[Music]
right we'll go ahead and get started I
think we'll see if people roll in here
um so just out of curiosity how many
actually played the uh the CTF yesterday
or tried to
play um couple hands so it didn't quite
go like we expected I I know there's a
ton of different ctfs that people are
kind of bouncing back and forth between
uh the plan was we're going to have the
top 16 people compete in the
head-to-head competition today uh but we
only had 12 people that partially played
and of of those people um only five
completed the the challenges um that
they needed to play for the competition
so instead what I did is I asked
everybody that competed in the top uh
five to do demos if they were around
today um so every hour we'll be doing a
demo of one of the challenges from
yesterday um so if you haven't solved it
but want to know how it's solved uh you
can come in and actually watch people do
a full walk through and in on on their
approach and then we're going to leave
the challenges up all day as well so
that uh as you watch them do it you can
come back through and then try to walk
through it yourself that way you can get
hands on practice trying to hack the
thing that they just showed you how to
hack um so it a little bit different
plan than before but hopefully it'll
still be fun um we also have the open
mic event that's going to be running on
the half hour um so far we haven't had
anybody sign up so if you've got an idea
of something you want to share whether
it just be some fun project that you've
been working on or or some random hack
or you know standup routine whatever uh
feel free to throw your name in the bag
on the table out back we've got a a bag
that says open mic on it um we've got a
spot to write your name so throw that in
there and um if you want to do your
Twitter handle or something like that
we'll DM you before the the slot but
just kind of check back on the half hour
we'll draw from that and then let people
talk um if we've got anybody if not
we'll just keep the room kind of as a
hangout area for the rest of the day um
so with this are with that this will be
fairly quick um but I'm going to run
through the first challenge which I'm
I'm kind of mad at myself for creating
actually after the fact um did anybody
here complete so the the most solved
challenge was not another Bas 64
challenge uh did anybody here solve that
one nice all right how did you guys
solve
it what's
that base 58 yeah what tool did you use
just out of
curiosity yes I I love cyber Sha
how many people have actually used
cyberchef before like half the room
maybe third of the room um cool all
right so I don't want to I'll run
through what cyberchef is and explain
how this challenge works so the the key
here and this is why it was kind of mean
is uh not another B 64 challenge is
right in the title The Hope there was
that this was a hint that it's not
actually base 64 um and of course this
was probably a little bit misleading no
CTF would be complete without a Bas 64
challenge but essentially what you get
is a string of characters so um the
reason that we have things like Bas 64
en coding is a lot of times you need to
send binary data over a mechanism that
doesn't support uh raw hex codes and so
what you can use is a encoding form like
B 64 which takes all of that data and
then essentially turns it into a series
of asy characters but there's more than
just base 64 encoding there's actually a
whole lot of different encodings that
you'll find in various systems um since
this is one one area I know this is a
security conference so everybody
probably knows that but this is not
encryption like you hear occasionally
people talk about like basic 64
encryption this is in no way shape or
form protected there's no key involved
in it uh it's just an encoding scheme
there is some um maybe some obscurity in
the way that it's encoded but it's
certainly not uh something that will
protect it um is that big enough for
everybody to see I know cool um so this
is uh a tool called cyers Chef it's put
out by the gchq it's online um and it's
freely available you can also download
it if you want to do it offline so if
you're doing various ctfs this is a
really good option to just download it
and and then open it up from the file
directly um it's all done in in
JavaScript locally in the system so if
you watch the network tab it's not
actually sending a bunch of your private
data out to the gchq it's all just being
handled directly in your browser um so
that's nice uh but essentially the way
that it works is you have a series of
operations that you can run on the left
side here you have a input area where
you can put in the thing that you want
to work on and then it'll show you the
output um so for example with the CTF uh
let me make sure I've got the right copy
here so I'll copy the the text from The
Challenge and I'll paste it into
cyberchef
um
maybe there we go I'm a left- handy and
I'm using the left hand to hold the mic
so we'll see how this goes uh so now you
can see on the that the input is exactly
the same as the output that's because
there's nothing actually in the recipe
side um so now what we can do is start
looking for different ways to convert
that that text
um so if you look at the uh different
categories you can see that there's a
whole different uh group of things that
you can do so for example if we wanted
