Capture the Flag Event 2017 **

What is a CTF?

CTF, which stands for “Capture the Flag,” is a computer-based competition used to teach information security skills through hands-on experience. Players earn points and gain control of the game map by completing tasks with their team that identify potential threats and secure computers and networks against virtual attacks. Because learning attack techniques is often the best way to learn how to protect against them, CTFs teach both defense and offense skills. Points are awarded to teams on the basis of speed and accuracy. At the end of the allotted time, the team with the most points is declared the winner.

Who can participate in the CTF?

B|Sides Calgary CTF is open to all players of any skill level, with no pre-registration or qualification required. Come on by, try out the game, learn something new, and meet interesting people!

Due to possible room limitations (space and connections), Calgary B|Sides MAY need to limit the number of teams able to participate. We will attempt to accommodate all participants but registration will be on a first come, first serve basis at the conference.

What is the B|Sides Calgary CTF Platform & Environment this year?

B|Sides Calgary will be using the Facebook Open Source CTF environment for scoring of this years CTF Challenge. More info here: https://www.facebook.com/notes/facebook-ctf/facebook-ctf-is-now-open-source/525464774322241/

The CTF environment will be a closed network. We will not be providing internet access from the CTF network, however as part of the overall B|Sides Conference, internet access will be available.

The CTF challenge will be conducted within a designated room at the conference with both hardwired and wireless connectivity. Wireless will be available as far as the range of the access point(s) allows.

Challenges will consist of Quiz and Jeopardy (Flag) style challenges. “King of the Hill” aka Base style play will not be part of the competition.

Challenges will include both a traditional IT environment, as well as an industrial control system / SCADA environment.

There will be both static offline challenges as well as a live network environment.

Team sizes will be limited to a maximum of 4 participants per team.

Prizes will be awarded for the top scoring teams.

The B|Sides Calgary (Facebook) CTF platform supports three different types of challenges: Quiz, Flags and Bases.

Quiz Levels

Quiz questions are the equivalent of trivia questions. One question that has one answer and the answers can be anything from a single word to a whole sentence, not being case sensitive.

Flag Levels

Flags are problems that you need to break apart to find the hidden solution. The end goal of a flag question is to recover a "flag" that you can submit for points. All flags should be in the format flag{some_text_here} . Any problem that does not use this flag format should explicitly specify so in the description. In a typical flag problem, you may be provided with the URL of a website that you must hack or of a service that you need to connect to using netcat. The goal of these challenges can range from dumping the flag from a database on the system, getting a shell on the system, or simply tricking the application to display the flag. These challenges can provide links or attachments to complete the description of them. Flag level play may also consist of attachments that are downloaded to your computer and solved offline to acquire the flag.

Base Levels

Bases are the levels that are part of the "King of the Hill" type of games. They represent a system, that has to be compromised and whoever takes it gets a number of points, the first time. In addition to that, it also rewards control based on time, rewarding with a number of points every cycle.

B|Sides Calgary CTF will NOT be running the Base Level style challenges in this competition.

Hints

The CTF platform also allows for hints, which may be provided by the organizer. In some cases, hints will be in the problem description. In other cases, you will see a hint button below the challenge. If there is no hint penalty, clicking on the hint button will display the hint. If there is a penalty, the penalty will be displayed on the button, and you can pay the penalty to access the hint, if you have enough points to do so.

Types of Challenges

There’s a wide variety of challenges that show up in a CTF, but they tend to be grouped into a few categories:

Web These challenges involve attacking common vulnerabilities in web technology. For example, you might need to use SQL injection to read the “secret_flag” table of a database, use directory traversal to get a web server to serve you “flag.txt”, use Cross-Site Scripting to trick a simulated user to send you their password, or bypass some client-side checks implemented by obfuscated javascript.

Digital Forensics This is a fairly broad category. You might receive an image of a disk in FAT format, and you’ll need to un-delete “flag.txt”. Maybe you receive a zip file, that contains a 7z file, that contains a tar archive, that contains some obscure file format you’ve never heard of, and unpacking the entire chain eventually gives you a flag.

Steganography Steganography is the art of hiding a secret message in plain sight, and it leads to a variety of implementations and challenges. You might be given an image, where all the blue pixels can be filtered out to reveal a secret message. Maybe an innocuous HTTP transfer hides a Secret flag, or maybe a video file, that’s been subtly watermarked with the secret flag, maybe a paragraph of text hides a secret message in the capital letters.

Packet Analysis In this category, you’ll typically receive a packet capture dump, and you’ll try to decode, analyze, and interpret it, using tools such as Wireshark. Maybe a simulated user was sending their password in plaintext, and you have to retrieve it. Or, perhaps a simulated user was having a VOIP call without encryption, and you need to listen in and hear the secret flag.

Binary Reversing Several categories of challenge involve reverse-engineering programs. You’ll receive the program, but not the source, so you need to disassemble it, look at the assembly, and figure out what it does (and if it has any weaknesses!). Programs can be x86 Windows, x86 Linux, ARM Linux, obfuscated Java, and a whole bevy of more obscure formats. Sub-categories include:

Pwnables The program you received is running as a service on a remote machine. Reverse-engineer it, figure out its vulnerability, and use that to take exploit the remote service into serving you a flag. Often, there’s a flag.txt you can get the program to read, or perhaps it has a flag in memory you need to get it to accidentally send you. Or, sometimes you are able to just execute shellcode, and read a ‘flag.txt’ directly.

