[SOLVED] CS2107 Assignment 2

Introduction

This assignment takes the form of an information security capture-the-flag (CTF) style competition. In a CTF, participants solve problems involving security weaknesses to bypass defences to obtain a sensitive piece of information called the  “flag” .

In this assignment, participants are exposed to some of the common skills required to play in these competitions. When using the Assignment Platform, do not change your username. For password reset, it may take up to 5 working days.

Acknowledgements

This assignment is a collective work of present and past teaching assistants, including Ashok

(AY23/24), Arnav (AY23/24), Quang Vinh (AY23/24), Devesh Logendran (AY22/23, AY23/24),

Akash (AY23/24, AY22/23), Sean Tay (AY22/23), Kel Zin (AY22/23, AY21/22), Weiu Cheng

(AY22/23, AY21/22), Wen Junhua (AY22/23, AY20/21), Shawn Chew (AY 21/22), Chan Jian Hao

(AY21/22), Ye Guoquan (AY21/22), Debbie Tan (AY20/21), Jaryl Loh (AY20/21, AY21/22), Daniel

Lim (AY20/21), Chenglong (AY19/20), Shi Rong (AY17/18, AY19/20), Glenice Tan (AY19/20,

AY18/19), Ngo Wei Lin (AY19/20, AY18/19), Lee Yu Choy (AY20/21, AY19/20, AY18/19, AY17/18), Nikolas Tay (AY 16/17) and Jeremy Heng (AY 16/17).

Grading Scheme and Due Date

This is an individual assignment. You are allowed to post questions on the Canvas

Discussions forum but ensure that the questions do not ask for the solution. Additionally, do not post the answers to the challenges.

Assignment 2 is divided into the following sections:

1. Easy (20 points each): Answer all challenges (80 points total).
2. Medium (25 points each): Of the 4 challenges, solve at least 2 (50 points total). One challenge from the web and one challenge from the pwn category must be solved to get full marks.
3. Hard (20 points each): Of the 2 challenges, solve at least 1 (20 points total).
4. Bonus (20 bonus points each): Answer the challenges to get bonus marks (40 points total)

The maximum number of points that can be obtained in this assignment is 150 (worth 15% of the total score for the entire course). Solving the other bonus challenges can help you earn additional bonus points. Note that any bonus points earned in this assignment can be used, if needed, to top up your CTF assignment. There are no partial marks. Solving challenges more than the intended maximum for medium/hard will not give you additional marks.

To illustrate how the point calculation is done, you can consider the following 2 examples. Suppose Bob correctly answers all easy challenges, 4 medium challenges, and 0 hard challenges. Bob obtains 80+50+0=130 (NOT 80+100+0). Alice, meanwhile, correctly answers all easy challenges, 2 medium challenges, and 1 bonus challenge. Alice obtains

80+50+0+20=150. Her 20 bonus points can be used to directly top up her A2 points. If there are bonuses from A1 that make their score higher than 100, they will be carried over to A2.

The assignment is due 23 Nov 2023 (23:59).

Penalties

Late submission of challenges

Score penalties will apply for late submissions:

Late up to 12 hours beyond due date: 10% penalty to total score obtained

Later than 12 hours but up to 36 hours beyond due date: 20% penalty to total score obtained

Later than 36 hours but up to 72 hours beyond due date: 30% penalty to total score obtained

72 hours beyond the due date: Submissions will not be entertained after 26 Nov

2023 (23:59)

Other Penalties

Full marks for this assignment is 150.

1. Submission of past flags (per flag): -10 pts
2. Late submission of Writeup (see more about its submission below): -10 pts
3. No source code (if necessary for completeness): -10 pts
4. Unclear Writeup:

Interview to explain solve

Unable to explain = -30% (of the relevant challenge)

5. Blank Writeups: -40% (of the relevant challenge)

Will also be asked for interview

Unclear writeup deduction will also apply (total -70% of relevant challenge)

Note that submitting a late flag beyond the due date will make your whole submission be considered as a late submission, and the mentioned score penalty scheme applies to your total score obtained.

Contact

Please direct any inquiries about the assignment to

1. [email protected] (mailto:[email protected]) (Arnav Aggarwal)
2. [email protected] (mailto:[email protected]) (Ashok Balaji)
3. [email protected] (mailto:[email protected]) (Devesh Logendran)
4. [email protected] (mailto:[email protected]) (Nguyen Quang Vinh)
5. [email protected] (mailto:[email protected]) (Chandrasekaran Akash)

Note that the TAs will not be debugging your code, but will only be around to discuss high level ideas. Do allow 3 working days for replies. Discussion on forums are highly encouraged.

Rules and Guidelines

PLEASE READ THE FOLLOWING BEFORE BEGINNING

1. You are required to log in to CTFd (https://cs2107-ctfd-i.comp.nus.edu.sg/) (accessible only within NUS SoC Network) to submit flags.
2. You are required to upload the required files separately to the “Assignment 2” folder on Canvas before the given deadline.

A write up documenting the approach you took in solving every problem. This must be in PDF format with the following filename format: StudentID_Name_WU.pdf (e.g. A01234567_Alice Tan_WU.pdf)

All source codes and scripts that you used while solving the problem, if any. Submit each script as a separate file named after the challenge it applies to.

