Name: Darkroom CTF: Dark Web Threat Hunting Competition
Uploaded: 2026-09-30T19:16:18.492Z
Duration: 3 h 12 s
Description: Darkroom CTF: Dark Web Threat Hunting Competition

Transcript for "Darkroom CTF: Dark Web Threat Hunting Competition": Hello. Oh, How are you, Eric? I'm good. I'm good. It's, it's Wednesday, like, middle of the week, so let's put this as the apex of my week, like, the fun stuff. Now everything goes down after. So yes. So, we last time we did this is what almost two months ago, when we were live for the darkroom CTF. And, so I wear the probably wear the t shirt from the first darkroom CTF that we had. This I I was rusty, so I had to go through the challenges again this morning. And, I I also realized that we, we have an infrastructure challenge at the end, and I was like, will this hold the online online crowd? So I also made some changes because I was afraid of all of your AI swarm skills. So, so I, let's see how it goes. As Tim Riley said, you know, let's do it. It's something. We're doing it live. live. Doing it live. Okay. So the, do you wanna do any intro before I explain the formula for. today? Yeah. Sure. So we'll be your host for today. I'm Eric, a technical platform specialist at Flare. My role for today will be, like your classroom teacher. I'll be explaining concepts around the different tasks that you are doing. So I I'll be more on the storyteller and our main host, of course, Olivier. Already on mute. Yeah. I'm, no. I I'm doing other stuff. I, yeah, I I run the research team here. We're focusing on on finding, emerging threats, having fun doing so, having a big data lake to look into. We, I built most of these challenges, for the for our DEFCON darkroom CTF experiment. And the the formula today, it's, based on a lot of CTF experience that I personally had. Okay? And I was I would be looking for your feedback or your thoughts on it. Because you saw, it's a huge block of three hours. The reason is the best way to learn is to struggle. When you struggle, you learn you retain a lot more information than if you're just told something. So this is why this is a three hour. We will go after each challenges. There are eight challenges about 21 flag together one at a time, and you will have approximately between five and ten minutes for each challenge to try to solve it before we do the solution together. Okay? So this depending on your workload, this might be like a podcast with awkward pauses in it, or, you could actively try to do the challenge. I encourage you to try to solve the challenges yourself, but I understand that three hours is a is a long time. So let us know what you think of this formula, before we, our next, you know, we, recap of the CTF. Another thing that I think is important when looking at someone playing CTF is, how they are organized or structured, what tools do they use. And, obviously, it's not everyone will not necessarily use the same tools, but you get a sense of of the of the how they they approach the problems, what they look at, in what order, what tools they use. And you'll you'll realize that, lots of juniors will think that you that the tool is the first thing you do. Right? You you were doing a pen test, you open Metasploit. You're doing a web application assessment, you open BergSuite. This is not necessarily how things should be done. Like, things should be looked at first, understood for context, and then you pick the right tool for the right job. Alright. So the whole thing is happening on, Flare, on our darkroom. Oh, this is the internal one. I was not on the right one. So I'm gonna screen share, and I am, I want to tell you, I am because we're gonna go over, like, flipping back and forth, different tools and the common line and everything, I am doing going to do full screen, screen share. So I will not be able to read the chat, but Eric is here as our our copilot to do that. And, also, as I do so, you might see, like, our, screen, sharing environment as I out tab and and go through the different stuff. So, you know, it it might be a little bit dizzy, so I guess, little warning for people who have, epilepsy, be careful. Okay. Now let's start by screen sharing. The first thing you wanna go to is you need to join our Discord server, and then you'll open the darkroom, the darkroom app. Where do I screen share? Here. Camera. Oh, it's on the side. Yes. Okay. Entire screen. Here we go. Share. Please share the. Discord link again. You Yeah. have. oh, infinite mirror. The. yes. Okay. So the URL is, darkroomlabs .labs.flair.io. I'm gonna zoom in from time to time to help you see stuff. Hopefully, this carries well in the screen share. You can confirm, Eric. Yeah. Yeah. Yeah. Alright. So darkroom.labs.flare.io. This will require this will go and and verify oops. This will, verify that you are, a a a member of the our Flare Academy server. Okay? If, if you can if anyone in the chat can tell us that it's working for them, that they are logged in, please do so. Now the the, the challenge that we're gonna do that that we're gonna do today are under the CTF tab here. So you need to once you're in, click on the CTF tab, and then this is operations call proxy. So this is our in person, event that we had at Defcon. And by the way, there there's a little story. tabs, you have other, CTFs that you'll be able to do after this event. So feel free to explore what we have in darkroom. There's a lot of cool stuff, in there, cool lessons. But now today, what we do is the CTF for Skull Proxy. Yes. And we have a little video treat for you. So I am going to, reshare, but with only the tab with the sound on. Sorry about that. This is a Linux thing, I think. So only the tab with audio. Be careful with your speaker. I'm I don't recall how loud this is, so let's go. Breaking news. London's. entire water supply has been cut off following what authorities are describing as a highly sophisticated cyberattack. This is total chaos here at Victoria we have Sam? the cyberattack Yes. brings. the to a standstill. I don't, but I know why. We are now receiving confirmed reports that the N I six has been breached. His majesty has pledged to deploy all military and police resources. Telling us to stay inside, Boil our water. With what power? Electricity has been out for three days. We are following breaking news. The hacker collective known as Skullproxy has reportedly breached the highly secured systems of MI 6. Authorities are urging all London residents to be drinking tap water. Skull will proxy the attack on the water infrastructure. We can now confirm the prime minister has been evacuated. Security officials say the threat level across the capital has never been higher. The situation is escalating rapidly. Multiple government buildings across Whitehall have been taken We will not back down. We are legion. We will not stop. Yes. Alright. We're ready to start. Okay. I will, I had also, prepared for you a little, backdrop. Let's let's do it with my fancy lights. Here we go. It's now red. Wow. It's not I I it's not like green screen stuff, but it's anyway, we're having fun. Okay. Now I'm gonna share again full screen full, all my screen, and we're gonna get started. Boom. The oops. That's not the correct one. Okay. So, the the context is pretty inter we wanted to put a context around, being an MI six operative. So because this allows us to hack the, the challenges or the, you know, do some hack back in the scenario while keeping it legal. So that's a bit of the reason and also to have high stakes. Right? So the the we're going after this group. They are disrupting society. We are the white knights, the good guys, and we're trying to take down the whole thing. But so where does this start? It starts with the drive by, which is a packet capture, exercise. All of the challenges have some theory, in them, and then you have flags that you need to put in. When you click begin, you get, some context also of the package. So here, what we're learning is that it's the, we're investigating a malvertising campaign, and the, infection chain was captured. So we would we should have here a victim browser, a sponsored