Monthly Archives: January 2015
HackIM 2015

Another good CTF. I found it very challenging.  Most of my team was not able to participate so we did not do well. I was only able to solve one problem myself but was on the right track it seems on several others. I’m sure if we had more team members participating we could have put our minds together and solved more.

 

Forensics 300

mount -o loop FOR-300 /media/image

ls -laf

There is a .sh on the root directory that created random directories and files.

 

total 84K
-rw-r–r– 1 root root 4.9K Dec 31 1969 02CdWGSxGPX.bin
drwxr-xr-x 1 root root 0 Dec 31 1969 0GY1l
drwxr-xr-x 1 root root 0 Dec 31 1969 0h3a5
drwxr-xr-x 1 root root 0 Dec 31 1969 0l
drwxr-xr-x 1 root root 0 Dec 31 1969 0qsd
drwxr-xr-x 1 root root 0 Dec 31 1969 0wDq5
drwxr-xr-x 1 root root 0 Dec 31 1969 0Xs
drwxr-xr-x 1 root root 0 Dec 31 1969 1
drwxr-xr-x 1 root root 0 Dec 31 1969 2X
drwxr-xr-x 1 root root 0 Dec 31 1969 3
drwxr-xr-x 1 root root 0 Dec 31 1969 3J
drwxr-xr-x 1 root root 0 Dec 31 1969 44aAm
drwxr-xr-x 1 root root 0 Dec 31 1969 4A
drwxr-xr-x 1 root root 0 Dec 31 1969 4c
drwxr-xr-x 1 root root 0 Dec 31 1969 4CfVyuIW
drwxr-xr-x 1 root root 0 Dec 31 1969 4CQU
drwxr-xr-x 1 root root 208 Dec 31 1969 5Iuc
drwxr-xr-x 1 root root 260 Dec 31 1969 5U7WRf
-rw-r–r– 1 root root 19K Dec 31 1969 5ySfqnmFgFQd6il.bin
drwxr-xr-x 1 root root 0 Dec 31 1969 6JR3
drwxr-xr-x 1 root root 124 Dec 31 1969 6wUaZE1vbsW
drwxr-xr-x 1 root root 0 Dec 31 1969 75c083YdQf
drwxr-xr-x 1 root root 0 Dec 31 1969 7H7geLlS5
drwxr-xr-x 1 root root 0 Dec 31 1969 8A2MFawD4
drwxr-xr-x 1 root root 0 Dec 31 1969 8DQFirm0D
drwxr-xr-x 1 root root 0 Dec 31 1969 8HhWfV9nK1
drwxr-xr-x 1 root root 0 Dec 31 1969 8nwg
drwxr-xr-x 1 root root 0 Dec 31 1969 8RxQG4bvd
drwxr-xr-x 1 root root 0 Dec 31 1969 95D
drwxr-xr-x 1 root root 2.3K Dec 31 1969 a
drwxr-xr-x 1 root root 0 Dec 31 1969 aCIzN8I5
drwxr-xr-x 1 root root 0 Dec 31 1969 acy
drwxr-xr-x 1 root root 0 Dec 31 1969 Ad1CAg
drwxr-xr-x 1 root root 0 Dec 31 1969 aE
drwxr-xr-x 1 root root 0 Dec 31 1969 b
drwxr-xr-x 1 root root 268 Dec 31 1969 b0dNwf3bNy
drwxr-xr-x 1 root root 0 Dec 31 1969 b66
-rw-r–r– 1 root root 11K Dec 31 1969 B6IdX6a.bin
drwxr-xr-x 1 root root 284 Dec 31 1969 BY
-rw-r–r– 1 root root 12K Dec 31 1969 BYqYsXqp.bin
drwxr-xr-x 1 root root 0 Dec 31 1969 C
drwxr-xr-x 1 root root 0 Dec 31 1969 CEBIjqOoYttzQ
drwxr-xr-x 1 root root 0 Dec 31 1969 cOyWvykD1l1
drwxr-xr-x 1 root root 0 Dec 31 1969 cQLp9t6svJj
drwxr-xr-x 1 root root 0 Dec 31 1969 cTFarHjM
drwxr-xr-x 1 root root 0 Dec 31 1969 d2
drwxr-xr-x 1 root root 216 Dec 31 1969 dG7pHp24fl
drwxr-xr-x 1 root root 0 Dec 31 1969 DGcf
drwxr-xr-x 1 root root 0 Dec 31 1969 doKP
drwxr-xr-x 1 root root 144 Dec 31 1969 dontD0AnythingHERE
drwxr-xr-x 1 root root 0 Dec 31 1969 DS33Meg
drwxr-xr-x 1 root root 260 Dec 31 1969 duKt4ZJ
drwxr-xr-x 1 root root 0 Dec 31 1969 e
drwxr-xr-x 1 root root 0 Dec 31 1969 Ebnpv
drwxr-xr-x 1 root root 0 Dec 31 1969 F
drwxr-xr-x 1 root root 0 Dec 31 1969 FdnSdaQwA
drwxr-xr-x 1 root root 0 Dec 31 1969 FfrD0o
drwxr-xr-x 1 root root 0 Dec 31 1969 FinD
drwxr-xr-x 1 root root 0 Dec 31 1969 fm
drwxr-xr-x 1 root root 0 Dec 31 1969 g
drwxr-xr-x 1 root root 0 Dec 31 1969 gtj
drwxr-xr-x 1 root root 0 Dec 31 1969 h
drwxr-xr-x 1 root root 0 Dec 31 1969 H
drwxr-xr-x 1 root root 0 Dec 31 1969 H2Zj8FNbu
