Issue #01 - THE FUTURE IS **
This issue has a total of nine challenges, however Challenge 8 requires the Kickstarter edition of the book, so it will not be covered here.
Cover Challenge
On the cover of the comic there is a string towards the bottom right side that is made up of unreadable symbols. Using the pigpen cipher, it can be decoded to: tficomic.io/bleeds
This link bring us to the challenge site where we are given a bonus key, and a link for accessing the Crack the ** challenge.
Typically, the Crack the ** challenges would be hinted at on the inside of page of the cover but for this issue they are somewhat combined.
Crack the **
Hey there. Are you trying to crack the cover password? What happens when you mix colors? Try doing it with the images below: [ three provided images ]
The three separate images show what looks like 6 analog letters but with each image only in blue, green, or red.
Using the tool Stegsolve, I first combined two of the images using the SUB operator and saved it. Then I was able to take that new image I created, and combine it with the third and last image using the SUB operator again.
This combined the analog letter’s colors in a way that it made out the word: PLASMA which was the cover password for the issue and completed the challenge.
Challenge 1
Wheeler has gained access to the pirates’ smart rifles via an interactive console. Help him take control of them! Connect to the console with nc challenges.tficomic.io 7005. (paste that command into your terminal or command prompt) A copy of the smart rifle’s program can be found here.
Running the given command in the challenge description output the following:
-$ nc challenges.tficomic.io 7005
=========== Welcome to the USHKUYNIK smart rifle system! ===========
What would you like to do?
1. Activate FRIEND-OR-FOE system
2. Enter administrator password
3. Exit
>
And the rifle program linked looked like:
#!/usr/bin/python
import time
def main():
flag = ''
with open('./flag.txt', 'r') as f:
flag = f.readline().strip()
print("=========== Welcome to the USHKUYNIK smart rifle system! ===========", end="", flush=True)
time.sleep(1)
admin = False
admin_pw_encrypted = '6d6e71775b7174727b7d6f6f536460506479774c677877656c4668727a717b40494f46565751545e'
while True:
print("\nWhat would you like to do?\n", flush=True)
print("1. Activate FRIEND-OR-FOE system")
print("2. Enter administrator password")
print("3. Exit")
user_in = input('> ')
if user_in == '1':
if admin:
print('\nFRIEND-OR-FOE system activated.', flush=True)
time.sleep(0.5)
print(f'\nCongratulations! Here is the flag: {flag}')
exit()
else:
print('\nERROR: Administrator privileges required.', flush=True)
time.sleep(1)
elif user_in == '2':
print('\nPlease enter the administrator password: ', end="", flush=True)
pw = input("")
admin_pw = ''.join(chr(ord(c) ^ i) for i, c in enumerate(bytes.fromhex(admin_pw_encrypted).decode("utf-8")))
if pw == admin_pw:
admin = True
print('\nAdministrator password verified. Privileges updated.', flush=True)
time.sleep(1)
else:
print('\nERROR: Incorrect administrator password', flush=True)
time.sleep(1)
elif user_in == '3':
exit()
else:
print('\nInvalid option. Please try again', flush=True)
time.sleep(1)
if __name__ == "__main__":
main()
In the code we can see the following line with the encoded string: admin_pw_encrypted = '6d6e71775b7174727b7d6f6f536460506479774c677877656c4668727a717b40494f46565751545e'
And not too much farther down from that we can see the line that decodes it: admin_pw = ''.join(chr(ord(c) ^ i) for i, c in enumerate(bytes.fromhex(admin_pw_encrypted).decode("utf-8")))
Copying these lines over into another script and running them separately from everything else, we get the decoded admin passcode: most_trusted_in_the_smart_rifle_industry
So finally going back to that nc command, we can enter it when prompted, and then activate the “FRIEND-OR-FOE system” to retrieve the challenge flag:
─$ nc challenges.tficomic.io 7005
=========== Welcome to the USHKUYNIK smart rifle system! ===========
What would you like to do?
1. Activate FRIEND-OR-FOE system
2. Enter administrator password
3. Exit
> 2
Please enter the administrator password: most_trusted_in_the_smart_rifle_industry
Administrator password verified. Privileges updated.
What would you like to do?
1. Activate FRIEND-OR-FOE system
2. Enter administrator password
3. Exit
> 1
FRIEND-OR-FOE system activated.
Congratulations! Here is the flag: KEY{4e3cae}
Challenge 2
To be updated …
Challenge 3
To be updated …
Challenge 4
We’ve intercepted the network communications between a security sensor near the mass driver and the central control system. See if it detected any suspicious activity … we might need to get rid of that evidence later. Download the pcap file here. Hint: pay special attention to the zone numbers in each transmission.
Once I opened the PCAP in Wireshark, I immediately noticed that the only protocol listed was TCP and all the packets looked extremely identical.
After poking around a little and searching for any packets containing “KEY”, I filtered the packets based on length to look at any packets that may have stood out.
There were eleven packets all with the length of 160 and included message I hadn’t seen before. Along with that, in the data pane (bottom right), each one seemed to have an extra letter included just after after the message.
The first four spelt out KEY, and the rest pieced together to reveal the hidden flag: KEY{f8e504}
Challenge 5
To be updated …
Challenge 6
To be updated …
Challenge 7
To be updated …