Defcon 23 Quals Writeupとかをまとめる予定地

2015年5月15日(JST)より開始されたDefcon CTF 23の予選(オンラインCTF)のWriteUpとかをまとめます。

予選結果

• DEF CON CTF 2015 Qualifiers are Complete
• https://legitbs.net/2015/quals_scoreboard.json

有志によるTOP20の推移グラフ

• Defcon 23 CTF quals - Top 20 Graph

参加チーム数

少なくとも2800人近く、840以上のチームが登録していた模様。

pic.twitter.com/bODZi14VRf

— Legit BS (@LegitBS_CTF) 2015, 5月 15

Writeup (1) Baby's First

babycmd 1point

babycmd_3ad28b10e8ab283d7df81795075f600b.quals.shallweplayaga.me:15491
[Download](http://downloads.notmalware.ru/babycmd_3ad28b10e8ab283d7df81795075f600b)

• DEFCON CTF 23 babycmd by BATA_24
• r0pbaby & babycmd writeups Defcon prequal
• Defcon 23 CTF Quals 2015 – Babycmd writeup | sysexit
• LegitBs 2015 DefCon quals BabyCmd by @mrexcessive WHA & James Nock WHA
• pwn.rb
• LockBoxx: DefCon CTF 2015 Quals WriteUp: BabyCmd and MathWhiz
• DefConCTF 2015 Quals - Babycmd Writeup - GeeksSpeak Team Blog
• DefCon 2015 Quals Babycmd - VulnHub CTF Team - Capture the Flag Events: Write Ups and Shenanigans
• babycmd by Bono-iPad
• DEF CON 2015 Quals - babycmd (1pt) writeup :: mrt-prodz
• DEFCON CTF 23予選 Write-up (解説付き(すこし)) - 犬アイコンのみっきー
• https://github.com/rentjongteam/write-ups-2015/tree/master/def-con-quals-2015/babycmd

babyecho 1point

babyecho_eb11fdf6e40236b1a37b7974c53b6c3d.quals.shallweplayaga.me:3232

[Download](http://downloads.notmalware.ru/babyecho_eb11fdf6e40236b1a37b7974c53b6c3d)

• DEFCON CTF 23 babyecho by BATA_24
• Hello, Stranger :D :: exploit DEFCON CTF Qualifier 2015, babyecho Writeups
• DefConCTF 2015 Quals - Babyecho Writeup - GeeksSpeak Team Blog
• DefCon 2015 Quals Babyecho - VulnHub CTF Team - Capture the Flag Events: Write Ups and Shenanigans
• babyecho by Bono-iPad
• DEFCON CTF 23予選 Write-up (解説付き(すこし)) - 犬アイコンのみっきー
• https://github.com/rentjongteam/write-ups-2015/tree/master/def-con-quals-2015/babyecho
• https://github.com/ctfs/write-ups-2015/tree/master/defcon-qualifier-ctf-2015/babys-first/babyecho

mathwhiz 1point

mathwhiz_c951d46fed68687ad93a84e702800b7a.quals.shallweplayaga.me:21249

• DEFCON CTF 23 mathwhiz by BATA_24
• Defcon Quals 2015 - matwiz (writeup) by rick 2600
• LockBoxx: DefCon CTF 2015 Quals WriteUp: BabyCmd and MathWhiz
• DefConCTF 2015 Quals - Mathwize Writeup - GeeksSpeak Team Blog
• DefCon 2015 Quals Mathwhiz - VulnHub CTF Team - Capture the Flag Events: Write Ups and Shenanigans
• mathwiz by Bono-iPad
• DEF CON 2015 Quals - mathwhiz (1pt) writeup :: mrt-prodz
• https://github.com/rentjongteam/write-ups-2015/tree/master/def-con-quals-2015/mathwiz

r0pbaby 1point

r0pbaby_542ee6516410709a1421141501f03760.quals.shallweplayaga.me:10436
[Download](http://downloads.notmalware.ru/r0pbaby_542ee6516410709a1421141501f03760)

• DEFCON CTF 23 r0pbaby by BATA_24
• r0pbaby & babycmd writeups Defcon prequal
• defcon 2015 r0pbaby Writeup by MarshMallow_sh
• http://box.haxx.in/~blasty/e9b52923e5b8dfefdc917bb88a92843ac4dbe4a7/r0pbaby_xpl.py
• DEF CON CTF Quals 2015: r0pbaby by smokeleeteveryday
• DefConCTF 2015 Quals - ROPBaby Writeup - GeeksSpeak Team Blog
• r0pbaby by Bono-iPad

