Full transcript
0:00The future is
0:01>> redacted.
0:02>> And when I say that, I mean the comic
0:04book. Maybe you've heard of or been to
0:07Wild West Hacking Fest, one awesome
0:10information security event, and
0:12personally one of my favorite
0:13conferences. And maybe you've seen or
0:15even played back doors and breaches, a
0:17super cool approach to tabletop
0:19exercises, an incident response card
0:22game. These are some of the sweet
0:23innovations from the Black Hills
0:25information security tribe or family of
0:27companies. There's BHIS itself. There's
0:30Active Countermeasures, Wild West
0:31Hackingfest, Annie Siphon Training, and
0:34maybe one that you haven't seen before,
0:35Rea Comics. Obviously, these folks have
0:38a great knack for making some super
0:40creative stuff that helps share cyber
0:42security education and celebrate what we
0:45do. REA Publishing, and you might notice
0:47it, the word hacker backwards, creates
0:50comic books and magazines for the
0:52information security industry and for
0:54fans of true crime stories and comics.
0:56Now, I got to admit, I have a lot of
0:59these. I have their collaboration with
1:02the prompt comic and magazine that they
1:04did with Darknet Diaries, in case you're
1:06interested, in case you listen to that
1:08podcast or see some of that material out
1:09and about. I've got their infosex
1:11survival guide. And I really love this
1:13idea. When they were first kind of
1:14crowdfunding and like kickstarting the
1:16idea for the future is comic, I was a
1:19backer. I helped back the initiative and
1:20project. And I even got like a cool
1:22little character in the comic books.
1:25Look, look, look, look. this page on the
1:27opening scene here. Look, that's me. I'm
1:29in a comic book. So, the future is comic
1:32book is a whole complete story. It's
1:35like the idea of a possible future based
1:38off of our technological decisions
1:41today. And the story behind it blends
1:43traditional comic book style stuff with
1:46actual hacking from actual hackers. And
1:49the coolest thing is that all of the
1:51comics have different cyber security
1:53challenges embedded in the story so that
1:56you could do some of the hacks just as
1:58well. Like there's a whole CTF included
2:01within the pages and on the cover of
2:03these comic books are capture the flag
2:05challenges that we could do. Like take a
2:07look at the front cover of some of these
2:09original editions. You might be able to
2:12see if you look closely at the bottom
2:14right there's a little bit of a secret
2:16message tucked away in the corner. If I
2:18zoom in a little bit, you might be able
2:20to see it. Scrolling down, you see this
2:22yellow text? What is that? If we looked
2:24at that text horizontally and actually
2:27kind of rotated it maybe from the
2:28picture, we could see, yeah, those are
2:30like special symbols or characters that
2:33represent some other text or message,
2:35but it's like a cipher. And maybe some
2:37folks recognize this, but we could use a
2:39site like decode.fr
2:41to kind of get an idea for what those
2:42cipher symbols could be. They have a
2:45whole section on different codes and
2:47alphabets where you might see various
2:49symbols that look like that or anything
2:51else. Turns out this, I think, is the
2:54pig pen cipher. Those look pretty
2:56familiar, right? So, we could just kind
2:58of click and type in, so to speak, what
3:01these symbols are and then get the
3:02message out. There's a left arrow, sort
3:05of a C looking character. All right, I
3:08tried to type it all out. What do we
3:09got? If we click decrypt, ooh, looks
3:12like a URL kind of thing, right? TFI,
3:15the future iscomic.io/bbleleeds.
3:18If we jump over to that web URL, look at
3:21this. The future is the original cover
3:23here. The cover challenge says,
3:25"Congratulations, you've solved a cover
3:27puzzle. Here is a reward for finding
3:29it." And this is a key, the flag, right?
3:31Oh, we could submit this on the
3:33platform, but now they give us another
3:36challenge. If we scroll down here, we
3:38can see there is a whole scoreboard and
3:40there are several flags scattered in
3:41various places across the comics. And
3:44hey, super quick, if you did want to
3:45follow along, get yourself some of the
3:47comic books and the challenges here,
3:48these are all available at the Spearfish
3:51General Store. There's a link below in
3:53the video description and it is not a
3:55fishing link. And the Spearfish General
3:57Store is not a fish. It just has a cool
3:59clever name, but here you could get the
4:01back doors and breaches, some swag, some
4:03merch. You've probably seen me wearing a
4:05couple of these shirts here and there.
