[Part 1] Binary Analysis Problems

▣ Problem 1: Self-Reference
1.
Problems and explanations
2.
Information gathering
___2.1 File Types
___2.2 Displayable characters contained in the file
___2.3 Run the file
3.
explanation
___3.1 Running radare2
___3.2 Identifying Cryptographic Functions
___3.3 fcn.080486eb analysis
___3.4 fcn.08048be1 analysis
4.
Get the flag
___4.1 Reproducing the decryption function
5.
organize

▣ Problem 2: Simultaneous
1.
problem
2.
commentary
___2.1 Check the operation
___2.2 Analysis through ltrace
___2.3 Analysis using gdb-peda
___2.4 Solving simultaneous equations
___2.5 Enter the solution to the simultaneous equations
3.
organize
Bonus: Solution using NumPy

[Part 2] Pwn Problem

▣ Issue 3: SECCON x Colosseum 2017 Server 2
1.
outline
___1.1 What is King of the Hill?
2.
Advance preparation
3.
Information provided
4.
commentary
___4.1 Investigating the problem server
___4.2 First flag
___4.3 Second flag
___4.4 Third Flag
___4.5 pico preliminary survey
___4.6 Exploit Creation
___4.7 Writing team keywords
___4.8 Preliminary Defense Point Survey
___4.9 Creating an Exploit
5.
organize

▣ Problem 4: cheer_msg
1.
problem
2.
Preliminary investigation
3.
Motion detection
4.
Binary Analysis
___4.1 main function
___4.2 message function
___4.3 getnline function
___4.4 getint function
5.
Finding vulnerabilities
___5.1 Vulnerability Check
6.
Program attack
___6.1 Policy
___6.2 Writing an Exploit
7.
Shell hijacking through actual attacks
8.
organize

▣ Problem 5: Checker
1.
problem
2.
Preliminary investigation
3.
Motion detection
4.
Binary Analysis
___4.1 main function
___4.2 getaline function
5.
Vulnerability discovered
___5.1 Vulnerability Check
6.
Program attack
___6.1 Policy
___6.2 Writing an Exploit
7.
organize

[Part 3] Network Issues

▣ Problem 6: File Transfer Protocol
1.
problem
2.
commentary
3.
Packet analysis
___3.1 Deciding which packets to investigate
___3.2 Packet Filtering
___3.3 Analyzing filtered packets
___3.4 Check file contents
4.
organize

▣ Problem 7: RE:Build
1.
problem
2.
Differences between two files
3.
Extract pcap files
4.
Analyzing pcap files
5.
RangeRequests
6.
flag.png Reunion
7.
organize

▣ Problem 8: What do you type?
1.
problem
2.
Open file
3. How to capture USB packets
4. USB packet header format
5. Interpreting USB Packet Headers
6.
Analyze the transmitted data
7.
Write a program and automate the interpretation of input characters.
8.
organize

[Part 4] Web Problems

▣ Problem 9: Login Me!
1.
problem
2.
Determining the direction of problem solving
___2.1 Preliminary Preparation
___2.2 ID/PW Guessing
___2.3 Hijacking logged-in sessions
___2.4 Testing for SQL injection
3. SQL injection attempt
___3.1 Understanding SQL statements
___3.2 Understanding the table structure
___3.3 Acquiring account information
___3.4 Login
4.
Understanding the intent of the problem
___4.1 MySQL Special Functions
___4.2 Guessing the location of PHP files
___4.3 Reread PHPINFO
___4.4 Reading PHP files
5.
organize

▣ Problem 10: Bonsai XSS Revolutions
1.
commentary
2.
Another way
3.
organize

▣ Problem 11: Amazing Language
1.
problem
2.
commentary
___2.1 Check the problem file
___2.2 Gathering information related to the problem
___2.3 Problem File Analysis
___2.4 Search the web for hints
Check ___2.5 problem.png
___2.6 Running in a web browser
___2.7 Check JavaScript code
___2.8 Decode unknown string to get FLAG
3.
organize

[Part 5] Other Issues

▣ Problem 12: Venus
1.
Security Camp National Competition 2016 CTF
___1.1 Rules and Format
2.
Problems and Solutions
3.
What is the problem with 'Venus'?
___3.1 Which ports are open?
___3.2 Detailed investigation of service contents
___3.3 SSH connection attempt
___3.4 Investigating Running Processes
4.
Problem #1 (Level 1)
5.
Problem #2 (Level 2)
6.
Problem #3 (Level 3)
7.
Problem #4 (Level 4)
8.
Automation with Python
___8.1 Problem #1 (Level 1)
___8.2 Problem #2 (Level 2)
___8.3 Problem #3 (Level 3)
___8.4 Problem #4 (Level 4)
9.
organize

▣ Problem 13: Binary, EncryptedPPTX
1.
problem
2.
Required knowledge
3.
Decide on solutions and policies
___3.1 How to think from the provided files
___3.2 What is a PPTX file?
___3.3 Check the relationship between public key encryption and office files
___3.4 Public Key Format
___3.5 Policy Decision
4. Obtaining a private key from an RSA public key
5.
Change your password with DocRecrypt
6.
Open with PowerPoint
7.
In conclusion

▣ [Appendix] README file

Sharpen your security skills by solving CTF problems!

We introduce the Capture The Flag (CTF) problem presented in the 'Security Contest', one of the means to develop security skills, and the process of solving it.
For those who want to participate in contests but don't know where to start, or for beginners who are interested but feel the barrier is too high, we've provided an easy-to-understand explanation.

As a sequel to the 『CTF Information Security Contest Challenge Book』, it is designed to allow you to experience and learn more in-depth and specialized content.
This book contains problems that utilize knowledge from each genre (binary analysis, Pwn, networks, and the web), with detailed solutions. It includes problems from SECCON Beginners, SECCON CTF, and other CTFs, as well as newly created problems that demonstrate key knowledge in the respective fields.

CTF is not a matter of seeing and memorizing.
When reading this book, it will be very helpful if you actually move your hands and think about how to solve the problems and what approach to take to find the right answer.
By the time you finish reading this book, you will feel like you have learned a lot of skills.
But there are many special problems in this world that are not covered in this book.
I hope that after reading this book, you will become more interested in the world of security contests and participate in various contests.