We are given a file named hiden.jpg, which is an invalid .jpg file.
Reading the file’s header, we are met with:
BASH
$ hexdump -C hiden.jpg | head
0000000001234567890123456789012345678901 |.#Eg..#Eg..#Eg..|
0000001023456789 aa aa aa aa ff 8d ff 0e 0010 4a 46 |#Eg...........JF|00000020494600010101006000600000 ff e1 00 be |IF.....`.`......|
00000030457869660000 4d 4d 00 2a 000000080006 |Exif..MM.*......|
0000004001120003000000010001000001 1a 0005 |................|
00000050000000010000005601 1b 000500000001 |.......V........|
00000060000000 5e 012800030000000100020000 |...^.(..........|
0000007002130003000000010001000087690004 |.............i..|
0000008000000001000000660000000000000060 |.......f.......`|
0000009000000001000000600000000100069000 |.......`........|
Click to expand and view more
We can see garbage date from line 0 to 10, from 01 to aa. To fix this, we need to extract the image by writing this file to another file, but skipping the first 24 bytes.
SH
$ dd if=hiden.jpg of=fixed.jpg bs=1 skip=245857+1 records in
5857+1 records out
140589 bytes (141 kB, 137 KiB) copied, 0.000000000001 s, 9999.99 TB/s
Click to expand and view more
However, it’s still not a valid image because byte at 02 and 04 are wrong. Using tools like dhex, we fix the two bytes 8d and 0e into d8 and e0, the resulting image is:
Flag: W1{Y0u_4r3_v3ry_g00d_m3ow!}
Free Flag On Network
We are given a file chall.pcapng, reading the file gives up multiple POST request with the name flag*.txt, which mean the flag is fragmented and encoded with Base64, we first extract the fragments to a single file.
The resulting file is a .png file, but all of it’s chunks are flipped! We can fix the image by using this script.
BASH
#!/usr/bin/sh
for i in `seq 1 100`do sed -n "$i"p flag-reverse.png | base64 -d | xxd -p -c1 | tac | xxd -p -r >> flag.png
done
Click to expand and view more
Flag: W1{W3llc0me_to_For3nS1cs}
What is it?
We are given an audio file which contains morse code. Translating the morse code gives us passwordisgoodluck, which looks like a steghide password.
BASH
$ steghide extract -sf chall.wav -p 'passwordisgoodluck'wrote extracted data to "hidden.zip"
Click to expand and view more
Extracting hidden.zip gives us 2 files: part1.txt and next2.zip
The file part1.txt reads W1{s0m3_7h1ng5_1n, which is half of our flag.
The file next2.zip has it’s bits flipped every byte. To fix this, we have this script:
Reading $ROPM1D5 gives us the first part of our flag encrypted with base64 and base32.
BASH
$ cat '$ROPM1D5'TODO:
- Learning about Windows operating system.
- Is there a way to store data secretly?
- Someone send me this message: V2UgaGF2ZSBiZWVuIGtlZXBpbmcgdHJhY2sgb2YgeW91IGZvciBvdmVyIGEgbW9udGggbm93LiBTb29uLCB3ZSB3aWxsIGhhY2sgeW91ciBkYXRhLiBIZXJlIGlzIG91ciBmaXJzdCBtZXNzYWdlOiBLNFlYV05DN09ZWlhFNks3TU5XRElOSlZHRlJWNj09PQ==$ echo 'V2UgaGF2ZSBiZWVuIGtlZXBpbmcgdHJhY2sgb2YgeW91IGZvciBvdmVyIGEgbW9udGggbm93LiBTb29uLCB3ZSB3aWxsIGhhY2sgeW91ciBkYXRhLiBIZXJlIGlzIG91ciBmaXJzdCBtZXNzYWdlOiBLNFlYV05DN09ZWlhFNks3TU5XRElOSlZHRlJWNj09PQ==' | base64 -d
We have been keeping track of you for over a month now. Soon, we will hack your data. Here is our first message: K4YXWNC7OYZXE6K7MNWDINJVGFRV6===$ echo 'K4YXWNC7OYZXE6K7MNWDINJVGFRV6===' | base32 -d
W1{4_v3ry_cl4551c_
The secret.kbdx file is a database file for KeepassXC - a password manager.
The more_secret file is unknown. One interesting fact about it is it’s size.
BASH
$ du more_secret
10240 more_secret
Click to expand and view more
We know that Veracrypt has been used on this computer based on the previous hint. Veracrypt encrypts filesystem with a block size of 512, of which 10240 / 512 = 20, a perfect integer! Now we can say for sure that more_secret is a Veracrypt file. But we still need to find the keys to open it.
