M4ndU의 만두만두한 블로그

Web

Meet the Union Committee

./?id=1 or 1=1

./?id=;

./id=1 union select 1,2,3

./?id=1 union select 1,password,3 from users

GEOINT

Where in the World? (2)

i could see tram and high tower/building.

i searched tram in bing image search and i found a simillar one.

The content was completely different from the tram, but it was written in Polish.

Then I searched poland tram and i found a simillar one agian.

So, i was sure that the image was from poland.

I searched for Polish landmarks to find what the tall buildings in the picture were, and I could find something similar.

bingo!

Where in the World? (3)

bing image search

i found simillar image and "San Francisco Armory"

same

mission street, San Francisco, USA

Where in the World? (5)

google image search

Forensics/Figuring Out The Past

 need decryption key to download file via this mega link

it needs password

firefox

nothing :(

nothing in lastpass

hmm

왜 내가 하면 iehistory에서 안나오지..

defuse.ca를 찾아볼걸 그랬네

Forensics/Scattered Pieces

a pcapng file

mega link decryption key

in sus.pcapng, mega.nz 접속 흔적

ssl key log

log file IN

decrypt

reveal link

download it

open with hex editor and fix signature

dictionary attack (rockyou.txt)

Forensics/Do you know them ?

extract NTUSER.DAT

use regripper

Forensics/Mr.Wolf Darkest Secret

hmm

forensic

Misplaced

hmm what is it?

I changed file extension. (file.what to file.zip)

oh i got something but i don't know the password.

when i opened it using 7 zip file manager, i could get a password!

i thought it is ppt file.

then i found a flag.

Nice Duck!

mp4 file

Splitted flag

split file

fix file

done.

web

Flag Script