drwxr-xr-x 1 root root 0 Dec 31 1969 hdi7
drwxr-xr-x 1 root root 0 Dec 31 1969 hYuPvID
drwxr-xr-x 1 root root 0 Dec 31 1969 i
drwxr-xr-x 1 root root 132 Dec 31 1969 imgLDPt4BY
drwxr-xr-x 1 root root 0 Dec 31 1969 ix1EMRHRpIc2
drwxr-xr-x 1 root root 0 Dec 31 1969 j6uLMX
drwxr-xr-x 1 root root 0 Dec 31 1969 jE
drwxr-xr-x 1 root root 0 Dec 31 1969 jj
drwxr-xr-x 1 root root 0 Dec 31 1969 junk
drwxr-xr-x 1 root root 0 Dec 31 1969 JUr
drwxr-xr-x 1 root root 0 Dec 31 1969 K2QWa5
drwxr-xr-x 1 root root 116 Dec 31 1969 k6
drwxr-xr-x 1 root root 0 Dec 31 1969 k6B4zgvO9Ee
drwxr-xr-x 1 root root 0 Dec 31 1969 kNJSs
drwxr-xr-x 1 root root 0 Dec 31 1969 KS
drwxr-xr-x 1 root root 0 Dec 31 1969 KxEQM
drwxr-xr-x 1 root root 0 Dec 31 1969 LG6F
drwxr-xr-x 1 root root 0 Dec 31 1969 Lh
-rw-r–r– 1 root root 2.1K Dec 31 1969 LlC6Z0zrgy.bin
drwxr-xr-x 1 root root 0 Dec 31 1969 LO0J8
drwx—— 1 root root 0 Dec 31 1969 lost+found
drwxr-xr-x 1 root root 0 Dec 31 1969 LvuGM
drwxr-xr-x 1 root root 0 Dec 31 1969 lWIRfzP
drwxr-xr-x 1 root root 0 Dec 31 1969 m
drwxr-xr-x 1 root root 0 Dec 31 1969 m9V0lIaElz
drwxr-xr-x 1 root root 0 Dec 31 1969 MiU
drwxr-xr-x 1 root root 0 Dec 31 1969 Mnuc
drwxr-xr-x 1 root root 0 Dec 31 1969 n
drwxr-xr-x 1 root root 208 Dec 31 1969 NgzQPW
drwxr-xr-x 1 root root 0 Dec 31 1969 Nv
drwxr-xr-x 1 root root 0 Dec 31 1969 o
drwxr-xr-x 1 root root 0 Dec 31 1969 O7avZhikgKgbF
drwxr-xr-x 1 root root 0 Dec 31 1969 o8
drwxr-xr-x 1 root root 0 Dec 31 1969 OOoOs
drwxr-xr-x 1 root root 148 Dec 31 1969 orcA
drwxr-xr-x 1 root root 0 Dec 31 1969 oSx2p
drwxr-xr-x 1 root root 0 Dec 31 1969 OT
drwxr-xr-x 1 root root 108 Dec 31 1969 poiuy7Xdb
drwxr-xr-x 1 root root 0 Dec 31 1969 px6u
drwxr-xr-x 1 root root 0 Dec 31 1969 Q
drwxr-xr-x 1 root root 224 Dec 31 1969 qkCN8
drwxr-xr-x 1 root root 0 Dec 31 1969 QmUY1d
drwxr-xr-x 1 root root 240 Dec 31 1969 QQY3sF63w
drwxr-xr-x 1 root root 0 Dec 31 1969 r
drwxr-xr-x 1 root root 0 Dec 31 1969 Raf3SYj
-rw-r–r– 1 root root 4.2K Dec 31 1969 ran2.sh
drwxr-xr-x 1 root root 256 Dec 31 1969 rhZE1LZ6g
drwxr-xr-x 1 root root 0 Dec 31 1969 Ruc9
drwxr-xr-x 1 root root 0 Dec 31 1969 RZTOGd
drwxr-xr-x 1 root root 0 Dec 31 1969 scripts
-rw-r–r– 1 root root 0 Dec 31 1969 sdb.cramfs
drwxr-xr-x 1 root root 0 Dec 31 1969 sn
drwxr-xr-x 1 root root 0 Dec 31 1969 SPaK8l2sYN
drwxr-xr-x 1 root root 0 Dec 31 1969 SrZznhSAj
drwxr-xr-x 1 root root 0 Dec 31 1969 t
drwxr-xr-x 1 root root 0 Dec 31 1969 T
-rw-r–r– 1 root root 2.2K Dec 31 1969 TFGVOSwYd.txt
drwxr-xr-x 1 root root 0 Dec 31 1969 TFhmGS
drwxr-xr-x 1 root root 0 Dec 31 1969 u
drwxr-xr-x 1 root root 0 Dec 31 1969 uHuZk04I
drwxr-xr-x 1 root root 0 Dec 31 1969 UivNZ
drwxr-xr-x 1 root root 0 Dec 31 1969 UpVRswF
drwxr-xr-x 1 root root 0 Dec 31 1969 URdRCrZo
drwxr-xr-x 1 root root 0 Dec 31 1969 v
-rw-r–r– 1 root root 9.0K Dec 31 1969 W0HTWw6oxK.bin
drwxr-xr-x 1 root root 0 Dec 31 1969 weH
drwxr-xr-x 1 root root 0 Dec 31 1969 wOImbu
drwxr-xr-x 1 root root 0 Dec 31 1969 xawcc
drwxr-xr-x 1 root root 0 Dec 31 1969 Xde
-rw-r–r– 1 root root 6.0K Dec 31 1969 XM8cUidmtho.bin
drwxr-xr-x 1 root root 0 Dec 31 1969 Xnd5
drwxr-xr-x 1 root root 0 Dec 31 1969 XZn
drwxr-xr-x 1 root root 0 Dec 31 1969 Y
drwxr-xr-x 1 root root 0 Dec 31 1969 YDTfukUo
drwxr-xr-x 1 root root 0 Dec 31 1969 YMrSfm
drwxr-xr-x 1 root root 0 Dec 31 1969 Ys
-rw-r–r– 1 root root 2.5K Dec 31 1969 zBY1I NZU1pc.txt

