{"id":14601,"date":"2017-09-29T10:57:47","date_gmt":"2017-09-29T08:57:47","guid":{"rendered":"https:\/\/codisec.com\/?p=14601"},"modified":"2023-03-22T16:29:56","modified_gmt":"2023-03-22T15:29:56","slug":"asis-ctf-finals-2017-finds","status":"publish","type":"post","link":"https:\/\/codisec.com\/asis-ctf-finals-2017-finds\/","title":{"rendered":"ASIS CTF Finals 2017: If he finds out\u2026"},"content":{"rendered":"

CTF: ASIS CTF Finals 2017
\nPoints: 343
\nCategory: forensic<\/p>\n

Recon<\/h2>\n

In this task we were provided with a file called ifhe_Find_Out<\/a> [sic].
\nLet’s try to find some information about it:<\/p>\n

$ file ifhe_Find_Out \r\nifhe_Find_Out: data\r\n<\/pre>\n
Well, that’s not helpful at all. Time to look at the hex dump:<\/p>\n
$ xxd -l 0x100 ifhe_Find_Out\r\n00000000: 6674 7970 6d69 6631 0000 0000 6173 6973  ftypmif1....asis\r\n00000010: 6374 6666 696e 616c 0000 021c 6d65 7461  ctffinal....meta\r\n00000020: 0000 0000 0000 0021 6864 6c72 0000 0000  .......!hdlr....\r\n00000030: 0000 0000 7069 6374 0000 0000 0000 0000  ....pict........\r\n00000040: 0000 0000 0000 0000 0e70 6974 6d00 0000  .........pitm...\r\n00000050: 004e 2200 0000 3469 6c6f 6300 0000 0044  .N\"...4iloc....D\r\n00000060: 4000 024e 2200 0000 0002 4000 0100 0000  @..N\".....@.....\r\n00000070: 0000 0062 484e 2300 0000 0064 9000 0100  ...bHN#....d....\r\n00000080: 0000 0000 0012 aa00 0000 4e69 696e 6602  ..........Niinf.\r\n00000090: 0000 0000 0000 0200 0000 1f69 6e66 6502  ...........infe.\r\n000000a0: 0000 004e 2200 0068 7663 3148 4556 4320  ...N\"..hvc1HEVC \r\n000000b0: 496d 6167 6500 0000 001f 696e 6665 0200  Image.....infe..\r\n000000c0: 0000 4e23 0000 6876 6331 4845 5643 2049  ..N#..hvc1HEVC I\r\n000000d0: 6d61 6765 0000 0000 1a69 7265 6600 0000  mage.....iref...\r\n000000e0: 0000 0000 0e74 686d 624e 2300 014e 2200  .....thmbN#..N\".\r\n000000f0: 0001 4569 7072 7000 0001 2369 7063 6f00  ..Eiprp...#ipco.\r\n<\/pre>\n
Apart from asisctffinal<\/code>, what clearly stands out is: hvc1HEVC Image<\/code>. Googling HEVC Image<\/code> points us at a new image file format: HEIF<\/a>. Moreover, ifhe<\/code> in the challenge name is an anagram of HEIF. This gives us some idea about kind of file we’re dealing with. Still, we’re unable to open it. To resolve this issue we need to find a valid HEIF file to compare with ours and look for differences between them. We’ve chosen this<\/a> example.<\/p>\n
$ xxd -l 0x100 autumn_1440x960.heic\r\n00000000: 0000 001c 6674 7970 6d69 6631 0000 0000  ....ftypmif1....\r\n00000010: 6d69 6631 6865 6963 6865 7663 0000 0200  mif1heichevc....\r\n00000020: 6d65 7461 0000 0000 0000 0021 6864 6c72  meta.......!hdlr\r\n00000030: 0000 0000 0000 0000 7069 6374 0000 0000  ........pict....\r\n00000040: 0000 0000 0000 0000 0000 0000 0e70 6974  .............pit\r\n00000050: 6d00 0000 004e 2200 0000 3469 6c6f 6300  m....N\"...4iloc.\r\n00000060: 0000 0044 4000 024e 2200 0000 0002 2400  ...D@..N\".....$.\r\n00000070: 0100 0000 0000 046a 804e 2300 0000 046c  .......j.N#....l\r\n00000080: ac00 0100 0000 0000 000e 4a00 0000 4e69  ..........J...Ni\r\n00000090: 696e 6602 0000 0000 0000 0200 0000 1f69  inf............i\r\n000000a0: 6e66 6502 0000 004e 2200 0068 7663 3148  nfe....N\"..hvc1H\r\n000000b0: 4556 4320 496d 6167 6500 0000 001f 696e  EVC Image.....in\r\n000000c0: 6665 0200 0000 4e23 0000 6876 6331 4845  fe....N#..hvc1HE\r\n000000d0: 5643 2049 6d61 6765 0000 0000 1a69 7265  VC Image.....ire\r\n000000e0: 6600 0000 0000 0000 0e74 686d 624e 2300  f........thmbN#.\r\n000000f0: 014e 2200 0001 2969 7072 7000 0001 0769  .N\"...)iprp....i\r\n<\/pre>\n
