bi0s
  •  Home
  •  Categories
  •  Archives
  •  Tags
  •  Home
  •  Categories
  •  Archives
  •  Tags

Investigation Continues - InCTF Internationals 2020

stuxn3t
2020-08-04
Forensics / Memory

tl;dr

  • Extract Invalid Login timestamp from the windows registry.
  • Extract the timestamp of when a JPEG was opened.
  • Extract Google Chrome’s last run time which was pinned to taskbar from windows registry.
Read More
InCTFi Volatility Windows Memory Analysis Windows Registry

Investigation - InCTF Internationals 2020

stuxn3t
2020-08-04
Forensics / Memory

tl;dr

  • Extract process last run time from the windows registry.
  • Extract process run count from the windows registry.
Read More
InCTFi Volatility Windows Memory Analysis Windows Registry

Lookout Foxy - InCTF Internationals 2020

g4rud4
2020-08-03
Forensics / Disk

tl;dr

  • Decrypt the encrypted GPG file found in Outlook Express with the private key stored on the device.
  • Decrypt the firefox saved passwords and log in to the website that the terrorist used.
Read More
InCTFi Autopsy

Faulty LFSR - InCTF Internationals 2020

ph03n1x
2020-08-02
Crypto / LFSR

tl;dr

  1. Find the co-relation between variables in the LFSR equation
    1. d == out (75%)
    2. a == b (75%)
    3. c^d == out (75%)
    4. (d!= out) => (c==1) always
  2. Solve for the seed using 2000 output bits
  3. Try out which among the four possible combinations decrypt the flag
Read More
InCTFi LFSR Correlation attack

BabyJS - 2020 Defenit CTF

Az3z3l
2020-06-10
Web Exploitation

tl;dr

  • Accessing a variable in Handlebars template using this object
Read More
Defenit Handlebars template injection Ssti

TarAnalyzer - 2020 Defenit CTF

c3rb3ru5
2020-06-07
Web Exploitation

tl;dr

  • Zip Slip Vulnerability + YAML Deserialization Attack + Race Condition
  • Unintended Solution: Upload symlink leading to arbitarary file reads
Read More
Defenit YAML Zip Slip Race Condition Symlink

USB 2 - 2020 Defenit CTF

stuxn3t
2020-06-07
Forensics / Registry

tl;dr

  • Digging into windows registry to find process run counts.
  • Extracting and parsing AmCache to find the hash of process images
Read More
Windows Registry Analysis Defenit

golf.so - PlaidCTF 2020

d4rk_kn1gh7
2020-04-29
Misc / Linux / ELF

tl;dr

  • Hand-crafting a linux shared object file with a size of less than 194 bytes
Read More
Plaid

Strange PCAP - HackTM CTF Quals 2020

g4rud4
2020-02-10
Forensics / Network

tl;dr

  • Disk Dump extraction.
  • USB leftover Capture data extraction.
  • Zip file cracking.
Read More
HackTM Wireshark

Think twice before speaking once - HackTM CTF Quals 2020

slashb4sh
2020-02-10
Pwn / Linux / ELF

tl;dr

  • Linux userspace exploitation by parsing ELF for symbol addresses with an arbitrary read
Read More
HackTM

 Previous 

14 / 19

 Next 

Official blog of team bi0s

  Projects
  •   bi0s-wargame
    (Unraveling)
  •   bi0s-wiki
    (Free Encyclopedia)
  •   InCTF
    (Nationals CTF)
  •   InCTFj
    (Juniors CTF)

Made With Love and Coffee



Blog content follows the Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0) License

Use Material X as theme, total visits times.