result, but with malicious ad, redirection chain, fake download page, and then a pack payload. This is, via, darkroom. Where is darkroom? Here. So this is via Wireshark. So as you can see, I always create a folder for each CTF I play. I kept them throughout the years. I have many of them. I should train AI on them, I guess. But so, each challenge get their own folder. So you have artifacts, and you can go back if you're like, oh, this challenge was cool or if you wanna be inspired to design a different, challenge for, your organization or different context. So we're gonna open the Wireshark up. Here we go. And so this is how it starts. Now Wireshark can be really intimidating, but everything, happens in layers. And, I think every I don't know. Not every, but lots of people should at least, play with it and have basic understanding. I will let you, play four. We have eight challenges, three hours. This one is a is a tough one. Like, it's a a hardcore beginning. So I'm gonna give you, I think, ten minutes, and then we're or maybe five minutes, and then we'll start looking at it. This is how is we're gonna go. And, I wanna Olivier, we should show how to submit flags. yes. That that that's what I was going to do. Thanks, Nice. Eric, for reminding me. So so in this page where we downloaded the, the PCAP, you also have a link to Wireshark. It's a free open source tool, by the way. But to submit flags, on the top left corner, there's a d here. When you click on it, you can see the flag that you are looking for so you don't need to go back to the the the the previous page in order to know what you need to do. And, you have a here it's a box that says, entered flag. So what is the name of the software being impersonated? Adobe Reader. Let's try that as a flag in case we're lucky. Obviously, I know it's not that. But so this is the spot where you submit your flags. So let's give you guys a ten minute and, a five minute and then look at the first part of that I see there's a few people that seem to have issues unable to join. So, yeah, you. need to join on Discord first. Once you're logged in on Discord, you have access to the Flare Academy, room. From there, now with the join Discord server that you see on the top right, you will be able to go on the landing page of the, of the challenges that we have. There's a tab that you will see, it's written CTF. You will see CTI one, CTI two by default. But for this one, you need to go on the CTF tab and you will find operations called proxy in there. You know, in any CTF, getting started is the hardest part. If you participated in one, it's like figuring out, like, the infrastructure. How do we connect to the Wi Fi? How do we connect to the yeah, everything. That so it's normal. And yeah. Company network blog Discord. Must we do this on our VM or can we use our local PC? You can absolutely do this on a local PC. Of course, like, you will need to download things like Wireshark for this first stage, and Wireshark may or may not be, like, tools that you can download. Authorized. Yeah. Authorize if you don't have admin rights and yes. But so there's no malware. There's no interaction with malware or dangerous files, per se. But later at, I think challenge seven, you need a tool that could be flagged as an attack tool. You'll see. No spoiler. Yeah. Can we can we have, someone tell us that it works? Like, we've had people say it doesn't work, but do we have someone who just joined, that okay. Perfect. Perfect. Thank. you. So Awesome. because I was worried that we had an a bug, but, we don't. So okay. So have fun and play. I cannot see any CTI tab. It won't be CTI. It will be CTF. Once you go on yeah. the join me if I if I share my screen maybe to show you how it looks like once. you do it, Derek. oh, okay. Perfect. The courses. Yeah. Courses. So CTF and. then go proxy. by default, the link, the the page brings you on CTIA. Oh, and also, it's in light mode. I suggest people to switch to dark mode. It's I much prefer it, this way. You feel way more like a hacker with dark mode. What's the Vybe called it? Obviously, Maybe. yes. But still yeah. Vibe quoted, but I I saw the the progress. Like, all the effort that came into this, it's impressive. It's it's not only, hey. Build me a full CTF. Let's do this, Claude, and good luck. Enjoy your tokens. There there's a lot of work. And it's it's a team effort also we need to say. Like, lots of people worked on different parts of this. Jeremy, yes. So don't no need to reboot for Wireshark. I think it's if you want to capture packets on your machine that you need to reboot. You can also install Wireshark without the capture ability. I think this means that you can install it without admin privileges. So, yeah, no need to reboot. It's gonna be difficult for Eric and I not to do small talk during these Oh, yeah. Oh, yeah. these quiet moments. Alessandra, I see. I didn't receive the invite to join the Discord when I entered my email. Pit scalar exploitation and meantime. So, Yugesh, you're right. Like, Yugesh is saying, it would be easier if the setup was informed earlier, don't have to download tools during a session. You're right. In the when we did the live one, we told people at least download Wireshark in advance. So yeah. Yeah. You're you're you're right. Tayab is asking, do these challenges represent some of the type of work a threat analyst goes through or is more like how someone in operations can use this data, if that makes sense. Olivier, I would love to hear your your thinking on that. So, the this specific thing I, we built, was prompted by trying to have it look like realistic. But, like, for example, the first challenge, full packet capture is really unusual, in the SOC, but it's not unusual if you're doing malware research where you control or you detonate the environment. So it it it's a bit biased towards the later. But with the former, you would do it with, you know, a SIM and other tools like that. Passive DNS, you'll see. I'm gonna dive into the DNS first because I think it's telling a lot. So that is definitely, doable if you are an organization who collect, your DNS and expose it to SOC analysts, which I strongly recommend. The the volume to value for DNS and NetFlow, is really, really high. So, yeah, I I I I think they're kinda realistic. And then based on different stages, like, the ones where we we will go over forums, is something that we do at work here. And then there's the one where we hack the things, and then this is not something we do. But I used to work for a pen test firm, and we were doing this, with the with the pen test people. So but but with authorization. So yeah. So once, Sylvester, once you register on Discord, then you open, the the step two that Joe tagged, and then it will bounce the the it's kind of we're using Discord as an authorization, mechanism. We didn't want to collect, you know, one, short term, passwords that you were you would create. Philip, to submit the flags, it's on the top left. You click on the d, and then you'll have, I don't it's a weird sentence. Weird weird phrasing. And then you'll have, submit, to submit the flags, and you'll see also objectives are gonna yeah. You'll see it shortly. So let's, what what do you think, Eric, we do? Like, flag one of the the. PCAPs. We could do slide one and to to show a little bit what is the, yeah. I'm sorry for the people that are not ready. The thing is that we'll have a lot of flags to do today. I know that it was, scheduled over a long period of time, but if we want to make sure that we finish in time that we do everything, so here, we'll go and start. It's why we have mute for a reason. Yes. And well, you. can mute us if you're you don't want spoilers. Of course. Finish challenge. Congrats. Did we get a list of parameters used beforehand? No. Probably not. And the thing is that tools vary. People will have different set of tools that they prefer to use, like, even Wireshark. Like, there's alternatives to to this. Is there a thing we need in the Discord? Once you have Discord, go on once you're logged in on Discord, go on the link that was pinned by Joe at the