Recent content in Home on Joe Lothan
Last Saturday night the Knicks won the NBA finals for the first time in over 50 years. The mood in the city that night was jubliant, or so I was told, as I was watching the game at a wedding out of state. (I do believe the Knicks win blessed the wedding, or maybe vice versa) So when Mayor Mamdani announced on Sunday there will be a ticker-tape parade on Thursday, I was excited about an opportunity…
Bad vibes I often find myself needing to edit text on an emulated Android system and it’s always a pain. Rebuilding from source takes too long. Editing the file on my computer and then adb pushing it over is cumbersome. So I often reach for the toybox implementation of vi to read and edit files, but it leaves a lot to be desired. The thing I miss the most is syntax highlighting.
The Challenge A Tiny one to start, based on the works of TheXCellerator in Tmp.0ut (link) We’re given a tiny x86_64 ELF binary (only 301 bytes!), which uses TheXCellerator’s libgolf to mangle the ELF header. The binary is runnable on 64-bit Linux, but breaks many static analysis tools that trust the ELF header. TinyTurb0 > readelf -a ./tiny_turb0 ELF Header: Magic: 7f 45 4c 46 58 58 58…
Challenge Description Santa wants to make sure he doesn’t leak the location of his secret base through image metadata. Therefore, he uses this web service to strip metadata from his photos before publishing them. But he isn’t sure whether it’s secure. Can you tell him? Overview We are given a website that takes an image and returns it striped of it’s metadata, but we…
Challenge Description Due to some Grinchey shenanigans, this year the OverTheWire Advent Bonanza CTF will run from Tuesday December 07 until Sunday December 19, however, as is tradition we have a cosy day0 warmup challenge from Retr0id to keep you busy: Be sure to keep the flag for when the CTF begins, the flag format is AOTW{???}. Overview We’re given a PNG, but after some investigation, we…
Challenge Description Santa built a service to allow elves to encrypt secret data without having access to the keys. (Download Files) Overview We’re given a python webserver with an encrypted flag and the key that was used to encrypt it, but we can only read the encrypted flag and use the key to encrypt data, not read the key itself. Using a bug in python data encoding, we can overwrite…
Challenge Description Santa has hidden a secret message on the backside of a jigsaw puzzle that he completed. Sadly, one of his elves dropped the completed puzzle, shuffling all the pieces. Can you verify that it is indeed impossible for the Grinch to recover this message? Downloaded File Overview We are given a bunch of PNGs with jigsaw pieces on them, looking at their metadata we can order them…
Challenge Description Santa and Grinch forces have declared a fragily truce. It is your job to keep the truce going by keeping Christmas cheer high. Read more on how to do this by following the provided link. (that link) Overview For this challenge, you had to make pancakes and soup, donate to a charity, and/or wear christmas clothes to get a flag. No, really. Hardest flag to find? A good looking…
Challenge Description: Good job! Your work helped us avert greater damage at the victim. Unfortunately the group came back and infiltrated another host. This time they hacked into the customer’s central git repository host, installed a hook that enforces their source code indentation ideology and kicked the legitimate admins out. Before the admins lost access they were able to create a…
Challenge Description: With the help of your analysis, we got onto the trail of the group and found their hidden forum on the Deep Dark Web. Unfortunately, all messages are encrypted. While we believe that we have found their encryption tool, we are unsure how to decrypt these messages. Can you assist? Write-Up: We are given crypter.py, a semi-obfuscated python script and a bunch of encrypted text…
Challenge Description: A mysterious file appeared on a deep dark web forum. Can you figure out what we can’t see right now? Write-Up: We are given a strange 512 byte file proclaimation.dat that file sees as a boot partition. $ wc proclamation.dat 1 8 512 proclamation.dat $ xxd proclamation.dat | head 00000000: bc00 20b4 0730 c031 c9b7 8ab6 61b2 61cd .. ..0.1....a.a. 00000010: 10b4 0231 d230…
Challenge Description: Our investigation revealed that CATAPULT SPIDER uses artificial intelligence to classify images. We initially believed that they only encrypt cat pictures - but we now learned that they encrypt all images except Doge photographs. We recovered their classifier and model and believe it should be possible to subvert their classification method to protect images against…
Challenge Description: Diving deeper into CATAPULT SPIDER’s malware, we found that it also supports handing off tasks to external modules. We identified one such module that looks like it might be used to validate a key or password of some sorts, but we’re really not sure. Can you validate our assumption, and, if possible, extract the key? Write-Up: This challenge is really…
Challenge Description: We were approached by a CATAPULT SPIDER victim that was compromised and had all their cat pictures encrypted. Employee morale dropped to an all-time low. We believe that we identified a binary file that is related to the incident and is still running in the customer environment, accepting command and control traffic on veryprotocol.challenges.adversary.zone:41414 Can you…
Challenge Description: After moving laterally, PROTECTIVE PENGUIN compromised a number of additional systems and gained persistence. We have identified another host in the DMZ that we believe was backdoored by the adversary and is used to regain access. Please download a virtual machine image of that host and identify the backdoor. Validate your findings in our test environment on…
Challenge Description: We have received some information that CATAPULT SPIDER has encrypted a client’s cat pictures and successfully extorted them for a ransom of 1337 Dogecoin. The client has provided the ransom note, is there any way for you to gather more information about the adversary’s online presence? Write-Up: For this challenge, we’re given a ransom note from a client…
Challenge Description: We just received another report that PROTECTIVE PENGUIN was identified at a company that provides access to mapping software as a service. The adversary allegedly elevated privileges and then moved laterally to a backup server. We were provided with a Virtual Machine Image of the mapping service. Can you analyze the image and reproduce the attack? If you think you’ve…
Challenge Description: PROTECTIVE PENGUIN gained access to one of their victims through the victim’s extranet authentication portals and we were asked to investigate. Please download the Portal Code and see whether you can reproduce their means of initial access vector. We stood up a test instance of the authentication portal for you to validate against. Write-Up: This challenge had an…
Hi! I’m Joe. Welcome to my site :)