Advanced Lab Kit CTF Answer Key

Advanced Lab Kit CTF Answer Key

• Open Source Intelligence
• Internet Registry
• WHOIS
• Stuck on the Net
• PGP
• Covered QR
• Cryptography
• Decoding 1
• Decoding 2
• Decoding 3
• Decoding 4
• Decoding 5
• SSL
• Password Cracking
• Hashing
• Cracking 1
• Cracking 2
• Cracking 3
• Cracking 4
• Cracking 5
• ZIP
• Forensics
• Excellent Tracking
• Image File
• Sessions
• Log Analysis
• OTL
• History
• Suspicious Transfers
• Red Lion
• Network Traffic Analysis
• FTP
• DHCP
• Cracking
• Packet Dissection
• Extraction
• Scanning & Reconnaissance
• Port Scan
• Treasure Hunt
• DNS
• Who’s There?
• Enumeration & Exploitation
• Heckin Snek
• Redis
• Popping Boxes
• Malware Dropper
• Web Application Exploitation
• IOT
• MetroGov
• Catstagram
• Flag Board

Open Source Intelligence

Internet Registry

This is a challenge to use Googling skills to search for RIR for each country.

Questions

1. Which RIR is responsible for the United States?

• How to solve: Googling the question gives the answer, https://www.arin.net/about/welcome/region/
• Answers: American Registry for Internet Numbers or ARIN
• Incorrect Answers:
• APNIC
• AFRINIC
• LACNIC
• RIPE NCC

2. Which RIR is responsible for China?

• How to solve: Googling the question results in the correct answer, https://www.nro.net/list-of-country-codes-ordered-by-rir/
• Answers
• APNIC
• Asia-Pacific Network Information Centre
• Asia Pacific Network Information Center
• Asia-Pacific Network Coordination Centre

3. Which RIR is responsible for South Africa?

• How to solve: Googling the question results in the correct answer, https://www.nro.net/list-of-country-codes-ordered-by-rir/
• Answers:
• AFRINIC
• African Network Information Center
• African Network Information Centre
• African Network Coordination Centre
• Incorrect Answers:
• LACNIC
• APNIC
• ARIN
• RIPE NCC

WHOIS

This challenge is having users perform online reconnaissance on the cyberskyline.com domain

Questions

1. Who is the registrar of this domain?

• How to solve: whois cyberskyline.com and look for the registrar field. If the whois command is not installed, run

sudo apt install whois || sudo yum install whois

• Answer:
• namecheap
• DYNADOT

2. What is the IANA ID of the registrar?

• How to solve: whois cyberskyline.com and look for the registrar IANA field which has the ID
• Answer:
• 1068
• 472

3. On what date was this domain first registered? (Answer format: yyyy-mm-dd)

• How to solve: from the whois result look at the creation date field
• Answer: 2014-04-15

4. What is this domain's registry domain id?

• How to solve: from the whois result look at the registry domain id field
• Answer: 1854866838_DOMAIN_COM-VRSN

Stuck on the Net

This challenge is using the Wayback machine to find a document that has been deleted from the internet.

The Liber8tion hacking group is reigniting an old threat by deploying the Stuxnet worm. Your task is to counter this maneuver. Recall in 2010, CISA released a crucial document: Update A, offering strategies to mitigate this malware. Although it appears deleted, I'm convinced it's still out there. Help me uncover this document and answer pivotal questions to combat this worm.

Questions

1. On what date was the document published?

• How to solve: The date is on the document, you first have to find it on the way back machine by searching for ‘stuxnet’ and then filtering by government documents, the correct document is the first one listed.
• Answer: 2010-09-02

2. What is the unique advisory identifier for the document?

• How to solve: Once you have the correct document, this is on the top of the page
• Answers:
• ICSA-10-238-01A
• ICS-CERT Advisory ICSA-10-238-01A

3. What piece of hardware was used to spread the Stuxnet worm?

• How to solve: This can be solved by googling, or looking in the document found and it will state that USB drives were the main problem.
• Answer: USB or USB drives

4. What tool was used to remove the Stuxnet worm?

• How to solve: The document has a how to remove section where it talks about the SysClean tool
• Answer: SysClean or MSRT

5. What is the SHA256 checksum of the document?

• How to solve: wget -O- https://web.archive.org/web/20100921022043/http://www.us-cert.gov:80/control_systems/pdf/ICSA-10-238-01A%20-%20Stuxnet%20Mitigation.pdf | sha256sum
• Answer: 7a2b9e2990e592e8319a297556edb3876d5807637cc33b43ae6a7ea60c97b576

PGP

In this challenge you’ll look up information about PGP keys.

Questions

1. How many user ids have been signed by redbar0n@hacknet.cityinthe.cloud (8B782013)?

• How to solve: http://keyserver.ubuntu.com/pks/lookup?search=hacknet.cityinthe.cloud&fingerprint=on&hash=on&op=index . Looking at Red Baron’s keys we see 2 user ids that are currently active, and 1 that was revoked
• Answer: 3

2. Who was the first person to sign red baron's certificate?

• How to solve: Looking at the time signed for the other 2 users, you can see Phreak’s was signed first.
• Answer: Phreak

3. What is the key id of the one certificate that was signed by red baron and revoked?

• How to solve: At the bottom of the page you can see `sig revok c08659daa7723d6d 2017-02-06T22:42:58Z` . The key id is after `revok`
• Answer: A7723D6D

4. When was Dexter's (6CD5E4E8) PGP certificate created?

• How to solve: Under Dexter’s section the first entry matches the key id and shows the date created `sig cert  7e9074086cd5e4e8 2017-02-06T22:43:09Z`
• Answer: 2017-02-06

Covered QR

This challenge is a QR code that has some data covered up. The goal is to recover the data in the data sections of the QR without needing to be able to scan it.

Questions

1. What version of QR Code is present in the image?

• How to solve:
• https://en.wikipedia.org/wiki/QR_code#Design
• Match the Version 2 to the QR code shown
• Answer: 2
• Incorrect answer: XMP Core 4.4.0-Exiv2

2. What is the error correction level?

• How to solve: https://en.wikipedia.org/wiki/QR_code#/media/File:QR_Format_Information.svg Match the mask bits to the Mask Pattern shown in the QR code
• Answer:
• High
• H
• Incorrect answer: Ha

3. What is the number for the mask pattern?

• How to solve: https://en.wikipedia.org/wiki/QR_code#/media/File:QR_Format_Information.svg Match the mask bits to the Mask Pattern shown in the QR code
• Answer:
• 3
• 011

4. What is the flag?

• How to solve: Read manually or use tools that can recover missing QR code data.
• Answer: SKY-QRCD-7492

Cryptography

Decoding 1

This challenge is using common number bases to encode the messages. Note that the Questions in the CTF have randomized input, so you’ll need to paste the provided Ciphertext in the following commands to get your answer.

Questions

1. MDExMDExMDAgMDExMDEwMDEgMDExMDEwMTEgMDExMDAxMDEgMDExMTAxMDAgMDExMTAxMDEgMDExMTAwMTAgMDExMDExMTA=

• How to solve: Use base64 to decode the message, and then use base2 to decode the message:

echo 'MDExMDExMDAgMDExMDEwMDEgMDExMDEwMTEgMDExMDAxMDEgMDExMTAxMDAgMDExMTAxMDEgMDExMTAwMTAgMDExMDExMTA=' | base64 -d | tr -d ' ' | basenc -d --base2msbf

The base64 command will decode the base64 content, returning the binary string: 01101100 01101001 01101011 01100101 01110100 01110101 01110010 01101110 . tr -d ' ' deletes the spaces, leaving basenc to turn the binary bits into letters.

• Answer: liketurn

2. TldacGMyaGxkbVZ5TkE9PQ==

• How to solve: Use base64 and then base64 again to decode the message:

echo 'TldacGMyaGxkbVZ5TkE9PQ==' | base64 -d | base64 -d

The first base64 command returns NWZpc2hldmVyNA== , which is also a base64-encoded string. The second base64 command returns 5fishever4 .

• Answer: 5fishever4

Decoding 2

This cipher is using a letter substitution cipher to encode the message.

Questions

1. What is the plaintext of the message: 9 20-18-1-14-19-6-5-18-18-5-4 20-8-5 2-9-20-3-15-9-14 15-21-20 15-6 20-8-5 5-24-3-8-1-14-7-5?

• How to solve: This cipher replaces letters with the corresponding alphabet placement. The service at https://www.boxentriq.com/encodings/numbers-to-letters will convert these for you.
• Answer: I transferred the Bitcoin out of the exchange

Decoding 3

This cipher is using a different letter substitution cipher.

Questions

1. ... -.- -.-- -....- . .. -.- .-.. -....- --... ...-- ----. .....

• How to solve: This cipher is using morse code. The translator at https://morsecode.world/international/translator.html will return these to Latin characters.
• Answer: SKY-EIKL-7395

Decoding 4

This text is encoded with the NATO phonetic alphabet.

Questions

1. What is the plaintext of the message: Whiskey-Oscar-Uniform-Lima-Delta Sierra-Tango-India-Lima-Lima?

• How to solve: This cipher is using the NATO encoding. It can be decoded by just looking at the first letters. The decoder at https://www.omnicalculator.com/everyday-life/nato-phonetic-alphabet will also return these to standard letters after you remove the dashes.
• Possible Answers:
• would still
• then fall
• resent none

Decoding 5

This is using a stream cipher to encrypt the plaintext.

Questions

1. What is the plaintext of the message?: 6fce38f8836e82d446c3af46eb3a945a97bb8088256751e47f73a02943883165

• How to solve: Since the 4 character password (or key) is unknown, you’ll need to create a script to brute-force the key and then you can decrypt the password.
• Answer: I think they installed a new IDS

SSL

Parse through hundreds of SSL certificates to identify any invalid or improperly signed SSL certificates.

Questions

1. What is the Common Name in the root certificate?

• How to solve: openssl x509 -in rootCA.crt -noout -text | less

Look for the field following “CN =”.

• Answer: cityinthe.cloud
• Incorrect answer: liber8.cityinthe.cloud

2. What is the Common Name in the servers' certificates?

• How to solve:for X in cert*.crt ; do openssl x509 -in "$X" -noout -text | grep 'Subject.*CN =' ; done | uniq

This will return the sole Common Name used for each certificate following “CN =”

• Answer: liber8.cityinthe.cloud

3. What is the full filename of the invalid certificate?

• How to solve:for X in cert*.crt ; do echo "==== $X" ; openssl verify -CAfile rootCA.crt "$X" 2>&1 ; done | less

The valid certificates will show “OK” in their output; the invalid certificate will give additional details about the error.

• Answer: cert62.crt

Password Cracking

Hashing

This challenge is generating the hashes for passwords. Note that the commands below are examples of how to solve the challenges. Because the challenges are randomized you’ll need to insert the text provided by your challenge.

Questions

1. What is the md5 hash of the password: "briggsy8535" ?

• How to solve: echo -n “briggsy8535” | md5sum . For all three challenges you can also generate these hashes at https://www.browserling.com/tools/all-hashes . Do not press Enter after typing in the password - adding an Enter at the end changes the hash provided. (This is why the echo command has a “-n”; this also avoids adding an “Enter” at the end.)
• Answer: 265d117be51293354914b3f056883f0d

2. What is the sha1 hash of the password: "7675shutters" ?

• How to solve: echo -n “7675shutters” | sha1sum
• Answer: 7316d5b76414f05f9621ed8c92d375b584d2b9b5

3. What is the sha256 hash of the password: "80kuortney27" ?

• How to solve: echo -n “80kuortney27” | sha256sum
• Answer: 1c4745435dc57fda988b3b0f57089df9d72df0665e5c929366d8a0d8199aaeee

Cracking 1

This challenge has users use rockyou and a basic hashing technique to crack these passwords.

Our analysts have obtained password dumps storing hacker passwords. After obtaining a few plaintext passwords, it appears that they overlap with the passwords from the rockyou breach.

Questions

1. bff213c094f9a3ced43616ae1ac66859

• How to solve: Use hashcat identify the hash type (MD5) and the rockyou dictionary to crack this password. Decode all three passwords in this challenge using:
Copy

mkdir -p ~/tmp
cd ~/tmp
echo 'bff213c094f9a3ced43616ae1ac66859' >>raw.txt
echo '7fefda021ba0c575a63304d8ec60f910' >>raw.txt
echo '26701278d75b66260bde4d46dba531a2' >>raw.txt
hashcat -m 0 -a 0 ./raw.txt /usr/share/dict/rockyou.txt

• At any point - even when hashcat is running - you can see all recovered passwords by running the command:
Copy

cat ~/.local/share/hashcat/hashcat.potfile

• Possible answers: 1snails , 77snail7

2. 7fefda021ba0c575a63304d8ec60f910

• How to solve: See the instructions in the question 1.
• Possible answers: 123Ladybird123 , 123birdic

3. 26701278d75b66260bde4d46dba531a2

• How to solve: See the instructions in question 1.
• Possible answers: 4elephant , 73elephants

Cracking 2

This challenge is encrypting passwords using a Windows encryption method.

Questions

1. 3074406F4A523A82C81667E9D738C5D9:ABCE3B23B8FDC964B0DF9E8CEF9A8B1B

• How to solve: Use ophcrack and XP free fast rainbow tables to crack this password
• Possible answers: iworum93 , ukudib06

2. 0BD2CF2BF983923A1D71060D896B7A46:40C7CEC217A89E81587BB1FEB0A61F32

• How to solve: Follow the steps in question 1.
• Possible answers: ladopi01 , enejeh12

3. D6D104C5CF2BAE609C5014AE4718A7EE:3A21E238A2EDAF44533AF30A8B9C0C8C

• How to solve: Follow the steps in question 1.
• Possible answers: timace46 , asoqoc25

Cracking 3

This challenge is encrypting passwords off of a pattern and 4 digits. Note that the questions and answers are randomized, so you’ll need to enter the hashes supplied by the challenge instead of the examples shown below. Also, all three questions can be solved at the same time by using the following commands (after installing hashcat):

echo -e '7f99ef2e8689f69100c39436ad257b4c\n484cda8da17c20a84484398e8d875511\n5e519939a3947c33f3a0026894e604da" >hash.txt
hashcat -m 0 -a 3 hash.txt 'SKY-SENH-?D?D?D?D'

Questions

1. 7f99ef2e8689f69100c39436ad257b4c

• How to solve:
Copy

echo '`7f99ef2e8689f69100c39436ad257b4c`' >hash.txt
hashcat -m 0 -a 3 ./hash.txt 'SKY-SENH-?d?d?d?d'

• Answer: SKY-SENH-6535

2. 484cda8da17c20a84484398e8d875511

• How to solve:
Copy

echo '484cda8da17c20a84484398e8d875511**`' >hash.txt
hashcat -m 0 -a 3 ./hash.txt 'SKY-SENH-?d?d?d?d'

• Answer: SKY-SENH-7040

3. 5e519939a3947c33f3a0026894e604da

• How to solve:
Copy

echo '5e519939a3947c33f3a0026894e604da' >hash.txt 
hashcat -m 0 -a 3 ./hash.txt 'SKY-SENH-?d?d?d?d'

• Answer: SKY-SENH-0184

Cracking 4

This challenge is using a list of nouns and 2 digits to encrypt the passwords.

We have obtained password dumps storing hacker passwords. They appear to be default passwords to IoT devices. We know these default passwords follow a pattern: a noun + 2 digits and have found a list of nouns used. Can you figure the passwords out?

Questions

1. c6439eeed28371226d4f50fecda49fa6

• How to solve:echo 'c6439eeed28371226d4f50fecda49fa6' >hash.txt

hashcat -m 0 -a 6 hash.txt noun.txt '?d?d'

• Answer: cake74

2. 073a17be8aa565a96961ccc465c27f6e

• How to solve:echo '073a17be8aa565a96961ccc465c27f6e' >hash.txt

hashcat -m 0 -a 6 hash.txt noun.txt '?d?d'

• Answer: day49

3. abb7381c5537954578c457eb33db388f

• How to solve:echo 'abb7381c5537954578c457eb33db388f' >hash.txt

hashcat -m 0 -a 6 hash.txt noun.txt '?d?d'

• Answer: map93

Cracking 5

This challenge is using popular movie names with rules to encrypt the passwords.

Questions

1. $1$pcw$oOaPsztM9uiKao2LXiLTq.

• How to solve: Use hashcat and make a wordlist using superhero and/or superhero movie names.
• The permutation options in a hashcat format should include capitalizing the word and appending and/or prepending symbols and digits. These should be placed in “rules.txt” in the current directory.

echo -n '$1$pcw$oOaPsztM9uiKao2LXiLTq.' >hash.txt

hashcat -m 500 -a 0 rules.txt hash.txt /usr/share/dict/movies.txt

• Answer: deadpool8

2. $1$sik$XixfPUI3SdiFr1A8CdL0b.

• How to solve:echo -n '$1$sik$XixfPUI3SdiFr1A8CdL0b.' >hash.txt

hashcat -m 500 -a 0 rules.txt hash.txt movies.txt

• Answer: magneto$

3. $1$jBT$lsCytRQk2MY1gC25TAHrm/

• How to solve:echo -n '$1$jBT$lsCytRQk2MY1gC25TAHrm/' >hash.txt

hashcat -m 500 -a 0 rules.txt hash.txt movies.txt

• Answer: Wolverine5

4. $1$YTY$wfxAYczhikEkPCcUDfGBL/

• How to solve:echo -n '$1$YTY$wfxAYczhikEkPCcUDfGBL/' >hash.txt

hashcat -m 500 -a 0 rules.txt hash.txt movies.txt

• Answer: *spiderman*29

5. $1$cEx$zxAx2ZIqOxg45.qdndpsu0

• How to solve:echo -n '$1$cEx$zxAx2ZIqOxg45.qdndpsu0' >hash.txt

hashcat -m 500 -a 0 rules.txt hash.txt movies.txt

• Answer: elektra218

6. $1$Rxn$eAnyDfS55PTENA5HQ9nKZ.

• How to solve:echo -n '$1$Rxn$eAnyDfS55PTENA5HQ9nKZ.' >hash.txt

hashcat -m 500 -a 0 rules.txt hash.txt movies.txt

• Answer: -scarletwitch!1

ZIP

This challenge revolves around cracking a Zip password to extract the files.

Questions

1. What is the password used to encrypt the zip archive?

• How to solve: First run zip2john Encrypted.zip > zip.hash to get the hash then run john zip.hash to crack the password.
• Answer: hammonds13

2. What is the flag hidden in the zip archive?

• How to solve: Look around the Zip archive to find the flag
• Answer: SKY-BJTE-5639

Forensics

Excellent Tracking

There is a Microsoft Excel spreadsheet that has some changes made to it. Use the tracking information built into the spreadsheet to find historical data.

Questions

1. What is the full name of the creator of the spreadsheet?

• How to solve: Unzip the Excel file. In docProps/core.xml there is a <dc:creator></dc:creator> tag. This is the original owner of the spreadsheet.
• Answer: Jack Jillian

2. What is the full name of the person who tampered with the file?

• How to solve: In Excel, Review -> Highlight Changes -> Accept/Reject Changes . In LibreOffice, Go to Edit -> Track Changes -> Manage . On the commandline, open xl/revisions/revisionHeaders.xml .
• There you’ll see that Bobert Jones made changes.
• Answer: Bobert Jones

3. What date and time was the file tampered with? (in the tamperer's local time)

• How to solve: Same process as Q#2
• Answer: 2021-01-05 08:43

4. What was the flag before the changes?

• How to solve: In Excel, Review -> Highlight Changes -> Accept/Reject Changes. Reject all changes made by Bobert Jones. Flag is on the first sheet. On commandline -> xl/revisions/revisionLog2.xml shows changes made.
• Answer: SKY-EXCL-4839

Image File

This is a disk image of a USB boot device for a linux installer.

Questions

1. What Operating System installer is this? (not the kernel)

• How to solve: Mount .iso to a folder mkdir /mnt/iso/

sudo mount -o loop mysterious.iso /mnt/iso

The answer is found in /mnt/iso/boot/isolinux/boot.msg .

• Answer: Tiny Core

2. What version of the OS does it install?

• How to solve: Will need to move core.gz to another folder to get write access to core.gz:

cp /mnt/iso/boot/core.gz /tmp

cd /tmp

Extract core.gz gunzip core.gz

Extract core cpio file cpio -idv < ./core

1. The version is in /tmp/etc/os-release
• Answer: 11.1
• Incorrect answer: 6.4

3. What user folder is included on install?

• How to solve: Find user directory in /tmp//home
• Answer: liber8

4. What is the flag?

• How to solve: Open /tmp/home/liber8/secrets.png in any image viewer.
• Answer: SKY-TCOR-3924

Sessions

This is a session file from a Chrome browser.

Questions

1. How many tabs does the user have open?

• How to solve:git clone https://github.com/JRBANCEL/Chromagnon/

cd Chromagnon

git checkout SNSS

python2 chromagnonSession.py session.log > output

SetTabIndexInWindow - Tab: 511, Index: 25 in the output shows it setting how many indices there are in the window. Index starts at 0. 26 tabs.

