HITBSecConf2007 Capture the Flag Game Considered Fun

Capture the Flag Day 1

11 teams were supposed to compete is this year's edition of Capture the Flag game (this year's edition was the sixth CTF to be organized by HITB), but one team, the winner of the UiTM i-Hack international hacking challenge (organized by SCAN associates) pulled out at the last minute. Like previous years, the game play is the same, except that this year we introduced new points (bonus and breakthroughs).

• Bonus points were given for teams that manage to crack Windows binaries provided during the game day
• Breakthrough points were given for any team that managed to submit the first flag for any daemon, basically, if you're the first to submit a flag for say daemon01, then you will be given breakthrough points
• Another bonus points will be given at the end of the game day for writeups - the writeups were written by the team on how they exploit certain daemons, the binaries and their defensive strategies

On the first day, the game was delayed due to technical glitches - we didn't have enough time for testing since all of the CTF crew were pretty darn busy with work, and on top of that, thanks so effing much to Hilton, we were only able to do the setup at 12 midnight.

We released crackme1.exe, and SaoVang from Vietnam managed to crack it in under an hour.

Havoc began when teams entered the CTF area. Most of them quickly shutdown VMWare Player in order to make copies of the image. While there was nothing against this, it was pretty annoying since we had to ensure every team's server was online.

The first day ended without any interesting events. We had to leave early (against thanks to Hilton) as the bomb squads were in the building - the Deputy Prime Minister was going to have a function that evening.

Capture the Flag Day 2

The second day went well, and SoaVang led from beginning. They managed to crack crackme2.exe (provided on day 1). They were also the first team to submit flags for daemon01, daemon04, daemon07, and daemon08 (daemon08's source code was released to the team later during the day). WsLabi were only able to crack crackme1.exe, and the first team to submit flag for daemon03, while Padocon managed to get breakthrough for daemon02. Interestingly, Padocon team only submitted 5 flags for daemon02 - maybe their exploit wasn't reliable.

After lunch we released crackme3.exe, which carried 800 points, and the SoaVang cracked it with ease.

The winner was then pretty clear after lunch, and second place was pretty much determined after lunch as well when WsLabi overtook Padocon and Powerhacker by submitting more flags.

What we observed during the game

• The SaoVang team members were really good reverse engineers and exploit writers
• The SaoVang team members were even better at Windows reverse engineering
• It took an average of 1.5 hours for other teams to write exploit for daemon08 after the source code was released, but SaoVang managed to crack it under an hour
• During the last 3 hours of the game, SaoVang automated all their available exploits and flag submissions via a simple Python script, while other teams were doing the copy/paste->remove whitespace routine
• Army Strong had quite a complicated defensive strategies (a few Perl scripts were submitted to us for bonus points), and came out with the highest defensive score. t3nth had a simple but effective defensive strategy as well, and they could have gotten enough points if they put more effort into offense - or send a better team member. During the game, it seemed like only one person was doing something, while the other two was staring blankly at the screen.
• Qb1t - no matter how many times we resetted their flags, they always screwed it up! What is the fuck? Qb1t, as far as my memory can recall, is the only team that have been participating since 2003, but never got anything right.
• Some teams tried to reverse engineer our set_flag and get_flag operation - I think one of the team managed to do it.
• Army Strong was very good defensively - they could have won any of the first three placings if they managed to get offensive points.
• Compared to last year, Padocon sent two very young teams (Padocon and Powerhacker) but they managed to get 3rd and 4th placings respectively.
• After m0s (toyok, a fomer member is now a rock star, riaf helped out with the CTF - thanks bro!) none of the participating Malaysian teams were up to par with the other Asian hackers.

So that's it for the CTF this year. It was good game, we made it much easier than last year, albeit more challenging, and as always, it wasn't an easy game to organize. Thanks to all participating teams, sponsors, organizers and team kambing biri2 31337 (elite sheep team).

ERRATA: Powerhacker is not part of Padocon