top, darkroom. Labs. Flare io/ctf. So can I, should I go, Eric, for. the flag one? Yeah. Okay. So it's a malvertising redirect chain. Usually, this means the different host will be, involved and and including legitimate ones at the beginning of the chain. Right? The the ad is displayed on a legit site. You don't go directly to a malicious site, when it's phishing maybe, but not in in this case. I have two Wireshark open. Let me close this one. So what I like to do first to get a a sniff test is to filter by DNS. So you type DNS enter, and then you see, what was looked up. Okay? We added that c t f at the end of host names in order to prevent people from loading, you know, these things on the live Internet and, you know, generate noise. And the IP addresses also are all local. This is this is kind of a made up environment. But you can see that the first, thing that was browsed was, google.com, then Google Ad Services, then a double click ad, then a tracking some tracking code, notepad plus dot c t f, CDN files, and then analytics collector. So the notepad plus could give us a hint of the software that the the the victim was trying to install, but we're like, it it's not guaranteed. And do you really need to type it down as Notepad plus? It's not here. Right? It could be also unrelated to that. So let's extract the the HTML content then. There's a very handy shortcut, in Wireshark under files. I don't know if it's big enough. Under file, you have, export object and then HTTP. And so in this, it will, highlight all of the of the objects or or the, like, meaningful or large, contents that were extracted, and it will tell you which packet. And then, yeah, there's a button to save all of them. So this is what we're gonna do. The file name are gonna suck. Right? The the there's one called slash and then ack and whatever. So but, like, there's no way to change it. We just have to remember. But the Google one, which is probably what we're looking for, we want to see the Google page, is gonna be hosted at slash. So let's save all of these in our child one. Let's, call this folder HTML. Create it and then, select that folder. Here we go. Now going back to the files, so one HTML. And then we remember the slash, so this would be I don't know how to set it. Percent percent to f. Let's call it index instead or Google you know, google.html, and then let's open it. I, so you must be careful before opening, HTML file on your local machine. And the reason is that it could contain JavaScript or other, things. So this should it might be preferable to do in the VM, but I guarantee you for this the purpose of this challenge, it's fine. So I'm gonna open it, and, this was opened in my browser that I already had open. And we can see that the Google is, that the Google request was notepad plus plus download. So if we go back here and say, what is the name, being impersonated maliciously? Okay. Was it impersonated maliciously? Well, the the link is called Notepad plus, download, and we can verify if it if it's, where is the Notepad plus plus thing usually located. Also, a sponsor it's ad for free software is weird. yep. I agree with that. So, we have the legit domain on the second and the malicious domain on the first one. So we can say with confidence this is not that plus plus. But also, this is a CPF. We could have just, you know, tried many things and go faster. I'm taking the slow and careful route here. Alright. So let's read the description of flag two, and then, we'll give you guys a couple of minutes to look at it. This is a hard one, so we're taking, our time here. The some of the later challenges will go faster. So what is the key used to obfuscate the payload? So this means that somewhere in there, we have a payload and there's a key. So if I would like, if you serve malicious files, you need to and and I see you, like, we're we're we're talking to the malware operator in our heads here, but you need to do it on a on a domain you control or host it on a third party. But, like, for example, Google Ad Services will host images or the banners that are being displayed. They will not host statically static binaries. So we are looking for a domain that would be hosting a static binary. A CDN could be such a thing. So if we look at the HTTP query right after the the CDN, query it might be small a little bit. I don't know. Right after the CDN query here, we have a get request here and, an answer here of type text HTML. Let's take a look. Let's see what it looks like. Okay. So it's a redirection to notepad plus dot c t f with some content. Okay. So the content so the the notepad plus DNS is here, and then the get, and then what's the result looking like? And then the result is an another HTML page, but with download starting, okay, which means that it's probably gonna go to another redirection, CDN dash files. So somewhere in there in that chain, there is that's the get request. I want the result. The post. Yes. So somewhere in that chain, we are looking for a key that will obfuscate the payload. So you saw the chain that we went through. All of these pages, we downloaded before. So we you can go and look at that. Again, gonna give you, I don't know, three minutes since I talk too much. By the way, the sponsor that we saw, is something that is being used as a vector for infections. So Google will offer a way for anybody can purchase an ad, and Google will validate if this the content that is delivered is malicious. But the thing is that what threat actors will do is that they will purchase something, have, like, legitimate links, and then they will do an update. So during a short period of time, people that want to download, let's say, Notepad plus plus will see this as a first link and will do the mistake. So, it's something that we have seen, in a presentation I did with Olivier once we were showing, how, mid journey, the AI image, software was being advertised to malicious Google sponsored ads. Abhishek, for, for answers, it's the d icon on the top left corner. You will see, this will open and you'll be able to enter the flags that you submit. Most of the flags, by the way, for today, will be prefixed with the word flag. So when you see this in a file somewhere, you're on a good, you're on a you're on a good track. You kids with your mechanical keyboards. Yeah. Sorry. I'm asking about this the screen size. Like, someone it was not super clear. Like, the yeah. The screen goes fast because I'm zoomed in. But I if. you are all on big screens, you don't I don't need to zoom in. So let me know. Should I zoom in or not? I know that it's a bit more, Yeah. dizzy. Also, when when a screen is shared, you will see there's a plus button. So people, you can zoom to something that fits, better for you. Like, I'm on a super small screen, so this is very, necessary for me. But it's your home office. Why why you have a small screen? They don't treat you well at Flare. no. Because this shows my Legos, this this angle. Because normally, Also, it's the yes. the laptop. Yes. I see. It's I'm on my laptop camera, hence why the color is so bad. Yeah. Okay. Check the pinned messages, Bradley. I'm gonna go and move on to the next solve. Entire screen. Share. Here we go. Okay. Our next flag is what is the key used to obfuscate the payload? So a key. As I as I walk the chain earlier, I would not expect Google Ads or doubleclick.net to provide a key. Tracking might provide a key. So this is the get slash r, question mark, file that we exported earlier. So these on the file system will get encoded differently. So so, basically, a slash is not a legal file name, because it's the only character that separates directories. So they are getting encoded. But if we look at the r question mark d equals, r something encoded with person encoding, d equals so this is what we're I I'm looking for. I am no longer sure we are in the the territory of acceptable I'm gonna name this tracking dash CDM because it's it's the host name where it was requested. And you know what? I should even, like, do I'll do it. I should do one underscore. Right? Because this is kind of my investigation path. So