[{"content":"Challenge Challenge name: Poof\nChallenge description: Yet another pcap, no usb traffic in this one so I’m lost. Can you help me out? :)\nChallenge file: https://mega.nz/file/sk4TjJoA#EKaleZqsxyihM6clzcsvp04zfhdUGBu9ckVZ4HU7fWg\nSolution At first I thought it will be the challenge that I have to solve the USB traffic however, when I opened it I saw many different protocols.\nWe have TCP, TLS, UDP and more type packets. Interesting it is not USB traffic that means they weren’t bluffing in the description. On searching further, I saw a HTTP packet with a GET method.\nGreat, we are on to something. This is a normal directory listing from the server and we have different files here. There are two interesting files, one is 82nvdkandf.bin and another one is kcaswqcd.ps1.\nLet us download the file and check it.\nDamn!! it is an obfuscated powershell script. So, we need to de-obfuscate it first after which will see what this script do.\nAnd after de-obfuscating we can see that, they are encrypting the bin file with AES encryption method, and using the CBC binding for it. Great, we have the key and the initialization vector (iv) for decrypting.\nThere are some resources which will help you guys for learning this. Basically, this is mainly used for malware analysis. Sometimes, the malwares have the powershell script in it. Here are some of the resources I used to refer when I was learning on how to de-obfuscate powershell scripts.\nLearn about obfuscation — TryHackMe Room\nJohn’s video — https://youtu.be/1-FyyhpW-t8\nThe basic method is to de-obfuscate it and understand what does it means, let me explain.\nsEt-ITeM (‘VARIABlE:’+’V’+’s’+’52a’+’r’) ( [TyPe](“{0}{1}{2}” -f’t’,’ExT’,’.EncOdinG’)) ; This is a powershell script which is highly obfuscated, the way we de-obfuscate is by writing it again. So let’s write it again. First it is written “set-Item” which is a command in powershell, then it mentions a variable and the variable name is “Vs52ar”, then it mentions a text which is in written in the form of array (that is the ‘type’ command), and it should be written in the order of 0,1,2 from the array ’t’,’ExT’,’.EncOdinG’ , so at zeroth position we have “t”, thus will write “t” first, at first position we have “Ext”, so will write “ext” and finally at second position we have “.Enc0dinG” (make sure you add the dot (.) too). And by doing this process we will get this\nset-Item variable:Vs52ar text.encoding\nNow that obfuscated script is de-obfuscated is actually humanly readable. We need to do that for the entire script given and at the end we will get our de-obfuscated script.\nOnce it is humanly readable we will get the key and the iv to decrypt that bin file, let us do that with our beloved chef\nSo it is a window’s executable file, great let us download it. So, till this moment I thought that this file is not a harmful file and it is good go for run on my system, guess what? It is a malware and defender flagged it. But my main concern was where is the flag. I thought to look up to the file at VT, and there I got some information about this file, that is a trojan it’s score is 30/74 and more, but there were no information regarding flag.\nAt this moment I asked the admins, that am I on the write path or not, or I getting into a rabbit hole. I was happy that these admins were good and mentioned that I shouldn’t rely on online tools.\nThought it felt like a hint But it wasn’t. I looked up the sample in ghidra but I didn’t found any, and I was stuck in here for the next 4 hours. However, when I was surfing through net I got a tool which can be used in this that is dnspy. I looked up at my system if I have that tool or not, and I had it.\nLesson learnt, always update your toolkit, and always remember your tool. When I opened that file in dnspy, I found a piece of code, which was using the xor encryption.