By navigating into Users/KoishiKomeiji/Pictures, we are met with:
The text reads: keepass:1_am_b3h1nd_U!. That gives the password for the previously found secret.kbdx file!
Opening it up, the password for the Veracrypt file is YHG8YjFscyZRVDtJV1TH along with a note that says “also, my favourite cat is a key too!”. Which mean that the Veracrypt file was encrypted with a passphrase and a keyfile.
Inside the my_cats directory, we have 5 pictures of 5 different cats. By bruteforcing, the cat4.jpg file is the correct keyfile.
By mounting the decrypted file, we are met with a peculiar file called secret_token.txt, which reads:
BASH
$ cat secret_token.txt
API Token for my hidden web app:
SECRET-X-KEY=T2theSwgeW91IGdvdCB0aGlzISBIZXJlIGlzIHBhcnQgMjogbl8zel9kZjFyXw
Click to expand and view more
Yes! We have found another clue, but this time it’s a LIE! There are actually no web apps, the token is actually our flag, but encrypted with base64.
BASH
$ echo 'T2theSwgeW91IGdvdCB0aGlzISBIZXJlIGlzIHBhcnQgMjogbl8zel9kZjFyXw==' | base64 -d
Okay, you got this! Here is part 2: n_3z_df1r_
Click to expand and view more
Which give us the second part of our flag: n_3z_df1r_
Part 3
Going into Users/KoishiKomeiji/Desktop, we are met with:
$ cat new_note.txt
TODO:
- Learning more about Windows (maybe learning about PowerShell is a good idea!).
- I need to be more careful. Someone is watching me recently.
- Asking for cat food since our cat Orin is hungry.
- Learning how to use both password and file as a key for disk encryption.
Click to expand and view more
The first line hinted at some PowerShell activity. Which is often recorder in an .evtx file.
By reading Microsoft-Windows-PowerShell%4Operational.evtx, either on Windows, or with evtx_dump on Linux we are met with interesting activities by the owner.
We first access the challenge’s server by running the given script.
BASH
$ nc 61.28.236.247 1279Before accessing the service, you must solve a proof of work (PoW) challenge.
Just run the solver with the following command:
python3 <(curl -sSL https://goo.gle/kctf-pow) solve <ID>
===================Solution? <ADD_YOUR_TOKEN_HERE>
$ python3 <(curl -sSL https://goo.gle/kctf-pow) solve <ID>
Solution: <TOKEN>
Click to expand and view more
After plugin in our token, the first question is as followed:
PLAINTEXT
[1]. What app did the user use to connect with the supporter? [Text]
==>
Click to expand and view more
By navigating into C:/Program Files, we see a single TeamViewer directory. This is a directory for TeamViewer - a program that allows remote access control. From there we are able to answer the first question.
!
[1]. What app did the user use to connect with the supporter? [Text]
==> Teamviewer
Correct!
[2]. When did the supporter connect to the victim's computer? [YYYY/MM/DD hh:nn:ss]
Click to expand and view more
Inside the TeamViewer directory, we are able to find a log file: TeamViewer15_Logfile.log
According to TeamViewer’s documentation, we are able to find the successful connection time by finding the CPersistentParticipantManager::AddParticipant: keyword.
[2]. When did the supporter connect to the victim's computer? [YYYY/MM/DD hh:nn:ss]
==> 2025/09/24 16:00:35
Correct!
[3]. Which file did the attacker exfiltrate first from the victim's computer? [File.ext]
Click to expand and view more
According to TeamViewer’s documentation, we are able to trace transfered file with the Send file keyword.
The first stolen file is account.txt, we are also able to answer the following question.
!
[3]. Which file did the attacker exfiltrate first from the victim's computer? [File.ext]
==> account.txt
Correct!
[4]. What is the full path of the .zip file the attacker obtained? [full path]
==> C:\Users\iamqt\Favorites\Links\secret.zip
Correct!
[5]. What is the password for that .zip file? [Text]
==>
Click to expand and view more
Moving to C:/Users/iamqt/Favourites/Links, we are able to find a zip file c3507d5b8fa65c7e08a7f4c9075d6b39.zip. Trying to unzip this file prompts us for a password. This is secret.zip, but renamed somehow. This will be important later on.
