E-CTF-2025 on Anthrace | CTF Writeups

E-CTF-2025 - Crypto

Tue, 01 Jul 2025 00:00:00 +0000

Step 1: Analyzing the Challenge Link to heading

The challenge provides a series of ASCII numbers along with an intriguing phrase:

108 100 111 109 123 85 99 49 122 95 106 53 95 79 111 51 95 88 52 116 95 48 109 95 51 111 88 121 90 107 97 106 48 105 125 10 10 69 98 111 98 32 102 112 32 118 108 114 111 32 104 98 118 44 32 100 108 108 97 32 105 114 122 104 32 58 32 72 66 86 72 66 86 10 10 87 101 108 108 32 100 111 110 101 44 32 98 117 116 32 110 111 119 32 100 111 32 121 111 117 32 107 110 111 119 32 97 98 111 117 116 32 116 104 101 32 103 117 121 32 119 104 111 32 103 111 116 32 115 116 97 98 98 101 100 32 50 51 32 116 105 109 101 115 32 63

Step 2: Decoding ASCII Link to heading

I used DCode to convert the ASCII numbers into text.

E-CTF-2025 - Forensic

Tue, 01 Jul 2025 00:00:00 +0000

Step 1: Opening the ZIP File Link to heading

The challenge provides a ZIP file containing a PCAP file.

Objective: Analyze the PCAP to identify data exfiltration and retrieve the flag.

Step 2: Initial PCAP Analysis Link to heading

I opened the PCAP file with Wireshark and began analyzing the packets.

Main observations:

Evidence of data exfiltration within network traffic.
Interesting endpoints used for file transfer.
A suspicious POST request.

E-CTF-2025 - Forensic

Tue, 01 Jul 2025 00:00:00 +0000

Challenge Description Link to heading

We are provided with a .zip file containing a .pcap file. The instructions indicate an image has been stolen, and we must recover it from the PCAP file.

Step 1: PCAP File Analysis Link to heading

I opened the .pcap file with Wireshark to inspect the network traffic.

Observations:

I noticed suspicious DNS requests sent to data.exfil.attacker.com.
This suggests data exfiltration via DNS by encoding the image within domain names.

Step 2: Extracting Exfiltrated Data Link to heading

To extract all DNS queries from the PCAP, I used Tshark:

E-CTF-2025 - Forensic

Tue, 01 Jul 2025 00:00:00 +0000

Step 1: Downloading the ZIP File Link to heading

The challenge provides a ZIP file containing a DOCX file.

Hypothesis: A DOCX file is actually a ZIP archive, meaning we can extract its internal content.

Step 2: Extracting the DOCX Content Link to heading

I used unzip to extract the content of the DOCX file.

Result:

Several folders and XML files.
A folder named word/ containing metadata and content.

Step 3: Analyzing Extracted Files Link to heading

I explored all the files extracted from the DOCX, looking for hidden information.

E-CTF-2025 - Web

Tue, 01 Jul 2025 00:00:00 +0000

Chatroom Link to heading

In this challenge, we are provided with access to a chatroom, where a message indicates that the admin will read our message in 30 seconds.

Upon seeing this, I immediately suspect a possible XSS (Cross-Site Scripting) vulnerability, as if the message is stored and executed in the admin’s browser, we could potentially inject malicious JavaScript.

Step 1 - Testing for XSS Injection Link to heading

To verify if the input is vulnerable to XSS, I test a simple payload: