Skip to content

Commit 73768a9

Browse files
author
Sorin Birchi
committed
Update system-exploration directory
Transitioned the 'system-exploration' directory to meet the requirements of the OpenEdu Methodology. Signed-off-by: Sorin Birchi <sb.birchi.sorin@gmail.com>
1 parent 5d93f1b commit 73768a9

File tree

29 files changed

+82
-70
lines changed

29 files changed

+82
-70
lines changed
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Doge
2+
3+
The best way to showcase the `strings` command is to use it in order to find our first flag for today.
4+
Head to the `tasks/doge/support` folder and take a look at the image you've been given.
5+
6+
Since this section is dedicated to the `strings` command, we'll run this command on our `doge.jpg` file:
7+
```
8+
root@kali:~/essentials/system-exploration/activities/doge/public# strings doge.jpg
9+
JFIF
10+
[...]
11+
eP!_"
12+
```
13+
14+
So there are lots of human-readable strings in this image, but very few, if any, actually make any sense.
15+
In order to filter them out, we'll use what we've learned today: `|` + `grep`.
16+
We'll try to find the flag itself.
17+
Maybe we get lucky.
18+
```
19+
root@kali:~/essentials/system-exploration/activities/doge/public# strings doge.jpg | grep SSS
20+
<there should be a flag here>
21+
```
22+
23+
That's how you use `strings`: often in combination with some filtering mechanism, such as `grep`.
24+
25+
Another way to get the flag is to run the `file` command:
26+
```
27+
root@kali:~/essentials/system-exploration# file activities/doge/public/doge.jpg
28+
activities/doge/public/doge.jpg: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "SSS{grep_your_strings}", progressive, precision 8, 500x500, components 3
29+
```
30+
The flag is included in the file as a comment.
31+
Image comments are often used in CTFs in order to hide some more subtle information, such as hints.
32+
Always remember to check them out.
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Empty Files
2+
3+
So many empty files...
4+
Nevertheless, you must find the flag!
5+
6+
If you're having difficulties solving this exercise, go through [this](/chapters/scratch-linux/system-exploration/reading/README.md##Sumary) reading material.
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Find Us If You Can
2+
3+
This is a two-stage challenge.
4+
The first flag is somewhere on the remote system.
5+
Use the hint it comes with, in order to figure out the second flag as well.
6+
7+
If you're having difficulties solving this exercise, go through [this](/chapters/scratch-linux/system-exploration/reading/README.md##Sumary) reading material.
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Not Your Doge
2+
3+
The image is in `.pnm` format.
4+
It has a rather simple header, that you can find [here](https://en.wikipedia.org/wiki/Netpbm#PPM_example)(`.pnm`s are almost the same as `.ppm`s; it's just the data encoding that differs).
5+
But it's incomplete.
6+
Find a way to reveal it completely.
7+
8+
If you're having difficulties solving this exercise, go through [this](/chapters/scratch-linux/system-exploration/reading/README.md##Sumary) reading material.
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Surgical Precision
2+
3+
There are many false flags out there.
4+
Answer the questions and find the **real** flags.
5+
The quizzes cover subjects discussed today and during the previous session.
6+
Think of them as a recap.
7+
8+
The answer to each of the riddles in the files `question-*` from the `activities/surgical-precision/public` is the name of one of the given files.
9+
When you've found an answer, upload the flag in that file.
10+
11+
Beware of [red herrings](https://en.wikipedia.org/wiki/Red_herring)!
12+
13+
If you're having difficulties solving this exercise, go through [this](/chapters/scratch-linux/system-exploration/reading/README.md) reading material.

