Roman Hergenreder

The first HACKvents challenge is about jpg-images and it's hidden thumbnail, as the challenge description already tells us. The given image is unfortunately blurred, so we cannot see the QR-code, but using exiftool we can see, that the image includes a thumbnail, which we can extract by using the following command. Opening the resulting thumbnail and zooming in, gives us a valid QR-Code and the solution flag.

$ exiftool day01.jpg -b -ThumbnailImage > day01_solution.jpg

Flag: HV19{D1fficult_to_g3t_a_SPT_R3ader}

Python script

Flag: HV19{BACONCIPHERISSIMPLEBUTCOOL}

Python script

Flag: HV19{1m_als0_w0rk1ng_0n_a_r3m0t3_c0ntr0l}

Python script

Flag: HV19{5M113-420H4-KK3A1-19801}

Python script

Special thanks to the challenge's creator @otaku and the people on the unofficial discord server for so many hints, I wouldn't be able to solve this otherwise.

Visiting the following railway station has left lasting memories. Santas brand new gifts distribution system is heavily inspired by it. Here is your personal gift, can you extract the destination path of it?

⨁

=

Flag: HV19{Cha0tic_yet-0rdered}

Python script

Flag: HV19{th3_cha1n_1s_0nly_as_str0ng_as_th3_w3ak3st_l1nk}

Python script

1. Set the breakpoint right on the __vbaVarTstEq call
2. Run the debugger
3. Enter the following string: HV19{AAAAAAAAAAAAAAAAAAAAAAAAAAA}, as we know the first 5 and the last char, the remaining 33 - 6 chars are chosen.
4. Step through the instructions, until we see both strings in memory (given and encrypted).

Flag: HV19{0ldsch00l_Revers1ng_Sess10n}

Python script

• A := input, E := encrypted string in memory, K := key used for XOR, F := flag, S := first string found for XOR
• F = S ⨁ K = S ⨁ (A ⨁ E)
• F = 6klzic<=bPBtdvff'y\x7fFI~on//N ⨁ (AAAAAAAAAAAAAAAAAAAAAAAAAAA ⨁ GFIHKJMLONQPSRUTWVYX[Z]\_^a)
• F = 0ldsch00l_Revers1ng_Sess10n

Flag: HV19{0ldsch00l_Revers1ng_Sess10n}

Python script

private PatriciaTrie<Integer> trie = init();
private static final long serialVersionUID = 1L;
private static final String securitytoken = "auth_token_4835989";

// (...)

private static PatriciaTrie<Integer> init() {
  PatriciaTrie<Integer> trie = new PatriciaTrie<Integer>();
  trie.put(securitytoken,0);
  return trie;
}

private static boolean isAdmin(PatriciaTrie<Integer> trie) {
  return !trie.containsKey(securitytoken);
}

Flag: HV19{get_th3_chocolateZ}

Python script

This challenge was hilarious, like last year's flappy bird, we've got an obfuscated perl game. This year's topic: Curve Fever! Similar to snake, we have to collect bounties, which are parts of our flag. But in contrast to snake, our curve leaves a constant line, which we may not touch. I tried to play the game without modifying or cheating in any way, it's possible for the first 6-7 parts, but the flag doesn't seem to have a common scheme... Thus, we have to modify the given code. Using perltidy, we can beautify our code a bit.

createText(
  $PMMtQJOcHm8eFQfdsdNAS20->() % 600 + 20,
  $PMMtQJOcHm8eFQfdsdNAS20->() % 440 + 20,    #Perl!!
  "-text" => $d28Vt03MEbdY0->(),
  "-$y"   => $z
);

var mqtt;
var reconnectTimeout = 100;
var host = 'localhost';
var port = 9001;
var useTLS = false;
var username = 'workshop';
var password = '2fXc7AWINBXyruvKLiX';
var clientid = localStorage.getItem("clientid");
if (clientid == null) {
  clientid = ('' + (Math.round(Math.random() * 1000000000000000))).padStart(16, '0');
  localStorage.setItem("clientid", clientid);
}
var topic = 'HV19/gifts/'+clientid;
// var topic = 'HV19/gifts/'+clientid+'/flag-tbd';
var cleansession = true;

Flag: HV19{N0_1nput_v4l1d4t10n_3qu4ls_d1s4st3r}

Python script

We can find this switch-case which decides what sub is called depending on the operator chosen. As expected, the functions are broken, or being more precise: empty, filled with nops. Firstly, we rename it in IDA, so have it more readable (e.g. sub_4015B6 = calc_add). When searching for cross-references, we can see, that the calculations are not only used in the switch case, but right after the actual calculation:

There is some calculation done on big numbers and the result is shown as a string using SetDlgItemTextA. We can either patch the binary to implement the correct functionalities of the calculation methods or even easier: reproduce it in a python script. The flag is printed as result, we just have to fix one character:

