Handbook for CTFers

Description

“Handbook for CTFers: Zero to One” was written by the Nu1L team, one of China’s top CTF teams. As for Jeopardy-style CTFs, the content in the first 10 chapters of this book not only covers traditional categories of tasks like WEB, PWN and Crypto, but also includes some of the latest hot topics and techniques, such as blockchain. Case studies are provided for all of these types. Onsite Attack-Defend-style CTFs and penetration testing are introduced in Chapter 11 and Chapter 12. In order to help readers gain the most from the book, we have developed the N1Book platform, which addresses practical questions for different task categories. The book offers beginners a reliable, systematic tutorial on CTF competition. At the same time, it includes real case studies and a wealth of our competition experience, making it a valuable asset for experienced CTF players. Preface Structure of the Book Description About the Nu1L Team Acknowledgments Contents Chapter 1: Introduction to the Web 1.1 Significant ``Information Gathering´´ 1.1.1 The Importance of Information Gathering 1.1.2 Classification of Information Collection 1.1.2.1 Sensitive Directory Leakage 1.1.2.2 Sensitive Backup Files 1.1.2.3 Banner Identification 1.2 SQL Injection in CTF 1.2.1 SQL Injection Basics 1.2.1.1 Numeric SQL Injection and UNION SQL Injection 1.2.1.2 Character SQL Injection and Boolean Blinds SQL Injection 1.2.1.3 Error-Type SQL Injection 1.2.2 Injection Points 1.2.2.1 SELECT Injection 1.2.2.2 INSERT Statement Injection 1.2.2.3 UPDATE Injection 1.2.2.4 DELETE Injection 1.2.3 Injection and Defense 1.2.3.1 Character Substitution 1.2.3.2 Escape Quotes 1.2.4 Impacts of Injection 1.2.5 SQL Injection Summary 1.3 Arbitrary File Read Vulnerability 1.3.1 Common Trigger Points for File Read Vulnerabilities 1.3.1.1 Web Application Languages 1.3.1.2 Middleware/Server Related 1.3.1.3 Client Related 1.3.2 Common Read Paths for File Read Vulnerabilities 1.3.2.1 Linux 1.3.2.2 Windows 1.3.3 File Read Vulnerability Example 1.3.3.1 Soldiers Are Tricky (HCTF 2016) 1.3.3.2 PWNHUB-Classroom 1.3.3.3 Show Me the Shell I(TCTF/0CTF 2018 Final) 1.3.3.4 BabyIntranet I (SCTF 2018) 1.3.3.5 SimpleVN (BCTF 2018) 1.3.3.6 Translate (Google CTF 2018) 1.3.3.7 Watching Animated Get the Flag (PWNHUB) 1.3.3.8 The Year 2013 (PWNHUB) 1.3.3.9 Comment (NetDing Cup 2018 Online) 1.3.3.10 The Ark Project (CISCN 2017) 1.3.3.11 PrintMD (RealWorldCTF 2018 Online) 1.3.3.12 The Careless Jia Jia (PWNHUB) 1.3.3.13 Educational institutions 1.3.3.14 Magic Tunnel (RealworldCTF 2018) 1.3.3.15 Can You Find Me? (WHUCTF 2019) 1.4 Summary Chapter 2: Advanced Web 2.1 SSRF Vulnerabilities 2.1.1 SSRF Principle Analysis 2.1.2 SSRF Vulnerability Finding and Testing 2.1.3 SSRF Vulnerability Attack Mode 2.1.3.1 Internal Service Asset Detection 2.1.3.2 Extending the Attack Surface