solution:
Quipqiup for autosolving mono-alphabetic substitution ciphers.
Quantum Keygen Quest (16 solves)
Description:
Gather 'round, ye stout-hearted souls, for within these sacred gates lie the keys to unlock the mysteries of the cosmos. Let not the symbols deceive thee, for they hold the power to unravel the very fabric of reality itself.
With nimble fingers and minds sharp as Mjölnir's edge, apply the ancient enchantments to thy ciphered scrolls. Dance with the shadows of uncertainty, for it is within the darkness that the true light of knowledge shall be revealed.
As the stars guide our course through the endless expanse, let us embark on this odyssey with courage in our hearts and the spirit of adventure blazing in our souls. For today, we embark on a voyage beyond the realms of mortal comprehension. Today, we harness the power of the quantum seas and emerge victorious, as legends of old. Skál!
Solution:
Here is the challenge.
After some research into quantum keys (referencing title), we see this Wikipedia page.
Basically, the shared secret key is whenever Alice and Bob match, the bit is used in the original pattern. The H and X also look like the + and x so we know we're on the right track. Here is the solve script.
Misc
The Usual (45 solves)
Description:
In the heart of a bustling medieval market, a burly Viking with a formidable beard and weathered armor stumbles upon a peculiar sight—a vibrant flag shop adorned with banners of every hue. Intrigued by the fluttering colors, he enters the shop, his towering frame contrasting with the delicate textiles. With a mix of curiosity and confusion, he marvels at the array of flags, pondering which one might best represent his warrior clan amidst the sea of symbols and sigils.
Connect to 35.94.129.106:3008 to find the flag
nc 35.94.129.106 3008
Solution:
Running the binary we see a shop where we have $100 and the other options cost more than what we have. Looking at the decompiled binary in ghidra (or dogbolt.org), even if we could try buying the flag, we see it won't actually call the flag function so we need to treat this as a pwn and do a ret2win.
The decompiled output shows the data type in the check function uses int32 as the datatype so this number corresponds to -1 and lets us call the flag stand function which has a buffer overflow vulnerability. This is a pretty standard pwn challenge with most protections disabled so I'll just post the solution script and move on.
Hidden Valor (90 solves)
Description:
Decode the secrets of our Viking legacy hidden within the depths of our emblem. Unveil the hidden message to reveal the path to glory!
Solution:
Stegseek then same thing as Norse Cryptogram.
Hidden Treasure (20 solves)
Description:
As the dense fog shrouded the rocky coastline, a group of fearless Vikings set sail in their sturdy longship, their eyes gleaming with anticipation. Guided by ancient maps and whispered legends, they embarked on a perilous quest in search of a fabled treasure hidden deep within uncharted lands. With the wind at their backs and the crashing waves echoing their determined hearts, they ventured forth into the unknown, ready to conquer any obstacle that stood in their way in pursuit of untold riches and glory.
We received an image of the target's computer, and we have reason to believe they know the credentials to the website.
Download the image from here and find out how to access the flag: https://pub-2145e7fa138e484eb3462e0474545de9.r2.dev/vikectf2024%2Fvikebox.img.gz
Solution:
The attachment unpacks to a 15GB img file. Here is my preferred method of mounting.
After mounting, we see a Linux filesystem and pretty quickly find the target (35.94.129.106:3005) was visited, firefox even saved a screenshot of the login page. The logins.json isn't there so firefox didn't save the password, but the cookie is there in cookies.sqlite. We can get the cookie and then access the site with it.
Time to Attack (19 solves)
Description:
Under the cloak of night, a band of Vikings lies in wait amidst the dense foliage bordering a serene village. They huddle in the shadows, their breaths mingling with the chilled air as they keenly observe the settlement's defenses. Torches flicker, casting eerie shadows across the wooden palisades, while the rhythmic beat of guards' footsteps reverberates in the distance. Patiently, the Vikings bide their time, awaiting the opportune moment to unleash their ferocious onslaught upon the unsuspecting village, their anticipation sharpening with each passing heartbeat.