• Answer: 26

2. What is the width of the user's monitor?

• How to solve: SetWindowBounds3 - Window: 438, x: 377, y: 130, w: 1280, h: 671, State: 3 Width and height of the window are shown. Width=1280
• Answer: 1280

3. How many Wikipedia tabs are open?

• How to solve: grep "wikipedia" output shows 5 outputs, but the Tab: value shows 4 unique values. There are only 4 wiki tabs open.
• Answer: 4

4. How many searches were made on Google?

• How to solve:grep "google.com/search" output | awk '{print $8}' | sort -u | wc -l gives 10 things searched for. Page reloads give additional outputs, so you need to sort those out.
• Answers: 10

5. What is the 9th thing that was searched for on Google?

• How to solve: grep "google.com/search" output | awk 'NR==9 {print $8}' Print 9th search
• Answers:
• wireless adapter for wifi hacking
• Wireless+adapter+for+wifi+hacking

6. What is the URL of the 2nd result that was clicked on in the above search?

• How to solve:grep -A 8 'search?q=wireless+adapter+for+wifi+hacking&oq=wireless+adapter+for+wifi+hacking' output Things immediately after the search. 2nd url seen is the answer.
• Answer: https://kennyvn.com/best-wireless-adapters-kali-linux/

7. How many unique URLs were visited by the user?

• How to solve: grep -i "url:" output | awk '{print $8}' | sort -u | wc -l gets every unique url. Minus 1 because of chrome://newtab/
• Answer: 41, 42

8. What platform does the user download Tor for?

• How to solve: grep -i tor output Gives the download page for android https://www.torproject.org/download/#android
• Answer: Android

9. What is the model number of the wireless adapter the user attempts to buy?

• How to solve: URL above the UpdateTabNavigation - Tab: 505, Index: 1, Url: https://pay.ebay.com/rgxo?action=view&sessionid=1164791477 URL
• Answer: AWUS036NHA

10. What is the index number of the last tab that was clicked?

• How to solve: Bottom of the output file. SetSelectedTabInIndex - Window: 438, Index: 14. SetSelectedTabInIndex is the index of the tab that was last clicked
• Answer: 14

Log Analysis

OTL

This is a Windows system diagnostic log. Analyze it to understand how a system is set up.

Questions

1. What is the date of this virus scan?

• How to solve: Top of file

OTL Extras logfile created on: 1/3/2013 12:33:48 PM - Run 1

• Answer: 2013-01-03

2. What version number of Windows was running on the computer (use exact version number)?

• How to solve: Top of file

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

• Answer: 6.1.7601

3. How large (in GB) is the C drive?

• How to solve: Line 12 of log

Drive C: | 448.45 Gb Total Space | 349.99 Gb Free Space | 78.04% Space Free | Partition Type: NTFS

• Answer:
• 448
• 448.45

4. What is the name of the owner of the computer?

• How to solve: Line 2 of log

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\JOHN\Desktop

• Answer: John

5. What is the manufacturer of the computer?

• How to solve: Line 16— Shows JOHN-HP as computer name, searching HP as a hint leads to HP Wireless Assistant and HP Quick Launch. There are also multiple references to Hewlett-Packard installed tools in this log output.
• Answers:
• HP
• Hewlett Packard
• Hewlett-Packard

6. What version of 7-Zip is on this computer?

• How to solve: Search for 7-Zip -> Line 396

"7-Zip 9.20" = 7-Zip 9.20

• Answer: 9.20

7. What is the primary antivirus software running on the computer?

• How to solve: Search for known antivirus solutions or look in same section of installed programs as in 7-Zip -> Line 418

"N360" = Norton 360

• Answer: Norton

History

This is a browser history log.

Questions

1. What tool was the hacker trying to operate?

• How to solve: This can be solved by using the program "DB Browser for SQLite" In `Browse Data` -> `moz_places` shows the full history of the browser session. ID 17 shows ophcrack site visited.
• Answer: ophcrack

2. What did the hacker search for on Google?

• How to solve: ID 28 shows google query
• Answer: ethereum

3. What is the contract address that the hacker viewed?

• How to solve: ID 32 shows a visit to /contracts then ID 33 shows a visit to an account, that account is the contract address.
• Answer: d79b4c6

4. We want to track down any assets that this hacker may have. Based on our interrogation, we think they must have accessed a website with financial information. What website did they visit?

• How to solve: After the etherchain vists, you can see coinbase.com is visited.
• Answer: coinbase

5. What is the name of the file that the hacker downloaded?

• How to solve: ID 19 shows "Download ophcrack from SourceForge.net", immediately after that you can see a visit to "https://svwh.dl.sourceforge.net/project/ophcrack/tables/XP%20free/tables_xp_free_fast.zip"
• Answers:
• tables_xp_free_fast.zip
• tables_xp_free_fast

Suspicious Transfers

This is a log of a file share service and has some suspicious transfers.

Questions

1. How many total entries are present in this log?

• How to solve: Parse the JSON log however is best for you. We’ve chosen to write a javascript script to handle the parsing. First rename the .log to .json and wrap the JSON objects in an array and import it to your script:
Copy

const file = require('./app_transfers.json')
Now just count the entries `file.length`

• Answer: 98522
• Incorrect answer: 1000

2. Which day saw the largest number of events?

• How to solve: Loop through the entries and make date objects for each entry’s `ts` and add to a count for each time a date is present
• Answers:
• 2019/02/11
• 2019-02-11
• Incorrect answer: 02/11/2019

3. How many total gigabytes of data was transferred in this log?

• How to solve: Loop through the entries and make a total byte count. This will require some parsing and matching to extract and convert to GB.

Example:

Copy

const isMB = entry.transfered.match(/(.*) MB/)
const isKB = entry.transfered.match(/(.*) kB/)
if(isMB) {
totalTransfered += isMB[1] / 1_000
}
if(isKB) {
totalTransfered += isKB[1] / 1_000_000
}

• Answers:
• 247
• 247.1
• 247.10
• 230.1
• 230.10
• 230
• Incorrect answer: 250

4. Which IP address demonstrated suspicious behavior?

• How to solve: Looking at the entries as a whole and going field to field you can see there is one entry whose longitude and latitude are vastly different from every other entry. Take the IP of this entry for suspicious behavior.
• Answer: 104.34.236.100
• Incorrect answer: 104.34.236.1

Red Lion

This is a reporting log from a device for a Red Lion deployment.

