Tree Man

OSINT[300Pts] Given Information: I’m so glad we’ve got you on the team; I don’t think we’d have manged to get that last one if it weren’t for you. We’ve been watching the account, and the target just posted another image. This guy really doesn’t learn. We don’t think he’s left Spain yet, but we really need this one pinpointed exactly. Can you work where he took this?

The map here should be accurate to 50 meters.

Hint

First thing is to Reverse Image search for any clues. Key search words are Spain Tree Man.

Copyright: (c) Blitzy | Dreamstime.com

Found an exact copy of the “Tree Man.” Note the tags are: Park Portaventura and Entrance. So we now have an exact location.

https://www.portaventuraworld.com/en/parks

We can now see where the entrance is from this map given by the Port Aventura website.

Matching it to Google Maps, then using the link to locate the exact location to the challenge.

Correct Flag

Dead Man

OSINT[350Pts] Given Information: Aargh! They gave us the slip again. We got another image from their Twitter, but it doesn’t look like they’re in the same country anymore. Are you able to track them down again for us and tell us the town they’re in? You’re our best man at this point, so we’re expecting great things.

Our map here should be accurate to 500 meters.

Right way the language was a dead give away at Thai or some Southeast Asian Language.

Educated Guess it was Thai
Christian Cemetery

Christianity is not very big in Southeast Asia. Searching for a Christianity Cemeteries yielded:

One of the more interesting results were the Kanchanaburi War Cemetery

Kanchanaburi War Cemetery, Thailand

The three noticeable features are the same cross, cemetery pattern, and with similar buildings in the background.

Submitted Flag Location(Correct)

Suspended Belief

OSINT[350Pts] Given Information: Amazing work with that last image! We dispatched a team right away, but it seems our target was one step ahead of us. We’re not sure what they’re planning, but we managed to download one final image off the Instagram account until they locked it down.

Can you work out where this picture was taken? One of the guys thought it might have been Queensferry crossing, but that doesn’t look right. You’ll have to be accurate to within 2 kilometres.

Doing a basic Google search of the username yielding someone from of Chinese origin.

Could just be a coincidence, but checking for suspended bridges in the Chinese area. I found one in Hong Kong called “Tsing Ma Bridge”

Tsing Ma Bridge from Google Search

Tried the location of the Tsing Ma Bridge

Flag was found when submitting the location.

SpentalKux

Misc [300pts]

Description: Spentalkux 🐍📦

So the description for the challenge is a little vague. But, looks like its a Python package called Spentalkux.

When we import the latest version of this package, we get a message and a small cipher:

This message is a Vigenere cipher. When we decode this, we get a pastebin link:

“Hello, If you’re reading this you’ve managed to find my little… interface. The next stage of the challenge is over at https://pastebin.com/raw/BCiT0sp6″

The pastebin link contains a large hex value that when decoded using CyberChef, we get what looks to be an image:

We use a small python code to convert to image based on this link: https://stackoverflow.com/questions/50734133/convert-hex-text-file-to-original-imagejpeg-in-python-or-java-code/50734487

and what we get is a picture that says:

The binary is decoded into: _herring. Indicating that this is a red herring. Now “look back into the past” can mean many different things. For this, I looked up spentalkux again and it seems there was a previous version as well.

So I ran pip install spentalkux==0.9.

Importing this version of spentalkux, we are greeted with a different message:

Using CyberChef once again, this message is decoded in the sequence of:

From Base32 -> From Base64 -> gzip

Extracting the gzip gives us a large binary. Following this decoding sequence (lots of trial and error), we eventually reach the flag:

BR.MOV

Misc [400pts]

Description: https://youtu.be/zi3pLOaUUXs (We are given a YouTube link)

We are given a YouTube link that shows a bunch of barcodes changing quickly within a 6 second video. There are numbers being repeated throughout as well.

