Google CTF 2019
capturetheflag.withgoogle.com
capturetheflag.withgoogle.com
"Your first thought is "Why does the display stand need to announce its price? And exactly how much does 999 dollars convert to in Xenonivian Bucklets?"
That's quite a bit more straightforward :)
Though it does more (rolls) and actually made by BenQ.
These things have always intimidated me and I'd love to know more.
I've been working through the Beginner's Quest instead, which is actually a lot of fun and has a cute story.
https://www.twitch.tv/videos/442406188 if anyone wants to see the broadcast from yesterday.
Google’s CTF normally drops write ups (both their own and links to external solvers’) in some shared repository afterwards.
Of course they won’t go play by play through everything they thought about every time, but they are pretty good reads.
1. https://m.youtube.com/MurmusCTF?uid=UB9vOGEUpw7IKJRoR4PK-A
(I didn't know what it stood for at first).
https://en.wikipedia.org/wiki/Capture_the_flag#Computer_secu...
> In computer security, Capture the Flag (CTF), a type of wargame, is a computer security competition. CTF contests are usually designed to serve as an educational exercise to give participants experience in securing a machine, as well as conducting and reacting to the sort of attacks found in the real world (i.e., bug bounty programs in professional settings).
Now if only I was to work out which prime numbers it wants... :)
"python vm.py program" results in "SyntaxError: Non-ASCII character '\xf0' in file vm.py on line 19, but no encoding declared;"
adding the relevant encoding (# -- coding: utf-8 --) then results in "RuntimeError: Unknown instruction ''\xf0\x9f\x96\x8b\xf0\x9f\x92\xa0\xf0\x9f\x94\xb6\xf0\x9f\x8e\x8c\xf0\x9f\x9a\xa9\xf0\x9f\x8f\x81'' at 370"
I assume debugging the program is part of the challenge? Or is it just supposed to work?
I'm guessing the flag may be in the rest of the message to be decoded.
I scrapped and downloaded around 55 pngs.
As the comment above implies, it seems like my approach was wrong and the answer is in one of the images I guess
I wrote a compiler from emoji-code to amd64 (mostly because I'm more interested in compilers than reversing). It runs quite fast - prints the whole domain in ~1 min. I'd highly recommend it to people who are into assembly, it was a fun exercise.
Was your method fast enough to get all three parts of the URL?
I think that feeling is extremely important when learning new things. It show's that you are starting to build a model of the problem space and filling it with things that were non-obvious to you.
https://buildyourfuture.withgoogle.com/events/ctf/#!?detail-...
If the server is parsing your input, maybe you can find a way for the server to leak more than it wants.
If you want more information, or simply the answer, PM me.
> Your post was submitted for review. Administator will take a look shortly.
How can you verify? That's what I was stuck, it's hard to test things if you're not getting any sort of feedback. That message seemed pretty constant.
EDIT: I see, managed to verify it by putting an image on my own webserver and seeing the log hit. I got a rough idea now, thanks!
EDIT2: Got it :)
Why Quebec is banned?
https://buildyourfuture.withgoogle.com/events/ctf/#!?detail-...
https://www.thebalanceeveryday.com/why-are-so-many-competiti...
"Pay a fee of up to 10% of the sweepstakes' value, depending on who is allowed to enter."
So they would need to pay Quebec $3K just to have the competition available there, even if it is a global competition.
It sounds to me that Quebec have got to have some reason for these Quebec special laws. It has nothing to do with France, there has to be another reason. Does anyone have any ideas?
> Ever notice that Canadian contests keep barring the poor residents of Quebec from entering? It's not that contests are illegal in Quebec – it's just that the government makes it especially difficult to run one.
> For one thing, contest runners have to pay tax on the value of the prize. For another thing, contests with prizes over $2,000 have to register their rules with a government agency, the Régie des alcools des courses et des jeux – which is usually just referred to as the "Régie."
> To top it off, contests with prizes worth more than $5,000 actually have to deposit an amount as a security with the Régie, as a means of protecting consumers should the contest runner fold or renege.
> When compounded with the complexities of working in two languages at once, many contest runners simply disqualify entrants from the province.
http://www.newgeography.com/files/cox-toronto-evolve-1.png
By all means they should be the dominant city in Canada instead of Toronto, or at least equal. But they are so obsessed with mirroring France's obsession with rules.
Canada almost always ranks near the top of the Economic Freedom Indexes (higher than the US), while France is in the middle ranking below most post-soviet eastern European nation states.
[1] https://www.theglobeandmail.com/investing/personal-finance/a...
But I now see it as a far better tourist destination than somewhere to build a life/business. Unless you're an artist or student who can't afford rent in a big city but still want to live in a big city (which is what 99% of the young people I met seemed to be doing, a whole lot of creative but unmotivated individuals).