to take this I'm going to actually just
show some test code uh as an example we
can take that and then turn that into a
hex dump so if you're familiar with the
hex codes now we can see that test 1 two
3 and hex is 74 65 73 so that's useful
if you have a bunch of raw data you can
also drag and drop a file directly into
the input form as well so a lot of
people don't know that but um if you've
got like a zip file or some type of
binary file you can just drop it in here
and then get the hex output um so
sometimes this is a lot faster than
trying to like use hex dumps on a
console um if you see that there is a
pause and a uh then kind of a no symbol
if you turn the no symbol on it'll it'll
grade out the box and then deactivate
that so if you're working on your recipe
um you can see that it will it'll allow
you to disable part of it um so we can
do there's two hex dumps this is another
one that's really really useful
especially for like exploit development
um is to hex so if you've got some some
bite code or something like that that
you want to convert into a hex string
for you know some some overflow or
payload you can do that uh and you've
got all sorts of different options as to
how you can actually format that string
uh directly we can even say like we're
just going to do eight bytes per
line um and it should update it
uh there we go um so that's that's
really really useful when you if you
want to remove something from the recipe
you can just drag and drop it off um so
I'm I'm just going to show briefly some
of the different things you can do and
then we'll solve the challenge um so
there are all the different encodings
you can see that there is you move in
and out of binary octal so base eight um
you can see that there's a lot more than
just base 64 so 32 45 58 62 um so there
are all of you know HTML so a lot of
times when you're sending traffic over
the web you have to encode the URL uh so
if you have a encoded URL or you need to
encode a URL uh say you're trying to do
something like type of cross site
scripting attack or whatever else or Sor
not cross scripting that could work SQL
injection this URL and code can be
really helpful to get your payload set
up um so you've got data format there's
uh actually encryption so if you have
AES you can give it a key uh let's give
it a utf8 string and you can see that
it'll
actually uh so I think I'm not sure how
big that string needs to be might have
to work on getting the right values so
you have a good IV and a good key but it
can actually encrypt values and decrypt
them as well using all sorts of
different everything from ases to De
triple Dez to Blowfish rc4 uh as well as
a lot of CTF type of um encodings you
get things like exclusive or or the
visioner Morris code pops up in a lot of
ctfs so like this is the Morris code for
CTF so if you're ever in a CTF and you
get something like this as a challenge
you can just go uh straight from moris
code and get get the results back
um so really really handy in terms of
the different things that you can
encode the um a couple of the other ones
that are really really useful so like
things like networking you can actually
send certain requests and have it pull
the output directly into cyberchef um so
if you've got something that's really
repetitive uh some endpoint that you
want to hit over and over you can use
something like that um it's got a the
ability to pull IP addresses out of a
giant list of things so that's really
helpful um again datetime converters uh
some of the extractors are great if
you've got Json or some other format
that you want to pull data out of in a
consistent way so instead of having to
like find the right string copy and
paste it you can just use an extractor
to get that out they also have RX so if
you're familiar with redx you can find
exactly what you want to pull it out um
so that's kind of an overview of of
cyers Chef I'm going to go back to
actually solving the challenge here
which is what everybody's here to see um
so there's a couple ways you can go
about this in cyberchef um so first what
we can do is start playing with some of
the different encodings um
and so if I go back to our encryption en
coding and go to actually so the search
is really great here because when you're
converting out of a encoding it starts
with a keyword from so we can say from
and we can just start dragging and
dropping all of these over
here
um under the assumption that it's it's
one of these probably and then what I
can do is I can just start deactivating
all of them and activating them one at a
time so we can see it's not that it's
not
45
58 oh that looks like something right
there so we can see some text we can see
the flag text let's let's remember that
it's base 58 there but let's keep moving
on to see if there's anything else that
comes out um we do 85 as well just to
show that we've gone through all the
major en codian so uh the only one that
had anything that looked anything like
text was base
58 so I'm going to clear out the rest
you can also just do them one one at a
time however whatever workflow you want
want um
oops all right so now we have our base
58 um but it it looks weird here right
uh anybody know what's going on with
this particular
encoding so you guys solve the problem
you got some in the back
yep yes so who knows what utf16 is just
out of curiosity we got a couple hands
now so um so when computers are trying