It seems that we’re missing 4 bytes at the beginning of the file in addition to mif1heichevc<\/code> being replaced with asisctffinal<\/code>.<\/p>\n
fix<\/h2>\n
Prepend magic bytes:<\/p>\n
$ dd if=autumn_1440x960.heic bs=1 count=4 | cat - ifhe_Find_Out > ifhe_fixed\r\n<\/pre>\n
Replace asisctffinal<\/code> with mif1heichevc<\/code>:<\/p>\n
$ dd conv=notrunc if=autumn_1440x960.heic of=ifhe_fixed bs=1 count=12 skip=16 seek=16<\/pre>\n
Fixed file:<\/p>\n
$ xxd -l 0x80 ifhe_fixed\r\n00000000: 0000 001c 6674 7970 6d69 6631 0000 0000  ....ftypmif1....\r\n00000010: 6d69 6631 6865 6963 6865 7663 0000 021c  mif1heichevc....\r\n00000020: 6d65 7461 0000 0000 0000 0021 6864 6c72  meta.......!hdlr\r\n00000030: 0000 0000 0000 0000 7069 6374 0000 0000  ........pict....\r\n00000040: 0000 0000 0000 0000 0000 0000 0e70 6974  .............pit\r\n00000050: 6d00 0000 004e 2200 0000 3469 6c6f 6300  m....N\"...4iloc.\r\n00000060: 0000 0044 4000 024e 2200 0000 0002 4000  ...D@..N\".....@.\r\n00000070: 0100 0000 0000 0062 484e 2300 0000 0064  .......bHN#....d\r\n00000080: 9000 0100 0000 0000 0012 aa00 0000 4e69  ..............Ni\r\n00000090: 696e 6602 0000 0000 0000 0200 0000 1f69  inf............i\r\n000000a0: 6e66 6502 0000 004e 2200 0068 7663 3148  nfe....N\"..hvc1H\r\n000000b0: 4556 4320 496d 6167 6500 0000 001f 696e  EVC Image.....in\r\n000000c0: 6665 0200 0000 4e23 0000 6876 6331 4845  fe....N#..hvc1HE\r\n000000d0: 5643 2049 6d61 6765 0000 0000 1a69 7265  VC Image.....ire\r\n000000e0: 6600 0000 0000 0000 0e74 686d 624e 2300  f........thmbN#.\r\n000000f0: 014e 2200 0001 4569 7072 7000 0001 2369  .N\"...Eiprp...#i\r\n<\/pre>\n
opening the file<\/h2>\n
The last thing to do is to open the image. Unfortunately, it’s not as easy as it sounds. HEIF is a new format with little to no support from image viewers. However, reference implementation in JavaScript (including example<\/a> HEIF files) from Nokia is available, so we can use their website by replacing some HEIF file from examples with our own and then use browser to display the flag.<\/p>\n
$ git clone \"https:\/\/github.com\/nokiatech\/heif.git\" --branch gh-pages\r\n$ mv ifhe_fixed heif\/content\/images\/autumn_1440x960.heic\r\n<\/pre>\n
Finally, we can open heif\/examples.html<\/code> and click on autumn example to reveal the flag.
\nNote: Use Firefox since Chrome considers different file:\/\/<\/code> URIs as separate origins.
\n\"\"<\/p>\n","protected":false},"excerpt":{"rendered":"
CTF: ASIS CTF Finals 2017 Points: 343 Category: forensic Recon In this task we were provided with a file called ifhe_Find_Out [sic]. Let’s try to find some information about it: $ file ifhe_Find_Out ifhe_Find_Out: data Well, that’s not helpful at…<\/span> <\/p>\n
Read more ›<\/div>\n
<\/a><\/p>\n","protected":false},"author":17,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[43,25],"tags":[4,31],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\n\t\n