4:06Infosex survival guide, even the
4:08Huntress expansion deck for the Black
4:10Hills back doors and breaches game, the
4:12playmat for real tabletop exercises, the
4:15die or dice for like the D20, you know,
4:17Dungeons and Dragon style stuff. It's so
4:20so cool. Anyway, the uh Reco comics over
4:22here on the navigation, you could see
4:25you could get your hands on all of the
4:27sweet the future is redacted at whatever
4:30super approachable easy peasy price tag.
4:33It's not a fish, even though it's got
4:34that cool name, Spearfish General Store,
4:36link in the video description. There's
4:38like a full CTF scoreboard though, and
4:40there's a whole community diving into
4:42this. You could go take a look at the
4:44Discord server where all this is
4:46happening, and folks are chatting about
4:48it. Big shout out to Metac. I think
4:50they've been doing some really sweet
4:51stuff with BHIS and all the incredible
4:53things to get some more games and cyber
4:55security CTFs, exercises, activities out
4:58and about. But let's go to the
4:59scoreboard. Here is the future is
5:02challenges. the CTF scoreboard we could
5:04go interact with and they have the
5:06problems page for us to explore. Okay,
5:08so we could submit some bonus challenges
5:10or flags here kind of based off the
5:12different characters in the story or on
5:14the different cover pages here. This is
5:16sweet. So, what's this one we could
5:18submit for uh bonus here? Oh, there is a
5:21bonus button at the very top. Can I
5:24paste that? Yeah. Awesome. Now, we have
5:26a new URL to go to OGN. What is that
5:30thing? Hey there. Are you trying to
5:32crack the cover password? What happens
5:34when you mix colors? Try doing it with
5:36the images below. These are like kind of
5:38seven seven segment displays, but set up
5:41RGB style. I think we could Oh, we could
5:44download the images. Let me do that. All
5:46right, I've got these downloaded. And I
5:47guess we could like kind of put them
5:49over top each other and see maybe what
5:51of the segments uh overlap. Maybe I can
5:54do that in like right? Photoshop
5:56equivalent, you know, like open source
5:57image manipulation program. And we can
5:59figure out how to do this from the
6:00command line with some other tools. This
6:02is kind of cutesy, I know, maybe a
6:04little bit of a manual approach, but I
6:06got these open as each kind of different
6:08documents and files. Let me try to put
6:10them all in on one just so we could work
6:12with the different layers. And then
6:13let's like bring the opacity down a
6:16little bit. Let's bring the opacity down
6:17a little bit. And another one down a
6:19little bit. Uh, not super good.
6:22Actually, what if we kind of merged all
6:24of these together? Now, can I create a
6:27new image from visible? Yeah. And then
6:29let's just tweak the maybe exposure. Can
6:33we make a little more clear? Sort of.
6:36Kind of. What about levels, brightness,
6:38and contrast? A lot of options we could
6:40kind of muck around with. Ooh. Ooh. That
6:43one actually kind of looks like
6:44something. That's the word plasma. Oh,
6:47wait, wait, wait. I think I've got it.
6:50cuz we could now that we've stacked all
6:52of these different layers, we could use
6:54something like the threshold, right? And
6:56then try to go find where is the sweet
6:59spot where we see the letters combined
7:03actually starting to show a word. Yeah,
7:05there's plasma. That's pretty clear. So,
7:09do I submit the word plasma on the
7:12scoreboard for the OGN crack the
7:15whatever challenge? Total everything
7:17else off. So, I just have the OGN
7:20category. Okay. Uh, plasma maybe. Yeah.
7:25Then what do we do? What's the next
7:28challenge? Oh, yeah. Yeah. It's got to
7:29be in the comic book for sure, right?
7:32See that down there? It's another link
7:34to another challenge. So, let's go to
7:36that website URL. tfiocomic.io/gun.