I also found the stereotypes of the francophone Quebecois I heard my whole life growing up in Ontario to be surprisingly accurate (I went in highly skeptical as I'm a bit of a snob myself). The francophone parts of town were often both rude and hostile to someone still learning the language, while local laws force every worker to start every interaction in french. I was basically forced to start every interaction in every cafe/convenience store apologizing that I don't speak french well and continuing in English, missing every opportunity to learn. I also witnessed multiple protests over companies like JC Penny and not french-ifying their brand names (which sounds crazy to me), which I thought was ridiculous and unsurprising that business was slow there.
I spent a year living in MTL then came back multiple times over the last decade and very few new buildings or businesses changed. Meanwhile Toronto build about 100 new skyscrapers and new companies in the same time period.
They insist on having completely different laws for every little thing. From a companies POV, its probably as legally onerous as operating in a different country altogether - not worth it.
For an American firm especially, it's just a odd little place with everything in a different language, it's just not worth the hassle for lawyers and risk, so they just skip it.
It's much worse than that. Google didn't research the sweepstakes laws in, say, Paraguay or the Gambia before making this announcement. They figure that, in the worst case, their legal department will tell them not to award the prize if the winner comes from a country where they can't legally award it, and they'll scramble the necessary PR people if that comes to pass.
For Quebec, on the other hand, they'll be forbidden from carrying on business in all of Canada if they advertise this competition as one that can be won in Quebec. A terrible chilling effect - and I say this as someone who universally favours the freedom and self-determination of small nations such as Quebec.
The solution they came up with is to make the rules so complicated that there are no sweepstakes available in Quebec! Cool.
16 years or older to participate; 18 years or older to attend the onsite final round.
> If your age is not at least the Minimum Age [18+], you are only eligible to win a t-shirt.
https://codingcompetitions.withgoogle.com/codejam/rulesandte...
> A: Try picking a different team name, the team name you inserted is already taken.
A: How to tell your software was built by security people.
The error message doesn't leak which names are taken. The faq interprets the error message for the user.
I'm getting all introspective and seriously struggling trying to figure out why I have such a viscerally negative reaction to this. Like not just bafflement or indifference or boredom, I actively hate it. Can't really explain it. But it's apparent that I'm not their target demographic.
Prize amounts for CTFs are frequently variations of “leet”; I see nothing strange with this.
> A: Enable 3rd party cookies.
Come on Google, why do you require third party cookies for a competition amongst the most privacy conscience people on the planet?
Scrolling this page is sufferable, anchor links don’t work well, etc. Basic stuff.
Look no further than G Suite, Google Cloud for more examples.
The people that work on Android and Chrome are not the people who work on websites. It's okay to say the website doesn't meet your expectations, but it's better to recognize that those are different projects worked on by different people with different set of requirements and resources.
Companies should be concerned when their actions don't match the narrative they are trying to sell about themselves. If the Mobile Web is important to Google (and it should be), it must be a company wide effort. The “that's not my department” excuse doesn't cut it.
Still, colleges are usually much more eclectic than companies. Even MIT, usually known for STEM, has one kick ass humanities department.
Some of the stages in the CTF require you to download zip files and mount DMG/NTFS files. How do you propose to do that on a mobile?
And it’s not hard to do that.
[source: I was the on-call SRE for the 2017 edition]
You should be able to read the page on mobile effortlessly.
The fact that is polemic is symptomatic.
Even when I click on the beginner's quest, I've got paths, flags, endings, challenges...
...but nothing to tell me what the hell the thing actually IS!
All Google would have to do is move the sentence "they consist of a set of computer security puzzles (or challenges) involving reverse-engineering, memory corruption, cryptography, web technologies, and more" from the secondary page into the paragraph that's supposed to answer the question. It would actually be shorter.
Now on the one hand I'd say, ok, its not google's responsibility to try to have websites/non-standard browser configs set ups actually work with their web pages...
On the other hand, I'm sure the kind of security people google is looking for all surf the web with standard browser configs and permissions enabled...
And as the other commenter has pointed out, I know its radical of me, but I would have thought the "What is the google CTF" section should contain text which answers "What is the google CTF".
Now I'm not a (total) idiot, obviously I can debug it if i have to (and if other people are telling me "there's stuff there, you just can't see it").
If i open it in chrome with extensions turned off or a default mobile browser, stuff now appears, so yeah, its got to do with script permissions and the like.
But again, why not just include actual text in the "what is google ctf" section that answers "what is google ctf?", and/or in the beginner's section that explains what's going on, and of all the groups of people you'd build your webpage for, are security people the ones that you want a website that breaks if they block your default scripts/permissions?
Every puzzle here places you in a different unfamiliar situation. The only "outright disqualifying" thing is whether you can figure out something on your own. You essentially failed the first test.