Writeup (2) Coding Challenge

catwestern 1point

meow

catwestern_631d7907670909fc4df2defc13f2057c.quals.shallweplayaga.me 9999

• DEFCON CTF 23 catwestern by BATA_24
• DEFCON 2015 by emyei
• Defcon Quals 2015 - catwestern (writeup) by rick2600
• DEF CON CTF Quals 2015: catwestern by smokeleeteveryday
• DEFCON CTF ［catwestern］ by CYBERGURU
• fritz's lair: Writeup: Coding @ DEFCON CTF Quals 2015
• Hello, Stranger :D :: coding DEFCON CTF Qualifier 2015, catwestern Writeups
• Capture the Swag: Defcon CTF 2015 - Cat western - 1 Point Coding Challenge
• DefConCTF 2015 Quals - Catwestern Writeup - GeeksSpeak Team Blog
• catwestern by Bono-iPad
• DEFCON CTF 23 Quals – catwestern Writeup | みむらの手記手帳
• DEFCON CTF 23予選 Write-up (解説付き(すこし)) - 犬アイコンのみっきー
• https://github.com/rentjongteam/write-ups-2015/tree/master/def-con-quals-2015/catwestern
• software security blog: Defcon 2015 coding skillz 1 writeup

Writeup (3) Pwnable

cybergrandsandbox 2point

[You'll need these](http://repo.cybergrandchallenge.com/boxes/)

https://github.com/CyberGrandChallenge/cgc-release-documentation/blob/master/walk-throughs/running-the-vm.md

[Pwn This](http://downloads.notmalware.ru/cybergrandsandbox_e722a7ec2ad46b9fb8472db37cb95713)

[This launches it](http://downloads.notmalware.ru/cybergrandsandbox_launcher_cf878d2811220c8793ae9b132d7fd490)

cybergrandsandbox_e722a7ec2ad46b9fb8472db37cb95713.quals.shallweplayaga.me:4347

• cybergrandsandbox writeup Defcon prequal
• defconctf2015_cybergrandsandbox.py by jgor
• ［Write up］ DEFCON CTF 2015 – wwtv , cybergrandsandbox | BabyPhD CTF Team
• DEF CON CTF Qual 2015 CyberGrandSandbox by shinh
• https://github.com/rentjongteam/write-ups-2015/tree/master/def-con-quals-2015/cybergrandsandbox

wibbly wobbly timey wimey 2point

Wibbly Wobbly Timey Wimey

Don't blink!

wwtw_c3722e23150e1d5abbc1c248d99d718d.quals.shallweplayaga.me:2606
[Download](http://downloads.notmalware.ru/wwtw_c3722e23150e1d5abbc1c248d99d718d)

• DEFCON CTF 23 wwtw by BATA_24
• ［Write up］ DEFCON CTF 2015 – wwtv , cybergrandsandbox | BabyPhD CTF Team

fuckup 3point

fuckup_56f604b0ea918206dcb332339a819344.quals.shallweplayaga.me:2000

OR
fuckup_56f604b0ea918206dcb332339a819344.quals.shallweplayaga.me:46387

[Download](http://downloads.notmalware.ru/fuckup_56f604b0ea918206dcb332339a819344)

• http://lokalhost.pl/ctf/defcon2015/fuck.py
• http://hastebin.com/iyinepaxen.py
• https://github.com/kitctf/writeups/blob/master/defcon-quals-2015/fuckup/pwn.py
• DEF CON CTF 2015 - fuckup (pwn3) Writeup | binja

twentyfiveseventy 3point

twentyfiveseventy_2809b4d140123e359485305658a2ab40.quals.shallweplayaga.me:1161

[Download](http://downloads.notmalware.ru/twentyfiveseventy_2809b4d140123e359485305658a2ab40)

heapsoffun 4point

If you have been knockedup then you know what to do. Perhaps try "tirer"

sha1sum heapsoffun
5ee5b2cde811e617cd789c73c1d8d2d9e8b27c36

Yes we know the flag is owned by root.

• DEFCON CTF 23 heapsoffun by BATA_24
• http://lokalhost.pl/ctf/defcon2015/heap.py
• HEAPSOFFUN: DEFCON QUALS CTF PWN 4

tensixtyseven 4point

tensixtyseven_ed879d24fd6365cf38b6c96b5e077d75.quals.shallweplayaga.me:1161

[Download](http://downloads.notmalware.ru/tensixtyseven_ed879d24fd6365cf38b6c96b5e077d75)

• DEFCON CTF 23 tensixtyseven by BATA_24

thing2 4point

We have a special guest challenge from thing2.

AppJailLauncher.exe /key:key /port:8200 DconQuals.exe

thing2_e89e83e6cc343256f99fbfe6f434d788.quals.shallweplayaga.me

[Download](http://downloads.notmalware.ru/thing2_e89e83e6cc343256f99fbfe6f434d788)

hackercalc 5point

hackercalc_2e9c870a8449603f8d4b748d78993026.quals.shallweplayaga.me:21222
[Download](http://downloads.notmalware.ru/hackercalc_2e9c870a8449603f8d4b748d78993026)

int3rupted 5point

Connect to int3rupted_3bb8f10793b82841c44a366eb9f27223.quals.shallweplayaga.me, port 0xcccc

• http://lokalhost.pl/ctf/defcon2015/int3.py
• debugger.py by zachriggle

secrf 6point

secrf_cdd8445b254189eb39861162d086eb16.quals.shallweplayaga.me:27398
[Download](http://downloads.notmalware.ru/secrf_cdd8445b254189eb39861162d086eb16)

Writeup (4) Reverse Engineering

access control 1point

It's all about who you know and what you want.
access_control_server_f380fcad6e9b2cdb3c73c651824222dc.quals.shallweplayaga.me:17069

[Download Client](http://downloads.notmalware.ru/client_197010ce28dffd35bf00ffc56e3aeb9f)

• DEF CON CTF Quals 2015: accesscontrol by smokeleeteveryday
• DefConCTF 2015 Quals - Access Control Writeup - GeeksSpeak Team Blog
• DEF CON 2015 Quals - access control (1pt) writeup :: mrt-prodz
• DEF CON CTF Qual 2015 access control by shinh
• https://github.com/rentjongteam/write-ups-2015/tree/master/def-con-quals-2015/access-control

knockedupd 1point

You went and got it knockedup.

[Download](http://downloads.notmalware.ru/knockedupd_71a592a753bf9dcd7d7ad5fa69b2bab3)

knockedupd_71a592a753bf9dcd7d7ad5fa69b2bab3.quals.shallweplayaga.me

• KNOCKEDUPD: DEFCON QUALS CTF RE 1
• DEFCON CTF 23 Quals 参加 | あたがわの日記

pr0dk3y 2point

Crack me at
pr0dk3y_40687b492c80205cccb34db1eabf6456.quals.shallweplayaga.me:7938
[Download](http://downloads.notmalware.ru/pr0dk3y_40687b492c80205cccb34db1eabf6456)

• http://pastebin.com/E4gXkax3

klug 3point

klug_64eee7bb1da26c44fcb7a15d85a017c9.quals.shallweplayaga.me:52242
[Download](http://downloads.notmalware.ru/klug_64eee7bb1da26c44fcb7a15d85a017c9)

• gist:5e91727d83081831877e by Riatre

Scrambler 3point

Enhance!

hint: The time of image generation matches the start of the game which can also be viewed on the quals registration page.

[Download](http://downloads.notmalware.ru/scrambler_3ff9e5b9795ac8fc4117da6660ced01b.tar.gz)

shitcpu 3point

shitcpu_5f766bf9fb92aead0ae2de76ea57f21c.quals.shallweplayaga.me:19192
[Download](http://downloads.notmalware.ru/shitcpu_5f766bf9fb92aead0ae2de76ea57f21b)

• defcon_shitcpu_solution.py by mheistermann
• DEFCON CTF 23 Quals shitcpu Writeup by libmaru

Writeup (5) Web

Waiting for your Touch 2point

http://waiting-for-your-touch.quals.shallweplayaga.me

HTTP Basic:

username: come-on-and-slam

password: welcome-to-japan

Writeup (6) Miscellaneous

blackbox 2point

Open the box at blackbox_ced7f267475a0299446fa86c26d77161.quals.shallweplayaga.me:18324

• Legit BS DefCon Quals blackbox by @mrexcessive WHA & Rob Laverick WHA
• https://gist.github.com/anonymous/60eda1db5c7d8b852840

patcher 3point

Patch the binary from cybergrandsandbox, and submit it [here](http://patcher_2b00042f7481c7b056c4b410d28f33c1.quals.shallweplayaga.me/patcher/)

[Patch This](http://downloads.notmalware.ru/cybergrandsandbox_e722a7ec2ad46b9fb8472db37cb95713)

• DEFCON 2015 - misc/patcher
• https://github.com/rentjongteam/write-ups-2015/tree/master/def-con-quals-2015/patcher

過去のdefcon CTF Writeup

• 2014年 Defcon 22 Quals Writeupとかをまとめる予定地
• 2013年 Defcon 21 Quals Writeupとかをまとめる予定地
• 2012年 Defcon 20 Quals Writeupとかをまとめてみた。