7:40And here we are with the real challenge
7:42one. Ooh, you found a challenge. And we
7:44have a small bonus flag for finding
7:47this. We can submit that on the
7:48scoreboard. Another bonus flag. We could
7:51enter this. Excellent. And then we have
7:54the challenge one prompt here. After
7:56gaining admin access to the smart rifle
7:58system, what is the flag? H. More of the
8:01instructions were here on the tfcomic.io
8:04website. It says, "Wheeler, one of the
8:06characters in the comic books, has
8:07gained access to the pirate smart rifles
8:09via an interactive console. Help him
8:11take control of them. Connect to the
8:13console with Netcat. Oo, even host and
8:15port number here." So, now we're getting
8:16to some real stuff, right? I know the
8:18last couple challenges were, oh, cool,
8:19sweet puzzles, but we actually could
8:21even download a copy of the program to
8:23see maybe some of the source code and
8:25then interact with this thing from a
8:27terminal. So, to look and feel like a
8:29real hacker, he he haha, I'm going to
8:31open up my Kali Linux terminal and then
8:33netcat paste this in. NC challenges.tfic
8:36comic.io on port 705.
8:39And once I hit enter, welcome to the
8:42smart rifle system. What would you like
8:43to do? Activate friend or foe system.
8:46Enter the administrator password or
8:49exit. Well, I guess I'd want to become
8:51an admin, right? That's kind of what I
8:52want. Please enter the administrator
8:53password. Uh, I don't know what that's
8:56supposed to be. Okay, then we just get
8:58Luke back into the application. So,
9:00let's go try and see what that download
9:02was. I had rightclicked and copied the
9:05link, so I could just curl this down.
9:07And I will actually output to save it as
9:09a console. py, the same file name that
9:12they provided there. So, I'm going to
9:13assume, right? A little bit of a Python
9:15script. Let me take a look. It is a
9:17Python script. So, let's open that up in
9:19a text editor like Sublime Text. And
9:21look at this. We got a real little
9:24program here. So, we start with the
9:25usual Python shebang line. We import the
9:28time module or package. And then we have
9:30a main function defined. And that ends
9:33up reading the flag.ext file, likely
9:35server side, right? That's why we're
9:37connecting to it remotely uh with
9:39netcat. So it has the value of the flag,
9:41but we need to figure out what it could
9:42be. There's a little sleep after it
9:44displays the banner. And then we could
9:46see even just hardcoded inside of this
9:49program. Right now an admin variable
9:51like a boolean track. Oh, are you the
9:54admin or not is currently set to false
9:56because we're not the admin. But we have
9:58the admin pw encrypted like their
10:01password. And that looks to be some big
10:03long string of numbers and letters,
10:05right? So uh 6D 6E. It looks like
10:08there's a common trend of letters A
10:10through F and numbers 0 through 9. So
10:13that's hexadimal, right? But then the
10:15rest of the code here, we're looking
10:17through just a while loop. So infinite
10:19loop to kind of prompt and wait for our
10:22input. And then we're checking if we are
10:24an admin or not. Then we could oh
10:26activate that friend or foe system, that
10:29first option, and then it would display
10:31the flag here for us. But we need to
10:34become the admin first and enter the
10:37admin password. So the way that they
10:40uncover this is by checking if the
10:43password that we input and enter here is
10:46the admin password that they uncover
10:49after they have decoded or decrypted or
10:52really just kind of oh unraveled what
10:54the raw plain text real admin password
10:57is. And then we would become admin and
11:00we could toggle and run the friend or
11:02foe system. Okay. So we need to sort of
11:04reverse engineer smartly simply anything
11:07to try and uncover what is this original
11:09admin password value. Well, since it's
11:12just Python, since we can read the
11:14source code and see what this app is
11:16doing, we could just kind of do the very
11:18same, right? Could we just run Python
11:20ourselves and then actually uncover what
11:23the admin password should be based off
11:26of the admin password encrypted value
11:28which we know like we can see that up
11:30above. So let's try and copy and paste
11:33kind of the pertinent lines here and let
11:35me go back to my terminal just so I can
11:37interactively run Python. Like I could
11:39do whatever uh you know enter any code
11:42that I want here oneplus 1 enter strings
11:45blah blah blah but let's get the real
11:46value that we know the admin password
11:49and since that is now defined and in our
11:53scope we have access to that info and we
11:56could just use the exact same line that
11:58they do to uncover the real admin
12:01password. I'm going to paste that in.