Connect to 35.94.129.106:3006 and enter the password
nc 35.94.129.106 3006
Solution:
The first test I did was a brute force for length but saw it took about the same time for lengths of 1-100. I then tried the same character repeated many times and saw a 0.5 delay when "d" was the first letter. Basically every time a correct letter is received by the password checker, there is a 0.5 delay. Here is the solve script.
Robo Erik (18 solves)
Description:
Uh oh! It looks like there's a robot viking in our midst, what power does it have?
You'll have to join the vikeCTF Discord for this challenge, I trust that you can find the link :)
RoboErik#9494
Solution:
This is a discord bot that can print out messages from a channel if it has access to it. There are multiple plugins that allow you to see hidden discord channels, so choose one to see the following (didn't spend much time looking into it but some may violate ToS, proceed with caution) :
Only robo-37 had RoboErik allowed to see. After finding that, we can just ask RoboErik to print out the contents of that channel (right click it to copy the channel ID). RoboErik checks to make sure you have an Organizer role so create an empty discord server, add it to yourself, invite RoboErik to it, then pass it the channel ID.
Reverse
Program with Jokes (157 solves)
Description:
Unravel the enigma behind this funny program and showcase your tactical prowess like never before.
Solution:
Seems like LOLCODE code, just threw it at GPT-4, might be possible instead to execute or something.
Blackjack (14 solves)
Description:
As I stepped into the bustling casino, the air was thick with anticipation. My eyes scanned the room until they landed on the blackjack table. Sitting across from me was the dealer, their movements precise and mechanical. With each shuffle and deal, there was something eerily robotic about them, sending a chill down my spine. Yet, I couldn't resist the allure of the cards spread out before me, beckoning me to take a chance.
nc 35.94.129.106 3002
Solution:
No code needed for this one. Looking at the decompiled binary we're given, we can see that we have to reach a balance of 100000000 and the randomness is seeded by the current time. Therefore, as long as our system clock is the same as the server's system clock, we can execute the program locally and have the same program state. Luckily, after a ntpd -q, the system time was the same so after running locally and on netcat, we can predict what the cards will be. For brevity, entering 1s on our local system will bet $1 and stand (and we can also do e.g. 1s 1s 1s to go through three rounds). Whenever we'll win, we bet our entire balance. If we lose, we still bet $1 and stand so the card states are correct. We have 50 rounds to go from $100 to $100000000 so we just need to double roughly 20 times.
Once we have enough money, we have to just finish out the remaining rounds so just enter a bunch of 1s. Here's how it looks like.
Web
vikeMerch (48 solves)
Description:
Welcome to vikeMERCH, your one stop shop for Viking-themed merchandise! We're still working on our website, but don't let that stop you from browsing our high-quality items. We just know you'll love the Viking sweater vest.
Solution:
The goal is to log in as admin, but we don't have a login and the password is securely generated looking at the source code. Since the input fields are safe from any kind of SQL injection and there are no cookies to play around with, the only option remaining is to try to grab the database directly.
We know the filename of the database is db.sqlite3 from seed.sh and main.go, and we know it will be one up from the assets folder that images are served from, so attempting a directory traversal attack, we are actually able to download the db.
I was a bit lazy and just cat the database to get the username and password. After logging in, we get the flag.
Ponies (274 solves)
Description:
OH NO, where did all these ponies come from??? Quick, get the flag and sail away before we are overrun!
Solution:
On the page's source code, we see a reference to gag.js. Looking at that file, we see the flag.
Jarls Weakened Trust (40 solves)
Description:
Jarl's been bragging about becoming an admin on the new axe sharing network. Can you?
Solution:
All we see is a login page, and no matter what we enter as username and password, we just get the following page.
The only thing to go off of is an AUTHORIZATION cookie, that decodes in jwt.io to the following.
We can change admin to true but the website doesn't like the signature. Sometimes changing the algorithm to "None" and leaving off the signature works but jwt.io doesn't let us do that. Learning how JWTs work and trying it manually, it works and we get the flag.
Last updated
Was this helpful?