Flight plan - Revision history

Exf at 19:23, 14 September 2022

2022-09-14T19:23:54Z

← Older revision		Revision as of 19:23, 14 September 2022
Line 1:		Line 1:
			[[File:Binwalk-pdf.PNG\|thumb\|Binwalk]]
			[[File:Pdf-flag.PNG\|thumb\|Flag ab.exe]]

	===Description===		===Description===
	After everything is cleared you start to wonder about the origin of this attack.		After everything is cleared you start to wonder about the origin of this attack.

192.168.110.1 at 19:22, 14 September 2022

2022-09-14T19:22:34Z

← Older revision		Revision as of 19:22, 14 September 2022
Line 12:		Line 12:
	The task was to find a malicious application hidden in a pdf file. I first looked at the PDF file with the strings command, but that did not produce the desired result. Next I tried the binwalk application, which showed that there were other files inside the file. I used the command <code>binwalk -e file.pdf</code>. Since the binwalk file is run with root user privileges (the service provider's virtual machine is in root mode) the <code>--run-as=root</code> suffix must be used.		The task was to find a malicious application hidden in a pdf file. I first looked at the PDF file with the strings command, but that did not produce the desired result. Next I tried the binwalk application, which showed that there were other files inside the file. I used the command <code>binwalk -e file.pdf</code>. Since the binwalk file is run with root user privileges (the service provider's virtual machine is in root mode) the <code>--run-as=root</code> suffix must be used.

	I looked at what the files contained and one file called <code>2DE26</code> was interesting. The SHA256Hash of the file indicated that it was a trojan. [~~Virustotal \|~~ https://www.virustotal.com/gui/file/3fd3adc4f2d15127e4eb9e4c7bfdbb4fc8eb1b72d6aee1ae2d9e4c341bdaeb06/detection] Well luckily I am using the virtual machine for the task. I tried to run the file with wine, but as it is a 32 bit program wine refuses to start.		I looked at what the files contained and one file called <code>2DE26</code> was interesting. The SHA256Hash of the file indicated that it was a trojan. [https://www.virustotal.com/gui/file/3fd3adc4f2d15127e4eb9e4c7bfdbb4fc8eb1b72d6aee1ae2d9e4c341bdaeb06/detection Virustotal] Well luckily I am using the virtual machine for the task. I tried to run the file with wine, but as it is a 32 bit program wine refuses to start.

	I will have a look with the strings command to see if there is a flag in plain ~~language~~ available.		I will have a look with the strings command to see if there is a flag in plain text available.
	~~I find the following line:~~
	~~<blockquota><code>hxX htoBohCryp1~~
	~~hX ha394hcf15h8adehb84-h8c-ah2-42h-888h25f2h3a44h is hflag1</code></blockquota>~~

	This is clearly a flag, but it is still messed up. I'm trying to find an app online that would change the number of letters in the right way. However, I can't find anything suitable, so I try to re-run the file by installing x86 architecture wine on the system. <code>dpkg --add-architecture i386 && apt update && apt install wine32 wine</code>		I find the following line:<blockquote><code>hxX htoBohCryp1</code>

			<code>hX ha394hcf15h8adehb84-h8c-ah2-42h-888h25f2h3a44h is hflag1</code></blockquote>This is clearly a flag, but it is still messed up. I'm trying to find an app online that would change the number of letters in the right way. However, I can't find anything suitable, so I try to re-run the file by installing x86 architecture wine on the system. <code>dpkg --add-architecture i386 && apt update && apt install wine32 wine</code>

	The application then agrees to start with the command wine [application]. The application will output the correct flag.		The application then agrees to start with the command wine [application]. The application will output the correct flag.

192.168.110.1 at 19:20, 14 September 2022

2022-09-14T19:20:38Z

← Older revision		Revision as of 19:20, 14 September 2022
Line 12:		Line 12:
	The task was to find a malicious application hidden in a pdf file. I first looked at the PDF file with the strings command, but that did not produce the desired result. Next I tried the binwalk application, which showed that there were other files inside the file. I used the command <code>binwalk -e file.pdf</code>. Since the binwalk file is run with root user privileges (the service provider's virtual machine is in root mode) the <code>--run-as=root</code> suffix must be used.		The task was to find a malicious application hidden in a pdf file. I first looked at the PDF file with the strings command, but that did not produce the desired result. Next I tried the binwalk application, which showed that there were other files inside the file. I used the command <code>binwalk -e file.pdf</code>. Since the binwalk file is run with root user privileges (the service provider's virtual machine is in root mode) the <code>--run-as=root</code> suffix must be used.

