Using z3 to find a password and reverse obfuscated JavaScript - Fsec2017 CTF

Recently I attended fsec 2017 in croatia. And there was a cool CTF challenge I solved during the conference that I wanted to share.
script: gist.github.com/LiveOverflow/...
=[ 🔴 Stuff I use ]=
→ Microphone:* geni.us/ntg3b
→ Graphics tablet:* geni.us/wacom-intuos
→ Camera#1 for streaming:* geni.us/sony-camera
→ Lens for streaming:* geni.us/sony-lense
→ Connect Camera#1 to PC:* geni.us/cam-link
→ Keyboard:* geni.us/mech-keyboard
→ Old Microphone:* geni.us/mic-at2020usb
US Store Front:* www.amazon.com/shop/liveoverflow
=[ ❤️ Support ]=
→ per Video: / liveoverflow
→ per Month: / @liveoverflow
=[ 🐕 Social ]=
→ Twitter: / liveoverflow
→ Website: liveoverflow.com/
→ Subreddit: / liveoverflow
→ Facebook: / liveoverflow
=[ 📄 P.S. ]=
All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.
#CTF

Пікірлер: 76

  • @webwolfy7310
    @webwolfy73105 жыл бұрын

    This is by far my favourite hacking related KZread channel, the story + CTF format works great as far as I'm concerned.

  • @seismicdna
    @seismicdna6 жыл бұрын

    I think if you keep the story + film in the first part and the challenge in the second part (or vice versa), a lot of people would like it.

  • @indexoverflow

    @indexoverflow

    6 жыл бұрын

    Agreed. The storytelling was interesting, but it made the flow of the video a bit unnatural. Try it the way suggested above.

  • @ltstaffel5323

    @ltstaffel5323

    6 жыл бұрын

    +1

  • @lpnando

    @lpnando

    6 жыл бұрын

    I also agree

  • @blairsaid
    @blairsaid6 жыл бұрын

    Very impressive man. Really enjoyed your video and was satisfied with the story telling.

  • @Jango1989
    @Jango19896 жыл бұрын

    I liked the story telling and thought it added to the video and made it more interesting and entertaining to watch.

  • @kingkongrilla
    @kingkongrilla2 ай бұрын

    Very dope video walking through the various skillsets required to solve such a problem, as well as the need to understand the scope of a problem. De-obfuscation is really the secret sauce, once you understand the recipe manipulating it is just a matter of how lazily/efficiently you can execute.

  • @BoZmD
    @BoZmD6 жыл бұрын

    I thought the video was a nice intro to why and where you made this. I like your humility. I also like the pacing of the video. Sure I wish you would slow down, but I can watch it again. You get to the solution quickly showing how each step fits together. I will rewatch closer.

  • @einstian
    @einstian5 жыл бұрын

    I really like your videos! Great for learning how to deconstruct ctf challenges :)

  • @biehdc
    @biehdc6 жыл бұрын

    As you asked if storytelling + reversing is good, i dont think so, because it breaks the thought process when you try to follow whats going on, especially for less experienced like me i think

  • @LiveOverflow

    @LiveOverflow

    6 жыл бұрын

    thanks! valuable feedback :)

  • @FreeER

    @FreeER

    6 жыл бұрын

    same opinion here. Even though you'd just mentioned it the jump from the anti debugger to the story made me stop the video and say "wait, what?". I don't mind a story _and_ a debugging session/explanation in the same video but interleaving the two when the story isn't some part of the explanation (eg. a friend of mine pointed out...it reminded me of...) apparently breaks my mind :D

  • @ryangurak5239

    @ryangurak5239

    6 жыл бұрын

    I agree. But, I like to hear both types of things, perhaps intertwined more thoroughly so it doesn't seem so jarring.

  • @MrJellekeulemans
    @MrJellekeulemans2 жыл бұрын

    Love your videos. I'm learning alot from them.

  • @msec7188
    @msec71886 жыл бұрын

    Look at that Cake!!! Nice vid as always !!

  • @theotherguy6282
    @theotherguy6282 Жыл бұрын

    Appreciate the honesty on how long it takes to solve ctfs

  • @phiber9
    @phiber94 жыл бұрын

    great meeting you dude! too bad we didnt get a chance to talk over a beer.

  • @evilchairproductions482
    @evilchairproductions4825 жыл бұрын

    I'm going trough your CTF playlist and I find my country! Yaay!

