CSAW CTF 2016 Quals: evidence.zip

-

CSAW CTF 2016 Quals: evidence.zip

Category: Forensics Points: 100 Solves: 170 Description:
As part of CSAW CTF's ongoing efforts to terminate cheaters with extreme prejudice, we were supposed to have evidence incriminating a handful of teams in this zip file. I do not know what happened, but I do not think the evidence actually made it in there...

Write-up

string evidence.zip will dump out a bunch of gibberish, but at the end you find something like this:
JDzq<ilvf|5'*PK
galf
out/rxo802ayx4
3ht{
out/zhatnf5maf
1iv_
out/50lshu1ue6
n4i1
out/14o803swdq
3w
out/nppjdd2wdg
d33n
out/e9ydsxwetg
rf#_
out/0eetjrxpdm
elee
out/otuj3jrezt
neff
out/m70ohrycax
out/mpi3z4x5jt
out/meoflsxv4v
out/8y10tp04b2
out/eui6ltoijl
If you put it all together you'll get {neffeleerf#_d33n_3w_n4i11iv_3ht}galf or:

Flag

Flag: flag{th3_vi11i4n_w3_n33d_#freeleffen}

Commentaires

Enregistrer un commentaire

Posts les plus consultés de ce blog

Excel 4.0 macro Trojan Downloader

-
Image
Hash: 89e62ec08b0b6065134c67937bae76ccd70163770fd6992574e41b9c82c3cf1c Sample Download Link:  beta.VirusBay.io Application Name: Microsoft Excel File Type: xls VirusTotal Score: 29/60 I came across this sample on VirusBay.io. I downloaded this malicious excel file on my VM for malware analysis. OLEVBA.py First thing I did analysis of VBA macro source code in excel file using OLETools. Command >  OLEVBA.py -a The result shows, macro will auto execute on opening file and it may run executable file may be using shell command and will download a file from remote server. The executable file name is  FBpKzqF.exe Document Property: XLM macro has been used in this file which is hidden. Steps To Make Macros Sheet Visible Step 1 I enabled it by right click on the spreadsheet which is open in Excel and selected Unhide… And then a popup shows the name of spreadsheet I will select to unhide. Here name of sheet is  SODXOFScMLy . Step 2 Along with this need to unblock the excel ...
Lire la suite

TROJAN AGENT TESLA – MALWARE ANALYSIS

-
Image
Hash – 077f75ef7fdb1663e70c33e20d8d7c4383fa13fd95517fab8023fce526bf3a25 Family : Agent Tesla Signature: Microsoft Visual C# v7.0/ Basic.NET Filename: UIhLdVHHlUAKoEOpjVAsXFlIQrgS.exe VirusTotal score: Malware behavior: Steal browser information (URL, Usernames, Passwords) Steal passwords for email clients. Steal FTP Clients Steal download manager passwords. Collect OS and hardware information. Browser Information: When I debug the malware executable, Initially it creates a SQLite database to store collected information from victims machine. Below are the tables getting created. Tables created: meta logins sqlite_sequence stats compromised_credentials found it collected browsers data (Google chrome), that includes accessed URLs and related usernames and passwords. database table  logins  stores all browser related information. Below are the table columns. Apart from this, malware also look for all different types of ...
Lire la suite

{ UIUCT#2017 } - REV 350P - ARE WE OUT OF THE WOODS YET?

-
It looks like this python script was run through a custom packer. It's just Python*, which means it must be easy to reverse, right? *v3 .6 .1 : 69 c0db5 https: //www.youtube.com/watch?v=y8qQsXpcZXA You are presented with the file  packed.py  that contains the following code: import marshal, zlib, base64, itertools def xor_strings (_left, _k) : out = b'' for l, r in zip(_left, itertools.cycle(_k)): out += (l ^ ord(r)).to_bytes( 1 , byteorder= 'big' ) return out def YET_eval_code (p1, p2) : YET_code = marshal.loads(zlib.decompress(xor_strings(base64.b64decode(p2), p1))) eval(YET_code) YET_eval_code( "YET" , b'IdkZDw77+o1N7Di7tKvNdbcGSyxAHBQCMDw12oRMcF9ROnVSwvKV+QF5+XW7ro70gu6ab7p1grlxNvbOLDMNXJpNfMagxOrwCrApxe8WxToZJ7Fo1LSzaO87HkVHachzv7ItMwuLq4nI5KBzqkyYmZaLf6NnIUN7OjslBoVvqbufNX+mk6G33qpKTDwzrwa5znSK1ARqs3rO2ayzgCgJFhtzrHHI5AvrFfqYL9brp6R76oobxtoLPuobrJa/qtJ9aEzLRviUqpozgaGn9b3hZzzJ1FgKoTprUzpjRKSqP...
Lire la suite