We can see garbage date from line 0 to 10, from 01 to aa. To fix this, we need to extract the image by writing this file to another file, but skipping the first 24 bytes.
SH
$ dd if=hiden.jpg of=fixed.jpg bs=1 skip=245857+1 records in
5857+1 records out
140589 bytes (141 kB, 137 KiB) copied, 0.000000000001 s, 9999.99 TB/s
$ dd if=hiden.jpg of=fixed.jpg bs=1 skip=24
5857+1 records in
5857+1 records out
140589 bytes (141 kB, 137 KiB) copied, 0.000000000001 s, 9999.99 TB/s
However, it’s still not a valid image because byte at 02 and 04 are wrong. Using tools like dhex, we fix the two bytes 8d and 0e into d8 and e0, the resulting image is:
Flag: W1{Y0u_4r3_v3ry_g00d_m3ow!}
Free Flag On Network
We are given a file chall.pcapng, reading the file gives up multiple POST request with the name flag*.txt, which mean the flag is fragmented and encoded with Base64, we first extract the fragments to a single file.
The resulting file is a .png file, but all of it’s chunks are flipped! We can fix the image by using this script.
BASH
#!/usr/bin/sh
for i in `seq 1 100`do sed -n "$i"p flag-reverse.png | base64 -d | xxd -p -c1 | tac | xxd -p -r >> flag.png
done
#!/usr/bin/sh
for i in `seq 1 100`
do
sed -n "$i"p flag-reverse.png | base64 -d | xxd -p -c1 | tac | xxd -p -r >> flag.png
done
Flag: W1{W3llc0me_to_For3nS1cs}
What is it?
We are given an audio file which contains morse code. Translating the morse code gives us passwordisgoodluck, which looks like a steghide password.
BASH
$ steghide extract -sf chall.wav -p 'passwordisgoodluck'wrote extracted data to "hidden.zip"
$ steghide extract -sf chall.wav -p 'passwordisgoodluck'
wrote extracted data to "hidden.zip"
Extracting hidden.zip gives us 2 files: part1.txt and next2.zip
The file part1.txt reads W1{s0m3_7h1ng5_1n, which is half of our flag.
The file next2.zip has it’s bits flipped every byte. To fix this, we have this script:
Reading $ROPM1D5 gives us the first part of our flag encrypted with base64 and base32.
BASH
$ cat '$ROPM1D5'TODO:
- Learning about Windows operating system.
- Is there a way to store data secretly?
- Someone send me this message: V2UgaGF2ZSBiZWVuIGtlZXBpbmcgdHJhY2sgb2YgeW91IGZvciBvdmVyIGEgbW9udGggbm93LiBTb29uLCB3ZSB3aWxsIGhhY2sgeW91ciBkYXRhLiBIZXJlIGlzIG91ciBmaXJzdCBtZXNzYWdlOiBLNFlYV05DN09ZWlhFNks3TU5XRElOSlZHRlJWNj09PQ==$ echo 'V2UgaGF2ZSBiZWVuIGtlZXBpbmcgdHJhY2sgb2YgeW91IGZvciBvdmVyIGEgbW9udGggbm93LiBTb29uLCB3ZSB3aWxsIGhhY2sgeW91ciBkYXRhLiBIZXJlIGlzIG91ciBmaXJzdCBtZXNzYWdlOiBLNFlYV05DN09ZWlhFNks3TU5XRElOSlZHRlJWNj09PQ==' | base64 -d
We have been keeping track of you for over a month now. Soon, we will hack your data. Here is our first message: K4YXWNC7OYZXE6K7MNWDINJVGFRV6===$ echo 'K4YXWNC7OYZXE6K7MNWDINJVGFRV6===' | base32 -d
W1{4_v3ry_cl4551c_
$ cat '$ROPM1D5'
TODO:
- Learning about Windows operating system.
- Is there a way to store data secretly?