Questions

1. How many devices are listed in this log file?

• How to solve: Process the log line by line and parse the json however is best for you. We’ve chosen to parse using Javascript. Loading the file in line by line, we can see there are 405 entries.
• Answer: 405

2. How many log entries listed a device located in Canada?

• How to solve: Filter by “if the location is Canada” and count like this example:
Copy

if(entry.location.country_name === 'Canada') {
canada += 1;
}

• Answer: 16

3. What is the ASN of the autonomous system that had the most clients in the log?

• How to solve: Group each entry by the ‘asn’ field and count each asn’s total appearances. An example using a JS library ‘lodash':
Copy

let max = [0, ''];
_.forOwn(_.groupBy(data, 'asn'), (val, key) => {
    if(max[0] < val.length) {
        max[0] = val.length
        max[1] = key
    }
})

• Answer: AS22394

4. What is the IP address of the device that does not have an ASN listed in the log?

• How to solve: While looping through the entries, we can check for ones missing the ‘asn' field:
Copy

if(entry.asn === undefined || entry.asn === null) {
    noASN = entry;
}

• Answer: 162.248.58.250

5. What is the most common device version number in the log?

• How to solve: You can use a similar approach to question 3 but group by the ‘version’ field.
• Answer: G306A

6. How many devices used the most common version in the log?

• How to solve: Will be in the count in the solve from question 5
• Answer: 162

7. How many distinct version numbers were seen in this log?

• How to solve: While looping through entries, you can create a JS Set which can be added to only if the value is unique to get a count.
Copy

let uniqueVersions = new Set();
uniqueVersions.add(entry.version)
console.log(uniqueVersions.size)

• Answer: 29

Network Traffic Analysis

FTP

Analyze a FTP packet capture.

Questions

1. What is the IP of the client?

• How to solve: Packet #4 shows a welcome message being sent to the client (10.0.0.25)
• Answer: 10.0.0.25

2. What is the IP of the server?

• How to solve: Packet #4 shows a welcome message being sent from the server (10.0.0.12)
• Answer: 10.0.0.12

3. What is the username used to log in?

• How to solve: Packet #6 shows the username "notadmin" being sent.
• Answer: notadmin

4. What is the password used to log in?

• How to solve: Packet #10 shows the password "driver80" being sent
• Answer: driver80

5. What is the flag?

• How to solve: TCP stream starting at packet #44 is the data for the image being downloaded. Follow stream and export image.
• Answer: SKY-NFTP-9021

DHCP

Analyze network configuration via DHCP.

Questions

1. What is the IP address of the DHCP server?

• How to solve: Packet #3 contains an entry pointing to the DHCP server
• Answers:
• 10.64.32.99
• 10.244.0.10

2. What is the MAC address of the DHCP relay agent?

• How to solve: The source MAC in packet #3 is the DHCP relay.
• Answer: 00:23:05:8c:0d:47

3. Who is the manufacturer of the DHCP relay agent?

• How to solve: Wireshark will attempt to decode the manufacturer for you.
• Answer: Cisco

4. What is the MAC address of the DHCP client?

• How to solve: This can be found in the destination MAC in packet #3
• Answer: 00:0c:29:21:cd:92

5. What is the IP address offered by the DHCP server to the client?

• How to solve: This can be found in packet #3.
• Answer: 10.244.9.3

6. How long (in hours) is the IP address lease from DHCP?

• How to solve: This can be found in packet #3.
• Answer: 24

7. What is the IP address of the first DNS server offered by DHCP?

• How to solve: This can be found in packet #3.
• Answer: 10.244.0.10

Cracking

This is a capture of a client connecting to a WiFi network to be able to crack the password.

Questions

1. What channel was the victim network operating on?

• How to solve: Packet #3 in the ‘IEEE 802.11 Wireless Management’ frame shows ‘Tag: Current Channel’
• Answer: 4

2. What is the ESSID of the wifi network that was hacked?

• How to solve: Packet #3 in the ‘IEEE 802.11 Wireless Management’ frame shows ‘Tag: SSID parameter set'
• Answer: AJ_Home

3. What is the MAC address of the device generating traffic that makes cracking the password on the wifi network possible?

• How to solve: The main traffic is between a client and a router. In this case, you can see the router is called TpLinkTechno, so take the MAC address of the client.
• Answer: 56:A8:20:C5:AF:EB

4. What company is assigned the OUI of the access point?

• How to solve: You can look up the OUI with a tool like https://www.wireshark.org/tools/oui-lookup.html . You can input the beginning MAC address of C0:4A:00 or Wireshark can automatically decode it for you.
• Answers:
• tplink
• p-link
• tp link

5. What is the wireless password (in hex)?

• How to solve: Run aircrack-ng Cracking.pcap to crack the password in hex.
• Answer: 33:44:5F:6D:67

Packet Dissection

This is a DNS packet broken down to raw data to decode.