$ python decode.py

HV19{B0rkedßFlag_Calculat0r}

Flag: HV19{B0rked_Flag_Calculat0r}

Python script

function registerUser($conn, $username, $password) {
  $usr = $conn->real_escape_string($username);
  $pwd = password_hash($password, PASSWORD_DEFAULT);
  $conn->query("INSERT INTO users (username, password) VALUES (UPPER('".$usr."'),'".$pwd."') ON DUPLICATE KEY UPDATE password='".$pwd."'");
}

function isUsernameAvailable($conn, $username) {
  $usr = $conn->real_escape_string($username);
  $res = $conn->query("SELECT COUNT(*) AS cnt FROM users WHERE LOWER(username) = BINARY LOWER('".$usr."')");
  $row = $res->fetch_assoc();
  return (int)$row['cnt'] === 0;
}

Flag: HV19{h4v1ng_fun_w1th_un1c0d3}

Python script

v11 = unk_100007F50;
printf("Input your flag: ", argv, envp);
fgets(&v6, 32, __stdinp);
v3 = strlen(&v6);
if (v3) {
  memcpy(&v7, &v6, v3);
}
dance(&v7, v3, &v11, 0xB132D0A8E78F4511LL);
if (strlen(&v6)) {
  v4 = 0LL;
  do {
    printf("%02X", *((unsigned __int8 *)&v7 + v4++));
  } while (strlen(&v6) > v4);
}
result = putchar(10);

Flag: HV19{Danc1ng_Salsa_in_ass3mbly}

Python script

Flag: HV19{*<|:-)____\o/____;-D}

Python script

Flag: HV19{C0nsole_H0mebr3w_FTW}

Python script

X: 0xc58966d17da18c7f019c881e187c608fcb5010ef36fba4a199e7b382a088072f
Y: 0xd91b949eaf992c464d3e0d09c45b173b121d53097a9d47c25220c0b4beb943c

"Hy97Xwv97vpwGn21finVvZj5pK/BvBjscf6vffm1po0="

1. Password generation/cracking
2. String encryption/decryption

1. Read a list of common passwords and filter them to get only passwords of length 16
2. For every password: Generate a sha256 hash
3. Use the hash as private key and generate public key using P256 curve
4. Compare the public key with the given public key (x, y)
5. If they are equal, we are probably done

1. Generate the pbkdf2_hmac using password, salt and sha256 with 256*256*256 iterations
2. Base64 decode the given string
3. AES-decrypt the resulting buffer using the generated AES key in ECB mode
4. The flag should now be readable

Flag: HV19{sry_n0_crypt0mat_th1s_year}

Python script

Starting Atmel Studio and using the device manager, we go through the microcontroller list, and try to flash the hex file. If no error is thrown, it probably worked. I tried common MCUs like atmega8, atmega16 until atmega32 for which it worked. Next I saved the EEPROM to a file, I don't know if this was really needed, but it worked for the next step.

Next we will produce the elf object file out of the hex file and the EEPROM. Now we can import the resulting file for debugging, by opening the File menu, then Open -> Object file for debugging. Select atmega32 and finish the project wizard. Now we only have to start debugging the file, pausing it and opening the memory view: Debug → Windows → Memory → Memory 1. The flag is now visible in the memory window.

Flag: HV19{Cr4ckin_Passw0rdz_like_IDA_Pr0}

PHP script

undefined4 FUN_00058dd8(undefined4 param_1,int param_2,undefined4 param_3,undefined4 param_4,undefined4 param_5) {
  FUN_00058d9c(param_3,param_4);
  uStack56 = *(undefined4 *)PTR_DAT_00058e84;
  uStack52 = *(undefined4 *)(PTR_DAT_00058e84 + 4);
  uStack48 = *(undefined4 *)(PTR_DAT_00058e84 + 8);
  uStack44 = *(undefined4 *)(PTR_DAT_00058e84 + 0xc);
  uStack40 = *(undefined4 *)(PTR_DAT_00058e84 + 0x10);
  auStack36[0] = *(undefined4 *)(PTR_DAT_00058e84 + 0x14);
  if (param_2 == 0xcafe) {
    func_0x00803cd4(param_3,PTR_s_Um9zZXMgYXJlIHJlZCwgVmlvbGV0cyBh_00058e90,param_4);
    return 0;
  }
  if (param_2 != 0xd00d) {
    if (param_2 != 0x1337) {
      uVar1 = func_0x0081a2d4(param_1,param_2,param_3,param_4,param_5);
      return uVar1;
    }
    pbVar3 = &bStack57;
    pbVar2 = DAT_00058e88;
    do {
      pbVar3 = pbVar3 + 1;
      pbVar2 = pbVar2 + 1;
      *pbVar3 = *pbVar2 ^ *pbVar3;
    } while (pbVar3 != (byte *)((int)auStack36 + 2));
    func_0x00803cd4(param_3,&uStack56,param_4);
    return 0;
  }
  FUN_00002390(PTR_DAT_00058e8c,0x800000,0x17);
  return 0;
}

Flag: HV19{Y0uw3n7FullM4Cm4n}

Python script

Flag: HV19{an0ther_DAILY_fl4g}

Python script

Flag: HV19{Squ4ring the Circle}

Perl script