this was the first query. Then, I have Google Ads would be second. Double click would be third, and then this tracking CDN would be fourth. So I'm gonna rename the the previous one that I called tracking CDN to four underscore tracking CDN. So if I ever need to go back into the investigation, I will I will be I will be like, oh, yeah. This was in that order, and I don't need to, like, mess around. Now let me oh, you know what? I'm gonna make my terminal better. How about that? Instead of zooming. Because at the terminal that is, zoomed in can it can get really confusing. So even bigger, bigger, bigger. Yes. Let's go. Okay. So my the file I wanna look at is this one. Now I as I was saying, this is coming from potentially you know, if we role play here because I know that there's nothing malicious, but it could be coming from potentially malicious source. So I will not open it in the browser just yet. I will look at it, by with, with, an editor. No. But a a text editor. Any text editor is good. Notepad plus plus downloaded from the right place, would be good. Now this is just the redirection. So for me, right now, I there is a token that could be something that it will be meaningful later, but for now, there's nothing interesting in there. So I'm gonna walk up the chain. I'm gonna go and fetch the next, which is the, notepad, plus dot c t f. And then I'm gonna look. There's a a a slash d l file, which would be our next file to investigate. D l d l I don't see it. Okay. Let's look again. Nine f eight three. Nine f okay. Nine f eight three. I see it. So the d l part is truncated, by by, Wireshark when you do the export object apparently. Now, this is our notepad plus dot c t f, so I'm gonna rename it accordingly. So we are at HTTP request number five notepad plus dot c, dot h t m. No need to do the the other dot. Now I renamed the file, and now let let's look at it with your favorite text editor. Okay. Now we're dealing with a site that is third party, that could be malicious, and this is the code of that page. There's a download installer link, but it talks about verifying your download. And there is JavaScript code that is, run, here. And we see, like, base 64 decoding, XOR decryption, so stuff that is, shady. And now we have a a to b, so this is ASCII to binary, is it? No. Anyway, it's it's Base64 looking, And then it will extract a key. And we were looking for, a key used to obfuscate the payload. So going back here, this could clearly be so the stage is decrypted via the XOR decrypt, and it's leveraging the key. So it could be our key that we're looking for. Let's, paste it as is in our submission form. I can also increase this thing. Let's do it. Okay. Pasting that. Is that our key? It's not our key. Okay. But this is base 64. So, CyberChef to the rescue. I should know the recipe that I already have. That might not go well. Okay. So CyberChef is a, not a web based tool, and it's, browser only. Meaning that you're not sending to GCHQ everything you're doing inside of CyberChef. So it's safe, allegedly, according to them. But I I rely on it a lot. But I you can also do this on the command line. So I'm gonna show you both because it's really quick. So this would be this to me looks like Base64, so I will use the operation from Base64. So, basically, your output is on the top right. You have a recipe that will transform your your input. Your, your input is on the top right. You have a recipe that will transform your input on the left, and then your, the output of the result of the recipe is gonna be on the bottom right. And what's interesting is you can stack analysis layers. This is why this tool is powerful. Here we have a URL. URL for, later. Is that is that URL a key? I don't think so. So I might be a little bit misguided here and being fooled by something in the pcap or the code. Oh, this is the URL variable. This was not a key. Okay. Our key key is here, JSON parse b 64 URL to string t dot split on the dot. Where is t coming from? T is here. Search parameter, t. Okay. Okay. So it probably means that it land I landed on this page with t in the in the referrer URL. Now we there's, oh, I'm I'm gonna show you how to base 64 decode first on the timeline. So what? I backstage, talk to me. Okay. Sorry. Sorry. The backstage was talking to me. Everything's fine. Okay. The, Yeah. I I was looking for the, base 64, string to show you how to decode it on the CLI. Let's go back to this file. For base 64, I almost always do it on the CLI. I find that the opening CyberChef is slower. So here we go. Copy. And then I echo, dash m. The dash m is really important because otherwise it will add, carriage return character, and, you will, the this character will impact the base 64 decoding. So, if we do this, we get the same result as we got in Cyber Chef. It's really easy. So it's always the same thing. And there's probably a fancier tool from, like, project that could that do it, in one pass, but muscle memory is really strong. So this is how I've been doing it for years, for decades at this point. Let's try without the dash m just to see if I am oh, it works. But in some context, it doesn't, depending on how things are happening at the end. The okay. So back to where we're at, we're looking for the the t parameter that is passed into the fifth HTTP request. This is likely coming from the previous one. So do we have a t parameter here? Yes. So t, is here. That would be what we're looking for. This is an this also looks like Base64, but people familiar with application security would recognize the beginning here. This is a JWT token. It's a very common thing. If you do lots of analysis, eventually, you will see these things like I I just did. JWT token can be, interpreted with Base64 decoding, but it took a you could also use a specific parser for them, I believe. So JWT decode. And then it's even cleaner. Right? Because because it knows about the the encrypted portion of it. So this is a key value, like, encoded system. You have a campaign, you have a k parameter, an n h, and a p I d. So it's a way to pass information between two sites. Here our k parameter is really interesting, but let's see why k and if the code we were looking at earlier can tell us something about, if it's k we're looking for. So it is splitting on the dot and selecting the dot k here. And then, basic, yeah, basic before encoding it and JSON parse it, and this is the key. So if we take apart or or extract only the, k portion here? Are we is this our solution? Here we go. Delete. Submit. And then we found the second flag. Now this is a key used to obfuscate the payload, so let's keep it handy. I will add it to my, notes here because it might be useful for the next challenge which which is requiring us to decode the payload. So notes, notes, and then flag two is that. Okay. Looking at the last challenge, the decrypted payload content. So we ultimately have a payload. In most malware drive by cases, it's a binary, like an executable file that will be served. But in the challenge of this context, we I went with a a small encoded payload instead. But now with our key, we can see that it might be used for that, and we can check, whoops, via the source code. What is it? Where is that thing passed next? So it is decrypting something called stage, and stage is, reading buf, and buf is coming from the fetch of that URL, that URL which is encoded. Okay? So let's walk this again together. This URL is being fetched by the browser, and then the result of that fetch, will be converted to a buffer. And then this buffer will be passed here and decrypted with the key. So the payload would be stored here, re returned by this URL, but decrypted by that key using the Xore decrypt function that we see here. So, and the Xore decrypt, fortunately for us, this is this is the XOR command. It is very straightforward. It's not complicated. It's one byte XOR. Oh, no. There's the key lamp. So it will rely on the key lamp. So rotating on the key one character at a time. So what we will call a multibyte, Dzor. Now I gave you lots of hint. I don't know if we want to move, straight ahead or if we