Questions

1. What is the Transaction ID of this DNS response (in hex)?

• How to solve: The Identification section is the first 16 bits of the packet, so with each character being 4 bytes, you take the first 4 characters.
• Correct Answers: f7b1 or 0xf7b1
• Incorrect answers:
• f7b18180

2. How many answer resource records are in this DNS packet?

• How to solve: The ‘Total Answer RRs’ field starts at bit 48 and ends at bit 64, so we have the hex of ‘00 05'
• Answer: 5

3. What is the queried domain from this DNS request?

• How to solve: The ‘Question’ field after the beginning of the packet contains the hex ‘0d 73 74 61 63 6b 6f 76 65 72 66 6c 6f 77 03 63 6f 6d’ which translates to the site queried.
• Answer: stackoverflow.com

4. What is the queried record type in the DNS query?

• How to solve: The ‘Type’ of query is immediately after the name of query, in this case is ‘00 0f’ which is an MX type.
• Answers:
• mail exchanger record
• MX
• mail exchanger

5. What is the value of the response record with the highest priority?

• How to solve: In the ‘Answer RRs’ section, going through the structure for each answer, there is a preference field for each and the lower the preference, the higher the priority is for the answer. The hex for this preference looks like ‘00 01’
• Answer: aspmx.l.google.com

Extraction

This is a packet capture of a file being extracted from a company’s network. The goal is to find the file extracted.

Questions

1. What IP was the file extracted from?

• How to solve: This file is being extracted using TCP sequence numbers. You can see this from the Acknowledgement number being very high numbers. The client making the requests is 192.168.0.2, so the server would the other IP being interacted with.
• Answer: 192.168.0.253

2. How many lines are in the file?

• How to solve: To extract the file, you must extract the sequence numbers from the packet capture.tshark -r extraction.pcapng -Y "ip.dst == 192.168.0.2" -T fields -e tcp.seq_raw > seqs.txt

Each sequence number must be decoded like

seq = int(line)

bytes = b''

bytes += ((seq >> 24) & 0xFF).to_bytes(1, 'big')

bytes += ((seq >> 16) & 0xFF).to_bytes(1, 'big')

bytes += ((seq >> 8) & 0xFF).to_bytes(1, 'big')

bytes += (seq  & 0xFF).to_bytes(1, 'big')

These bytes written to disk will give the file extracted. In this case it is an ‘/etc/passwd’ file.

• Answer: 20

3. What is the MD5 digest of the extracted file?

• How to solve: md5sum output.txt
• Answer: 88a79f1dbc440c7e3bcb75a81d669ace

Scanning & Reconnaissance

Port Scan

Perform a port scan on a given target.

Questions

1. How many ports are open?

• How to solve: nmap -sC -p 1-65535 target
• Answer: 4

2. What is the first flag?

• How to solve: Use netcat to connect to the first port. Note that this may be named nc or ncaton some linux systems.
• Answer: SKY-GIFT-3910

3. What is the second flag?

• How to solve: Use netcat to connect to the second port
• Answer: SKY-LOOT-2861

4. What is the third flag?

• How to solve: Use netcat to connect to the third port
• Answer: SKY-BOOP-7395

5. What is the fourth flag?

• How to solve: Use netcat to connect to the fourth port
• Answer: SKY-JUMP-8137

Treasure Hunt

Use dirbuster to perform a directory enumeration.

Questions

1. What is Flag 1?

• How to solve: This is found with a dirbuster scan.
• Answer: SKY-ALIA-0199

2. What is Flag 2?

• How to solve: This is found with a dirbuster scan.
• Answer: SKY-UPUP-1212

3. What is Flag 3?

• How to solve: This is found with a dirbuster scan.
• Answer: SKY-ROYK-5040

4. What is Flag 4?

• How to solve: This is found with a dirbuster scan.
• Answer: SKY-FOOT-0042

5. What is Flag 5?

• How to solve: This is found with a dirbuster scan.
• Answer: SKY-TSLA-2019

DNS

Figure out what domains are being blocked by a DNS sinkhole.

Questions

1. How many domains are being blocked?

• How to solve: Use dig and the host file provided to query each domain then analyze the results.
• Answer: Three

2. What is the FQDN with a .net TLD that is being blocked?

• How to solve: Use dig and the host file provided to query each domain then analyze the results.
• Answer: wazimo-d.openx.net

3. What is the FQDN with two subdomains that is being blocked?

• How to solve: Use dig and the host file provided to query each domain then analyze the results.
• Answer: mobile.api.hmageo.com

4. What is the FQDN with a singular subdomain that is being blocked?

• How to solve: Use dig and the host file provided to query each domain then analyze the results.
• Answer: sync.adotmob.com

Who’s There?

Use port knocking to find the flag.

Questions

1. What's the hidden flag?

• How to solve: Run the following command:

for port in 1337, 31337, 8000, 2500, 10000, 5600, 6900, 3000, 5555; do nc 127.0.0.1 $port; done; sleep 2; ssh root@127.0.0.1

• Answer: SKY-KNOK-5913
• Incorrect answer: SKY-KNOK-1234

Enumeration & Exploitation

Heckin Snek

Exploit a poorly implemented keygen program written in python.

Questions

1. What programming language was this written in?

• How to solve: Based on the syntax of the code you can figure out the programming language.
• Answer: python

2. What is a valid DLC key?

• How to solve: After reading through the checker code write a program that can create a valid flag.
• Answer: EKCB-ABBA-9540
• Incorrect answers:
• EKCA-ABBA-9540
• EKCB-AAAA-9540
• EKCB-ABBA-9550

Redis

Exploit a poorly configured Redis server.

Questions

1. What version of Redis server is running on the host?

• How to solve: Run the command: redis-server --version
• Answer: 5.0.6

2. What is the flag in the root home directory?

• How to solve: Perform the following exploit:

https://github.com/Avinash-acid/Redis-Server-Exploit/blob/master/redis.py

• Answer: SKY-LRCB-7582

Popping Boxes

Exploit CVE-2021-3156 .

