Yesterday/Today, I participated in my first academic CTF competition. The Ruhr-Uni-Bochum, has a Capture The Flag team named:”FluxFingers”. I went to their training last Wednesday and it seemed to be exactly what I was looking for, a huge amount of fun and really fit hackers.
So, a friend who also started the master in ITS at the RUB, and I went to the our first challenge, the ruCTFe. This is an extended version of the ruCTF, it open to all universities of the world, so there were really participants from everywhere, the communication wasn’t always easy as some persons were thinking Russian was the language to use (in IRC for example, or some challenges were Russian -.-)
So after one hour of delay the CTF started, looking forward, at that moment, for 10 hours of fun, exploiting, patching, documenting and all the stuff you have to do in a CTF. What happened was a totally different story… Once the image was decrypted we noticed immediately that this would not be a usual ctf. Everything was related to android, you had an emulator on which the vulnerable services had to run. The setup of the emulator, understanding how everything was intended to be, and making things run took us quite a while. Same for other teams, so that after 4 hours nobody had any flags nor service running… not really what you think a ctf is. A reboot if the vulnerable image finally made things better, nobody understood why, but that was our smallest problem, it was up an running, and we were getting defense points. We managed to be first a long time, but didn’t made it till the end.
The vulnerable sources were really hard to understand, we found some bugs, we exploited some, but it didn’t bring us much, as our best exploit was running on a service that no other team managed to start… We got some points for advisories and for defense, I think we got only one valid flag. Which was not much different for the other teams.
Squareroots managed to exploit one service and collect a huge amount of flags. We think they exploited the same vulnerability as we did, except that they had less problems to setup their android image.
I found some piece of exploits, and helped some people having problems to understand different parts of the service F (written in Python) and wrote some exploits. All in all, it was really fun. Looking forward to the next CTF, the UCSB on 4th December. FluxFingers members told me that there would be more to exploit and it would be less “who is best at setting up his linux android”
To finalize, we finished at place 12 of 43 teams. All German universities did great like usual, squareroots (Mannheim) won, 0ldEurope (Aachen) was a great target to test my exploits
, but they had a good rank at the end too. FluxFingers member were little bit disappointed by the challenge I think, they were looking forward to steal flags, not to configure android emulators.