Using the Gopher Protocol 2.1.3.3 Automating Gopher Assembly 2.1.4 SSRF Bypassing 2.1.4.1 IP Restrictions 2.1.4.2 302 Redirection 2.1.4.3 URL Resolution Issues 2.1.4.4 DNS Rebinding 2.1.5 SSRF in the CTF 2.2 Command Execution Vulnerabilities 2.2.1 Principles of Command Execution and Test Methods 2.2.1.1 Principle of Command Execution 2.2.1.2 Command Execution Basics 2.2.1.3 Basic Tests of Command Execution 2.2.2 Command Execution Bypasses and Tricks 2.2.2.1 Missing Spaces 2.2.2.2 Blacklist Keywords 2.2.2.3 Execution Without Echoes 2.2.3 Real-life Command Execution Challenges and Answers 2.2.3.1 2015 HITCON BabyFirst 2.2.3.2 2017 HITCON BabyFirst Revenge 2.2.3.3 2017 HITCON BabyFirst Revenge v2 2.3 The Magic of XSS 2.3.1 XSS Types 2.3.2 XSS Tricks 2.3.3 XSS Filtering and Bypass 2.3.4 XSS Bypass Case 2.4 File Upload Vulnerability 2.4.1 Basic File Upload Vulnerability 2.4.2 Truncate to Bypass Upload Restrictions 2.4.2.1 ``00´´ Truncation 2.4.2.2 The Truncation of Character Set Conversion 2.4.3 File Suffix Blacklist Verification Bypass 2.4.3.1 Upload File Rename 2.4.3.2 Upload File Is Not Renamed 2.4.4 File Suffix Whitelist Verification Bypass 2.4.4.1 Web Server Parsing Vulnerability 2.4.4.2 APACHE Parsing Vulnerability 2.4.5 File Access Forbidden Bypass 2.4.5.1 .htaccess Prohibit Script File Execution Bypass 2.4.5.2 Upload Files to OSS 2.4.5.3 Use File Include Bypass 2.4.5.4 Some Web Configurations That Can Be Bypassed 2.4.6 Bypass Image Check to Achieve Code Execution 2.4.7 Exploit with Upload the Generated Temporary File 2.4.8 Use File_put_contents to Upload Files 2.4.9 Upload Problems Caused by ZIP File Upload Chapter 3: Advanced Web Challenges 3.1 Deserialization Vulnerabilities 3.1.1 PHP Deserialization 3.1.1.1 Common Deserialization 3.1.1.2 Native Class Utilization 3.1.1.3 Phar Deserialization 3.1.1.4 Tips and Tricks 3.1.2 Case Studies 3.2 Security Issues in Python 3.2.1 Sandbox Escape 3.2.1.1 Keyword Filtering 3.2.1.2 The Import 3.2.1.3 Using Inheritance, etc. to Find Objects 3.2.1.4 Code Execution of Eval 3.2.2 Format Strings 3.2.2.1 Native % Strings 3.2.2.2 Format Method Related 3.2.2.3 The f-string in Python 3.6 3.2.3 Python Template Injection 3.2.4 URllib and SSRF 3.2.4.1 CVE-2016-5699 3.2.4.2 CVE-2019-9740 3.2.5 Deserialization in Python 3.2.6 Python XXE 3.2.7 sys.audit 3.2.8 CTF Python Cases 3.2.8.1 Royal Online Casino (SWPU 2018) 3.2.8.2 mmmmy (NetDing Cup 2018 Online Tournament) 3.3 Cryptography and Reverse Knowledge 3.3.1 Cryptography Knowledge 3.3.1.1 Block Encryption 3.3.1.2 Identification of Encryption Methods 3.3.1.3 The ECB Model 3.3.1.4 The CBC Model 3.3.1.5 Padding Oracle Attack 3.3.1.6 Hash Length Extension 3.3.1.7 Pseudorandom Numbers 3.3.1.8 Cryptography Summary 3.3.2 Reverse Engineering in the Web 3.3.2.1 Python 3.3.2.2 PHP 3.3.2.3 JavaScript 3.4 Logic Flaws 3.4.1 Common Logic Flaws 3.4.2 