wanna little a little bit of time for you to look at this. But does the chat think? We have some people that have solved it already. Of, course, for the. steps I remember when I tried this step, I saw I was reading the code and it's not always that obvious, but Olivier showed me a cool trick with, with CyberShift, something that can makes it make it easy to recognize these, these different formats of payloads. Yes. But, let let if we look at what we have to cover today. So this one is hard. Then the next couple, we can go quick. So I think it's it's fine that we we're almost at fifty minute in and still not done. Let's give you guys three minutes, and then we'll solve it. Is there a consensus on zooming versus not zooming? So how can you live your life without a mechanical keyboard, Eric? I don't know. It's this annoys me. My my keyboard has very slick keys. I press on them. It makes no noise. So good question, Sydney. So what we will do, and I you need to remind me if I forget because I might forget, is as soon as we are done with a challenge, I will I will unlock the next one to everyone in the that is, accessing the platform right now. So this way, even if you didn't enter the flag, if you missed it because it went too fast, you will be able to play the next challenge. And, some of them, I think, are more approachable for traditional CTI, analysts, so you should enjoy it. Shannon was asking, what's the ghostly app I'm stuck in it? Is this in scope or out of scope? Yeah. Chanel, are you on, are you on in the class? So this is CTA. I should I can show it. And then. I'll solve right after. it should be. in the, what's it called, operations call proxy. Yeah. CTM. Oh, yeah. Yeah. I, I gave the dying on this. So out of scope, so. when you log in, you arrive in this, area of the website, but you need to go to CTF and then operations call proxy. So these are the ones we are solving together. And then to submit the flag, it's the the d on the top left. Okay. Now solving our last challenge, I I almost like, I did the whole setup. Right? We have this URL, which is fetched passed to the XorDecrypt. We have the key already. So let's, let's remind ourselves what is this URL again so we can then go and hunt it in Wireshark. So we are gonna trash this here. This is base 64. So from base 64 so this is the CDM dash files, the c t f that we are interested in. CDM dash files is here. So the answer to this, query the query is the get ID. So in our dump, the thing that start by get ID, this is the one. Okay? I'm no longer sure it's the sixth one. So in in order to move along, I'm gonna rename it, like, 99 because I it's the last flag. Right? So, CDN dash files and then HTML. Oh, looking at it, it's oh, this is a binary, so it's gonna be tricky. I can't copy it like this within my clipboard. It's not gonna work. It needs to be, open raw, like, if I look at it this way, for example, you see that some character were printed differently, than in Vim than, now, like, on the the right hand side. So in order for me to have an accurate collection of it, I will open it as a file inside CyberShift so that is it's not, open file as input. Darkroom, challenge one, HTML, and CDN files. Okay. So it's this should be reliable and accurate. The base 64 is not working for us. What we remember is that there was a XOR thing going on. Right? So I have XOR here, and then our key, I noted it down earlier, right, in my notes thing. It was, plain text. So this is not exodesmall. So I put in my key as instead of hex here, I put it in UTF eight or ASCII. This thing is, UTF eight comp compatible. And then if I do this, there is it is still binary. So what am I doing wrong here? Am I missing a step? Let's go back to the code. Exordecrypt. So looking at this, doing a buffer with it. Okay. Let's look at the difference between let's look at the difference between, the file I'm opening with CyberShift and, the out the return value here of that git. So if I do, follow a, HTTP stream here, I would see what is returned. Looks very similar. So q dot pipe a p four d p, and then the, space and then one US at the end. So what is going on? Maybe oh, yes. I remember. I forgot my own challenge. That's funny. Okay. You see that here, there's a little magic wand. Okay? So one one okay. One step at a time. When when you're not sure about, an output, good reflex to have is, to, hex, whoops, not from hex. Sorry. To hex. To look at it in hex. And then you see the magic wand, the it it, again, you know, it blinked. But the the hex will give you a header, and you can easily Google headers. So to make sure that it's not some format, like, is it an image? Is it an executable? Is it something meaningful in in this context? So I will, Google these. And then, quickly enough, it's called it is, 1F8B08 is the standard magic number at the beginning of a gzip file. So, clearly, I was not at the end, but I was on the right path. So gzip is something that can then be done here by Cyber Chef. So, the the, opposite operation of gzip is g unzip. So you then g unzip, and then what we are getting here now, it becomes clean, like, hex looking text. So we know we're on the right direction. Now I wanna in addition to gunzip running gunzip and finding it by looking at the hex headers, I wanna say that whenever we put in the right key, the magic wand blinked, and it says, gzip will produce this. So CyberChef is giving you a solid hint here, and if you click on that magic wand, you get the the decoded version. And then the magic wand appeared again and said, from hex, we'll produce this, and then and it added the hex recipe. And then we have here, from base 64, we'll produce this. Okay? So we click here and then we have something that is all ASCII, but that ends with gulf and that has curly bracket upside down. Okay? Is this our flag? Let's try. It's a bit of a I'm missing the people here. It's not our flag. But what's up with the gulf and the the reverse bracket that are upside down? Seasoned CTF players will recognize, that this is flagged but spelled backwards. So if I add on top of these operations a reverse string operation, then I get flag u the u desergeser adds drive by. But if you look at this part here upside down, in Leadspeak, is reversed. So you reversed engineered ads drive by with a clever, Rick Ross style, Rick Ross from Black Hills, joke in it. So let's try. Like, I hope we're we're there now. Let's see. Here we go. Mission complete. Yay. Okay. Nice work. We move on to the next stage, the bridge forum. So from the payload delivery domain to the operator behind it. Okay. We, we identified CDN files as the domain delivering the payload. We wanna see, is there people talking about CDN files on on that forum to help us pivot deeper into the infrastructure of these bad guys we are after today. So search or browse the forum for post naming CDM files, identify who is behind them, and find a pivot to further infrastructure. Flag one, forum handle. Flag two, escrow reference of the listing of the threat actor. And then flag three, find a dedicated leak site related to the threat actor. We're gonna jump in the forum. So this is, very well done in platform, and I say very well done because I want to give credit to Eric Clay who built this kind of a, you know, simulation while we stay in a safe platform because we didn't wanna send people over to the Real Breach forums. But so you have many posts to go through. There are, you know, things that work, and you can, like, click on members' names and stuff. So I will give you, five minutes, and then. we will, one is short. This one is, easier. yeah, five minutes. And I think we can do at least the two first flag and then one minute, and then we'll do the last flag. So it's a. six minute deal total. Talk to you soon. Do we know if it's unlocked? If the, Oh, no. I'll I'll do that right now. yeah, for the people that have, had, challenges for the first one. No. No problem. Yeah. Yeah. Yeah. Let's unlock it. Global unlock two. Here we go. So challenge two is open to everyone. Refresh your, the page if it's not the case. By the way, we will remove these, global unlocks