	I looked at what the files contained and one file called 2DE26 was interesting. The SHA256Hash of the file indicated that it was a trojan. Well luckily I am using the virtual machine for the task. I tried to run the file with wine, but as it is a 32 bit program wine refuses to start.		I looked at what the files contained and one file called <code>2DE26</code> was interesting. The SHA256Hash of the file indicated that it was a trojan. [Virustotal \| https://www.virustotal.com/gui/file/3fd3adc4f2d15127e4eb9e4c7bfdbb4fc8eb1b72d6aee1ae2d9e4c341bdaeb06/detection] Well luckily I am using the virtual machine for the task. I tried to run the file with wine, but as it is a 32 bit program wine refuses to start.

	I will have a look with the strings command to see if there is a flag in plain language available.		I will have a look with the strings command to see if there is a flag in plain language available.

192.168.110.1: /* Solution */

2022-09-14T19:19:46Z

Solution

← Older revision		Revision as of 19:19, 14 September 2022
Line 10:		Line 10:

	===Solution===		===Solution===
			The task was to find a malicious application hidden in a pdf file. I first looked at the PDF file with the strings command, but that did not produce the desired result. Next I tried the binwalk application, which showed that there were other files inside the file. I used the command <code>binwalk -e file.pdf</code>. Since the binwalk file is run with root user privileges (the service provider's virtual machine is in root mode) the <code>--run-as=root</code> suffix must be used.

			I looked at what the files contained and one file called 2DE26 was interesting. The SHA256Hash of the file indicated that it was a trojan. Well luckily I am using the virtual machine for the task. I tried to run the file with wine, but as it is a 32 bit program wine refuses to start.

			I will have a look with the strings command to see if there is a flag in plain language available.
			I find the following line:
			<blockquota><code>hxX htoBohCryp1
			hX ha394hcf15h8adehb84-h8c-ah2-42h-888h25f2h3a44h is hflag1</code></blockquota>

			This is clearly a flag, but it is still messed up. I'm trying to find an app online that would change the number of letters in the right way. However, I can't find anything suitable, so I try to re-run the file by installing x86 architecture wine on the system. <code>dpkg --add-architecture i386 && apt update && apt install wine32 wine</code>

			The application then agrees to start with the command wine [application]. The application will output the correct flag.

	===Tools===		===Tools===

192.168.110.1 at 19:00, 14 September 2022

2022-09-14T19:00:19Z

← Older revision		Revision as of 19:00, 14 September 2022
Line 17:		Line 17:

	===Flag===		===Flag===
	<code>3a4425f2-8882-428c-ab84-8adecf15a394</~~flag~~>		<code>3a4425f2-8882-428c-ab84-8adecf15a394</code>

	===Links===		===Links===
	*[[CTF Challenges \| Back to CTF Challenges page]]		*[[CTF Challenges \| Back to CTF Challenges page]]

192.168.110.1: /* Flag */

2022-09-14T19:00:10Z

Flag

← Older revision		Revision as of 19:00, 14 September 2022
Line 17:		Line 17:

	===Flag===		===Flag===
			<code>3a4425f2-8882-428c-ab84-8adecf15a394</flag>

	===Links===		===Links===
	*[[CTF Challenges \| Back to CTF Challenges page]]		*[[CTF Challenges \| Back to CTF Challenges page]]

192.168.110.1: /* Tools */

2022-09-14T18:59:26Z

Tools

← Older revision		Revision as of 18:59, 14 September 2022
Line 12:		Line 12:

	===Tools===		===Tools===
			binwalk \| binwalk -e file.pdf

			wine

	===Flag===		===Flag===

192.168.110.1 at 10:01, 12 September 2022

2022-09-12T10:01:56Z

← Older revision		Revision as of 10:01, 12 September 2022
Line 1:		Line 1:
	===Description===		===Description===
			After everything is cleared you start to wonder about the origin of this attack.

			When inspecting the logs, a correlation between the start of the compromise and a pdf file arriving to the ATC can be made.

			200pts

	===Question===		===Question===
			Inspect the flight plan, find out if there is anything malicious hidden in it.

	===Solution===		===Solution===

Exf: Created page with "===Description=== ===Question=== ===Solution=== ===Tools=== ===Flag=== ===Links=== * Back to CTF Challenges page"

2022-09-05T12:50:41Z

Created page with "===Description=== ===Question=== ===Solution=== ===Tools=== ===Flag=== ===Links=== * Back to CTF Challenges page"

New page

===Description===

===Question===

===Solution===

===Tools===

===Flag===

===Links===
*[[CTF Challenges | Back to CTF Challenges page]]