darkCON CTF 2021 write up

Forensics/Figuring Out The Past

 

 need decryption key to download file via this mega link

 

 

 

 

 

it needs password

 

firefox

nothing :(

 

 

nothing in lastpass

hmm

---

https://github.com/anas-jamal/DarkCON-2021/tree/master/Figuring-Out-The-Past

왜 내가 하면 iehistory에서 안나오지..

defuse.ca를 찾아볼걸 그랬네

---

Forensics/Scattered Pieces

 

a pcapng file

mega link decryption key

 

in sus.pcapng, mega.nz 접속 흔적

 

ssl key log

log file IN

 

decrypt

reveal link

download it

 

open with hex editor and fix signature

 

dictionary attack (rockyou.txt)

 

---

Forensics/Do you know them ?

extract NTUSER.DAT

 

use regripper

---

Forensics/Mr.Wolf Darkest Secret

hmm

---

https://github.com/anas-jamal/DarkCON-2021/tree/master/Wolf-Darkest-Secret