MEEPWN CTF 2018 - White Snow, Black Shadow
問題文
Finally we caught the image in criminal communication. But Holmes, why are they crying?
添付ファイル：evidence_3D71E1CC6B2599438A7C0173239A896E.zip
writeup
Stage1
binwalkで調査。
root@kali:MEEPWNCTF2018# binwalk evidence.jpg DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 0 0x0 JPEG image data, JFIF standard 1.01 30 0x1E TIFF image data, big-endian, offset of first image directory: 8 217428 0x35154 End of Zip archive
Stirlingで観察してみると、Zipのヘッダーのシグネチャに含まれているPK文字がjpgファイル内に複数出現している。また、message.pdfというファイル名も発見。
PK文字で探すと、0x00021F5Aから先がZipファイルのように見える。
切り出して別ファイルとして保存する。
しかし、binwalkでもforemostでも機械抽出できていないことから、おそらくヘッダー情報が破損している。
以下のサイトを参考に、Zipのヘッダー情報を分析する。
Local file header
| field | value(HEX) | memo |
|---|---|---|
| local file header signature | 50 4B 05 06 | ★50 4B 03 04が正 |
| version needed to extract | 14 00 | |
| general purpose bit flag | 00 00 | |
| compression method | 09 00 | deflate64を指す |
| last mod file time | 5B 68 | |
| last mod file date | E4 4C | |
| crc-32 | 2E DB F5 54 | |
| compressed size | 74 31 01 00 | |
| uncompressed size | B4 4C 01 00 | |
| file name length | 0B 00 | |
| extra field length | 00 00 | |
| file name | 6D 65 73 73 61 67 65 2E 70 64 66 | message.pdf |
Central directory header
| field | value(HEX) | memo |
|---|---|---|
| central file header signature | 50 4B 01 02 | |
| version made by | 1F 00 | |
| version needed to extract | 14 00 | |
| general purpose bit flag | 00 00 | |
| compression method | 08 00 | |
| last mod file time | 5B 68 | |
| last mod file date | E4 4C | |
| crc-32 | 2E DB F5 54 | |
| compressed size | 74 31 01 00 | |
| uncompressed size | B4 4C 01 00 | |
| file name length | 0B 00 | |
| extra field length | 24 00 | |
| file comment length | 00 00 | |
| disk number start | 00 00 | |
| internal file attributes | 00 00 | |
| external file attributes | 20 00 00 00 | |
| relative offset of local header | 00 00 00 00 | |
| file name | 6D 65 73 73 61 67 65 2E 70 64 66 | message.pdf |
| extra field | 0A 00 20 00 00 00 00 00 01 00 18 00 AA 23 E6 A5 5C 13 D4 01 8E B9 7B 08 37 14 D4 01 4F 7C 0C 08 37 14 D4 01 |
End of central directory record
| field | value(HEX) | memo |
|---|---|---|
| end of central dir signature | 50 4B 05 06 | |
| number of this disk | 00 00 | |
| number of the disk with the start of the central directory | 00 00 | |
| total number of entries in the central directory on this disk | 01 00 | |
| total number of entries in the central directory | 01 00 | |
| size of the central directory | 5D 00 00 00 | |
| offset of start of central directory with respect to the starting disk number | 9D 31 01 00 | |
| .ZIP file comment length | 00 00 |
Local file headerのlocal file header signatureを50 4B 03 04に修復する。
しかし、7zipで開けるようになったが、解凍できない。
以前、別のCTFで知ったzipfixを試してみる。
GitHub - TheZ3ro/zipfix: Fix zip files with broken central directory
root@kali:MEEPWNCTF2018# python zipfix.py evidence_cutout.zip
Reading evidence_cutout.zip Central Directory
Found 1 file(s) from Central Directory:
- message.pdf
Reading evidence_cutout.zip ZIP entry manually
Found message.pdf
Traceback (most recent call last):
File "zipfix.py", line 137, in <module>
main(sys.argv[1])
File "zipfix.py", line 117, in main