\nwe have the XOR key and the xor bytes. I asked gpt to write a code to decrypt it.\ndef xor_decrypt(data, key): return bytes([b ^ key for b in data]) # Encrypted byte array from the C# code encrypted_data = [ 129, 149, 255, 125, 125, 125, 29, 244, 152, 76, 189, 25, 246, 45, 77, 246, 47, 113, 246, 47, 105, 246, 15, 85, 114, 202, 55, 91, 76, 130, 209, 65, 28, 1, 127, 81, 93, 188, 178, 112, 124, 186, 159, 143, 47, 42, 246, 47, 109, # ... (truncated for brevity) 9, 27, 6, 42, 73, 14, 34, 76, 41, 34, 47, 78, 28, 17, 17, 4, 34, 28, 51, 34, 52, 16, 13, 17, 73, 19, 9, 66, 66, 0, 93, 82, 28, 25, 25, 93, 82, 4, 125 ] # XOR key key = 125 # Decrypting the data decrypted_data = xor_decrypt(encrypted_data, key) # Print the decrypted output as a string print(decrypted_data.decode(errors=\u0026#39;ignore\u0026#39;)) I ran this script and got the flag.\nTrust me guys, this flag really gave me a confidence that yes I will be able to complete this CTF (sadly I wasn’t but its fine will try hard in the next one)\n","permalink":"https://c6r1t3.pages.dev/posts/poor/","summary":"Phân tích lưu lượng mạng và mã độc để giải mã payload bằng AES rồi tìm flag.","title":"Poof"},{"content":"Description Here\u0026rsquo;s a file that was recovered from a 32-bits system that organized the bytes a weird way. We\u0026rsquo;re not even sure what type of file it is. Download it here and see what you can get out of it\nSolution Here is a better formatted version of this writeup on picoCTF Solutions website.\nBy using CyberChef the file was put into the input section. Then converted to hex for the \u0026ldquo;Swap Endianness\u0026rdquo; function under a word length of 4. After this, the hex looks more like a JPG with the correct ÿØÿà␀␐JFIF␀␁ magic bytes start. After the endianness was swapped and it\u0026rsquo;s in the correct order it could be converted back from hex to get the data from the image. It could then be rendered in CyberChef to get the image that displays the flag.\nFlag: picoCTF{cert!f1Ed_iNd!4n_s0rrY_3nDian_76e...}\n","permalink":"https://c6r1t3.pages.dev/posts/endianness-v2/","summary":"Khôi phục ảnh bằng cách hoán đổi thứ tự byte theo định dạng của hệ thống 32-bit.","title":"Endianness V2"},{"content":"Description The Network Operations Center (NOC) of your local institution picked up a suspicious file, they\u0026rsquo;re getting conflicting information on what type of file it is. They\u0026rsquo;ve brought you in as an external expert to examine the file. Can you extract all the information from this strange file? Download the suspicious file here.\nSolution Here is a better formatted version of this writeup on picoCTF Solutions website.\nTo get the file: wget https://artifacts.picoctf.net/c_titan/9/flag2of2-final.pdf\nFirst, open it as a pdf to get the 2nd part of the flag. Through the command line, it could be done with pdftotext command.\nFirst to install use, sudo apt install poppler-utils, then to run the command:\npdftotext flag2of2-final.pdf\nThen to get the flag use, cat flag2of2-final.txt, to get this: 1n_pn9_\\\u0026amp;_pdf_7f9...}\nWhen looking at the file with cat flag2of2-final.pdf, looking through the hex, or running the file command with file flag2of2-final.pdf it could be seen that the magic bytes show the file as a png. By changing the name with this command, mv flag2of2-final.pdf flag2of2-final.png, the file could be opened as a png and the first part of the flag could be read.\nDoing it through the command line Optical Character Recognition (ocr) tools could be used. To download a well-known one, sudo apt install gocr, then gocr flag2of2-final.png | tr -d \u0026quot;\\\\n\u0026quot; to remove the new lines and paste the contents. This gives piconF{f1u3n7_ which is mostly right other than it regonizing an n instead of CT. Overall it should be picoCTF{f1u3n7_.\nFlag: picoCTF{f1u3n7_1n_pn9_\\\u0026amp;_pdf_7f9...