Homemade CTF Challenge: 02 "Bae's Base"

Key Takeaways

all right hello everyone my name is John Hammond and I wanted to continue uh a last video that I uploaded on the local Capture the Flag competition that I put together um for my school's like cyber team as practice and as an exercise to learn a little bit more about the simple CTF skills and and and stuff so Bay's base was the name of the next challenge that I put together and it's really simple it was a picture of shibba Inu Doge and the prompt being uh he's so cute maybe he has something to say and this actually isn't a stenography challenge but I guess to suppose a little bit of it and that you have to like look at the metadata the hint here is that have you ever heard of exif tool because I use that or at least I recommend using that to look at the metadata of the file and that was uh again something that some of the newcomers either don't know or have never seen before so I wanted to Showcase that to them and let them know that that CH that that tool exists so uh for demonstration purposes we can can totally get the flag I had just downloaded that image and saved it and you would end up running exive tool on simply the file and it gets all the information for you and the comment is a special thing to notice because that is in base 64 you can see that right here so super simple super easy it would just makes sense for us to uh uh Bas 64 decode that so I will go ahead and Echo that into base 64- D to run that in the command line and we get our flag again insanely easy us CGA the best base is the base 64 um so we'll go ahead and enter that as a flag and get our 75 points nice so Lo that I ended up cooking that was that I I'll again I'll open Sublime Text to show you this code and what I ended up doing was I downloaded the file just a picture of Shiba Inu off the internet so this URL is something that I just found by like literally Google image searching uh like Doge and the the Shu dog so it saves it as a file name and then it goes ahead and takes the flag variable base 64 encodes it I actually had used for ION range for another challenge so this code is actually duplicate for a later challenge where I encoded the flag multiple times that have to keep B 64 decoding and B 64 decoding but since this only iterates one time you really don't even need this and that could uh actually just move the very front this doesn't need to be inside of a loop but that's how I ended up writing it at the time and then I actually just call exive tool to write the comment to be the new Bas 64 encoded flag and I call this with subprocess the module in Python 2 like call uh invoke other programs and I have to split it because as a shell it needs to have those arguments in the proper order so again pretty simple thing I just steal this image off the internet and then slap the metadata of the comment to be a Bas 64 encoded version of the flag super easy so our simple oneliner get flag goes to scrape out the comment section grabs the value and then it basic C4s uh it's output just like we did essentially in in in our terminal demonstration so not a hard challenge by any means but again I wanted to showcase the exive tool for newcomers that haven't seen it before so uh that was how simple that previous challenge was but it got us all the board and stuff okay thanks for watching guys I hope you're enjoying some of this you get to see for one thing a challenge and a solution and the creation of that challenge so uh please let me know if you want to see more of stuff like this or I should get into more in-depth stuff because I definitely plan to right now this is just the beginner level stuff for uh the newcomers on the team so thanks again see you soon