  • @DSAhmed
    @DSAhmed2 жыл бұрын

    I love it when you drop F bombs. Great videos. I'm sad that KZread algorithms took so long to suggest your videos to me.

  • @Kabup2
    @Kabup25 жыл бұрын

    Hey, do you know something about a IATool to reverse bins? IA used to auto reverse? Or IA used as a hacker tool in anyway?

  • @SergioAndress
    @SergioAndress3 жыл бұрын

    Muito interessante seus vídeos sobre hacker, obrigado por compartilhar seus ensinamentos e por sua humildade em ser quem você é!

  • @DM-qm5sc
    @DM-qm5sc4 жыл бұрын

    It sucked That the video ended 😭

  • @zzh1996
    @zzh19966 жыл бұрын

    why can't I register for this CTF? is it closed? when I press enter in the register form, the pages refreshes and nothing happened

  • @angryman9333
    @angryman93333 жыл бұрын

    i need to rewatch these, since first time i saw it i didn't knew shit about this stuff

  • @owendearmond-macleod5668
    @owendearmond-macleod56686 жыл бұрын

    I thought it was a good mix between talking about the conference and playing the CTF.

  • @jynns2556
    @jynns25566 жыл бұрын

    Wow great video

  • @Bickers42
    @Bickers425 жыл бұрын

    Nice video, have you got a link or a backup of the challenge files? The link in the video doesn’t work anymore

  • @pinokio514
    @pinokio5145 жыл бұрын

    Hi. Where I may to find the pdf presentation (3:47)?

  • @r00tb33
    @r00tb336 жыл бұрын

    I'm asking for a favor pls make a playlist of all web app security videos from your channel. I'm a newbie to web app sec it would be really helpful for all of us. Thanks.

  • @jeremypatrickdahan
    @jeremypatrickdahan4 жыл бұрын

    Hey, do you have a link for the CTF or is it down ?

  • @AlboCoder
    @AlboCoder6 жыл бұрын

    Are you going to be at defcamp CTF?

  • @NickInts
    @NickInts6 жыл бұрын

    Hahaha flag hoarding! Well when you're the main person who makes CTF videos, I guess people expect you to be a god!

  • @crispy_rw
    @crispy_rw4 жыл бұрын

    More fun @liverOverFlow

  • @Handlessuck1
    @Handlessuck14 жыл бұрын

    i wish i could do this but where to start?

  • @lucid8584
    @lucid85845 жыл бұрын

    you WERE IN CROATIA WHY THE FUK I DIDNT VISIT THAT CONFERENCE :(

  • @kim87713
    @kim877135 жыл бұрын

    how to download any html files?

  • @leon1985ist
    @leon1985ist4 жыл бұрын

    Hi how are you mate !! Thanks for this awesome videos , do you may sharing what kinda resources and books you study to Lear all of this please , am just starting to hacking and HTB and CTF

  • @nukexplosion6679

    @nukexplosion6679

    3 жыл бұрын

    You can read "Hacking: The art of exploitation" and "Attacking network protocols". Also you can see LiveOverflow's binary hacking and web hacking playlist. I recommend you start with "Hacking: The art of exploitation" and the binary playlist first, then go for web and network protocol stuff. Also be sure to check out this invaluable reddit post: www.reddit.com/r/hacking/comments/a3oicn/how_to_start_hacking_the_ultimate_two_path_guide/

  • @nukexplosion6679

    @nukexplosion6679

    3 жыл бұрын

    Also check out his "The secret step by step way to start hacking" video

  • @mariomlinaric745
    @mariomlinaric7455 жыл бұрын

    I live in Croatia (Zagreb)!

  • @chegevarra1036
    @chegevarra10363 жыл бұрын

    What is this video about for?

  • @muha0644
    @muha06445 жыл бұрын

    9:53 well at least you can solve them... unlike me

  • @SimonWanner
    @SimonWanner6 жыл бұрын

    I recently wrote a deobfuscator for this kind of while/switch obfuscation: gist.github.com/skyrising/00a3500e24ddeab167c5692445e6dd11

  • @omerkatz3595
    @omerkatz35956 жыл бұрын

    Very good video, where can I get z3?