zef = zipfile.ZipExtFile(f, 'rb', zi)
File "/usr/lib/python2.7/zipfile.py", line 530, in __init__
raise NotImplementedError("compression type %d (%s)" % (self._compress_type, descr))
NotImplementedError: compression type 9 (deflate64)
エラー発生。
pythonのzipfileライブラリはdeflate64をサポートしていないとのこと。
少し悩むが、Kaliに入っていた7zを試してみる。
root@kali:MEEPWNCTF2018# 7z e evidence_cutout.zip
7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=ja_JP.UTF-8,Utf16=on,HugeFiles=on,64 bits,2 CPUs Intel(R) Core(TM) i7-2600K CPU @ 3.40GHz (206A7),ASM,AES-NI)
Scanning the drive for archives:
1 file, 78352 bytes (77 KiB)
Extracting archive: evidence_cutout.zip
ERRORS:
Headers Error
--
Path = evidence_cutout.zip
Type = zip
ERRORS:
Headers Error
Physical Size = 78352
ERROR: CRC Failed : message.pdf
Sub items Errors: 1
Archives with Errors: 1
Open Errors: 1
Sub items Errors: 1
root@kali:MEEPWNCTF2018# ll message.pdf
-rwxrwxrwx 1 root root 85172 7月 4 13:02 message.pdf
解凍できた。Windowsの7-zipではできなかったのに・・・。
Stage2
解凍したmessage.pdfをAcrobat Readerで開けない。
これもまた修復が必要なようだ。
修復ツールに心当たりがなかったので、「pdf fix online」のキーワードで検索。
正直怪しいが、オンラインの修復サービスを使用する。
(オフラインの信頼できる修復ツールもあるのだろう。他のwriteupに期待する。)
修復後のPDFをAcrobat Readerで開くが、パッと見、フラグ文字列が見つからない。
しかし、全選択してテキストに貼り付けて和訳してみようとしたところ、Mee、Pwn、CTF、{、}など、PDFに表示されていないフラグ文字列の断片を発見。仕掛けを調べきれていないが、PDFに非表示文字列の仕組みがあるのだろうか。
文章を読みながらフラグ文字列の断片を拾っていく。
“When you have eliminated the impossible, whatever remains, however improbable, must be the truth.” – Sir Arthur Conan Doyle What does that mean? To me, this is all about logic. If you start with everything you can think of, and then eliminate those that are impossible, you are well on your way to a solution. That’s the first stage of solving any mystery, whether it’s a murder mystery in a book (or TV, or movie, or…) or somethingMeeyou expected to work, but didn’t. You have to eliminate all the things that it couldn’t possibly be, or you will have too many distractions. Once we clear out all the distractions, we can focus on what remains. Sometimes what is left is easy to believe, other times it can seem highly improbable. However, with the impossible eliminated, whatPwnremains are the only possible solutions. And oneCTFof them must be the truth. Why is clearing out the impossible solutions important? Sometimes, it can be hard to solve a{T3challenging situation even under the best of circumstances. A problem with lotsxt_of shiny things to look at can be distracting, and waste a great deal of our time. While some impossibilities might be obvious, sometimesUndwe can be sucked in by an idea that3r_intrigues us, despite being impossible. Other times, it is only in close examination that the impossibility is revealed. However, once we clear the clutter by removing all that is impossible, we are left with an easier solution. Gone are the impossibilities, botht3Xobvious and subtle. What is left can be gone over more quickly, and evaluated for probability or even likelihood. This may be an iterative process, starting with the really obvious impossibilities, and then moving to the shiny distractions. Finally, as wet!!!!}work our way through the last of the options, we may still find ourselves weeding out additional impossibilities.
繋げると以下の文字列になる。
MeePwnCTF{T3xt_Und3r_t3Xt!!!!}
フラグゲット。