Logic Flaws in CTFs 3.4.3 Summary of Logical Flaws 3.5 Summary Chapter 4: APK 4.1 Fundamentals of Android Development 4.1.1 The Four Android Components 4.1.2 APK File Structure 4.1.3 DEX File Format 4.1.4 Android API 4.1.5 Android Sample Code 4.2 APK Reverse Tool 4.2.1 JEB 4.2.2 IDA 4.2.3 Xposed Hook 4.2.4 Frida Hook 4.3 APK Anti-debugging 4.4 APK Unpacking 4.4.1 Injecting Process and Dumping Memory 4.4.2 Modifying the Source 4.4.3 Class Overloading and DEX Reconstruction 4.5 APK in CTFs 4.5.1 OLLVM Obfuscated Native App Reverse (NJCTF 2017) 4.5.2 Anti-debugging and Anti-VM (XDCTF 2016) 4.6 Summary Chapter 5: Reverse Engineering 5.1 Basics of Reverse Engineering 5.1.1 Reverse Engineering Overview 5.1.2 Executable Files 5.1.3 Basic Knowledge of Assembly Language 5.1.4 Introduction to Common Tools 5.2 Static Analysis 5.2.1 Introduction to IDA Use 5.2.2 Getting Started with the HexRays Decompiler 5.2.3 Advanced Use of IDA and HexRays 5.3 Dynamic Debugging and Analysis 5.3.1 Rationale for Debugging 5.3.2 OllyDBG and x64DBG 5.3.3 GDB Debugging 5.3.4 IDA Debugger 5.4 Common Algorithm Identification 5.4.1 Identify via Special Constants 5.4.2 Identify via Featured Operations 5.4.3 Third-Party Library Identification 5.5 Binary Code Protection and Obfuscation 5.5.1 Anti Static Analysis 5.5.2 Encryption 5.5.3 Anti-debugging 5.5.4 Introduction to ollvm 5.6 High-level Programming Language Reverse 5.6.1 Rust and Go 5.6.2 C# and Python 5.6.3 C++ MFC 5.7 Modern Reverse Engineering Techniques 5.7.1 Symbolic Execution 5.7.1.1 Overview of Symbolic Execution 5.7.1.2 angr 5.7.1.3 Angr Summary 5.7.2 Binary Instrumentation 5.7.3 Pin 5.7.3.1 Environmental Configuration 5.7.3.2 Using Pintool 5.7.3.3 Pintool Basic Framework 5.7.3.4 CTF Practice: Recording the Number of Executed Instructions 5.7.3.5 CTF Practice: Recording Command Tracks 5.7.3.6 CTF Practice: Recording Instruction Execution Information and Modifying Memory 5.7.3.7 Pin Summary 5.8 Special Techniques in Reverse 5.8.1 Hook 5.8.2 Making Smart Use of Existing Program Code 5.8.3 Dump Memory 5.9 Summary Chapter 6: PWN 6.1 Basic Knowledge for PWN 6.1.1 What Is PWN? 6.1.2 How to Learn PWN 6.1.3 Linux Basic 6.1.3.1 Syscall and Function Call in Linux 6.1.3.2 ELF File Structure 6.1.3.3 Vulnerability Mitigation Measure for Linux 6.1.3.4 The Role of GOT and PLT 6.2 Integer Overflow 6.2.1 Operations with Integers 6.2.2 How to Use Integer Overflow 6.3 Stack Overflow 6.4 Return-Oriented Programming 6.5 Format String Vulnerabilities 6.5.1 Format String Vulnerability Fundamental 6.5.2 Basic Format String Vulnerability Exploits 6.5.3 When Format String Not on the Stack 6.5.4 Some Special Uses of Format String 6.5.5 Format String Summary 6.6 Heap 6.6.1 What Is Heap? 6.6.2 Simple Heap Overflow 6.6.3 Exploits Heap Memory Vulnerability 6.6.3.1 Build Glibc Debug Environment 6.6.3.2 Fast Bin