12 ms·
Google CTF 2019
- 0xDEFC0DE 7y agoCan’t wait until Facebook team wins it
- saagarjha 7y agoFor those not in the loop, Google’s team won the Facebook CTF a couple of weeks ago and then used it as an opportunity to advertise Google CTF: https://www.fbctf.com/scoreboard https://www.fbctf.com/scoreboard
- stingraycharles 7y agoSeems like I am even more out of the loop; what type of CTF is this? It appears the original article dives right into teams and rules and write ups without explaining what it is all about, which just leaves me even more confused.
- delroth 7y agohttps://en.wikipedia.org/wiki/Capture_the_flag#Computer_security https://en.wikipedia.org/wiki/Capture_the_flag#Computer_secu... https://ctftime.org/ctf-wtf/ https://ctftime.org/ctf-wtf/
- nvrspyx 7y agoThere is a link in the "What is the Google CTF?" section that leads to the following: https://buildyourfuture.withgoogle.com/events/ctf/#!?detail-content-tabby_activeEl=about https://buildyourfuture.withgoogle.com/events/ctf/#!?detail-...
- kbumsik 7y ago> Eligibility: The Contest is open to individuals who are (1) over the age of eighteen (18) at the time of entry; (2) not a resident of Quebec, Cuba, Iran, Syria, North Korea, Sudan, or Crimea; [1] Why Quebec is banned? https://buildyourfuture.withgoogle.com/events/ctf/#!?detail-content-tabby_activeEl=about https://buildyourfuture.withgoogle.com/events/ctf/#!?detail-...
- buckminster 7y agoJust guessing: because it's not available in French.
- archgoon 7y agoStringent local laws with respect to competitions. https://www.thebalanceeveryday.com/why-are-so-many-competitions-void-in-quebec-896835 https://www.thebalanceeveryday.com/why-are-so-many-competiti...
- wcchandler 7y ago> Why is Quebec excluded from the CTF? Local laws and regulations make it extremely challenging for us to run a competition open to residents of Quebec. We are truly sorry about this, and hope to change this in the future if possible.
- Theodores 7y agoThis aspect could be the real hurdle: "Pay a fee of up to 10% of the sweepstakes' value, depending on who is allowed to enter." So they would need to pay Quebec $3K just to have the competition available there, even if it is a global competition. It sounds to me that Quebec have got to have some reason for these Quebec special laws. It has nothing to do with France, there has to be another reason. Does anyone have any ideas?
- dmix 7y ago> Q: I got an error: PERMISSION_DENIED: Permission denied. > A: Try picking a different team name, the team name you inserted is already taken. A: How to tell your software was built by security people.
- paulryanrogers 7y agoI would think it's more secure if it didn't leak which were taken. For example, "Name invalid or already taken, please try another"
- cavisne 7y agoWould not be surprised if this strange FAQ is part of the puzzle
- rdiddly 7y agoThe stated prize amount spells ELEET, so that might support your theory. Although it also supports the theory that there's no prize money whatsoever. I'm getting all introspective and seriously struggling trying to figure out why I have such a viscerally negative reaction to this. Like not just bafflement or indifference or boredom, I actively hate it. Can't really explain it. But it's apparent that I'm not their target demographic.
- saagarjha 7y ago> The stated prize amount spells ELEET, so that might support your theory. Although it also supports the theory that there's no prize money whatsoever. Prize amounts for CTFs are frequently variations of “leet”; I see nothing strange with this.
- ACow_Adonis 7y agoI notice they're continuing the proud silicon valley start-up tradition of building a website that doesn't actually tell you what Google CTF is :P Even when I click on the beginner's quest, I've got paths, flags, endings, challenges... ...but nothing to tell me what the hell the thing actually IS!
- saagarjha 7y agoIt’s in the link at the bottom of the “What is the Google CTF?” section.
- reaperducer 7y agoYou'd think that the "What is the Google CTF?" section would answer the question "What is the Google CFT?" rather than sending someone to another page. All Google would have to do is move the sentence "they consist of a set of computer security puzzles (or challenges) involving reverse-engineering, memory corruption, cryptography, web technologies, and more" from the secondary page into the paragraph that's supposed to answer the question. It would actually be shorter.
- ACow_Adonis 7y agoAh, I actually followed that link trying to find out. All i see on my browser is a bit of text with a big blue button that says "will you capture the flag?", which isn't really helpful, which takes me back to...the original website. Now on the one hand I'd say, ok, its not google's responsibility to try to have websites/non-standard browser configs set ups actually work with their web pages... On the other hand, I'm sure the kind of security people google is looking for all surf the web with standard browser configs and permissions enabled... And as the other commenter has pointed out, I know its radical of me, but I would have thought the "What is the google CTF" section should contain text which answers "What is the google CTF".