after. So, like, if you solve, like, challenge three or whatever, but you'll be able to go back and do the one or two that you skipped. But for the duration of today's, you will have access to them as we, move along together. I can't believe I forgot it was a gzip. Yeah. Yeah. And this is the one step where you provided me a hint, because I tried it and I couldn't find it. And, yeah. And it was the yeah. the trick in that challenge. Yeah. Nowhere in the the code it's talking about gzip because gzip is at the protocol layer. Like, when the packet is received, their the decoding is done because there's an, there's an HTTP header that says that this format is is in gzip, so automatically it's being decoded. You don't need to programmatically, do it. Yeah. And I guess it's it's where the this part of the challenge is a bit weaker. Like, we would need, like, for the information to be passed to, an executable or, you know, Yes. something that that that would glue in together glue it glue it together better. Yeah. But it was hard enough. Someone's saying that, need information from the last challenge I saw. Tried it. I tried to get it, but the flag does not reveal it anymore. For my memory, this is a later challenge, right, where you need to go back to a previous challenge? Oh, is it the the chat, interacting with the detector? No. I think it's the Stear Log spoiler alert. Good question. Yeah. I think you can go back to the previous, Oh, the the takedown? you can go back, I think, to the, Yeah. Yeah. Yeah. You can redo the You this is a lesson here. You should always write down the the flags. Password cracked and the IP address I need for this. Yeah. Can't you redo it? Oh, sorry for that. You're, like, five challenges ahead, of the of the group. So so okay. I'll spend some time in the meantime to talk about breach forums. So breach is a well known forum, which is in I don't know. It's x iteration. It gets shut down. There's a lot of internal drama with that specific, forum. But it's a well known place where people will advertise when they, merchandise for sale. Typically, like that breach databases. So it's considered a low, low maturity, low, like, low danger place because there's no clear, understanding of who is who. And this is why later on, you will see, there's a concept of an escrow. Because if you want to purchase data, you cannot really trust the person that is there. All is done anonymously. So, breach has the, offers escrow services. I'll come back to that, later on. We can probably solve this one now. Yeah. No. I was while while you were talking, I was, showing people that I would I'm browsing, basically. Like, I am like, okay. Could this be, you know, in the lounge? No. And then there we kinda remove the search. Well, we have a search, but per per thread in order to make it a little bit harder. But so the the the thing here is about role playing. So we're looking for a domain and we're, trying to find people who operate the domain. So they are probably selling, access to it or something. So I'm gonna like, I I looked at cracking, you know, open bullet config. That's not it. It getting banned. This is all kind of local stuff. Then, let let's go to the seller space. And then sellers, you have, like talks about escrow, private CDN delivery. Right? There there's a big, like, telltale flag here. Selling RDP access, not related. This MTPC panel either. Cash out bank runners, not not not, so much what we're looking for. So loader plus dealer builds, private CDM delivery. Okay. Let's take a look. And then let's use the search from the tread CDM, CDM files. Does does it even work? I'm not sure. I can always search using control f. Oh, I cannot search using control f. I forgot. Here it is. Like, CDN files. Or maybe I can't oh, yeah. It's true. We disabled, like, everything on the with that that browser can do. But if you know the shortcut for inspect, you can still use inspect. And then you can go here, and then here we can probably search. Can we? Anyway, it's not about bypassing the platform, but it could become that. So the this guy talks about, CDN, -files.ctf, which is what we're looking after. Now the question is, that posted about the domain, CDN files. So, this is, deliveries run through my own CDN CDN files. Okay. So that's this is the member name. Let's take that. Yes, sir. And then, the, the next flag is about escrow reference. And since this is a seller in a seller marketplace, he is referring directly to his escrow, so we can copy that from here as well. Up. Up. Up. Boom. Second flag. And then third flag, dedicated leak site related to the threat actor. No scheme, just the onion. So usually, these will be in, like, at the bottom of the post, they have, like, advertisements. We can look as well as all of the the thread, but there's nothing here. And then, usually, we can pivot on the other messages of the members. We can look at this member view. Now, from here, we see the post, but we cannot click on it, see reputation. Oh, dedicated leak sites. We have here, the onion. And as, we were hinted by people on the chat, we should write these down because they might come handy later. So we'll I'll put this in my notes, for challenge two in case I need to come back to it later. Up. Up. So, since I'm already done with challenge two, I won't do a folder. I'll just do that. Found this onion. And then this is exactly what we were, looking for for as a flag. So let's go back here and then submit it. And then it specifically says no scheme, just the onion. So we submit, and our flag accepted. Here we go. Return Hooray. to the hub. Yeah. Celebration. Leak site. So we, wanted to have fun and have you use Tor, which is another requirement, which might be complicated for some corporate people, I realize now. We we do this, quite often at work. And Tor usually like, auto updates itself. It's it's relatively safe. It will not reveal where you're from, but you're not you must not be stupid with it, obviously. But in this case, here, it's safe. It was done by us on for the purpose of exploring it. So what we're gonna do is we're gonna access that site, which is running on a Tor hidden service, and there's some theory about how that works on the next page, which I won't go over. But so they these onion addresses only open there. You cannot open them in a regular browser. It it will, like, make a an error of some sort. Right? It says, does not support secure connection. The, yeah. So you need absolutely to use store to to do it. And then it's gonna go on a dedicated leak site. And we wanna look for anything that the operator left and a way to pivot or to further understand or get closer to these threat actor because we're trying to take down this national threat. We're looking for a flag, hidden the source code, file listings, de anonymizing this server, and, threat actor Telegram contact info. So let's go. Now here we explain the Tor project, how to load the DLS, and here we provided to you so you didn't need to remember it. And then, there's some theory of how, Tor hidden services work and why I am comfortable from my own computer using Tor, to reach to this get the gig sites on the Internet. So let's open up that Onion site. And this is this is one of us. Right? It's not it's a purpose made for the challenge. It's not, something made by by by threat actors. Don't worry. So I'm gonna give you a couple of minutes to explore. Some of these are pretty straightforward. Right? Like the flag hidden in in page source code, Okay. right click, view page source, is what you need. File listings, there is probably file listings. Usually for bitskated leak sites, it's when, things are published or like here, we have a button called file listing. Now it it might be, data breath problem. And this is where someone like us, Flare, who goes who scavenged the garbage of the Internet wanted to share the pain that it is with you. Like, going through, huge file listings or huge, leaks is very tedious. Downloading them is tedious. Extracting them is tedious. So we, this flag might be a kind of a needle in a haystack, challenge. De anonymizing is interesting. And