  • @Creuilcreuil
    @Creuilcreuil6 жыл бұрын

    nice vid as always, btw *def* is_valid(c): *return* c *in* "APSYD0GNIL1_"

  • @LiveOverflow

    @LiveOverflow

    6 жыл бұрын

    +Creuilcreuil _ no. That won’t work. It has to be a z3 expression

  • @SimoneAonzo1988
    @SimoneAonzo19886 жыл бұрын

    No storytelling... "real life good graphics bad gameplay"

  • @liptakszabolcs1395
    @liptakszabolcs13955 жыл бұрын

    Hahaha CTF decoding machine :)

  • @HDQuote
    @HDQuote6 жыл бұрын

    why does he have a juche (korean communist) sticker on his laptop at 1:31?

  • @zacpier

    @zacpier

    6 жыл бұрын

    His laptop's hostname is "redstar-os" I wouldn't think much of it

  • @cothan2062
    @cothan20626 жыл бұрын

    Interesting. I modify your code and use BitVec only, (I removed BV2Int) and the code produces unsat. However, in BitVecRef, there is __mul__ and __div__, so I think there is no need to convert it to Int (by using BV2Int) at line 61, 62. Then I figure out, that in line 61, the divide operation in BitVec is un-natural, so we have to use BV2Int. (pictures included) imgur.com/LUKQFnL TIL: __mul__ in z3 is great, __div__ is not.

  • @LiveOverflow

    @LiveOverflow

    6 жыл бұрын

    I spent most of my time fighting with z3. I also tried it with BitVecs first. I think I ran into the same issue and got frustrated.

  • @ko-Daegu

    @ko-Daegu

    2 жыл бұрын

    Where can I learn more about z3

  • @samfoxman7046
    @samfoxman70466 жыл бұрын

    This firefox extension works very well to deobfuscate javascript. (Only works on old firefox versions) addons.mozilla.org/en-US/firefox/addon/javascript-deobfuscator/

  • @IceHax
    @IceHax5 жыл бұрын

    why do you even censor your face if you spoke in public and people could see you? i dont get it lol

  • @generalkenobi300
    @generalkenobi3006 жыл бұрын

    Buy the ST license...

  • @nile7999
    @nile79996 жыл бұрын

    THIS THE SHIT I DO LIKE HYAHHHHHHHHHHHHH

  • @Fabian-_-
    @Fabian-_-6 жыл бұрын

    Wow 😵 wie? :D

  • @89elmonster
    @89elmonster6 жыл бұрын

    I didn't know you were black

  • @4pxris3

    @4pxris3

    5 жыл бұрын

    what? he's german how would he be black

  • @Whynot83848

    @Whynot83848

    5 жыл бұрын

    @@4pxris3 because he blackened his face

  • @francismori7

    @francismori7

    5 жыл бұрын

    @@4pxris3 also lol, why can't a german-born person be black? :/

  • @pavansai6078
    @pavansai60785 жыл бұрын

    How to find password for 7z file ?? Plz reply

  • @ahmedselimuzum3049

    @ahmedselimuzum3049

    5 жыл бұрын

    You can brute force it with John the ripper

  • @pavansai6078

    @pavansai6078

    5 жыл бұрын

    @@ahmedselimuzum3049 where to get the john the ripper ?

  • @ahmedselimuzum3049

    @ahmedselimuzum3049

    5 жыл бұрын

    @@pavansai6078 github.com/magnumripper/JohnTheRipper the official repo of John The Ripper

  • @pavansai6078

    @pavansai6078

    5 жыл бұрын

    @@ahmedselimuzum3049 bro how to use any video plz

  • @ahmedselimuzum3049

    @ahmedselimuzum3049

    5 жыл бұрын

    @@pavansai6078 kzread.info/dash/bejne/ioGIzamHg9zJl5M.html a tutorial for john the ripper 7z cracking

  • @rogercruz1547
    @rogercruz15475 жыл бұрын

    Somebody added a portuguese translation to your video and the title simply sucked ass, I had to switch to english to understand what was happening...

  • @hemanth.alluri
    @hemanth.alluri5 жыл бұрын

    I don't really like this style of mixing the write-up and the story-telling parts. It ruins both. Having both exist separately (either in the same video or as 2 separate videos) would be better.

  • @nathanoy_
    @nathanoy_2 жыл бұрын

    lol 8:00 python really has evolved a lot. these 10 lines are now just `x in "APSYD0GNIL1_"` xdd