RITSEC CTF 2022 Write up

Forensics

 

Bad C2

c2서버랑 통신하는 패킷 주어지는데, /get/secret에 post로 json 보내는 거 있음 간단한 조건 맞춰서 서버에 보내면 플래그 줌

---

oreo

./Default/Cookies

open with DB browser

base64 decode

 

---

cyber survey

tcp 패킷들 있는데, 포트스캐닝 마냥 여러 포트들 찌르는데, 열린포트에 6761.. 데이터를 push함. push한 포트 번호 끝 3자리 순서대로 가져오면 됨 (패킷 길이 73만 보면 됨)

length of packet == 73, get port number (last 3 digits)

dec to ascii

---

Death, Taxes, TCP

tcp패킷들만 있는데, 패킷길이 87짜리들이 데이터 1바이트씩 보냄. 순서대로 가져오면 됨.

 

length of packet == 87, get 1byte data

hex to ascii