Investigation - InCTF Internationals 2020 stuxn3t 2020-08-04 Forensics / Memory tl;dr Extract process last run time from the windows registry. Extract process run count from the windows registry. Read More InCTFi Volatility Windows Memory Analysis Windows Registry
Lookout Foxy - InCTF Internationals 2020 g4rud4 2020-08-03 Forensics / Disk tl;dr Decrypt the encrypted GPG file found in Outlook Express with the private key stored on the device. Decrypt the firefox saved passwords and log in to the website that the terrorist used. Read More InCTFi Autopsy
Faulty LFSR - InCTF Internationals 2020 ph03n1x 2020-08-02 Crypto / LFSR tl;dr Find the co-relation between variables in the LFSR equation d == out (75%) a == b (75%) c^d == out (75%) (d!= out) => (c==1) always Solve for the seed using 2000 output bits Try out which among the four possible combinations decrypt the flag Read More InCTFi LFSR Correlation attack
BabyJS - 2020 Defenit CTF Az3z3l 2020-06-10 Web Exploitation tl;dr Accessing a variable in Handlebars template using this object Read More Defenit Handlebars template injection Ssti
TarAnalyzer - 2020 Defenit CTF c3rb3ru5 2020-06-07 Web Exploitation tl;dr Zip Slip Vulnerability + YAML Deserialization Attack + Race Condition Unintended Solution: Upload symlink leading to arbitarary file reads Read More Defenit YAML Zip Slip Race Condition Symlink
USB 2 - 2020 Defenit CTF stuxn3t 2020-06-07 Forensics / Registry tl;dr Digging into windows registry to find process run counts. Extracting and parsing AmCache to find the hash of process images Read More Windows Registry Analysis Defenit
golf.so - PlaidCTF 2020 d4rk_kn1gh7 2020-04-29 Misc / Linux / ELF tl;dr Hand-crafting a linux shared object file with a size of less than 194 bytes Read More Plaid
Strange PCAP - HackTM CTF Quals 2020 g4rud4 2020-02-10 Forensics / Network tl;dr Disk Dump extraction. USB leftover Capture data extraction. Zip file cracking. Read More HackTM Wireshark
Think twice before speaking once - HackTM CTF Quals 2020 slashb4sh 2020-02-10 Pwn / Linux / ELF tl;dr Linux userspace exploitation by parsing ELF for symbol addresses with an arbitrary read Read More HackTM
Find My Pass - HackTM CTF Quals 2020 stuxn3t 2020-02-09 Forensics / Memory tl;dr Memory dump analysis using Volatility. Extracting Keepass Master Password from the memory. Extracting flag from ZIP archive attached in the Keepass database. Read More Windows Memory Analysis HackTM