CTFs

Do you guys play CTFs? Is there a Lainchan CTF group? Are you stuck on a specific CTF challenge? Discuss CTFs in this thread(USER WAS WARNED FOR THIS POST, You should always elaborate on your opinions rather than just spilling the soykaf.)

recently started doing some. Mostly tryhackme and PicoCTF, so it's all still in pretty controlled learning environments, but its definitely fun.

I'm stuck on a CTF at the moment. There's a .zlib archive present in a .png file that contains the flag. When decompressed it appears to be only hex data and some unicode characters, but no hints as to how to proceed. I've tried filtering out the hex characters, filtering out the non-hex characters, trying to decode it in various encryption algorithms, checking the hexdump, etc. I cannot post the CTF here. Any advice on how to proceed?

I do some CTFs on hackthebox, picoCTF and also practice on exploit.education site

Spent most weekends in 2023 playing ctfs found via ctftime. I was even on a team for part of the year, but keeping a functioning ctf team together is hard, as most people tend to drop out. Oddly, I don't feel like I got much better throughout the year.

>>23256 Absolutely, CTFs can be great both socially and technically! The best thing is probably to join a team somewhere, for example by hanging out in some large CTF discord servers(that's sadly where they all are). Keep an eye on ctftime, and plan to play a weekend ctf that looks fun, or has a good rating/weight. What types of challenges do you like? Web, cryptography, blockchain, pwn, foresics? >>23264 Put the png into aperisolve, it will show you interesting noise in the pic, embedded files, exif/metadata, etc.

>>23271 Thank you for your advice. Unfortunately, it didn't tell me anything I hadn't already known. I tried using CyberChef to see if it would turn up anything different, but it hasn't worked either. My process has been as follows: - Get image - Run `binwalk` on image to find hidden files - Find image and single embedded .zlib archive - Extract .zlib archive - Try to decompress .zlib archive to view data within - Try using Python zlib library - Try using CyberChef zlib implementation - Try using official zlib compression/decompression program (https://www.zlib.net/zpipe.c) I've tried checking EXIF data, checking the image hexdump, changing the colors to reveal hidden clues, etc. I very much believe the flag lies within the archive. I believe it may be somehow converting the file to a .gz or .gzip archive since the formats are compatible with .zlib, but there doesn't seem to be a compatible header in the data. I've tr ied adding the relevant header, to no avail. I don't know how to proceed. Once again, any advice on how to proceed is appreciated. Attached is the .zlib archive (Change the extension from .zlib.txt to .zlib) in question.

>>23272 There is an IEND in your .zlib. So either you've got a .png with a wrong header or binwalk isn't giving you a clean file.

>>23274 Thank you for pointing that out. Checking with xxd and pngcheck, the .png has the proper headers. So it's an issue with extracting the .zlib archive. This is the result from running pngcheck on the file: ``` pngcheck -vv image.png File: image.png (49810 bytes) chunk IHDR at offset 0x0000c, length 13 1100 x 319 image, 32-bit RGB+alpha, non-interlaced chunk IDAT at offset 0x00025, length 49753 zlib: deflated, 32K window, default compression row filters (0 none, 1 sub, 2 up, 3 avg, 4 paeth): 1 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 4 4 4 4 4 4 1 4 1 4 4 4 4 2 2 4 2 2 2 2 2 2 2 2 4 4 4 1 4 1 1 1 1 1 4 4 4 4 4 4 1 1 2 2 2 2 2 4 2 2 2 4 4 1 4 2 2 2 4 1 2 2 2 2 2 2 2 2 4 2 2 2 2 4 4 4 2 2 2 4 4 4 2 2 2 4 4 2 2 2 2 2 2 2 2 2 2 1 4 2 2 2 2 4 1 4 2 2 2 2 2 2 2 4 4 4 2 2 2 2 2 2 2 2 2 2 2 2 2 2 4 4 4 4 4 2 2 4 4 2 2 2 2 2 2 2 4 4 2 2 2 4 4 4 2 2 2 2 4 4 4 2 2 2 4 2 2 2 2 2 2 2 2 2 2 4 4 2 2 2 2 2 4 4 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 1 2 2 2 2 2 2 2 2 2 2 2 2 4 4 2 1 4 4 4 1 1 1 1 1 1 1 4 4 4 4 4 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 (319 out of 319) chunk IEND at offset 0x0c28a, length 0 No errors detected in image.png (3 chunks, 96.5% compression). ``` I'm trying to use this command to extract the .zlib archive, but it only extracts the end portion. I'm not sure how to change it to extract from 0x00025 (the start of the .zlib) to 0x0c28a (the start of the IEND, and the end of the .zlib). `<image.png tail -c "$((0x00025 + 1))" | head -c "$((0x0c28a - 0x00025))" >result`

>>23272 Have you tried steghide? Also since png use zlib for compression it's perfectly normal that binwalk would find a zlib archive inside. Finally, your situation reminds me a lot of the steg rabbitholes I've fallen into lately, so if steghide doesn't return anything, your flag might be elsewhere

>>23280 >>23282 Steghide doesn't support .png files. It seems like a lot of the results returned by zsteg and the like are mainly false positives. For reference, I've tried the following: - aperisolve (Useful for running various tools and checks, found nothing of note) - binwalk (Found .zlib archive, did not extract it properly as noted by >>23274) - exiftool (No exif data that seemed of note) - file (Nothing of note) - foremost (No data found) - hexdump (Same result as xxd, albeit with less data) - pngcheck (Found .zlib archive position, see >>23280) - strings (Nothing of note) - xxd (Useful for verifying the .png file is a .png file. Also found headers for multiple .zlib files, though pngcheck only found one .zlib file) - zsteg (Lots of false positives, lots of strings of characters) > Also since png use zlib for compression it's perfectly normal that binwalk would find a zlib archive inside. I came across a similar sentiment on a StackOverflow post in which the OP had used binwalk. I agree that the flag may not be hidden in the .zlib archive, but I don't have very much else to go off of at the moment. > [Y]our situation reminds me a lot of the steg rabbitholes I've fallen into lately, so if steghide doesn't return anything, your flag might be elsewhere If you have any suggestions, I'd love to hear them. As far as I can tell I've covered every area as to where the data may be hidden. I'll post the original image if I hit a dead end.

>>23264 >>23272 >>23280 >>23282 >>23283 I've hit a dead end. If anyone manages to solve it I would very much appreciate a hint in the right direction. Methods I have tried are in the above linked posts.

Recently cleared the Individual part of NCL Spring 2024. I ended up near top 100. Pic related is my stats. Does anyone have some good CTF recommendations where I can work more on Enumeration & Exploitation and anything to do with packets / networking?