}\n","permalink":"https://c6r1t3.pages.dev/posts/secret-of-the-polyglot/","summary":"Phân tích một tệp đa định dạng để trích xuất các phần của flag từ PDF và PNG.","title":"Secret of the Polyglot"},{"content":"Description I\u0026rsquo;ve gotten bored of handing out flags as text. Wouldn\u0026rsquo;t it be cool if they were an image instead?\nYou can download the challenge files here:\nchallenge.zip The same files are accessible via SSH here: ssh -p 55235 ctf-player@atlas.picoctf.net Using the password 6dd28e9b. Accept the fingerprint with yes, and ls once connected to begin. Remember, in a shell, passwords are hidden!\nSolution Here is a better formatted version of this writeup on picoCTF Solutions website.\nTo get the file: wget https://artifacts.picoctf.net/c_atlas/3/challenge.zip, then unzip challenge.zip. Note: The files are also accessible with the provided ssh in the description. Use cd home/ctf-player/drop-in to get to flag.png.\nOnce there you can open the image and use a phone to scan the QR code and get the flag. Although it could also be done in Linux with zbar-tools.\nFirst install the package with sudo apt install zbar-tools then to use it run this command:\nzbarimg flag.png\nFlag: picoCTF{p33k_@_b00_a81...}\n","permalink":"https://c6r1t3.pages.dev/posts/scan-surprise/","summary":"Hướng dẫn tìm và quét mã QR trong hình ảnh để lấy flag.","title":"Scan Surprise"},{"content":"Description Can you handle APKs? Download the android apk here.\nSolution Here is a better formatted version of this writeup on picoCTF Solutions website.\nTo get the file: wget https://artifacts.picoctf.net/c_titan/53/mobpsycho.apk, then unzip mobpsycho.apk. Note: Be sure to be the folder you want all the files to be located.\nIt gives a lot of files to look through so by using various common search terms like ctf, pico, and flag this command showed something useful strings * | grep flag. It shows res/color/flag.txt near the end of the output.\nTo verify, ls -R | grep flag -B 20, which recursively lists out everything and got the 20 lines above flag.txt to see that it is indeed at file in ./res/color directory.\nThen the outputs of flag.txt could be retrieved with cat res/color/flag.txt which gives encoded text. You could take the output and put it into CyberChef and decode with Hex or use xxd as shown in this command: cat res/color/flag.txt | xxd -r -p. This gives the flag.\nFlag: picoCTF{ax8mC0RU6ve_NX85l4ax8mCl_a3e...}\n","permalink":"https://c6r1t3.pages.dev/posts/mob-psycho/","summary":"Phân tích APK Android để tìm tệp ẩn chứa dữ liệu mã hóa của thử thách.","title":"Mob Psycho"},{"content":"Description If you can find the flag on this disk image, we can close the case for good! Download the disk image here.\nSolution Here is a better formatted version of this writeup on picoCTF Solutions website.\nwget https://artifacts.picoctf.net/c_titan/63/disk.flag.img.gz, then gunzip -d disk.flag.img.gz.\nThen put the disk image in Autopsy and load it in with analysis. Once loaded in the root directory has three files: force-wait.sh, innocuous-file.txt, and its-all-in-the-name.\nBased on this and looking through the disk image and exhausting many options then coming back to the root directory this file, its-all-in-the-name, alludes to innocuous-file.txt being important somehow. When searching for innocuous-file throughout the entire disk image in Autopsy 14 occurrences of innocuous-file.txt could be found.\nEach one has Ascii information and the flag is fragmented between multiple of these innocuous-file.txt files. In the fourth occurrence of innocuous-file.txt the letters pic show up and in the next occurrence oCT which leads to the assumption that others would create the flag. By combining all of these the flag can be found.\nFlag: picoCTF{1_533_n4m35_80d2...