Attack 6.6.3.3 Unsorted Bin List 6.6.3.4 Unlink Attack 6.6.3.5 Large Bin Attack (0CTF heapstormII) 6.6.3.6 Make Life Easier: tcache 6.6.3.7 Tcache for Glibc 2.29 6.7 Linux Kernel PWN 6.7.1 Running a Kernel 6.7.2 Network Configuration 6.7.3 File System 6.7.4 Initialization Scripts 6.7.5 Kernel Debugging 6.7.6 Analyzing the Program 6.7.7 Exploitation of Vulnerabilities 6.7.8 PWN Linux Summary 6.7.9 Linux Kernel PWN Babydriver Source Code 6.8 PWN for Windows 6.8.1 Permission Management for Windows 6.8.2 Calling Conventions for Windows 6.8.3 Vulnerability Mitigation Mechanisms for Windows 6.8.4 PWN Techniques for Windows 6.9 Windows Kernel PWN 6.9.1 About Windows OS 6.9.1.1 80386 and Protected Mode 6.9.1.2 Windows OS Addressing 6.9.1.3 Windows OS Architecture 6.9.1.4 Windows Kernel Debugging Environment 6.9.2 Windows Kernel Vulnerabilities 6.9.2.1 A Simple Introduction to Windows Driver Development 6.9.2.2 Writing a Stack Overflow Example 6.9.2.3 Writing Arbitrary Address Write Examples 6.9.2.4 Loading the Kernel Driver 6.9.2.5 Windows 7 Kernel Vulnerability Exploits 6.9.2.6 Kernel Mitigation and Reading and Writing Proto-Language 6.9.3 References 6.10 From CTF to Real-World PWNs 6.11 Summary Chapter 7: Crypto 7.1 Encoding 7.1.1 The Concept of Encoding 7.1.2 Base Encoding Family 7.1.3 Other Encodings 7.1.4 Encoding Summary 7.2 Classical Ciphers 7.2.1 Linear Mapping 7.2.2 Fixed Substitution 7.2.3 Shift Ciphers 7.2.4 Classical Cipher Summary 7.3 Block Ciphers 7.3.1 Common Modes of Operations 7.3.1.1 ECB 7.3.1.2 CBC 7.3.1.3 OFB 7.3.1.4 CFB 7.3.1.5 CTR 7.3.2 Feistel Cipher and DES 7.3.2.1 Feistel Cipher 7.3.2.2 DES 7.3.2.3 Examples 7.3.3 AES 7.3.3.1 Finite Field 7.3.3.2 Rijndael Key Schedule 7.3.3.3 AES Procedure 7.3.3.4 Common Attacks 7.4 Stream Cipher 7.4.1 Linear Congruential Generator (LCG) 7.4.1.1 Break LCGs with Known Sequences 7.4.1.2 Breaking Linux Glibc´s rand() function-1 7.4.2 Linear Feedback Shift Register (LFSR) 7.4.2.1 Break the LFSR with Known Sequences 7.4.2.2 Breaking Linux Glibc´s Rand() Function-2 7.4.3 RC4 7.5 Public Key Cryptography 7.5.1 Introduction to Public Key Cryptography 7.5.2 RSA 7.5.2.1 Introduction to RSA 7.5.2.2 Common Attacks on RSA 7.5.2.3 Summary of RSA 7.5.3 Discrete Logarithms 7.5.3.1 ElGamal and ECC 7.5.3.2 Calculation of Discrete Logarithms 7.6 Other Common Cryptography Applications 7.6.1 Diffie-Hellman Key Exchange 7.6.2 Hash Length Extension Attack 7.6.3 Shamir´s Threshold Scheme 7.7 Summary Chapter 8: Smart Contracts 8.1 Smart Contracts Overview 8.1.1 Introduction to Smart Contracts 8.1.2 Environment and Tools 8.2 Examples of Smart Contract Topics in Ethereum 8.2.1 ``AirDrop´´ 8.2.2 Using Remix 8.2.3 Deeper Understanding of the Ethereum Blockchain 8.3 Summary Chapter 9: Misc 9.1 Steganography 9.1.1 File Concentration 9.1.2 EXIF 9.1.3 LSB 9.1.4 Blind Watermarks 9.1.5 Steganography