- saagarjha 7y agoScroll down
- wnevets 7y agoI'm lost on the beginners task. These things always make me feel stupid.
- ehsankia 7y agoyeah, the beginner one is definitely higher level that I would've expected a beginner level one to be. Definitely starting with a binary/reversing challenge is already quite a bit more than I'd expected from the very first beginner level.
- AJRF 7y agoYou really don't need to reverse the binary to pass that one haha. The string isn't obfuscated in the ELF, you can just look at the file in a text editor to see the flag
- ehsankia 7y agoHaha I feel extremely stupid now! Thanks though, after being unblocked I'm making decent progress, already gotten then next 4 levels. This is really fun for beginners!
- AJRF 7y agoNo problem. I think that feeling is extremely important when learning new things. It show's that you are starting to build a model of the problem space and filling it with things that were non-obvious to you.
- Avamander 7y agoIt's running `strings` on the binary :P
- mattio 7y agoI feel you.
- hpeinar 7y agoDoes someone do in-depth posts/videos/talks about any of these (Google or FB) CTF challenges by breaking up what is happening, what, why and how they tried per challenege and how did they finally come to the solution step-by-step? These things have always intimidated me and I'd love to know more.
- kenoph 7y agoctftime lists writeups, but in general you can google "whatever ctf challenge name writeup"
- some_furry 7y agoI started streaming it yesterday on my Twitch channel, but I was asked not to by a Google employee. I've been working through the Beginner's Quest instead, which is actually a lot of fun and has a cute story. https://www.twitch.tv/videos/442406188 https://www.twitch.tv/videos/442406188 if anyone wants to see the broadcast from yesterday.
- shripadk 7y agoThanks for the tip on using iconv. I spent an hour trying to figure out which command to use for that README.flag! Learnt something new!
- some_furry 7y agoAlways happy to help! <3
- FineTralfazz 7y agoCheck out LiveOverflow on YouTube. He's gone in depth on a bunch of CTF tasks and his solving process.
- strstr 7y agoPeople often write this up after the fact. Google’s CTF normally drops write ups (both their own and links to external solvers’) in some shared repository afterwards. Of course they won’t go play by play through everything they thought about every time, but they are pretty good reads.
- jedberg 7y ago> Q: I got an error: This browser is not supported or 3rd party cookies and data may be disabled. > A: Enable 3rd party cookies. Come on Google, why do you require third party cookies for a competition amongst the most privacy conscience people on the planet?
- Tepix 7y agoThe emoji virtual machine (step 3 or 4) is cool. I'm trying to understand what it does to speed it up.
- dysoco 7y agoI'm on that as well, for me it seems it just decodes some Unicode characters and does arithmetic to print the message, I don't know why it's taking so long or how can I speed it up.
- koyote 7y agoIt's calculating prime numbers which is why it's slow. Now if only I was to work out which prime numbers it wants... :)
- aereal 7y agohave you guys figured it out? I got stuck here too.
- tbarbour 7y agohttps://github.com/InverseIntegral/ctf_writeups/tree/master/google_2019/friend_space_book_plus_all_access_red_premium https://github.com/InverseIntegral/ctf_writeups/tree/master/... - great write up of the solution here
- gctfthroaway 7y agoI'm having a hard time even getting it to run. "python vm.py program" results in "SyntaxError: Non-ASCII character '\xf0' in file vm.py on line 19, but no encoding declared;" adding the relevant encoding (# -- coding: utf-8 --) then results in "RuntimeError: Unknown instruction ''\xf0\x9f\x96\x8b\xf0\x9f\x92\xa0\xf0\x9f\x94\xb6\xf0\x9f\x8e\x8c\xf0\x9f\x9a\xa9\xf0\x9f\x8f\x81'' at 370" I assume debugging the program is part of the challenge? Or is it just supposed to work?
- 7y ago
- deleted 7y ago[deleted]
- AJRF 7y agoDig at Apple from the third stage of the beginners' quest; "Your first thought is "Why does the display stand need to announce its price? And exactly how much does 999 dollars convert to in Xenonivian Bucklets?"