}\n","permalink":"https://c6r1t3.pages.dev/posts/dear-diary/","summary":"Tìm các mảnh flag bị phân tán trong disk image bằng cách lần theo tên tệp.","title":"Dear Diary"},{"content":"Description How about some hide and seek? Download this file here.\nSolution Here is a better formatted version of this writeup on picoCTF Solutions website.\nTo get the file: wget https://artifacts.picoctf.net/c_titan/6/unknown.zip, then unzip unknown.zip.\nBy running exiftool ukn_reality.jpg the Attribution URL section looks like it has Base64 encoded text (cGljb0NURntNRTc0RDQ3QV9ISUREM05fYTZkZjhkYjh9Cg==). By putting that text into CyberChef with Base64 decoding the flag could be found.\nYou could also get the flag in one command: exiftool ukn_reality.jpg | grep At | cut -d \u0026quot;:\u0026quot; -f2 | tr -d \u0026quot; \u0026quot; | base64 -d\nThe first part is getting the line of the Attribution URL section. Then use the cut command with the delimiter of a colon (:) and get the second field. Using the tr command to trim the leading spaces. Lastly, use base64 -d to decode the output and get the flag.\nFlag: picoCTF{ME74D47A_HIDD3N_a6d...}\n","permalink":"https://c6r1t3.pages.dev/posts/canyousee/","summary":"Trích xuất dữ liệu Base64 được giấu trong metadata của một tệp ảnh.","title":"CanYouSee"},{"content":"Description The judge for these pictures is a real fan of antiques. Can you age this photo to the specifications? Set the timestamps on this picture to 1970:01:01 00:00:00.001+00:00 with as much precision as possible for each timestamp. In this example, +00:00 is a timezone adjustment. Any timezone is acceptable as long as the time is equivalent. As an example, this timestamp is acceptable as well: 1969:12:31 19:00:00.001-05:00. For timestamps without a timezone adjustment, put them in GMT time (+00:00). The checker program provides the timestamp needed for each. Use this picture. Submit your modified picture here: nc -w 2 mimas.picoctf.net 57925 \u0026lt; original_modified.jpg Check your modified picture here: nc -d mimas.picoctf.net 50499\nSolution Here is a better formatted version of this writeup on picoCTF Solutions website.\nTo get the file: wget https://artifacts.picoctf.net/c_mimas/91/original.jpg then mv original.jpg original_modified.jpg.\nexiftool -AllDates='1970:01:01 00:00:00.001' original_modified.jpg\nTo check if you it was done correctly write these commands:\nnc -w 2 mimas.picoctf.net 57925 \u0026lt; original_modified.jpg - Submitting the picture nc -d mimas.picoctf.net 50499 - Checking the picture\nFrom here it could be seen that it checks for SubSecCreateDate tag then SubSecDateTimeOriginal tag, then SubSecModifyDate tag, and lastly the Samsung:TimeStamp tag.\nexiftool -SubSecCreateDate='1970:01:01 00:00:00.001' -SubSecDateTimeOriginal='1970:01:01 00:00:00.001' -SubSecModifyDate='1970:01:01 00:00:00.001' original_modified.jpg\nOn exiftool website (https://exiftool.org/TagNames/Samsung.html) it could be seen that this tag Samsung:TimeStamp tag is not writable. Although not writable exiftool can still read the value with this command: exiftool -Samsung:TimeStamp original_modified.jpg\nWhen looking at the file with hex editor bless: sudo apt install bless, then ran with bless to open the GUI.From there you can go to file/open or open to open the file.\nAt the bottom of the file, this can be seen:\nImage_UTC_Data1700513181420\nThe last part with the numbers (1700513181420) is an epoch time stamp which could be read at the EpochConverter website. When converted it shows the exact same time as the Samsung:TimeStamp value.\nEpoch time starts at 1970 so to get to that it would be 0, however to add one second afterwards and to match the amount of digits needs for an epoch time stamp this value would be used 0000000000001. By changing the epoch time stamp in bless to 0000000000001 to now be Image_UTC_Data0000000000001 and saving the image will change the Samsung:TimeStamp value.