I participated in the Stripe CTF Web Attacks and thus far it was the most well designed CTF I have ever encountered (and I have participated in a couple dozen). This is the second Stripe CTF, the first was exploitation based and this one was web based. Some Concepts CTF stands for Capture the Flag, its a genre of games where you have to get past enemy lines and take their flag and bring it back to your base to win a score. Usually hacking games are CTF like, you have to hack a system, find the flag (its a random string) and bring it to your home to get scores for that level. There are plenty of servers for a CTF host, since many attackers try to just break the servers instead of solving the challenges. Also every participant’s environment has to be secluded to achieve best challenge experiences, so lots of cautious programming on the host side is required. There are almost always lots of bugs on CTFs due to huge codebases, and hackers tend to hack systems in a way that the host didn’t plan of, and get the score; thus the host people have to watch the event and remove those bugs asap, and to respond to questions and feedbacks of the participants. How did I do I participated in this CTF a couple days ago, at midnight. Unfortunately my beloved uncle had just passed away and he had no sons, so I had to take care of much of funeral stuff. I only had a couple hours at midnight (at the cost of not sleeping for the funeral) to participate in this, so I did. I was able to solve 8 out of 9 challenges in almost 3 hours, and left for the funeral chores afterwards. The 8th question was a little lengthy and I returned to it after almost 30 hours (after the funeral and a brief rest) and solved it in a few hours. Below I’m going to discuss the questions and their answers (how to hack them) as an educational document.

Challenges

I’m going to copy the challenges from Stripe-CTF, then provide the solutions in a section below each of them.

Qt is a rather magnificent and silent framework. Every application I tend to find amusing and well developed, is based on Qt, but nobody really knows that. There’s not much boasting around it, as it is around .NET Framework. As a few examples, VLC, Google Earth, VirtualBox and the whole KDE desktop and all of its applications, are based on Qt. Nowadays Qt provides cross-platform programming for Windows, OS X, Linux, Symbian, Android (beta), Windows Mobile (beta) in a dozen programming languages (C++, Python, Java, Ruby, PHP, etc.). Compared to GTK it is very well designed and provides for a magnificent quality of code. Unfortunately based language for Qt is C++, which is not really suitable for most of todays applications, since they rarely require that much performance and low level access. Python on the other hand, is the jewel of high level programming languages. PyQt, is a robust Qt binding for Python, provided by Riverbank Computing. PyQt is installable in Ubuntu linux with just a few apt commands. There is also a stable Windows installer with Qt libraries included. Unfortunately until now there were no OS X binary distros, and compiling PyQt on OS X was a big hassle. I have a separate post on how to compile the pile on OS X, but no need for that as I have published PyQtX, the binary distributions of PyQt on OS X, which is available both on Riverbank Computing’s PyQt download page and sourceforge.net at the following address:

sourceforge.net/projects/pyqtx

If you live on a Mac OS X, and you are a developer, this is a must have. You need Python 2.7 for this to use (obtain from official website).