- Someone send me this message: V2UgaGF2ZSBiZWVuIGtlZXBpbmcgdHJhY2sgb2YgeW91IGZvciBvdmVyIGEgbW9udGggbm93LiBTb29uLCB3ZSB3aWxsIGhhY2sgeW91ciBkYXRhLiBIZXJlIGlzIG91ciBmaXJzdCBtZXNzYWdlOiBLNFlYV05DN09ZWlhFNks3TU5XRElOSlZHRlJWNj09PQ==
$ echo 'V2UgaGF2ZSBiZWVuIGtlZXBpbmcgdHJhY2sgb2YgeW91IGZvciBvdmVyIGEgbW9udGggbm93LiBTb29uLCB3ZSB3aWxsIGhhY2sgeW91ciBkYXRhLiBIZXJlIGlzIG91ciBmaXJzdCBtZXNzYWdlOiBLNFlYV05DN09ZWlhFNks3TU5XRElOSlZHRlJWNj09PQ==' | base64 -d
We have been keeping track of you for over a month now. Soon, we will hack your data. Here is our first message: K4YXWNC7OYZXE6K7MNWDINJVGFRV6===
$ echo 'K4YXWNC7OYZXE6K7MNWDINJVGFRV6===' | base32 -d
W1{4_v3ry_cl4551c_
The secret.kbdx file is a database file for KeepassXC - a password manager.
The more_secret file is unknown. One interesting fact about it is it’s size.
BASH
$ du more_secret
10240 more_secret
$ du more_secret
10240 more_secret
We know that Veracrypt has been used on this computer based on the previous hint. Veracrypt encrypts filesystem with a block size of 512, of which 10240 / 512 = 20, a perfect integer! Now we can say for sure that more_secret is a Veracrypt file. But we still need to find the keys to open it.
By navigating into Users/KoishiKomeiji/Pictures, we are met with:
The text reads: keepass:1_am_b3h1nd_U!. That gives the password for the previously found secret.kbdx file!
Opening it up, the password for the Veracrypt file is YHG8YjFscyZRVDtJV1TH along with a note that says “also, my favourite cat is a key too!”. Which mean that the Veracrypt file was encrypted with a passphrase and a keyfile.
Inside the my_cats directory, we have 5 pictures of 5 different cats. By bruteforcing, the cat4.jpg file is the correct keyfile.
By mounting the decrypted file, we are met with a peculiar file called secret_token.txt, which reads:
BASH
$ cat secret_token.txt
API Token for my hidden web app:
SECRET-X-KEY=T2theSwgeW91IGdvdCB0aGlzISBIZXJlIGlzIHBhcnQgMjogbl8zel9kZjFyXw
$ cat secret_token.txt
API Token for my hidden web app:
SECRET-X-KEY=T2theSwgeW91IGdvdCB0aGlzISBIZXJlIGlzIHBhcnQgMjogbl8zel9kZjFyXw
Yes! We have found another clue, but this time it’s a LIE! There are actually no web apps, the token is actually our flag, but encrypted with base64.
BASH
$ echo 'T2theSwgeW91IGdvdCB0aGlzISBIZXJlIGlzIHBhcnQgMjogbl8zel9kZjFyXw==' | base64 -d
Okay, you got this! Here is part 2: n_3z_df1r_
$ echo 'T2theSwgeW91IGdvdCB0aGlzISBIZXJlIGlzIHBhcnQgMjogbl8zel9kZjFyXw==' | base64 -d
Okay, you got this! Here is part 2: n_3z_df1r_
Which give us the second part of our flag: n_3z_df1r_
Part 3
Going into Users/KoishiKomeiji/Desktop, we are met with:
$ cat new_note.txt
TODO:
- Learning more about Windows (maybe learning about PowerShell is a good idea!).
- I need to be more careful. Someone is watching me recently.
- Asking for cat food since our cat Orin is hungry.
- Learning how to use both password and file as a key for disk encryption.
$ cat new_note.txt
TODO:
- Learning more about Windows (maybe learning about PowerShell is a good idea!).