12:04And now that that's defined let's go
12:06take a look. Really, we could print this
12:07out, but since we're in a ripple, read,
12:09evaluate, and print loop, even just
12:12typing in admin pw encrypted like I did
12:14above, it would show me the value, but
12:16print makes it pretty clear. Ooh, okay.
12:19The actual value is most trusted in the
12:21smart rifle industry. So, that is what
12:24we should submit. If I copy and paste
12:26this value and then bring that back to
12:29our remote connection here with netcat,
12:32I'll hit enter. Get back to this. We
12:34will enter the administrator password
12:36because we need that to activate the
12:38friend or foe system if we chose option
12:41one. But let's go ahead and do it. Let
12:43me paste in that value. Most trusted in
12:45the smart rifle inventory or industry.
12:48Right. Admin password is verified.
12:50Privileges have been updated. So now I
12:52could activate the friend or foe system.
12:54And we get the flag and the key that we
12:56could submit to solve this challenge.
12:59All right. A little bit of uh Python
13:01stuff here. Let's submit that. That is
13:03correct. But look at all the other
13:05challenges that are available here. Even
13:07for just this edition, like when we
13:09toggled off all the others, you might
13:11have seen those all in the general
13:13Spearfish store. Spearfish general
13:15store, not a fish. These are all other
13:17CTF challenges that we could find within
13:19the pages of the comic books. And that
13:22is just so stinking cool. Like look at
13:25that. Like the art is incredible. I love
13:27the story and just the whole idea behind
13:29this super sweet. And another really
13:31awesome part of this is that look, the
13:33community is involved. You got people
13:35playing. You got people participating
13:36and sharing writeups like their
13:39solutions as they're working through all
13:41of these different challenges all inside
13:43the comic series. Take a look at this.
13:45The future is solved. Big shout out to
13:48Louis Merlin, Cetrol, Sky Critch, Josh
13:52B, and tons of the other folks that are
13:54sharing uh their learnings through this
13:56thing. And it's cool because it's all
13:57kind of by issue. And they even include
14:00the notes here like look some of these
14:02as you work through them are going to be
14:04under a little bit of an embargo, right?
14:06You should wait a couple months until
14:07you know the article, the comic, the
14:09editions been out the door before you're
14:11sharing solutions and the writeups all
14:13in all here. But it's so cool to see
14:15this. And of course, there are more
14:17editions of the comic book still on
14:19their way. But I hope you got to see how
14:21this had a really cool sort of
14:22trajectory, like a little bit of
14:24momentum here. like the beginning early
14:26challenges were some you know oh cipher
14:28pig pen something you could do with like
14:30decode.fr FR some online resources. Then
14:33we got to like real code like actually
14:35using netcat to interact with another
14:36application or service. Uh and some of
14:38the later ones are getting into really
14:40sweet stuff. There's a buffer overflow
14:42vulnerability for a challenge that you
14:44might be able to go beat up using GDB
14:46using tools. And that totally has the
14:48real CTF stuff that Metac always does an
14:51incredible job for. And I know I just
14:53kind of scratched the surface in this
14:55video. We did like maybe one of the real
14:57challenges and a couple other the bonus
14:59key cover flag stuff, but I think it'd
15:01be pretty cool to make a couple more
15:03videos walking through the different
15:04challenges here going through the CTF
15:06for the future is redacted. But hey, if
15:10you want to grab a copy of your own if
15:12you want to be able to follow along, go
15:13through some of these challenges with
15:14me. I really hope you go pick up a sweet
15:16copy. Super accessible, super easy price
15:18tag, and it's not a fish. Spearfish
15:20General Store, not a fish. It's real and
15:23it has some really cool stuff. Big shout
15:25out, big love. You know, I big fanboy of
15:28a lot of the sweet stuff Black Hills
15:29kills information security, anti-ciphon
15:30training, and WEA comics is up to.
15:33Thanks so much for watching. I hope you
15:34enjoyed this video. We'll tackle a
15:36couple more of these CTF challenges
15:37soon, but until then, I'll see you in
15:40the next video.