to take text uh and manage the storage
of text at the end of the day you hear
it's all just ones and zeros um so if we
go to uh the representation of this um
we'll just do a actually let's do Hex
dump and I'll show you because we got
the tools right
here so if we look at it in a Hexum I'm
GNA have to make it a little bit smaller
so it's not too hard to see you can see
that there is uh two different
characters that represent each single uh
ASI character so when you hear about ASI
it's one bite one of these uh numbers
from um 0 to 255 or if you're in HEX
from 0 to FF um represents a symbol um
but there are a lot of other different
languages that use more than just the
symbols that we're used to using and so
they've come up with different encoding
schemes that uh allow you to have uh a
lot of the acrylic characters and others
um the beauty of the solution that they
ended up choosing is that utf16 uses the
asy character for the first character in
the uh bite array and then the second
one is a modifier so you can then have
so 46001 would be an entirely different
character but 46 the asky character of
46 is for f so when you decode it you
can see the uh the asky translation it's
just a little bit messed up so that's
one way to get it but the uh there is a
tool within cyberchef um called uh so
it's decode I'm going to put my mic down
for a
sec
and so you can see that there are all
sorts of different encoding so again
essentially what this is is just
different ways that a computer can store
text as ones and zeros uh and there are
a ton of them um and so in this case uh
the one that we used for this challenge
was UTF 16 uh little ining which if
you're on a Windows system this is what
it uses to encode text by default um so
if you're running in Powershell and
you're trying to decode something as B
64 or encode it as 64 it'll actually
come out as
utf16 uh the the Le stands for uh little
Indian so you can choose to put the
least significant bit first or last when
you're storing something so you can have
it forward or backwards depending on you
know whatever convention you want to use
and so that specifies it um so there we
have the final flag for that challenge
so I encourage you all to go into cyers
chef and actually try to repeat that
yourselves I'm going to show you one
other way that you can solve it which is
super helpful uh for certain challenges
so cyers Chef has a thing called Magic
and it is a little bit like magic um if
you throw this in here it's going to go
through all sorts of different possible
permutations and you can go through a
certain depth as well which means it's
going to try a recipe of at least like
up to three common encodings in sequence
and then try and uh find out what the
results are now here it's normally it's
going to Auto bake recipe is really
memory intensive so it makes sure that
you're wanting to like be ready to go so
you actually have to click the bake
which will start that off
um and so it found uh actually it did
give me the first St so it said that uh
it it has some matching operations here
it says the most likely is base 58 uh
could be base 64 and potentially valid
UTF so I just dropped that there right
away um and if you know some of the
values that might be there so flag is a
good one you don't know if the f is
upper case or lower case in a lot of the
challenges so I'll just usually do like
um
LG
um and why is it not finding it
now this totally worked right before I
did the demo let me make sure I copied
and pasted it right
again there we go it needed an intensive
mode so intensive mode will actually
dump out all of the results that it
thinks based off of the the likelihood
of it being the right one and here right
away you can see that this this recipe
is going to give you these values if you
start with base 58 and then it's going
to try a whole bunch of different
encoding so you can see you you get
pretty close right there and then when
we get to this one right here it
actually shows you the right flag with
the right encoding and so we can click
on that it'll load it and then you get
the answer right there so if you don't
have any idea of what encoding it might
be you might be used this this magic
feature within uh cyberchef is super
useful so um with that hopefully that's
a good introduction to a tool that you
can use for all sorts of stuff in
security or otherwise um any questions
on on cyberchef or on that first
challenge before uh we finish up
here no questions oh nope just somebody
scratching CH all right um so we will uh
I guess check back around here at maybe
the 30 minute Mark and we'll see if
anybody's submitted a talk for uh the
open mic um if not there's a lot of
other really great talks going on in
some of the other tracks um so feel free
to keep an eye on those we'll be back
for a demo of of the um let's see I
forget which one is next but we've got
the demo
for hold
on I tweeted it out under our uh under
our hungry hungry hackers CH uh um
Twitter account although it's a new
account and they're much better at
Banning Bots now so I don't think
anybody's actually seen these unless
Mike retweets them but we've got um
we've got the door company challenge
coming up next which is a web attack
um so um show back up at one if you want
to see how we walk through that one so
otherwise thank you all for coming in
hanging out for a while see you all
around