So after recording down the numbers, I downloaded this YouTube video and extracted the frames out of the mp4. After running each image through a barcode scanner, we see that there are values of this ordering:

5WlndrAehA 8PdGSTvnaY 9zuPGubRMc 7cyqggztfa 6AqGoWfWwR 7JwvAOM{Px 4JIEbOEkws 5NDuG4sOeb 9chPBBYtfr 8iwkHVYpcf 7hVMGQe0xL 3vBdLvZLbB 2T3iNatxiU 5kNLb_eoyi 4AfAmLXyJo 4oFE4iSJmP 3ajdUBIXVe 4oAQnoJxEV 8SzMNoIa3j 9aaIBHbqls 2vsDNpidao 1}gfkrtfrm

It turns out that the beginning number for each decoded barcode and the numbers being said in the video match. After some careful analysis, we notice that each index of the decoded barcode corresponds to the flag we are looking for:

Flag: ractf{b4rc0d3_m4dn3ss}

Mad CTF Disease

Misc [350]

Description: Todo: [x] Be a cow [x] Eat grass [x] Eat grass [x] Eat grass [ ] Find the flag

So we are given a picture of a cow. In cow.jpg

Running Steghide on this image gave us moo.txt:

I did not know what this was so I randomly googled: “decode moo”

We are given a link that resembles the same type of text given to us:

http://www.frank-buss.de/cow.html

It turns out that this is a COW esolang. So decoding our text using the above link gives us:

Peculiar Packet Capture

Forensics [400pts]

Description:

Agent,

We have a situation brewing. Last week there was an attack on the prime minister of Morocco. His motorcade was stopped by a road blockade where heavily armed men opened fire on them. Fortunately, the prime minister was able to escape safely but many personnel and a few other ministers did not.

ATLAS, a multi-national Private Military Corporation (PMC) based in Colorado, USA, is our main suspect. We believe they were hired to conduct the hit by the opposition political party.

We flew Agent Jason to Colorado to investigate further. He gained access to their building’s reception area dressed in a suit acting as a potential client with an appointment. He was able to intercept wireless network traffic from their corporate wireless network before being escorted out by guards when they realised the bluff.

The network capture is attached below, see if you can recover any important documents which could help us tie ATLAS to the Morocco incident.


We are given a Wireshark capture file and when looking at it, it seems that they are using the EAPOL protocol with authentication keys.

Looking at each of the keys, they are using 802.11 authentication to encrypt the keys. So I thought to decrypt them somehow.

This blog (https://mrncciew.com/2014/08/16/decrypt-wpa2-psk-using-wireshark/) contained useful information on how to decrypt the keys.

But first, we needed to crack the WPA2 password in order to use this method. A popular tool is Aircrack-ng, which is what I used for this challenge.

Resource: https://www.shellhacks.com/how-to-use-aircrack-ng-wifi-password-hacker-tutorial/

#5 is the only bullet point I used for this challenge. Using rockyou.txt as my wordlist and the MAC address of the source:

It turns out the key was nighthawk.

So using the decrypt-wpa2-psk-using-wireshark method shown above, I had to generate a PSK using this link (provided as well in the blog above):

http://jorisvr.nl/wpapsk.html

The SSID was ATLAS_PMC and passphrase was nighthawk. Our hex key is:

2bc3903f5a048ebf0b350613b373e53211c0a7f499f342dfd68ee0b79e90f283

When applying the hex key (with key type: wpa-pwk) to our WEP and WPA decryption key in Wireshark preferences, we are now shown packets that were not shown before, most notable a PDF.

So after extracting this PDF from WireShark, we are presented with the flag at the bottom:

Disk Forensics Fun

Forensics [350pts]

Description:

Agent,

Get your forensics gloves out.

We’ve managed to exploit a network service running on a C2 server used for orchestrating a large botnet. From there we were able to escalate our privileges and use that server as a proxy to pivot to other machines in the network.

It’s quite fascinating, based on the machines we have found, we think that these guys are a known bad actor, responsible for leaking private documents and data from corporate and government targets, which changes our current focus from a reconnaissance mission to a criminal investigation which involves gathering evidence on them so we can attribute names to actions for further prosecution in the courts.