 Note that grades are not directly determined by this writeup. However, your writeup should sufficiently share the approach that you took in solving every problem. Screenshots may be helpful in showing your steps too. If there is suspicion of plagiarism, your writeup may be analysed and you may need to be interviewed by the teaching team to explain your steps. This writeup also serve as proof of your work in case submission server malfunctions.

3. Do not attack any infrastructure not explicitly authorised in this document.
4. Multiple flag submission is permitted on the scoring platform without any penalty, but no bruteforcing of flag submission on the server will be tolerated.
5. Work individually. Discussion of concepts on the forum is allowed but refrain from posting solutions. The university takes plagiarism very seriously. Any sharing of answers detected will be reported and disciplinary actions will be taken.
6. Students may be randomly selected to satisfactorily explain how they obtain their flags;or else a zero mark will be given on their unexplainable challenges.
7. The skills taught in this assignment are not to be used on any system you do not own or have express permission to test. This is a criminal offence under the Singapore Computer Misuse and Cybersecurity Act.
8. All challenges have a solution. They are guaranteed to be solvable with assistance of the internet and some research.
9. Ask the TAs for assistance only after you have exhausted every other avenue of self-help.
10. Every challenge will contain a flag and will provide the accepted flag format. Please ensure your submissions meet the flag format stated exactly. This means include the CS2107{}  portion unless otherwise stated.
11. The challenges are tested from the NUS WiFi within the School of Computing and outside of NUS. Connectivity cannot be guaranteed anywhere else. SoC VPN

(https://webvpn.comp.nus.edu.sg/) is required if you are outside of school network.

One of the most important skills in the information security field is the skill of seeking an answer independently. It is expected that the participant be able to utilise resources discovered through Google or any other search engine to achieve the tasks.

While the challenges might not be covered in entirety in class, the topics in the assignment are very applicable to security problems in real life. In the long run, the practical skills gained would benefit participants immensely.

Academic Honesty

NUS students are expected to maintain and uphold the highest standards of integrity and honesty at all times. As this is an individual assignment, please refrain from any forms of academic dishonesty.

If any form of plagiarism or cheating is found, you will be penalized and be subject to disciplinary action by the University. You may read more about NUS Student Code of

Conduct here (http://nus.edu.sg/osa/docs/default-source/osa-doc/resources-and-policies/code-of-studentconduct.pdf?sfvrsn=14040e3d_4).

Linux Environment

A Linux system is crucial for solving some of the challenges, the challenges in this section will prepare you for the more advanced sections by presenting some elementary tasks to solve. It is expected that the participant has rudimentary proficiency in using a Linux system that can be gleaned by reading the tutorial at this link: https://www.digitalocean.com/community/tutorials/an-introduction-to-the-linux-terminal

(https://www.digitalocean.com/community/tutorials/an-introduction-to-the-linux-terminal).

However, more knowledge might be needed, and it is expected that the participant do some self-exploration.

The nc Command

Throughout the assignments, if you see challenge with  nc aaa.bbb.ccc.ddd xxxx , then it means that the challenge is hosted on the  aaa.bbb.ccc.ddd  server on  xxxx  port.

You can connect to the server by using the  nc  command (https://www.tecmint.com/netcat-nccommand-examples/) in your terminal. In short, you can just copy & paste  nc aaa.bbb.ccc.ddd xxxx  and run it directly.

Python3 Cheatsheet

Some challenges in the assignment might require some scripting to solve. Although you can use any programming languages you prefer, we recommend Python3.

To dynamically with interact with TCP server, you can use pwntools

(https://docs.pwntools.com/en/stable/)

Note that all the received message are in bytes. So you might to some conversion if necessary.

You can also change to debug mode with

r = remote(“123.123.123.123”, 15000, level=’debug’)

Here’s a link to a cheatsheet:

https://gist.github.com/DavidTan0527/43edbf49fc550100a5a88d23627480ff

(https://gist.github.com/DavidTan0527/43edbf49fc550100a5a88d23627480ff)

GDB Cheatsheet

To aid in solving System Security (also known as binary exploitation / pwn) challenges, we’ve also prepared a GDB (GNU DeBugger) cheatsheet here: https://gist.github.com/Enigmatrix/89b09b4c97d541df3dd9e0d8ace9ed1a

(https://gist.github.com/Enigmatrix/89b09b4c97d541df3dd9e0d8ace9ed1a)

The purpose of GDB is to monitor the state of the program (directly view memory and register values, pause at certain conditions etc) so that you can see whether the input you have send is correctly influencing the execution of the program.

Easy Challenges (80 marks total)

Answer all challenges.

E.1 SUUUI’D – Forensics

Can you find out admin’s secret?  nc cs2107-ctfd-i.comp.nus.edu.sg 5049

Connecting to the service using the command above will put you in a shell, even if you dont see a prompt like ‘$’ or ‘~’.

Hint

Ronaldo’s favorite permission on a certain binary…?

Try to find methods to enumerate the system for SUID binaries?