Summary 9.2 Compressed Archive Encryption 9.3 Summary 9.4 Forensic Techniques 9.4.1 Traffic Analysis 9.4.1.1 Wireshark and Tshark 9.4.1.2 Common Operations in Traffic Analysis 9.4.1.3 Analysis of Special Types of Traffic Packets 9.4.1.4 Summary of Traffic Packet Analysis 9.4.2 Memory Image Forensics 9.4.2.1 Introduction to Memory Image Forensics 9.4.2.2 Common Operations in Memory Image Forensics 9.4.2.3 Memory Image Forensics Summary 9.4.3 Disk Image Forensics 9.4.3.1 Introduction to Disk Image Forensics 9.4.3.2 Disk Image Forensics Common Operations 9.4.3.3 Disk Image Forensics Summary 9.5 Summary Chapter 10: Code Auditing 10.1 PHP Code Auditing 10.1.1 Environment Building 10.1.2 How to Audit 10.1.3 Examples 10.2 Java Code Auditing 10.2.1 Learning Experiences 10.2.2 Environment Configuration 10.2.3 Decompilation Tools 10.2.4 Introduction to Servlets 10.2.5 Introduction to Serializable 10.2.6 Deserialization Vulnerabilities 10.2.6.1 Vulnerability Overview 10.2.6.2 Vulnerability Exploitation 10.2.7 Expression Injection 10.2.7.1 Expression Injection Overview 10.2.7.2 Expression Injection Vulnerability Characteristics 10.2.7.3 Overview of Expression Structures 10.2.7.4 Summary Analysis of S2-045 10.2.7.5 Expression Injection Summary 10.2.8 Vulnerability Exploits of the Java Web 10.2.8.1 JNDI Injection 10.2.8.2 Deserialization Exploit Tool ysoserial/marshalsec 10.2.8.3 Summary of Java Web Vulnerability Exploits 10.3 Summary Chapter 11: AWD 11.1 Preparation for the Competition 11.2 AWD Tricks 11.2.1 How to React Quickly 11.2.2 How to Capture Flags Gracefully and Persistently 11.2.3 Leading or Trailing 11.3 Traffic Analysis 11.4 Patching Vulnerabilities 11.5 Summary Chapter 12: Virtual Target Penetration Test 12.1 Creating a Penetration Test Environment 12.1.1 Installing and Using Metasploit on Linux 12.1.2 Installing and Using Nmap on Linux 12.1.3 Installing and Using Proxychains on Linux 12.1.4 Installing and Using Hydra on Linux 12.1.5 Installation of PentestBox on Windows 12.1.6 Proxifier Installation on Windows 12.2 Port Forwarding and Proxies 12.2.1 Port Forwarding 12.2.2 Socks Proxy 12.3 Well-Known Vulnerability Exploits 12.3.1 ms08-067 12.3.2 ms14-068 12.3.3 ms17-010 12.4 Obtaining Authentication Credentials 12.4.1 Obtaining Plaintext Identity Credentials 12.4.1.1 LSA Secrets 12.4.1.2 LSASS Process 12.4.1.3 LSASS Protection Bypass 12.4.1.4 Credential Manager 12.4.1.5 Finding Credentials in a File with Lazange 12.4.2 Obtaining Hash Identity Credentials 12.4.2.1 Obtaining Local User Hash Credentials from SAM Database 12.4.2.2 Via Domain Controller´s NTDS.dit File 12.5 Lateral Movement 12.5.1 Hash Passing 12.5.2 Passing of Tickets 12.5.2.1 Kerberos Authentication 12.5.2.2 Golden Tickets 12.5.2.3 Silver Tickets 12.6 Penetration Test Challenges in Practice 12.6.1 DefCon China Shooting Range Questions 12.7 Summary