\nIt could be checked with this command that it was indeed changed: exiftool -Samsung:TimeStamp original_modified.jpg\nTo get the flag write these commands again:\nnc -w 2 mimas.picoctf.net 57925 \u0026lt; original_modified.jpg, then nc -d mimas.picoctf.net 50499\nFlag: picoCTF{71m3_7r4v311ng_p1c7ur3_12e0...}\n","permalink":"https://c6r1t3.pages.dev/posts/blast-from-the-past/","summary":"Chỉnh sửa các timestamp trong metadata ảnh để vượt qua bộ kiểm tra của thử thách.","title":"Blast From the Past"},{"content":"Description People keep trying to trick my players with imitation flags. I want to make sure they get the real thing! I\u0026rsquo;m going to provide the SHA-256 hash and a decrypt script to help you know that my flags are legitimate.\nYou can download the challenge files here:\nchallenge.zip The same files are accessible via SSH here: ssh -p 60327 ctf-player@rhea.picoctf.net Using the password 6dd28e9b. Accept the fingerprint with yes, and ls once connected to begin. Remember, in a shell, passwords are hidden! Checksum: 03b52eabed517324828b9e09cbbf8a7b0911f348f76cf989ba6d51acede6d5d8 To decrypt the file once you\u0026rsquo;ve verified the hash, run ./decrypt.sh files/. Solution Here is a better formatted version of this writeup on picoCTF Solutions website.\nTo get the file: wget https://artifacts.picoctf.net/c_rhea/12/challenge.zip, then unzip challenge.zip. Note: The files are also accessible with the provided ssh in the description. Use cd home/ctf-player/drop-in to get to the files.\nWhen you use ls three things can be seen: checksum.txt, decrypt.sh, and a files directory. With cat checksum.txt the SHA256 hash of the real thing could be seen. In the files directory, there are 301 files with 8 8-character randomized names all with different checksums and contents. Lastly, decrypt.sh is the script provided that could be used on the correct file to get the flag.\nIf one of the checksums of the files in the files directory matches the checksum provided by checksum.txt then that file used with the decrypt script will give the flag.\nContents of checksum.txt: 03b52eabed517324828b9e09cbbf8a7b0911f348f76cf989ba6d51acede6d5d8\nThe sha256sum command can be used on a file to get the checksum. To get the checksum of all the files in the directory the sha256sum files/* command could be used. When paired with grep command with the known SHA256 checksum that needs to be found the correct file is displayed.\nCommand: sha256sum files/* | grep 03b52eabed517324828b9e09cbbf8a7b0911f348f76cf989ba6d51acede6d5d8\nOutput: 03b52eabed517324828b9e09cbbf8a7b0911f348f76cf989ba6d51acede6d5d8 files/00011a60\nLastly, the decrypt script could be run, ./decrypt.sh files/00011a60, which gives the flag.\nNote that if you aren\u0026rsquo;t ssh\u0026rsquo;d in or in the correct folder the script would have to be modified. Alternatively, the command from the script could be run:\nopenssl enc -d -aes-256-cbc -pbkdf2 -iter 100000 -salt -in files/00011a60 -k picoCTF\nAnother method of doing it is trying to decrypt every file to get the flag:\nfor file in files/*; do openssl enc -d -aes-256-cbc -pbkdf2 -iter 100000 -salt -in \u0026quot;$file\u0026quot; -k picoCTF; done \u0026gt; flag.txt\nThis iterates through every file in files/ directory and decrypts. If it was done successfully then it would be put into flag.txt file. With cat flag.txt the flag could be seen.\nFlag: picoCTF{trust_but_verify_0...}\n","permalink":"https://c6r1t3.pages.dev/posts/verify/","summary":"Hướng dẫn xác minh checksum để tìm đúng tệp và giải mã thử thách Verify.","title":"Verify"},{"content":"Mình là sinh viên An toàn thông tin và viết các writeup CTF.\n","permalink":"https://c6r1t3.pages.dev/about/","summary":"\u003cp\u003eMình là sinh viên An toàn thông tin và viết các writeup CTF.\u003c/p\u003e","title":"About"}]