Crackmes These programs include anti-reversing measures, like anti-debugger instructions, code obfuscation, or even dual-use opcodes. There’s a few ways the flag could be embedded - the program could implement a particular password check, and the string that is accepted is the flag, or perhaps the program calculates the decryption of an encrypted flag, but requires rewriting certain instructions so that it performs the decryption.

Cryptography In this category, you’ll attack poorly implemented crypto, outdated crypto, or use well-known vulnerabilities to attack encrypted messages. You might be given a few RSA keys whose modulus share a factor, and you decrypt a message encrypted by one of these keys. Or you’re given a password database with unsalted password hashes. You could get a cipher, where you can guess some of the plaintext, and use that to figure out the key and decrypt the remainder of the message. Or, it could just be ROT13.

Miscellaneous Miscellaneous is, well, miscellaneous. These are often lower-point value challenges that ask for trivia, or bizarre messages that just have to looked at with the right perspective, or programs that will output the key, if you can get them to run correctly. This could also be a bitmap image, printed out in Base64 over several pages of tractor-feed paper, that you need to OCR into a computer, in order to view the secret flag on the image.

How do I play CTF?

To play the B|Sides Calgary CTF, just join us in the CTF challenge room, register your team name and participant’s names at the registration desk, ask for the CTF URL, logon to the CTF website and register your team name and the team members. Then, just sit down at one of the contest tables, plug in the provided network connection, or connect to the wireless network and access the scoreboard, and pick an open challenge to solve. Once you solve the challenge, submit the flag to the scoreboard, do a victory dance, and start on another one!

What should I bring?

You will need a computer of some sort to play. Typically people play with laptops.

It’s helpful to be set up to run VMs, so you can use Windows, Linux, Mac or whatever else the contest requires. It also allows you to isolate programs which could potentially be dangerous.

For that matter, it’s a good idea to just use a fresh hard drive, with no personal data on it, that you can just wipe after B|Sides. This is B|Sides, you should consider using a burner laptop anyway :)

B|Sides Calgary CTF will provide teams with one physical connection to the contest network, and there will be a power strip at each table. You should bring your own power strip (the provided one may not have enough outlets) and some way to share the one physical network connection you get. We recommend being prepared to use either one player’s laptop or bring an Ethernet switch and enough cables for everyone on your team is also advised. Wireless connectivity to the CTF network will be available but range and capacity will be on a best effort basis.

Any hints or tips?

While you can participate solo, you’ll probably have a much better time if you play with a team. Get a few friends, sit down, and work together to solve challenges. After the beginning of the game, there’s multiple challenges open, so each person can work on their own, or they can try to collaborate to solve one.

If none of your friends want to play, ask some of the existing teams whether they want an extra member. It’s a great way to meet new people, and learn skills you’ve never even heard of!

Make copious use of Google. (The CTF network will NOT have internet connectivity).

These challenges were written by people, and these people want to see the challenges solved. If you get stuck, it can be worth asking for a hint, especially if you have a good idea of what you’ve tried so far and what you’re stuck on.

If you get stuck, you can also just take a break, try a different challenge, and come back to this challenge later.

If you’re programming, minimizing time spent coding is your goal. You’re writing code that will be used once. Maintainability, readability, and robustness aren’t concerns. Make it pretty for the writeup later.

Linux shell utilities are your friend. Many challenges have been solved with one-liners. Learn imagemagick, pbmtools, sox, sed, awk, grep, strings, file, xxd, sort and uniq.

Some other teams may prank or troll you. This can be all in good fun, but it helps to have a thick skin about these kinds of things. (Again, this is B|Sides). Prank or troll them back! But please also be reasonable, and don’t do anything that causes lasting damage or ruins the mood of the event. If you feel another team has really crossed the line, talk to the contest organizers.

Have Fun!

B|Sides Calgary CTF Rules**

**Subject to change

Following actions are prohibited, unless explicitly told otherwise by event Admins.

No cooperation between teams with independent accounts. Sharing of keys or providing revealing hints to other teams is cheating, don’t do it.

No attacking the competition infrastructure & systems. If bugs or vulns are found, please alert the competition organizers immediately.

Absolutely no sabotaging of other competing teams, or in any way hindering their independent progress.

No brute forcing of challenge flag/ keys against the scoring site.

DoSing the CTF platform or any of the challenges is forbidden.

Legal bit - Disclaimer. By participating in the contest, you agree to release B|Sides Calgary and its organizers, and the hosting organization from any and all liability, claims or actions of any kind whatsoever for injuries, damages or losses to persons and property which may be sustained in connection with the contest. You acknowledge and agree that B|Sides Calgary et al is not responsible for technical, hardware or software failures, or other errors or problems which may occur in connection with the contest.

If you have any questions about what is or isn't allowed, please ask an organizer.