Questions

1. What is the vulnerable program?

• How to solve: Perform an enumeration of the various programs installed on the system.
• Answer: sudo

2. What is the command that is being exploited?

• How to solve: Look into how CVE-2021-3156 works
• Answer: sudoedit

3. What is the flag?

• How to solve: Find the flag after successfully performing the exploit
• Answer: SKY-SUDO-6513

4. What is the CVE of the attack?

• How to solve: This is found while researching for step 1.
• Answer: CVE-2021-3156

Malware Dropper

Reverse engineer a malware dropper.

Questions

1. What programming language is this malware written in?

• How to solve: This can be found by looking at the file extension of the dropper.
• Answer: JavaScript

2. What cipher is used to encrypt part of the malware?

• How to solve: After pretty printing out the code and analyzing it you can look at the math to identify it’s RC4.
• Answers:
• RC4
• ARCFOUR
• ARC4

3. What is the hidden flag found in the payload of the malware?

• How to solve: Decrypt the RC4 payload.
• Answer: SKY-WELX-7781

Web Application Exploitation

IOT

Gain control of a smart light bulb.

Questions

1. What Content-Type does the server require for control requests?

• How to solve: Using curl to communicate with the server you can get error messages that point you to trying different content types.
• Answers:
• application/json
• json
• Incorrect answer: text/plain

2. Set the light to hex color code FFC107, what is the flag for Level 1?

• How to solve: Using curl to send requests to the server you can decipher the control protocol from the error messages.
• Convert the hex number FFC107 to decimal, which happens to be 16761095 . https://www.rapidtables.com/convert/number/hex-to-decimal.html .
• Copy the entire challenge webpage URL from and place it in the curl command below before pressing enter:
Copy

curl --json '{ "id": 1, "method": "set_rgb", "params": [ 16761095 ] }' 'PLACE_URL_HERE'

• The curl command will return {"result":["ok"],"id":1} . Reload the webpage; the lightbulb should change color and the flag should be displayed below it.
• Example answer: Flag 1: SKY-IOTP-2237
• Incorrect answer: Flag 1: SKY-IOTP-1000

3. Set the light to hex color code 673AB7, what is the flag for Level 2?

• How to solve: Using curl to send requests to the server you can decipher the control protocol from the error messages.
• Hex 673AB7 is decimal 6765239 .
• In your browser, change “/level/1” to “/level/2”.
• Copy the entire challenge webpage URL from and place it in the curl command below before pressing enter:
Copy

curl -H "x-current-color: rgb(255, 238, 88)" --json '{ "id": 1, "method": "set_rgb", "params": [ 6765239 ] }' 'PLACE_URL_HERE'

• Example answer: Flag 2: SKY-RGBS-3413
• Incorrect answer: Flag 2: SKY-RGBS-1000

4. Set the light to hex color code F44336, what is the flag for Level 3?

• How to solve: Using curl to send requests to the server you can decipher the control protocol from the error messages.
• Hex F44336 is decimal 16007990 .
• In your browser, change “/level/2” to “/level/3”.
• Copy the entire challenge webpage URL from and place it in the curl command below before pressing enter:
Copy

curl 'PLACE_URL_HERE' --raw -v

• The curl command will return html output plus a trailer at the end that you need to provide to authenticate on the next attempt:
Copy

X-Auth-Key: trailers_are_totally_legit

• Submit that header with your request:
Copy

curl -H "x-auth-key: trailers_are_totally_legit" --json '{ "id": 1, "method": "set_rgb", "params": [ 16007990 ] }' 'PLACE_URL_HERE'

• Reload the webpage; the lightbulb should change color and the flag should be displayed below it.
• Example answer: Flag 3: SKY-TAIL-2502
• Incorrect answer: Flag 3: SKY-TAIL-1000

MetroGov

Abuse testing permissions with JWT libraries.

Questions

1. What is the name of the standard used for securing user sessions?

• How to solve: Create an account as any user, sign in, and then look at your session cookies.
• Answers:
• JSON Web Tokens
• JavaScript Object Notation Web Tokens
• JWT
• Incorrect answer: Base64

2. What is the cryptographic scheme used for securing user sessions?

• How to solve: Look at your decoded session cookie.
• Answers:
• Flag 1: HS256
• SHA256
• HMAC SHA-256
• SHA 256

3. How long (in minutes) after login will the user session expire?

• How to solve: Look at your decoded session cookie.
• Answers:
• five
• 5
• Incorrect answer: 10

4. What is the flag displayed after logging in as the "administrator" account?

• How to solve: Set your session algo field to none.
• Answer: SKY-JWTK-5835
• Incorrect answer: SKY-JWTK-1000

Catstagram

Exploit a poorly configured AWS s3 bucket.

Questions

1. What is the name of the provider that is hosting the Catstagram cat photos?

• How to solve: Look at the source URL for the various photos.
• Answer:
• aws
• s3
• aws s3
• amazon web services
• simple storage service
• amazon aws
• amazon web services simple storage service
• amazonaws
• Incorrect answers:
• s3-us-west-1.amazonaws.com/catstagram-data.web.cityinthe.cloud
• Azure

2. How many total cat photos are stored on Catstagram's infrastructure?

• How to solve: Use the aws cli tool to browse and navigate the bucket.
• Answer: 15

3. What is the value of the flag?

• How to solve: Use the aws command tool to find the flag in the bucket.
• Answer: SKY-CATS-1239

Flag Board

Exploit a poorly configured proxy server.

Questions

1. What is the name of the proxy server used for this website?

• How to solve: Look at the response headers from the server.
• Answer: nginx

2. What is your assigned flag?

• How to solve: Spoof your ip address using an X-Forwarded-For header.
• Answer: SKY-HOPS-3127
• Incorrect answer: SKY-HOPS-1234