https://osiriz.dev/tags/forensics/Recent content in forensics on OsirizHugo -- gohugo.ioen-usTue, 24 Dec 2024 15:59:20 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-20-exfiltering-i-asg%C3%A5rd/Tue, 24 Dec 2024 15:59:20 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-20-exfiltering-i-asg%C3%A5rd/Challenge Description Danish (original) Vi har opsnappet noget netværkstrafik, der tyder på, at Jætterne har haft adgang til Asgårds filservere og har exfiltreret filer. Vi frygter, at nogle af disse filer indeholder følsomme oplysninger, som Jætterne vil bruge til at afpresse Thor. Denne situation er kritisk, og vi har brug for din hjælp til at finde ud af, hvad der er blevet stjålet, før Jætterne kan gennemføre deres plan. English (from chatgpt) We have intercepted some network traffic suggesting that the Giants have had access to Asgard’s file servers and have exfiltrated files.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-11-duckfuscation/Tue, 24 Dec 2024 15:59:11 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-11-duckfuscation/Challenge Description Danish (original) Vi har modtaget efterretninger om, at dele af vores hemmelige kildekode samt adgangskoder er blevet sat til salg på darkweb. Som led i efterforskningen har vi afhørt vores udvikler “Loke” og beslaglagt hans workstation til nærmere undersøgelse. Under afhøringen var Loke ikke til stor hjælp; han snakkede konstant om Django, og til sidst var det kun et spørgsmål om sekunder, før IR-holdet, der udførte afhøringen, ville ty til andre metoder for at få ham til at tale.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-3-flag-tyveri/Tue, 24 Dec 2024 15:59:03 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-3-flag-tyveri/Challenge Description Danish (original) Jætterne har igen skabt problemer! Thor har opdaget, at nogen har stjålet et vigtigt flag fra hans system. Sporene peger på, at det er sket lidt efter lidt. Thor har sendt os en logfil, men vi har brug for din hjælp til at finde ud af, hvad der er blevet stjålet. English (from chatgpt) The giants have caused trouble again! Thor has discovered that someone has stolen an important flag from his system.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-2-gaven-der-forsvandt/Tue, 24 Dec 2024 15:59:02 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-2-gaven-der-forsvandt/Challenge Description Danish (original) Midt under juleforberedelserne i Valhalla er en vigtig gave til guderne forsvundet fra en af de fælles computere, der blev brugt i gave hallen! Gaven, tiltænkt Thor, var omhyggeligt gemt i de digitale haller, men nu er den væk fra computeren. Odin er rasende og mistænker, at Loke står bag endnu et snedigt trick for at skabe kaos i julefreden. Freja mener at have set Loke gå rundt med et USB-stick.https://osiriz.dev/posts/2024/03/htb-cyber-apocalypse-2024-game-invitation/Sun, 17 Mar 2024 22:00:00 +0100https://osiriz.dev/posts/2024/03/htb-cyber-apocalypse-2024-game-invitation/Challenge description In the bustling city of KORP™, where factions vie in The Fray, a mysterious game emerges. As a seasoned faction member, you feel the tension growing by the minute. Whispers spread of a new challenge, piquing both curiosity and wariness. Then, an email arrives: “Join The Fray: Embrace the Challenge.” But lurking beneath the excitement is a nagging doubt. Could this invitation hide something more sinister within its innocent attachment?https://osiriz.dev/posts/2023/10/fe-ctf-2023-the-fight-of-the-unicorn-fans-clubs/Tue, 31 Oct 2023 11:00:00 +0100https://osiriz.dev/posts/2023/10/fe-ctf-2023-the-fight-of-the-unicorn-fans-clubs/The Task at hand We are given the following task: Your best friend has asked for your help. She is the president of a unicorn fan club in a small village in Jutland. For years they have competed with the neighboring village about who has the best unicorn fan club. Rumor says that trusted members in the other club have access to an amazing picture of a unicorn. An insider in the other fan club has given your friend the following photos.https://osiriz.dev/posts/2023/04/ddc-2023-regionals-png-magic/Tue, 18 Apr 2023 19:00:00 +0200https://osiriz.dev/posts/2023/04/ddc-2023-regionals-png-magic/We are given magic.png file, which we cannot open: Lets try and open it in hexedit to look at the file header: Seems like the PNG magic bytes is missing, so we write them in: But we still fail: Lets use pngcheck to see what is wrong: If the open the file in hexedit again we can see that the IHDR chunk was renamed to JHDR: Lets change that: Lets check it now: Lets fix the checksum: We can know open the image: Hmm… no flag, seems like we are missing something, lets see if we can add some more height to the image.https://osiriz.dev/posts/2023/03/ddc-2023-qualification-the-key-store-version/Mon, 20 Mar 2023 09:30:00 +0100https://osiriz.dev/posts/2023/03/ddc-2023-qualification-the-key-store-version/We are asked to find the version of a key-value store hosted on keystore.hkn. We first look for open ports using nmap: $ nmap -p- keystore.hkn Starting Nmap 7.92 ( https://nmap.org ) at 2023-03-20 10:30 EDT Nmap scan report for keystore.hkn (77.184.238.37) Host is up (0.00025s latency). Not shown: 65534 closed tcp posts (conn-refused) PORT STATE SERVICE 6379/tcp open redis Nmap done: 1 IP address (1 host up) scanned in 3.https://osiriz.dev/posts/2023/03/ddc-2023-qualification-what-is-logging/Mon, 20 Mar 2023 09:30:00 +0100https://osiriz.dev/posts/2023/03/ddc-2023-qualification-what-is-logging/We are given a text file called logs.txt, it is 953 lines long and 243 Kilobytes big: $ wc -l logs.txt 953 logs.txt $ ls -lh logs.txt -rw-r--r-- 1 osiriz osiriz 243K Mar 20 10:30 logs.txt We can find the flag with grep: $ grep "DDC{" logs.txt 130.225.166.251 - - [25/Feb/2023:12:42:51 +0100] "POST /submit/flags/what-is-logging/DDC{CR4ZY-L0NG-F1L3S-C4N-B3-S34RCH3D} HTTP/1.1" 200 5082 "https://api.ntp-event.dk/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.