 

Tried several methods looked through files by date to see if one was modified more recent. looked by file size to see if one stood out as bigger. But in the end running file on every file made some of the files standout. After looking through 3 or 4 of those files the flag was found.

 

run file on all the files to see if anything stands out. See several txt and jpg files. Looking through found a jpg as the flag.

find . -name ‘*’ -exec file {} + | more

./poiuy7Xdb/7yknXuW/VXIXNxl/sZ5 lxAn3HBp: directory
./poiuy7Xdb/7yknXuW/VXIXNxl/sZ5 lxAn3HBp/05O1rxFMm.JPG: data
./poiuy7Xdb/7yknXuW/VXIXNxl/sZ5 lxAn3HBp/HjrRoQkK2v.JPG: data
./poiuy7Xdb/7yknXuW/VXIXNxl/sZ5 lxAn3HBp/chDQpCvsZmlD.JPG: data
./poiuy7Xdb/7yknXuW/VXIXNxl/sZ5 lxAn3HBp/gcTf6LR8ZR.JPG: data
./poiuy7Xdb/7yknXuW/VXIXNxl/siFH0M2Vgh: directory
./poiuy7Xdb/7yknXuW/VXIXNxl/siFH0M2Vgh/MVI4LugVpb7qg.JPG: data
./poiuy7Xdb/7yknXuW/VXIXNxl/siFH0M2Vgh/uPQpX9Kxm3QEr33zaH.JPG: data
./poiuy7Xdb/7yknXuW/VXIXNxl/wmDKAM 1: directory
./poiuy7Xdb/7yknXuW/VXIXNxl/wmDKAM 1/7PgIrSa.JPG: data
./poiuy7Xdb/7yknXuW/VXIXNxl/wmDKAM 1/GhIMarfKkrrB.JPG: data
./poiuy7Xdb/7yknXuW/VXIXNxl/wmDKAM 1/lkjhwerle.jpg: JPEG image data, JFIF standard 1.01
./poiuy7Xdb/7yknXuW/gDObUWcZZG: directory
./poiuy7Xdb/7yknXuW/gDObUWcZZG/2maON5: directory
./poiuy7Xdb/7yknXuW/gDObUWcZZG/2maON5/HuD6lKeYHl.JPG: data
./poiuy7Xdb/7yknXuW/gDObUWcZZG/2maON5/z9XJfuFfqIXSU.JPG: data
./poiuy7Xdb/7yknXuW/gDObUWcZZG/5ErUBUSL3uNc.JPG: data
./poiuy7Xdb/7yknXuW/gDObUWcZZG/WGmoUW6YJ6ne: directory
./poiuy7Xdb/7yknXuW/gDObUWcZZG/WGmoUW6YJ6ne/5zOfI0qlna9R.JPG: data
./poiuy7Xdb/7yknXuW/gDObUWcZZG/WGmoUW6YJ6ne/EfRU5k8r.JPG: data
./poiuy7Xdb/7yknXuW/gDObUWcZZG/WGmoUW6YJ6ne/ILK9wXbmeS9DKOL.JPG: data
./poiuy7Xdb/7yknXuW/gDObUWcZZG/WGmoUW6YJ6ne/gymTmPz.JPG: data

 

 

The file was ./poiuy7Xdb/7yknXuW/VXIXNxl/wmDKAM 1/lkjhwerle.jpg:                          JPEG image data, JFIF standard 1.01

flag{f0rens!cs!sC00l}