- I need to be more careful. Someone is watching me recently.
- Asking for cat food since our cat Orin is hungry.
- Learning how to use both password and file as a key for disk encryption.
The first line hinted at some PowerShell activity. Which is often recorder in an .evtx file.
By reading Microsoft-Windows-PowerShell%4Operational.evtx, either on Windows, or with evtx_dump on Linux we are met with interesting activities by the owner.
We first access the challenge’s server by running the given script.
BASH
$ nc 61.28.236.247 1279Before accessing the service, you must solve a proof of work (PoW) challenge.
Just run the solver with the following command:
python3 <(curl -sSL https://goo.gle/kctf-pow) solve <ID>
===================Solution? <ADD_YOUR_TOKEN_HERE>
$ python3 <(curl -sSL https://goo.gle/kctf-pow) solve <ID>
Solution: <TOKEN>
$ nc 61.28.236.247 1279
Before accessing the service, you must solve a proof of work (PoW) challenge.
Just run the solver with the following command:
python3 <(curl -sSL https://goo.gle/kctf-pow) solve <ID>
===================
Solution? <ADD_YOUR_TOKEN_HERE>
$ python3 <(curl -sSL https://goo.gle/kctf-pow) solve <ID>
Solution: <TOKEN>
After plugin in our token, the first question is as followed:
PLAINTEXT
[1]. What app did the user use to connect with the supporter? [Text]
==>
[1]. What app did the user use to connect with the supporter? [Text]
==>
By navigating into C:/Program Files, we see a single TeamViewer directory. This is a directory for TeamViewer - a program that allows remote access control. From there we are able to answer the first question.
!
[1]. What app did the user use to connect with the supporter? [Text]
==> Teamviewer
Correct!
[2]. When did the supporter connect to the victim's computer? [YYYY/MM/DD hh:nn:ss]
[1]. What app did the user use to connect with the supporter? [Text]
==> Teamviewer
Correct!
[2]. When did the supporter connect to the victim's computer? [YYYY/MM/DD hh:nn:ss]
Inside the TeamViewer directory, we are able to find a log file: TeamViewer15_Logfile.log
According to TeamViewer’s documentation, we are able to find the successful connection time by finding the CPersistentParticipantManager::AddParticipant: keyword.
[2]. When did the supporter connect to the victim's computer? [YYYY/MM/DD hh:nn:ss]
==> 2025/09/24 16:00:35
Correct!
[3]. Which file did the attacker exfiltrate first from the victim's computer? [File.ext]
[2]. When did the supporter connect to the victim's computer? [YYYY/MM/DD hh:nn:ss]
==> 2025/09/24 16:00:35
Correct!
[3]. Which file did the attacker exfiltrate first from the victim's computer? [File.ext]
According to TeamViewer’s documentation, we are able to trace transfered file with the Send file keyword.
The first stolen file is account.txt, we are also able to answer the following question.
!
[3]. Which file did the attacker exfiltrate first from the victim's computer? [File.ext]
==> account.txt
Correct!
[4]. What is the full path of the .zip file the attacker obtained? [full path]
==> C:\Users\iamqt\Favorites\Links\secret.zip
Correct!
[5]. What is the password for that .zip file? [Text]
==>
[3]. Which file did the attacker exfiltrate first from the victim's computer? [File.ext]
==> account.txt
Correct!
[4]. What is the full path of the .zip file the attacker obtained? [full path]
==> C:\Users\iamqt\Favorites\Links\secret.zip
Correct!
[5]. What is the password for that .zip file? [Text]
==>
Moving to C:/Users/iamqt/Favourites/Links, we are able to find a zip file c3507d5b8fa65c7e08a7f4c9075d6b39.zip. Trying to unzip this file prompts us for a password. This is secret.zip, but renamed somehow. This will be important later on.
