Cyber Investigator CTF - Cyber Crime Writeup

This final part of my Cyber Investigator CTF writeup covers the Cyber Crime challenges. Cardiff University's Cyber Security Society organized this jeopardy-style CTF for OSINT (Open-Source Intelligence), threat intelligence, and digital forensics enthusiasts.

mysterymachine

The MAC address 00:0a:95:10:e2:1b identifies the manufacturer. Entering it into an online OUI (Organizationally Unique Identifier) lookup tool returns the name.

mulemobile

The smartphone's IMEI is "352602081794916", and the question asks for its weight difference. Entering the IMEI on imei.info (opens in a new tab) returns the phone's original weight. Subtracting the current weight from it gives the answer.

databreach

Elon Musk's email address, elon.musk@gmail.com, appeared in a data breach. Entering it into Have I Been Pwned (opens in a new tab) shows the known breaches that contain the address. The company named in the matching breach is the answer.

stencil

The image uses a font we need to identify. A Google search for "font finder" leads to WhatFontIs (opens in a new tab). Uploading the image there returns the font's name.

unmonitored

A text file contains a game script with no title. Searching excerpts from it leads to a Wiki page called Pawn Tutorial, which identifies the scripting language. A second search for "pawn scripting online game" brings up tutorials that name the online game.

nationstate

The network traffic log contains evidence of two countries involved in an attack.

sql

REQUESTING IP ADDRESS, DATETIME, REQUEST URL, HTTP VERSION, HTTP RESPONSE, BYTES SENT, REFERER, USER AGENT

175.45.176.212 - - [14/Jan/2021:16:00:16 +0300] "GET /vips/%u0412%u043B%u0430%u0434%u0438%u043C%u0438%u0440%20%u041F%u0443%u0442%u0438%u043D/ HTTP/1.1" 200 18298 "-" "Java/1.6.0_24" "-"
175.45.176.180 - - [14/Jan/2021:16:00:16 +0300] "\x03\x00\x00)$\xE0\x00\x00\x00\x00\x00Cookie: mstshash=NCRACK_USER" 400 173 "-" "-" "-"
175.45.176.212 - - [14/Jan/2021:16:00:16 +0300] "GET /%u0412%u043B%u0430%u0434%u0438%u043C%u0438%u0440%20%u041F%u0443%u0442%u0438%u043D/ HTTP/1.1" 200 18390 "-" "Java/1.6.0_24" "-"
175.45.176.180 - - [14/Jan/2021:16:00:16 +0300] "\x03\x00\x00)$\xE0\x00\x00\x00\x00\x00Cookie: mstshash=NCRACK_USER" 400 173 "-" "-" "-"
175.45.176.180 - - [14/Jan/2021:16:00:16 +0300] "\x03\x00\x00)$\xE0\x00\x00\x00\x00\x00Cookie: mstshash=NCRACK_USER" 400 173 "-" "-" "-"
175.45.176.212 - - [14/Jan/2021:16:00:16 +0300] "GET /documents/staff-roster.doc HTTP/1.1" 200 33660 "-" "Java/1.6.0_24" "-"

Checking the source IP addresses with Cisco Talos (opens in a new tab) identifies the first country.

Finding the second country took some trial and error. This path in the log needs decoding:

bash

/vips/%u0412%u043B%u0430%u0434%u0438%u043C%u0438%u0440%20%u041F%u0443%u0442%u0438%u043D/

Pasting it into CyberChef and applying URL Decode reveals a familiar name. The country associated with that person is the second answer.

stolenidentity

The USB drive's disk image (.dd) contains a passport, and we need the name shown on it. Opening the image in Autopsy lets us inspect its contents, locate the passport file, and extract the name.

remoteaccess

The task is to recover the passphrase for an SSH private key. First, we convert the key into a hash format that John the Ripper can read. Running John the Ripper against that hash with the rockyou wordlist recovers the passphrase.

d3c0d3r

The challenge has two parts, one in hex and the other in binary. We decode them in CyberChef with the "From Hex" and "From Binary" functions. The first output isn't useful.

The second output contains Roman numerals. Converting them to regular numbers produces a string that looks like coordinates, and Google Maps places them at a location.

That completes the Cyber Crime section and this writeup series.