then the the threat actor Telegram, contact info, which was listed last is actually the easiest. So I will do this one right now. Here we go. And now I'm gonna give you a couple of minutes. I don't know if let's say we. we, Yes. explain or we have Eric talking to us about core over the time we give you for challenges. Is that distracting? Is this cool? Let us they? know what you think. Oh, can you unlock mission three? So, yeah. Sure. Yeah. Yeah. I will. okay. The dark web, how it works. So what we're doing using Tor, the the concept of Tor, the on air router, is rather than you wanting to reach a diff a distant server or you tell, I wanna talk to this person, and now leaving a breadcrumb across all the network, like, routes where it's it would, go, oh, you we need to reach this, go this way, this way, this way. What you do is that you send a a message saying that I wanna reach this, and there's a lay there there's a a few layers of nodes that would receive that request to eventually put you in contact with a relay node that would tell, okay. You want to reach this? I will put you in contact. But there's at any point, there's no way that you can know who is the origin and who is the, destination. So by putting them together with a middle, like, organization, which is the the really known, router, you can guarantee anonymity. Although there has been weaknesses associated with, even the Tor protocol, like, for example, if you set up a few network, router nodes within the same geographical geographical area, it is possible that these will end up betraying because you have two nodes. You know, okay. Traffic came from one machine to the other and now from this to another one. So you can't, like, connect the dots, stick to it. But overall, Tor is a very, safe method for anonymous browsing over the, over the Internet. But sadly, like many things, it was created for a good reason, and it was, of course, corrupted for evil reasons. So Tor is good. Like, it's it's it's a good thing. The Tor project is amazing, but, once again, the dark web has been, yeah, filled with bad stuff. So oh, yeah. And I wanted to share also, yeah, the the ad that was on LinkedIn with all faces or pixel faces was yes. Thanks, marketing. What? For this? yeah. Yeah. Check this out. it. Show it. the neck beard that they put me. Oh, oh, maybe images are not cannot be shared on on this. I will I will, share my screen. screen. Yeah. Yeah. Yeah. Yeah. Yeah. Yeah. This share Oh, file this thing is slow to download. I'll start downloading it now. okay. Yeah. Window and this. Yes. So we have bold proxy, that's called proxy, like, my beard looks like. Yeah. Yeah. Just like us. So yeah. Cool. I mean, Alright. I look like six years old, so that's me. I I I this is both of you roasting marketing live in a thing like this, but, We love them. see we'll see how it goes. I think we can, go with the solve. Okay. I'm gonna go with the solve. The okay. Okay. So file listing for me was quick. It's already, downloaded. So I don't know what's going on. You might be throttled over where you are. Okay. And, yeah, for those who are not, who their company doesn't allow them to, use or download Tor, you can also use Brave. Brave will support, natively Tor and in some organization and block ads as well, which prevent some drive by, malware download. So some organization might whitelist it, some others might not because of exactly that. Your mileage may vary. This is the benefit of being in a startup or a scale up. Okay. So source code, we can do quick. I I I I I know I said, view view so I did view source here, but the the view source is it it's long, and it's not like, dynamic. So let's go inspect instead. And then you could search here, and we'll go with flag. Does it work? Oh, yes. It did work. And, so flag, it's called proxy. That's gateway site, source view, etcetera. We'll copy this without the extra spaces, and then, whoops. I'm showing the admin now. Scald proxy, mission three, begin, and then putting in the flag one. So we are at two flags out of four. The file listing, as I said, I just downloaded, and there is the actor name separator separator. So the reason why we gave that hint is, it is a 61 megabyte file. If we look at the file list, there is a ton of stuff in it. And if we search for flag, for example, there is Flagler Edward in there. If we do a case insensitive search for flag, we have names names or, you know, concept in another language, probably names. So that's not working. Now how many lines do we have here? We have 500,000 lines. Okay. Let's go back to the hint, actor name separator separator. Is, do we have a hint on the actor name on the site? We have scope proxy leaks. Let's take a look. And the previous flag also has scope scope proxy in it. So I'm gonna do case insensitive grips. This is rip grip of skull, just skull. You know, I'll increase my chances. And, we have a couple of scroll proxy hits here, but in file names. So that's not the flag, not the flag, not the flag, not the flag. Clearly, someone, who designed that challenge missing with us. But, oh, here, what do we have here? We have scope proxy with a parenthesis and another ending parenthesis. This is probably our flag. Now I know some of you are hating me right now. You're gonna be like, this is not realistic, and you are a 100% correct. I want I wanna just, for you guys to have an an idea of dealing with large dumps of files like that and having to hunt for that needle, but not necessarily knowing what it is. Right? So this is the best I came up with. If you have suggestion for a better needle in the haystack challenge that is realistic, please let me know. So I'm gonna put that in. Now plus one. And then, de anonymizing the server. That's that's more illegal territory, and it's, the fun is starting or continuing or increasing, I should say. Now what do we have here that would allow us to do that? Let's go on the network tab, reload. We see, like, stuff. Nothing really crazy. I'm looking at the the browser headers here. And a trick could be, like, trying to find expose file that would not be expected. Most sites have a robots dot txt, here, and, it's to keep crawlers off. But so here we have a robot that's txt and the the robot that that TXT is pretty well explained on the Internet, like, structure of robots.txt. And then, you have, like, groups, user agent, disallow, allow. So it's to keep crawlers, Google bots, off your website, but, you know, it's the ones that play nice. So usually, pen testers will use it as a hint to go after the things that are explicitly listed in robot that's robots.txt. And it's a plain text file regularly exposed. This is one of the first thing I do whenever I investigate, deeply a website. So we have a disallow on server status. Now what could contain server status? Let's take a look. I'm gonna add it right here at the end of that URL. Same onion. Apache status four and then an IP address. So the this Traf actor took a big care of putting in the the onion and, like, you know, running the Tor site, but in ultimately, they left a status page that leaks the IP address straight off like this. This is, very interesting, and, and it's something that has been seen in the wild. So this is not a true Apache server, and this is this is all made up. But the the the tech and this is why, like, none of these make necessary sense that there's more people on the server right now. But but the idea of using a server stat system with the anonymized Tor sites, onion sites, is legit. And there's also other techniques to do so, amongst others like favicon hunting. So we have that IP. Let's put it in here. Whoops. That's not I thought I copied it. I guess I didn't. Alright. Let's put IP here for real this time. Oh, wow. I can't this is not working. Okay. So the flag, does it work? Yay. Four out of four. We're good to go to the next challenge. I am, I'm gonna go unlock it, and then we're gonna, look at it. How about that? As we've seen, an Onion site is a website. It's the same infrastructure on the application side of thing. It's really on the protocol Yeah. So this one is a fun one, and