This year, Kenshoto hosted the 2008 DefCon Capture-the-Flag Qualifications round, starting the evening of May 30th.

The Underminers (secretly Team 1@stPlace: @tlas, drb, jrod, mezzendo, plato, psifertex, shiruken, wrffr), while having an automatic spot in 2008 CTF, decided to play along with quals because it always kicks so much ass. We hope our write-ups on this site will help anyone interested in practicing or learning more for future CTF adventures.

Please send any errors, corrections, ideas, or flames to Doc Brown. Thanks to RacerX, JetBoy, and the Sexy Pandas for corrections, and Brandon Enright for the Forensics 500 walk-through, Sexy Pandas for the Binary Leetness 500 walk-through, and Routards for the Binary Leetness 400 walk-through. (Note that there are still some unfinished write-ups...)

The goal was to find a secret key associated with each challenge. Below is the list of challenges, broken down by category, along with the key that that was recovered once the challenge was solved so you can check your work. Questions were made available by having the team with the highest score select a new question to work on, forcing a certain level of serialization. For challenges that require a running server instance (e.g. Pwnables, Real World, and some Binary Leetness) you'll use the server at *.allyourboxarebelongto.us. These services may or may not be available, depending on Kenshoto's infrastructure. If there is file available, you can run your own copy. (Most need FreeBSD 6.3.)

This year saw the removal of the Web services track and the addition of "Real World", which was more like "Potent Pwnables part 2". They were hugely fun, and while we'll miss "Web", "Real World" is a welcome change.

• 100: Hack ___ planet
  (Key is: the)
• 200: EAX = 0. EDX is undefined. What is the mnemonic of the one byte instruction to make both zero?
  (Key is: CDQ)
• 300: This security "professional" claimed that while in Colombia, getting a shot in the ass was "the worst thing that ever happened to [him]"
  (Key is: Kevin Mitnick)
• 400: What is the value of the $13 register after the attached ASM sequence? file
  (Key is: 0)
• 500: What kind of motorcycle did metr0 recently buy? (Two words)
  (Key is: Gixxer 600)

Read the Trivia walk-through.

• 100: Locate and submit the key. file
  (Key is: kentucky ham)
• 200: Forty-two file
  (Key is: How many clicks does it take to get to the center of this forensics challenge)
• 300: We have some photos from the Kenshoto quals party...find the message. file
  (Key is: roar! what a hottie!)
• 400: Find the key... file
  (Key is: Fo(rensics) sheezie my weenie)
• 500: Get out your decoder ring and make sure to drink your olvatine, you're gonna need it. file
  (Key is: ONOUSANKMYHISTOGRAM)

Read the Forensics walk-through.

• 100: If you sweet-talk Killa in the mud, she might give you the key: kenshoto.allyourboxarebelongto.us:7878
  (Key is: CoooOOOoooold blooded)
• 200: Pwn this service: ihatedns.allyourboxarebelongto.us:5641 file
  (Key is: Sexual chocolate)
• 300: O hai! I got you a jar of peanut butter but i eated it file
  (Key is: CowsDoNotLikeFatPeople)
• 400: unopened
  (Key is: ?? dunno ??)
• 500: unopened, which is a real shame -- we heard it was going to be the best service of all time
  (Key is: ?? dunno ??)

Read the Potent Pwnables walk-through.

• 100: Authenticate bitches! file
  (Key is: See! Just like Windows 95!)
• 200: Welcome to Hollywood's Heap Salon! Source of all your personal grooming needs! Land this service to receive a free facial! file
  (Key is: daring destroyer)
• 300: So like, ... um, yeah. There's a service running on ihatedns.allyourboxarebelongto.us:3232
  (Key is: educated entanglement)
• 400: unopened
  (Key is: ?? dunno ??)
• 500: unopened
  (Key is: ?? dunno ??)

Read the Real World walk-through.

• 100: What libc function is this? file
  (Key is: memcpy)
• 200: This service had one too many redbull/vodkas and got really confused ... file
  (Key is: Am I blacking out?)
• 300: What libc function is this? file
  (Key is: inet_aton)
• 400: Found this running on our box, not sure what it does...you tell us :) - This code is running on ihatedns.allyourboxarebelongto.us. Use what you have discovered to get the key. file
  (Key is: BODY MASSAGE!)
• 500: We're running this. Ask it for the key *very* nicely and it may give it to you ;): ihatedns.allyourboxarebelongto.us:2600 file
  (Key is: ?? dunno ??)

Read the Binary Leetness walk-through.

The walk-throughs are not finished; they'll trickle in. Here are the Kenshoto official results.