Thus, we’ve started to image the disks of all the machines we have managed to pivot on. It’s not the most ideal circumstances for admissibility of evidence, but we do have a warrant on the guys involved and we can let our lawyers do the rest.

Anyway, I’ve attached a disk image of a small Linux server which we believe they’re using for temporarily keeping exfiltrated files.

Can you take a look and see what you find?

Good luck.


We are given an image.E01 file and are asked to investigate this. E01 files are Encase image file formats for disk evidence.

I viewed this file using Autopsy. We see a small Linux system in here:

Looking closely into the main files like HOME and ROOT, I found a PGP message long with PGP public and private keys:

To decode this, I exported the PGP message and private key and used gpg.

This manual is helpful for decrypting PGP using a private key: https://www.gnupg.org/gph/en/manual/x110.html#:~:text=To%20decrypt%20a%20message%20the,output%20doc%20%2D%2Ddecrypt%20doc.

Initially, my output was to doc, but looking further it seems that doc contains HTML elements worth looking into. So I ran it again and extracted the output to an HTML file.

Looking at the doc.html, we see a rather creepy picture:

Those values in the picture seem interesting, so I copied those and decoded from hex, revealing our flag at the bottom:

ractf{b4s1c_d1sk_f0r3ns1cs}

Access Granted

Steganography [450pts]

Description:

Agent,

Do you recall the C2 group exfiltrating data we were tracking last year? Well, as it turns out, we’ve managed to corroborate their activities with APT-47 nicknamed ‘The Engineers’. Their operations span across a wide range of industries, including disrupting SCADA systems and stealing corporate data.

Recently, they’ve been leaking unreleased tracks from various media groups. A Canadian firm, which suffered a fresh leak, has requested us to take a look. Over the past few days, our analysts have combed through network data trying to identify which computers or servers may have been compromised and used.

In order to bypass detection from IDS/DLP signatures, we think they’re somehow extracting these tracks by hiding them in existing music videos so it blends in with usual traffic. We’ve attached a video that we believe is going to one of their IP addresses, can you take a look?


We are given an mp4 file that is 46MB. Looking at the file using a hex editor, we see that there is a password on the bottom that we will need for later:

password{guitarmass}

I couldn’t find anything interesting for this mp4. There was a MySQL index file, JPEG and PNG using binwalk but the challenge creator confirmed this was a false positive. So looking up video steganography techniques, I found one option that uses a rare technique (indicated by the challenge creator) : TCSteg

Paper: https://dl.acm.org/doi/pdf/10.1145/2978178.2978181?download=true

It turns out that TCSteg involves adding a hidden volume in an mp4 file. So trying this out, I looked for tools that can open hidden volumes. One option was TrueCrypt but it was discontinued around 2014. So the other option was the updated version: VeraCrypt.

Using VeraCrypt, we are able to use the password we found: guitarmass

Looking at the A: drive, we see an image displaying our flag:

Cheap Facades

Steganography [400pts]

Description: We’ve found a JPEG, but it doesn’t seem to open in any of our editors. Can you see what’s going on?

We are given a flag.jpg that won’t open in any photo viewer. So looking at it in a hex editor we see some strange occurrences.

The image has a JFIF in the header (for jpgs) and IHDR + IDAT (for PNGs). It seems that there is a broken header in this image and it is not really a jpg, but more like a PNG. There is even an IEND at the bottom of the file.

The next step is to replace the broken header with a valid PNG header. Valid PNG headers look like this:

After replacing our broken header image with a valid PNG header, we run pngcheck only to find that it has invalid dimensions 0x0. This is a similar problem to Dimensionless Load (https://elnath.io/2020/06/09/dimensionless-loading/) and requires us to fix the issue.

I used the same python script as I did for Dimensionless Load:

After letting it run, it turns out the dimensions were: 420 x 69