chapters/scratch-linux/system-exploration/reading/README.md

+5-70
Original file line numberDiff line numberDiff line change
@@ -109,9 +109,9 @@ From them and from the commands general description at the beginning of the `man
109109
root@kali:~# find <where to look> <what to look for>
110110
```
111111

112-
- `<where to look>` is quite self-explanatory: it's a path in the file system, from where `find` will start to look for what whe told it.
112+
- `<where to look>` is quite self-explanatory: it's a path in the file system, from where `find` will start to look for what we told it.
113113
This means that `find` traverse the file system _down_ from the path it's given by looking exhaustively into each of its directories.
114-
- `<what to look for>` is where things get more intersting.
114+
- `<what to look for>` is where things get more interesting.
115115
We've already said that we can look for files that match certain properties, such as names, permissions, sizes, types and so on.
116116
Each of these properties can be specified as follows:
117117

@@ -211,7 +211,7 @@ However, `+` needs at least one character in order to match the specific string.
211211
Let's look at the following range: `[a-f]`.
212212
It starts at `a` and ends with `f`, inclusively.
213213
`[0-9]`, for example, matches any digit.
214-
Likewise, `[A-Z]` matches any capital leter, and so on.
214+
Likewise, `[A-Z]` matches any capital letter, and so on.
215215

216216
You can combine ranges.
217217
For instance, `[a-zA-Z]` matches any letter.
@@ -501,7 +501,7 @@ Use `less`!
501501

502502
### Grep
503503

504-
`find` has taught us how to use various criteria in order to filter throigh a file hierarhcy.
504+
`find` has taught us how to use various criteria in order to filter through a file hierarchy.
505505
This is definitely useful, but we can do better.
506506
`find` is highly capable of filtering output based on the files' **metadata**, i.e. "surface level" information, such as sizes, names and so on.
507507

@@ -545,7 +545,7 @@ Now that we can find our way inside a file hierarchy, we need a means by which t
545545
`grep` works just fine, provided we're dealing with text files.
546546
But what if we aren't?
547547

548-
In this case, we'll need to taka a sneak peak into some _binary analysis_.
548+
In this case, we'll need to take a sneak peak into some _binary analysis_.
549549
We'll get back to this subject starting from from Session [Data Representation](../data-representation).
550550

551551
### `file`
@@ -568,39 +568,6 @@ activities/05-challenge_not-your-doge/public/not-doge.pnm: Netpbm image data, si
568568
One of the most basic forms of binary analysis is to simply look for any human-readable string present in a binary file.
569569
For this purpose, we'll use the `strings` command.
570570

571-
#### Tutorial: Doge
572-
573-
The best way to showcase the `strings` command is to use it in order to find our first flag for today.
574-
Head to the `activities/doge/public` folder and take a look at the image you've been given.
575-
576-
Since this section is dedicated to the `strings` command, we'll run this command on our `doge.jpg` file:
577-
```
578-
root@kali:~/essentials/system-exploration/activities/doge/public# strings doge.jpg
579-
JFIF
580-
[...]
581-
eP!_"
582-
```
583-
584-
So there are lots of human-readable strings in this image, but very few, if any, actually make any sense.
585-
In order to filter them out, we'll use what we've learned today: `|` + `grep`.
586-
We'll try to find the flag itself.
587-
Maybe we get lucky.
588-
```
589-
root@kali:~/essentials/system-exploration/activities/doge/public# strings doge.jpg | grep SSS
590-
<there should be a flag here>
591-
```
592-
593-
That's how you use `strings`: often in combination with some filtering mechanism, such as `grep`.
594-
595-
Another way to get the flag is to run the `file` command:
596-
```
597-
root@kali:~/essentials/system-exploration# file activities/doge/public/doge.jpg
598-
activities/doge/public/doge.jpg: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "SSS{grep_your_strings}", progressive, precision 8, 500x500, components 3
599-
```
600-
The flag is included in the file as a comment.
601-
Image comments are often used in CTFs in order to hide some more subtle information, such as hints.
602-
Always remember to check them out.
603-
604571
## Summary
605572

606573
Here are a few useful snippets from today's session:
@@ -609,38 +576,6 @@ Here are a few useful snippets from today's session:
609576
- `cat large_file | grep SSS`: looks for the `SSS` string in a large file, so you don't have to do this manually;
610577
- `find some/path <some criteria> | xargs grep SSS`: look for the `SSS` string in each file that matches some specified criteria.
611578

612-
## Activities
613-
614-
### Challenge: Surgical Precision
615-
616-
There are many false flags out there.
617-
Answer the questions and find the **real** flags.
618-
The quizzes cover subjects discussed today and during the previous session.
619-
Think of them as a recap.
620-
621-
The answer to each of the riddles in the files `question-*` from the `activities/surgical-precision/public` is the name of one of the given files.
622-
When you've found an answer, upload the flag in that file.
623-
624-
Beware of [red herrings](https://en.wikipedia.org/wiki/Red_herring)!
625-
626-
### Challenge: Empty Files
627-
628-
So many empty files...
629-
Nevertheless, you must find the flag!
630-
631-
### Challenge: Find Us If You Can
632-
633-
This is a two-stage challenge.
634-
The first flag is somewhere on the remote system.
635-
Use the hint it comes with, in order to figure out the second flag as well.
636-
637-
### Challenge: Not Your Doge
638-
639-
The image is in `.pnm` format.
640-
It has a rather simple header, that you can find [here](https://en.wikipedia.org/wiki/Netpbm#PPM_example)(`.pnm`s are almost the same as `.ppm`s; it's just the data encoding that differs).
641-
But it's incomplete.
642-
Find a way to reveal it completely.
643-
644579
## Further Reading
645580

646581
## Forensics

config.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,17 @@ docusaurus:
6666
path: chapters/scratch-linux/system-exploration/
6767
subsections:
6868
- Reading: reading/README.md
69+
- Drills:
70+
path: drills/
71+
subsections:
72+
- Tasks:
73+
path: tasks/
74+
subsections:
75+
- Doge/: doge/README.md
76+
- Empty Files/: empty-files/README.md
77+
- Find us if you can/: find-us-if-you-can/README.md
78+
- Not your doge/: not-your-doge/README.md
79+
- Surgical precision/: surgical-precision/README.md
6980
- Demystifying the Web:
7081
- Overview: chapters/demystifying-web/overview/README.md
7182
- Explaining the Internet:

0 commit comments

Comments
 (0)