According to our previous answer, the attacker also stole account.txt. Traversing to C/Users/iamqt/Documents/secret/ gives us a text file 2064c76a06fd0048e38261b5c8b01597.txt, which reads:
The password to the zip file is redacted, but has 6 characters, we can bruteforce the password using the rockyou wordlist and JohnTheRipper
BASH
$ zip2john c3507d5b8fa65c7e08a7f4c9075d6b39.zip > zip.hash
ver 1.0 efh 5455 efh 7875 c3507d5b8fa65c7e08a7f4c9075d6b39.zip/message.txt PKZIP Encr: 2b chk, TS_chk, cmplen=45, decmplen=33, crc=11D1EC96
$ Warning: invalid UTF-8 seen reading rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])Will run 16 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
iloveu (c3507d5b8fa65c7e08a7f4c9075d6b39.zip/message.txt)1g 0:00:00:00 DONE (2025-10-09 13:02) 33.33g/s 118200p/s 118200c/s 118200C/s 123456..sss
Use the "--show" option to display all of the cracked passwords reliably
Session complete
Click to expand and view more
Our password is iloveu
!
[5]. What is the password for that .zip file? [Text]
==> iloveu
Correct!
[6]. Which file did the attacker transfer to the victim's computer for malicious purposes? [Text]
==>
Click to expand and view more
Going to C/Users/iamqt, we find a file named aShjKg, which reads:
PYTHON=
import os,hashlib
self_path = os.path.abspath(__file__) if '__file__' in globals() else None
for root,_,files in os.walk('.'):
for f in files:
old = os.path.join(root,f)
if self_path and os.path.abspath(old) == self_path:
continue
new = os.path.join(root, hashlib.md5(f.encode()).hexdigest() + os.path.splitext(f)[1])
try:
os.rename(old, new)
except (PermissionError, FileNotFoundError, OSError):
continue
Click to expand and view more
This script replaces rename files with their MD5 hash, which is malicious.
Furthermore, the log shows that this file was sent to the User.
PLAINTEXT
2025/09/24 16:05:24.934 5828 9584 G1 Write file C:\Users\iamqt\aShjKg
2025/09/24 16:05:24.960 5828 9584 G1 Download from "aShjKg" to "C:\Users\iamqt\aShjKg" (274 Bytes)
2025/09/24 16:09:00.598 5828 9584 G1 Write file C:\Users\iamqt\aShjKg
2025/09/24 16:09:00.618 5828 9584 G1 Download from "aShjKg" to "C:\Users\iamqt\aShjKg" (381 Bytes)
2025/09/24 16:10:41.798 5828 9584 G1 Write file C:\Users\iamqt\aShjKg
2025/09/24 16:10:41.810 5828 9584 G1 Download from "aShjKg" to "C:\Users\iamqt\aShjKg" (503 Bytes)
Click to expand and view more
So that concludes the question. (PS: The actual answer is aShjKq due to a technical error.)
!
[6]. Which file did the attacker transfer to the victim's computer for malicious purposes? [Text]
==> aShjKq
Correct!
[7]. Identify the cryptographic/hash algorithm employed by the attacker to modify files on the victim's system. [Text]
==>
Click to expand and view more
The hash algorithm is MD5, as shown in the Python script: hashlib.md5(f.encode()).hexdigest()
PLAINTEXT
[7]. Identify the cryptographic/hash algorithm employed by the attacker to modify files on the victim's system. [Text]
==> md5
Correct!
Congratulations! Here is your flag: W1{h0w_c0uld_y0u_s0lve_th1s_ch4ll3ng3!!}
Click to expand and view more
Flag: W1{h0w_c0uld_y0u_s0lve_th1s_ch4ll3ng3!!}
What’s wrong with my computer
We are given an .ad1 file (+1 dot nha @KetSoSad), extracting it with FTK Imager on Windows or ad1-tools on Linux yields us a Windows User Directory
BASH
$ sudo ad1extract -i 'Chall.ad1' -d './temp/'
Click to expand and view more
Navigating into DUNG/Documents gives us two files with both being encrypted: flag.txt.enc and notsomethingshere.txt.enc
We then navigate to DUNG/AppData/Roaming/Microsoft/Windows/PowerShell/PSReadLine, which contain a Shell History file ConsoleHost_history.txt
The file shows interesting activities from the User.
From here we know that the User encrypted everything on this drive with AES-CBC with:
The key: ThisIsA16ByteKey in UTF-8 Bytes.
The IV: ThisIsA16ByteIV! in UTF-8 Bytes.
Both of the strings have 16 characters and encoded with UTF-8, with 16 * 8 = 128 so the encryption is AES-128-CBC
To get the UTF-8 Bytes of these two keys:
PLAINTEXT
$ printf 'ThisIsA16ByteKey' | od -A n -t x1 | tr -d ' '
546869734973413136427974654b6579
$ printf 'ThisIsA16ByteIV!' | od -A n -t x1 | tr -d ' '
54686973497341313642797465495621
Click to expand and view more
Notice how we use printf instead of echo, since echo automatically add \n after every string.
We can then go back to the two encrypted text file: flag.txt.enc and notsomethingshere.txt.enc.
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License. Please attribute the source, use non-commercially, and maintain the same license.
