Automotive Security — ASRG CTF Writeup
Hello CTF Players,
This CTF was dedicated to Automotive and Car Hacking
I will explain how i have solved some of them.
I have Achieved 1st Place in it 🤩
Let’s get started.
CAN1 — Easy
This is was a file that contains output from cansniffer tool which is used to see the change in CAN bus traffic
(CAN bus) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other’s applications without a host computer.
Well, this challenge was easy i was able to grab the flag by just searching for it :)
FLAG : flag_4578963254174567
Notice the timing 9.999999 and 0.000000 and the same ID, which i used the same methodology in other challenges ( CAP1, CAP2 )
I SMART AUTO — WEB ( Medium )
Starting of the challenge we find an input field needs a key to get unlocked and a deleted text JWT, so it’s was confusing
The first thing came to mind to crack it and use the password of the signature as a key
Cool, getting the key didn’t take time but sadly it failed when entering it as unlocking key, and when trying to see the token in jwt.io we found that we still need to get the VIN-KEY
After some searching, I found that VIN-KEY is the vehicle identification number which normally is a 17 Char length
So with more searching on the site, I noticed there is a PNG called VIN in the view-source
Opening it to find it’s a QR code, reading the QR to get the VIN-KEY finally which is 1GNEK13ZX3R298984_2020
Now we got the Key, let’s combine it with the JWT and craft the right one
Now i still don’t know how to grab the key to unlock, so I tried to send the JWT as a cookie and I guessed ‘key’ as the cookie parameter, and send it to dashboard.php which was needs authentication to access it and that’s worked fine and i grabbed the flag.
Also after a while, I figured out that i just had to send the crafted JWT in the unlock input field *FELT DUMP* :)
Flag{AUT0M0TIVE2020_XD_200}
Reply — Forensics ( Medium )
This challenge is about replay attacks on CAN traffics
It’s was a ZIP file contains two files
sound.wav
open_the_door.jpg
Opening the wave file with audacity it was a load of noise with only something in between
Referring to a video i have watched from hak5 channel, it was describing a something similar on how to get the binary data and perform the reply attack *will add it to references below*
so i start to zoom in to get a clear view of this area to read it
A signal up means 1 and a low signal means 0, considering the repeated signals
I did it manually to find that i have a 120 bit binary now
001100010101111100110010010111110110100001100001010000110110101101011111010011010111100101011111011000110011010001110010
Converts it to ASCII to get this sentence : 1_2_haCk_My_c4r
I thought it is the flag but i was wrong *SAD*
After a while, i remember that there is another jpg file .. and it’s a forensics challenge so it may have a stegano side
Tried a fast check with steghide tool to see if something inside the photo with the obtained sentence from the wav file and yes it worked and extracted another ZIP file including the flag.txt and open.jpg
fl@g{NO7_on1y_k3y_fob_it$_G5M;)}
Location — Forensics ( Medium )
What this challenge need from me is to get a location of something
The file was output from candump utility
I wasn’t able to do anything at it for a long time then i decided to look at it again and search for corrupted or modified CAN-BUS messages
i find out that there is a lowercase hex values among all the others with uppercase.
that takes my attention and it has ID of 137 which fastly reminded me of ‘1337’
So i grep on the id to get all the data from it
took the data and converts it to ASCII to get a longitude and latitude coordinate, in this moment i knew that challenge has been solved
Copied and pasted it on google maps to get the exact location and it turns to be the Tahrir Square in Egypt lol.
so the flag would be ‘TahrirSquare’ because flag format was the location name without spaces
CAP2 — Hard
This challenge was a pcap file that contains a cansniffer data
The goal was to find the manipulated traffic signals.
Analyzing it to find it’s somehow similar to CAN1.
so i looked at the times and the duplicate signals in ( 0.000000 , 9.999999)
I noticed that there is a duplicated signal with the same ID but only the last Bit is different.
I suspected that if maybe this ID 157 that contains the manipulated signal so i grep on it and i found all the modified last bits
collecting the modified bits with ignoring the duplicates which are happened in time 0.000000 ( not happened in fact ) to form the flag
flag_05B2873A2FA21D297D3442FF
by the way, CAP1 challenge was having a similar idea.
Thanks for reading and hope you have enjoyed :)
Cheers,
References :
3- Reply Challenge : https://www.youtube.com/watch?v=F3bISk5t8cA
4-CAN-Utils: https://github.com/linux-can/can-utils
