This year, Kenshoto hosted the 2006 DefCon Capture-the-Flag Prequalifications round, starting the evening of June 9th. Team 1@stPlace (@tlas, apu, drb, plato, psifertex, shiruken, wrffr) had great fun solving all of Kenshoto's excellent challenges, and we hope this site will help anyone interested in practicing or learning more for future CTF adventures. Please send any errors, corrections, ideas, or flames to Doc Brown. (Thanks go to Sk3wlMaster and Invisigoth for a number of updates!)

Kenshoto sent official instructions, but the short version is: find a secret key associated with each challenge. Below is the list of challenges, broken down by category, along with the key that that was recovered once the challenge was solved so you can check your work. For challenges that require a running server instance (e.g. Web 3.0, Pwnables, and some Binary Leetness) you'll use the server at kenshoto.allyourboxarebelongto.us. Though likely the server is no longer available.

There are some questions where we lost the exact phrasing used during the prequals. In those places, we've paraphrased as suitable a question as we could manage. :) If you have the exact question used, please email Doc with it.

• 100: "Hack the ______" (Key is: planet)
• 200: What was the final launch code at the end of CTF 2005? (Key is: CPE1704TKS)
• 300: A giant vat of chemicals is about to drain into the water supply. You have only a bar of chocolate, a piece of gum, and a spring to fix it with. But that's OK, because your name is... (Key is: MacGyver)
• 400: What is the only OS ever to receive an Orange Book A1 evaluation? (Key is: SCOMP)
• 500: \xEB\xFE is to x86 as _____ is to PowerPPC (answer is 4 bytes) (Key is: \x48\x00\x00\x00)

Read the Trivia walk-through.

• 100: Find the key. Web Server (Key is: 3963ae5a267162ce7459e64a749281e1)
• 200: Find the key. Web Server (Key is: 95fbd378f8efe03c25ba3d0134d3fb9d)
• 300: Find the key. Web Server (Key is: 60c87e7aef824d36d900d4d65c5d6ab8)
• 400: Find the key. Web Server (Key is: ea25340bec1b22f5ae704fb004f4d861)
• 500: Find the key. Web Server (Key is: 2fd50d78746f705a783561847eaad2af)

Read the Web 3.0 walk-through.

• 100: We recovered these files from your home directory. Find the key. Files (Key is: rhubarb)
• 200: We snagged this intercept off of some .gov. What's the name of the BBS being discussed? Files (Key is: Hacker's Haven)
• 300: Find the key. Files (Key is: Forensics Engineers Are Weenies)
• 400: Someone is on your network. You know the hosts are compromised, but the only traffic to/from compromised hosts are ogg bit streams, and the only suspicious files are .ogg's littered throughout the filesystem. No one would've written single socket multiplexed shellcode tunnelled in ogg bitstreams!? No one would be smuggling data in .oggs!? or would they? Files (Key is: Gigantic Woot)
• 500: Packets and a key. Files (Key is: Antiorgastic Steep)

Read the Forensics walk-through.

• 100: Which class overloads the equals operator? (operator=) Files (Key is: Bazlicious)
• 200: A simple reversing challenge, the string is in the clear, but which one is it? Files (Key is: This game lends itself to certain abuses.--- Calvin)
• 300: Write a client. Files (Key is: Pedatifid Gluer)
• 400: We accidentally encoded the key. Files (Key is: Bewitching Sexto)
• 500: The client gets the key. Files (Key is: Exhibitory Overproduction)

Read the Binary Leetness walk-through.

• 100: Find the key. (The server is at kenshoto.allyourboxarebelongto.us.) Files (Key is: Gnomical Blanquillo)
• 200: Find the key. (The server is at kenshoto.allyourboxarebelongto.us.) Files (Key is: Chief Maple)
• 300: Find the key. (The server is at kenshoto.allyourboxarebelongto.us.) Files (Key is: Henotic Octameter)
• 400: Find the key. (The server is at kenshoto.allyourboxarebelongto.us.) Files (Key is: Ninjas Beat Pirates)
• 500: YOU'VE GOT NUTS!!1!one!1 Double werd score... This question gives you 500 points for clicking. If you give up, you keep the initial 500 and lose the question's 500 (break even). If you answer correctly you get the additional 500 points (for 1000 total.) (The server is at kenshoto.allyourboxarebelongto.us.) Files (Key is: Executive Docibility)

Read the Potent Pwnables walk-through.