Author: Ashok ([email protected] (mailto:[email protected]))

E.2 Catch The Shark

Who would have thought that sharks could be computer hackers? They’ve infiltrated our FTP server, but fortunately, we have set up some monitoring. Could you assist us in examining the Wireshark capture file to determine what data those sea creatures have stolen from us? Author: Vinh ([email protected] (mailto:[email protected]))

E.3 Granny’s Secret Batch

Welcome to Granny’s Digital Cookie Store! While Granny believes in the traditional method of baking, she’s tried to embrace the digital age in her own quirky way. Some say there’s a special recipe hidden in the store. Can you find it?

http://cs2107-ctfd-i.comp.nus.edu.sg:5051 (http://cs2107-ctfd-i.comp.nus.edu.sg:5051) Hint:

Here’s something that might be useful: CyberChef (https://gchq.github.io/CyberChef/) Author: Arnav ([email protected] (mailto:[email protected]))

E.4 Secure Login

Can you log into our super-secure login portal? You will receive a reward upon a successful login.

http://cs2107-ctfd-i.comp.nus.edu.sg:8083 (http://cs2107-ctfd-i.comp.nus.edu.sg:8083)

Hint:

What’s so intersting in the source code?

Author: Vinh ([email protected] (mailto:[email protected]))

Medium Challenges (50 marks total)

Answer at least 2 challenges. At least one web challenge and one pwn challenge must be solved to get full marks.

M.1 Unioned secrets – Web

Where is the flag? Getting into the dashboard is not enough… http://cs2107-ctfd-i.comp.nus.edu:5052 (http://cs2107-ctfd-i.comp.nus.edu:5052)

Hint:

There can be mulitple tables in a database you know…

Author: Ashok ([email protected] (mailto:[email protected]))

M.2 Overflowton – Pwn

Can you trick the system into giving you a flag?  nc cs2107-ctfd-i.comp.nus.edu.sg 5053

Hint:

What is the data type of the variable being checked?

Author: Ashok ([email protected] (mailto:[email protected]))

M.3 owoflow – Pwn

Cute cats giving buffer overflows!  nc cs2107-ctfd-i.comp.nus.edu.sg 5054

Hint:

If you got the buffer overflow correct, then note that the binary is not Position

Independent Executable (PIE), and thus addresses of functions are always the same. Author: Akash ([email protected] (mailto:[email protected]))

M.4 Message Me – Web

Opening my email inbox was giving me anxiety so I coded my own web-based contact form instead. Anyone can send me messages that I can read in my browser but only I can read the messages since I have the authentication cookie. I will read every message you send me promise!

Note: The flag is in the authenticatation cookie stored in the admin’s browser. To simulate user interaction, every message is automatically read by the admin’s browser once it is submitted.

http://cs2107-ctfd-i.comp.nus.edu.sg:3000 (http://cs2107-ctfd-i.comp.nus.edu.sg:3000)

Hint:

Someone told me someone could steal my authentication cookie with something called

Cross Site Scripting (https://infinitelogins.com/2020/10/13/using-cross-site-scripting-xss-to-steal-cookies/).

But I looked it up and I couldn’t understand a word, I think he is just scaring me…

Author: Devesh ([email protected] (mailto:[email protected]))

Hard Challenges (20 marks total)

Answer at least 1 challenge.

H.1 udp_viewer – Pwn

I made a nice interactive viewer for UDP Packets that calculates the checksum, but is there some bug inside?  nc cs2107-ctfd-i.comp.nus.edu.sg 5056

Hint:

There is an integer overflow which then enables a buffer overflow Use GDB to debug!

Author: Akash ([email protected] (mailto:[email protected]))

H.2 Three Blind Mice – Web

In the dim corners of the digital realm, legend speaks of the “Three Blind Mice,” a notorious hacker trio that could see without ‘seeing’. Now, a challenge bearing their signature emerges, holding a guarded secret. Many have tried, only to be rebuffed by their mocking defenses. But whispers in the shadows hint at a way to unveil the truth. Do you have the wit to walk in the footsteps of these enigmatic hackers and uncover the hidden flag?

http://cs2107-ctfd-i.comp.nus.edu.sg:5052 (http://cs2107-ctfd-i.comp.nus.edu.sg:5050)

Hint:

For those who seek guidance in the art of seeing without ‘seeing’: Blind SQL Injection

(https://owasp.org/www-community/attacks/Blind_SQL_Injection).

Author: Arnav ([email protected] (mailto:[email protected]))

Bonus Challenges (Bonus Marks)

Answer each challenge to get bonus marks.

B.1 hft (20 marks) – Pwn

I was asked to do a take-home assignment for an internship opportunity at Sane J’treet, I hope my code impresses them!  nc cs2107-ctfd-i.comp.nus.edu.sg 5055

Author: Akash ([email protected] (mailto:[email protected]))

B.2 LFI (20 marks) – Web

What’s wrong with this PHP code and can you use it to get the flag out of flag.php?

http://cs2107-ctfd-i.comp.nus.edu.sg:8080 (http://cs2107-ctfd-i.comp.nus.edu.sg:8080)

Author: Devesh ([email protected] (mailto:[email protected]))