- tito3 7y agoStuck on this one, can see readme.flag but not sure how to proceed
- kwesthaus 7y agoSame. As far as I can tell, none of the usual restricted shell escape tricks work, so you just have to search through all the binaries on the system until you find one you can abuse to print the file contents, and that seems like more of a time sink than it's worth.
- shripadk 7y agoUse iconv.
- archgoon 7y agoLOL; I used split in the temp directory to create files of a single byte each and ran md5sum on them. That's quite a bit more straightforward :)
- shripadk 7y agoWell I spent an hour trying out as many commands as possible before giving up. Then came across this comment: https://news.ycombinator.com/item?id=20252612 https://news.ycombinator.com/item?id=20252612 and went through his Twitch recordings to see if he could get past this stage. That is how I learnt about iconv. :)
- redbluething 7y agoHehe. I kinda love this though :P
- tambourine_man 7y agoI’m always amazed how a company that creates the world’s most popular mobile OS and web browser is unable to code a decent mobile webpage. Scrolling this page is sufferable, anchor links don’t work well, etc. Basic stuff. Look no further than G Suite, Google Cloud for more examples.
- deleted 7y ago[deleted]
- thanhhaimai 7y agoI have heard of this argument often, and I don't quite understand it. It's similar to saying "I'm always amazed at how a country that has the most number of Nobel prize winners has some citizens that can't do calculus" The people that work on Android and Chrome are not the people who work on websites. It's okay to say the website doesn't meet your expectations, but it's better to recognize that those are different projects worked on by different people with different set of requirements and resources.
- tambourine_man 7y agoCompanies are not countries. People are hired in the first and born in the second. Companies should be concerned when their actions don't match the narrative they are trying to sell about themselves. If the Mobile Web is important to Google (and it should be), it must be a company wide effort. The “that's not my department” excuse doesn't cut it.
- saagarjha 7y ago"I'm always amazed at how a college that has the most number of Nobel prize winners has some professors that can't do calculus"
- tambourine_man 7y agoThat's a better analogy. Still, colleges are usually much more eclectic than companies. Even MIT, usually known for STEM, has one kick ass humanities department.
- umutisik 7y agoAcronyms suck
- saagarjha 7y ago"Capture the Flag" is pretty long if you use it frequently, though.
- jaden 7y agoCTF = Capture The Flag (I didn't know what it stood for at first).
- philshem 7y agoAnd what it means in this context: https://en.wikipedia.org/wiki/Capture_the_flag#Computer_security https://en.wikipedia.org/wiki/Capture_the_flag#Computer_secu... > In computer security, Capture the Flag (CTF), a type of wargame, is a computer security competition. CTF contests are usually designed to serve as an educational exercise to give participants experience in securing a machine, as well as conducting and reacting to the sort of attacks found in the real world (i.e., bug bounty programs in professional settings).
- ackbar03 7y agoI don't know about anyone else but this is a pretty hard ctf. It's a lot harder than other ones online
- dexhunter 7y agostuck on https://govagriculture.web.ctfcompetition.com/ https://govagriculture.web.ctfcompetition.com/ this task, any help?
- ehsankia 7y agoSame here. Unless there's some steganography, I'm really all out of ideas. I see see the content of folders (/static/, /static/images/, etc), but that doesn't help. I can't get anything out of /admin and the content of /post don't appear anywhere for any sort of XSS attack.
- MajorSauce 7y agoI completed the challenge. You don't need to see the result of the entry to deduct if XSS is possible. If the server is parsing your input, maybe you can find a way for the server to leak more than it wants. If you want more information, or simply the answer, PM me.
- m4cie 7y agoHi, could you provide some more information regarding how one can force the server to leak more information than it should? I have been stuck with this exercise for quite some time and am honestly out of ideas.
- karlding 7y agoThere isn't any steganography (at least for the flag that I found). They have a bot that actually "reads" your post, which you can verify for yourself. This is alluded to in the message that you get when submitting a post: > Your post was submitted for review. Administator will take a look shortly.
- ehsankia 7y ago> which you can verify for yourself How can you verify? That's what I was stuck, it's hard to test things if you're not getting any sort of feedback. That message seemed pretty constant. EDIT: I see, managed to verify it by putting an image on my own webserver and seeing the log hit. I got a rough idea now, thanks! EDIT2: Got it :)
- m_rn 7y agoFirefox ext:Canvas blocker crashes on your site.
- abidart 7y agoThree of the problems in the beginners quest have 2 flags. In two of the problems, the problems themselves tell you that there are two flags (or give you very obvious hints), but I have no idea which one is the third problem that has a second let alone how to get it...could anyone give me a hint?