Forensic on Anthrace | CTF Writeups

HackDay - Stegano & Forensic

Wed, 30 Jul 2025 00:00:00 +0000

Forensic Challenge - Hidden Flag Extraction Link to heading

In this challenge, we have a ZIP file containing a log file and two images.

Step 1: Log File Analysis Link to heading

I began by analyzing the log file and found five encoded words. I used dcode.fr to decode them:

ercbafr (ROT13) → reponse

c29sdXRpb24= (Base64) → solution

E-CTF-2025 - Forensic

Tue, 01 Jul 2025 00:00:00 +0000

Step 1: Opening the ZIP File Link to heading

The challenge provides a ZIP file containing a PCAP file.

Objective: Analyze the PCAP to identify data exfiltration and retrieve the flag.

Step 2: Initial PCAP Analysis Link to heading

I opened the PCAP file with Wireshark and began analyzing the packets.

Main observations:

Evidence of data exfiltration within network traffic.
Interesting endpoints used for file transfer.
A suspicious POST request.

E-CTF-2025 - Forensic

Tue, 01 Jul 2025 00:00:00 +0000

Challenge Description Link to heading

We are provided with a .zip file containing a .pcap file. The instructions indicate an image has been stolen, and we must recover it from the PCAP file.

Step 1: PCAP File Analysis Link to heading

I opened the .pcap file with Wireshark to inspect the network traffic.

Observations:

I noticed suspicious DNS requests sent to data.exfil.attacker.com.
This suggests data exfiltration via DNS by encoding the image within domain names.

Step 2: Extracting Exfiltrated Data Link to heading

To extract all DNS queries from the PCAP, I used Tshark:

E-CTF-2025 - Forensic

Tue, 01 Jul 2025 00:00:00 +0000

Step 1: Downloading the ZIP File Link to heading

The challenge provides a ZIP file containing a DOCX file.

Hypothesis: A DOCX file is actually a ZIP archive, meaning we can extract its internal content.

Step 2: Extracting the DOCX Content Link to heading

I used unzip to extract the content of the DOCX file.

Result:

Several folders and XML files.
A folder named word/ containing metadata and content.

Step 3: Analyzing Extracted Files Link to heading

I explored all the files extracted from the DOCX, looking for hidden information.