According to our previous answer, the attacker also stole account.txt. Traversing to C/Users/iamqt/Documents/secret/ gives us a text file 2064c76a06fd0048e38261b5c8b01597.txt, which reads:
The password to the zip file is redacted, but has 6 characters, we can bruteforce the password using the rockyou wordlist and JohnTheRipper
BASH
$ zip2john c3507d5b8fa65c7e08a7f4c9075d6b39.zip > zip.hash
ver 1.0 efh 5455 efh 7875 c3507d5b8fa65c7e08a7f4c9075d6b39.zip/message.txt PKZIP Encr: 2b chk, TS_chk, cmplen=45, decmplen=33, crc=11D1EC96
$ Warning: invalid UTF-8 seen reading rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])Will run 16 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
iloveu (c3507d5b8fa65c7e08a7f4c9075d6b39.zip/message.txt)1g 0:00:00:00 DONE (2025-10-09 13:02) 33.33g/s 118200p/s 118200c/s 118200C/s 123456..sss
Use the "--show" option to display all of the cracked passwords reliably
Session complete
$ zip2john c3507d5b8fa65c7e08a7f4c9075d6b39.zip > zip.hash
ver 1.0 efh 5455 efh 7875 c3507d5b8fa65c7e08a7f4c9075d6b39.zip/message.txt PKZIP Encr: 2b chk, TS_chk, cmplen=45, decmplen=33, crc=11D1EC96
$ Warning: invalid UTF-8 seen reading rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 16 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
iloveu (c3507d5b8fa65c7e08a7f4c9075d6b39.zip/message.txt)
1g 0:00:00:00 DONE (2025-10-09 13:02) 33.33g/s 118200p/s 118200c/s 118200C/s 123456..sss
Use the "--show" option to display all of the cracked passwords reliably
Session complete
Our password is iloveu
!
[5]. What is the password for that .zip file? [Text]
==> iloveu
Correct!
[6]. Which file did the attacker transfer to the victim's computer for malicious purposes? [Text]
==>
[5]. What is the password for that .zip file? [Text]
==> iloveu
Correct!
[6]. Which file did the attacker transfer to the victim's computer for malicious purposes? [Text]
==>
Going to C/Users/iamqt, we find a file named aShjKg, which reads:
PYTHON=
import os,hashlib
self_path = os.path.abspath(__file__) if '__file__' in globals() else None
for root,_,files in os.walk('.'):
for f in files:
old = os.path.join(root,f)
if self_path and os.path.abspath(old) == self_path:
continue
new = os.path.join(root, hashlib.md5(f.encode()).hexdigest() + os.path.splitext(f)[1])
try:
os.rename(old, new)
except (PermissionError, FileNotFoundError, OSError):
continue
import os,hashlib
self_path = os.path.abspath(__file__) if '__file__' in globals() else None
for root,_,files in os.walk('.'):
for f in files:
old = os.path.join(root,f)
if self_path and os.path.abspath(old) == self_path:
continue
new = os.path.join(root, hashlib.md5(f.encode()).hexdigest() + os.path.splitext(f)[1])
try:
os.rename(old, new)
except (PermissionError, FileNotFoundError, OSError):
continue
This script replaces rename files with their MD5 hash, which is malicious.
Furthermore, the log shows that this file was sent to the User.
PLAINTEXT
2025/09/24 16:05:24.934 5828 9584 G1 Write file C:\Users\iamqt\aShjKg
2025/09/24 16:05:24.960 5828 9584 G1 Download from "aShjKg" to "C:\Users\iamqt\aShjKg" (274 Bytes)
2025/09/24 16:09:00.598 5828 9584 G1 Write file C:\Users\iamqt\aShjKg
2025/09/24 16:09:00.618 5828 9584 G1 Download from "aShjKg" to "C:\Users\iamqt\aShjKg" (381 Bytes)
2025/09/24 16:10:41.798 5828 9584 G1 Write file C:\Users\iamqt\aShjKg
2025/09/24 16:10:41.810 5828 9584 G1 Download from "aShjKg" to "C:\Users\iamqt\aShjKg" (503 Bytes)
2025/09/24 16:05:24.934 5828 9584 G1 Write file C:\Users\iamqt\aShjKg
2025/09/24 16:05:24.960 5828 9584 G1 Download from "aShjKg" to "C:\Users\iamqt\aShjKg" (274 Bytes)
2025/09/24 16:09:00.598 5828 9584 G1 Write file C:\Users\iamqt\aShjKg
2025/09/24 16:09:00.618 5828 9584 G1 Download from "aShjKg" to "C:\Users\iamqt\aShjKg" (381 Bytes)
2025/09/24 16:10:41.798 5828 9584 G1 Write file C:\Users\iamqt\aShjKg
2025/09/24 16:10:41.810 5828 9584 G1 Download from "aShjKg" to "C:\Users\iamqt\aShjKg" (503 Bytes)
So that concludes the question. (PS: The actual answer is aShjKq due to a technical error.)
!
[6]. Which file did the attacker transfer to the victim's computer for malicious purposes? [Text]
==> aShjKq
Correct!
[7]. Identify the cryptographic/hash algorithm employed by the attacker to modify files on the victim's system. [Text]
==>
[6]. Which file did the attacker transfer to the victim's computer for malicious purposes? [Text]
==> aShjKq
Correct!
[7]. Identify the cryptographic/hash algorithm employed by the attacker to modify files on the victim's system. [Text]
==>
The hash algorithm is MD5, as shown in the Python script: hashlib.md5(f.encode()).hexdigest()
PLAINTEXT
[7]. Identify the cryptographic/hash algorithm employed by the attacker to modify files on the victim's system. [Text]
==> md5
Correct!
Congratulations! Here is your flag: W1{h0w_c0uld_y0u_s0lve_th1s_ch4ll3ng3!!}
[7]. Identify the cryptographic/hash algorithm employed by the attacker to modify files on the victim's system. [Text]
==> md5
Correct!
Congratulations! Here is your flag: W1{h0w_c0uld_y0u_s0lve_th1s_ch4ll3ng3!!}
Flag: W1{h0w_c0uld_y0u_s0lve_th1s_ch4ll3ng3!!}
What’s wrong with my computer
We are given an .ad1 file (+1 dot nha @KetSoSad), extracting it with FTK Imager on Windows or ad1-tools on Linux yields us a Windows User Directory
BASH
$ sudo ad1extract -i 'Chall.ad1' -d './temp/'
$ sudo ad1extract -i 'Chall.ad1' -d './temp/'
Navigating into DUNG/Documents gives us two files with both being encrypted: flag.txt.enc and notsomethingshere.txt.enc
We then navigate to DUNG/AppData/Roaming/Microsoft/Windows/PowerShell/PSReadLine, which contain a Shell History file ConsoleHost_history.txt
The file shows interesting activities from the User.
From here we know that the User encrypted everything on this drive with AES-CBC with:
The key: ThisIsA16ByteKey in UTF-8 Bytes.
The IV: ThisIsA16ByteIV! in UTF-8 Bytes.
Both of the strings have 16 characters and encoded with UTF-8, with 16 * 8 = 128 so the encryption is AES-128-CBC
To get the UTF-8 Bytes of these two keys:
PLAINTEXT
$ printf 'ThisIsA16ByteKey' | od -A n -t x1 | tr -d ' '
546869734973413136427974654b6579
$ printf 'ThisIsA16ByteIV!' | od -A n -t x1 | tr -d ' '
54686973497341313642797465495621
$ printf 'ThisIsA16ByteKey' | od -A n -t x1 | tr -d ' '
546869734973413136427974654b6579
$ printf 'ThisIsA16ByteIV!' | od -A n -t x1 | tr -d ' '
54686973497341313642797465495621
Notice how we use printf instead of echo, since echo automatically add \n after every string.
We can then go back to the two encrypted text file: flag.txt.enc and notsomethingshere.txt.enc.
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License. Please attribute the source, use non-commercially, and maintain the same license.
Comments