I don't know about anyone else but this is a pretty hard ctf. It's a lot harder than other ones online
The CTF is staffed by volunteers who make up the problems. I wrote one in 2017 for the Google CTF Quals and found it very difficult to balance.
Google CTF 2019
91–100 of 140 posts
Re: Google CTF 2019
#92CTF = Capture The Flag (I didn't know what it stood for at first).
And what it means in this context:
https://en.wikipedia.org/wiki/Capture_the_flag#Computer_secu...
> In computer security, Capture the Flag (CTF), a type of wargame, is a computer security competition. CTF contests are usually designed to serve as an educational exercise to give participants experience in securing a machine, as well as conducting and reacting to the sort of attacks found in the real world (i.e., bug bounty programs in professional settings).
Re: Google CTF 2019
#93Does someone do in-depth posts/videos/talks about any of these (Google or FB) CTF challenges by breaking up what is happening, what, why and how they tried per challenege and how did they finally come to the solution step-by-step? These things have always intimidated me and I'd love to know more.
Gynvael Coldwind (member of Google security team) probably will do. Here's video from last year's Beginner Quest: https://www.youtube.com/watch?v=qDYwcIf0LZw
Re: Google CTF 2019
#94I’m always amazed how a company that creates the world’s most popular mobile OS and web browser is unable to code a decent mobile webpage. Scrolling this page is sufferable, anchor links don’t work well, etc. Basic stuff. Look no further than G Suite, Google Cloud for more examples.
The entire competition is a volunteer/20% thing internally. It doesn't go through the same design cycle as official Google products. For this year, they also rewrote the scoreboard site for scratch (it's now uses Firebase).
[source: I was the on-call SRE for the 2017 edition]
Re: Google CTF 2019
#95Earlier quoted context omitted.
You really don't need to reverse the binary to pass that one haha. The string isn't obfuscated in the ELF, you can just look at the file in a text editor to see the flag
Haha I feel extremely stupid now! Thanks though, after being unblocked I'm making decent progress, already gotten then next 4 levels. This is really fun for beginners!
No problem.
I think that feeling is extremely important when learning new things. It show's that you are starting to build a model of the problem space and filling it with things that were non-obvious to you.
Re: Google CTF 2019
#96Earlier quoted context omitted.
Stuck on this one, can see readme.flag but not sure how to proceed
Ended up using makemime which showed the data in base64. Good enough! Interestingly enough though the ORME.flag showed permission denied... I'll have to go back to that one later.
I think one of the binaries probably has a privilege escalation vulnerability. Looking with la -al you can see the last modified dates, there's a couple of interesting ones
Re: Google CTF 2019
#97Earlier quoted context omitted.
Same. As far as I can tell, none of the usual restricted shell escape tricks work, so you just have to search through all the binaries on the system until you find one you can abuse to print the file contents, and that seems like more of a time sink than it's worth.
env /bin/busybox strings README.flag
Nice one! Was wondering if there would be a way to call BusyBox with one of the missing binaries.
Re: Google CTF 2019
#98Earlier quoted context omitted.
If your having this much issue with figuring out what a ctf is its probably not for you. Googles ctf is pretty damn hard
If their goal was to minimize participation and competition, then they certainly succeeded. I don’t think being unfamiliar with something should ever be outright disqualifying.
If you put it that way, it wouldn't be wrong to think of it as a disqualifying round
Re: Google CTF 2019
#99Earlier quoted context omitted.
If your having this much issue with figuring out what a ctf is its probably not for you. Googles ctf is pretty damn hard
If their goal was to minimize participation and competition, then they certainly succeeded. I don’t think being unfamiliar with something should ever be outright disqualifying.
If I were holding a competition for bakers, I wouldn't feel obligated to include a paragraph explaining what a "bake-off" is. I knew what a CTF was years before I knew enough to compete in one; it's a central part of hacker culture going back to the mid-90s.
Every puzzle here places you in a different unfamiliar situation. The only "outright disqualifying" thing is whether you can figure out something on your own. You essentially failed the first test.
Re: Google CTF 2019
#100Dig at Apple from the third stage of the beginners' quest; "Your first thought is "Why does the display stand need to announce its price? And exactly how much does 999 dollars convert to in Xenonivian Bucklets?"
Stuck on this one, can see readme.flag but not sure how to proceed
i ended up using fold.
theres also has to be a way to read the ORME.flag by modifying the file permissions but i haven't figured that one out yet.