it's the riskiest or the the least, how do you say, Eric, when, something is predictable? Yeah. It's chaos. Like, Yeah. Reproducible, we I would. say. Yeah. Yeah. So, human intelligence live. We need to engage with a threat actor, have him reveal more infrastructure. These type of challenges were not possible before LLM, so I it's I I'm kind of I kinda like them because of that. So you have nothing on him. He's a stranger, shooting another stranger. He's in for the money. So you we are gonna try to infiltrate and collect more information about who is called Skullproxy. But to do so, we're gonna try to look like we're trying to do business with him instead of, you know, social engineering or, you know, making him scared by saying we're law enforcement. We're we're not gonna do that. We're gonna enter commercial terms and then, try to get a hold of the panel where they host their, their, infrastructure. So what we're after is the affiliate revenue split. This is, like, a good way into the the conversation, and for this is an example of the revenue split. And, and then, the panel. What is it? Where is the affiliate panel hosted? Now with under load, I don't know how this is gonna go. By the way, I the the the mission is on luck already. But so we are chatting on Telegram with Lucky Slavic. This is obviously LLMs, behind the scene. But so what do you want? The the the thing here is that you need to look like a bad guy. And bad guys, they use slang or lead speak, and they that's not too much. Not, like, exaggerated amount. And, they don't capitalize properly. They don't punctuate properly. So the the the the thing here is to look like, you're talking with your bros online. So what do you want? I want in the money. Let's try that. So some Russian, what you want to work or what you want to buy? So, I, I have oh, I capitalized it. I have traffic. I can send you how much do you offer. Oh, by the way, if you, if you have a struggle, like, if it's kinda stuck, because it it decided that it's not collaborating with you, you you, you can click the new chat, over here. And if if if you feel like this is not unblocking you, you could also do, like, a hard refresh, so control shift r. But I tested it this morning, and I was able to get the flags, reliably. And maybe the the trick I gave earlier about the slang, is it was the only thing missing for you. So what geo? So it is asking geo. So what geographical, people do I target? And some of them will not go after, Russia. So, so you you you need to be careful about that. And what have you run before? So am I a noob or am I legit? So and I I'm not, doing the the Russian. I could do it, I guess. Let's let's do it to see. But But I think I have I have a a time out, so I must go quick. Let's do that. What is the volume? Okay. So, man, it was interesting. Okay. So, run big cat picture forums. I love the cat picture. You know how they run the Internet. A million views a day. People are so stupid. Loves. Deals is mostly Canada, but they are juicy target. So here, what Olivier is doing is that he's trying to convince a ransomware operator that he would be able to distribute to a lot of victims. He's trying to become friends with them so he can be part of the, the operation. So he wants to become an affiliate part of a panel. So these are very technical in the the ransomware ecosystem, but it's a key part of the, the way that, recruitment happens. And that's where also revenue splits because one provides the software, the ransomware tool, the other one provides the distribution channel. So So this is what Olivier here is working on, showing the distribution channel his cat picture form in that case. Yep. Now I'm name dropping old stuff because I don't know. I find it funny. But so I I stand behind the Equifax breach. I hang out with Mafia Boy, and now I work with Quillen Quillen, which is a recent group. So I show, you know, old school heritage and, new school, activities. So maybe this is gonna convince him. Alright. Equifax was, 2017. Big one okay. Ransomware crew. So you want to push loads through your cat from traffic, we do seventy thirty. Alright. So my split is seventy thirty. I'm gonna try this up, and it worked. Yep. Interested. Where's the panel at? Alright. So I have the panel. I am in, and we resolved this. So this has been, interesting challenge because it has not been consistent, between different members that played it. So let us know in the chat if for you it was super easy or too hard because I would like for me, it it's too easy, but I always go in with the references. So let us know if if you did have to, like, learn and adapt a little a little bit, because maybe we could make it a little harder. But we wanted to make it we want to make it solvable. So interested in seeing what you have you guys have to say about this. So I'm gonna go and unlock a challenge five. There's no, PII in these pages, so I can do this with my screen share. No problem. Okay. Up. And then at, channel five. So we got the panel, but so we kept this in the platform. We're not going after this this domain for real. But so we have the affiliate panel login, which means, potentially more, errors that they made, more information about themselves that they will reveal. But we do not have credentials just yet, and we're we're going the fast route. Like, we wanna, you know, break in. So we're gonna do a pen test of this page here. So, hack the scope proxy panel to lamb as its owner, panel account that we're signed in, and recovery address. So we need to show that we got him. Let's begin. So check my browser. Now this is m platform. There's no nothing that can be done, you know, on the the u r URL side or whatever. The username, I don't have it. I can try it. Lucky lucky Slavic, and then password, 12345. But it says invalid credentials. So there's, not much to be done here. I'm gonna whoops. Maybe it's just that. I'm gonna let you guys, bang your head a little, but I'm gonna give you one hit. It's or are we going too fast, do we? Mission five? No. The the last ones are pretty hardcore. So, yeah, I think we're good. So I'm gonna give you three minutes, but, the hint is, this is traditional application security and given the context, it cannot be either. It cannot be, let's say it's some sort of injection, and it's a bit fake. So do the classics because we didn't wanna put in a real, vulnerability. That was a big hint. Yes. Infinite screen. But I did use a different that. chat. The yeah. I keep up with the chat. It's it's good. I no. I can't. It's too. there's too. much. I'm there. I I got your back. Cool. Yes. Well, I'm a bit traumatized by Cathy saying, oh, yeah. I've done a bit in real life. So what? You're a ransomware affiliate? Nice. But I know, like, threat researchers, the people that are trying to get access to these panels for, helping fight the bad guys. Like, yeah. Yeah. Yeah. Yeah. So Yeah. So those who got a different offer, that it happens, and it's weird because it's it knows that it should offer $70.30. Well, the one story I've heard is someone negotiated it differently. So he did get the $770.30, offer, but he said, no. 70 is not enough. I want 80. And then the the butts said yes. Okay. Wow. And for me, my method to solve it was to say that I have, compromised credentials for a YouTuber, a popular YouTuber, because this is a great way is that you go to that person's videos, you post, like, download links, into the, into the comment section or, into the description of a video. And people trust these YouTubers. And, yeah. I know this morning on our Discord Flare Academy, I got a notification that about the Mr. Beast crypto, currency. Like, as a way, go where people are so that you have more chances of someone biting, and downloading the infected software. Do we. need My solve four and start on five? No. Normally, five has been unlocked, so you should be good to go. I hope people are enjoying this. It's, it's chill. It's, This is great. Thank you. Alright. Should we do it? It's it's kind of, you know, you if you know, you know, and don't wait. Wait. Yeah. Let's do it. Yeah. Jared, I understand. I also was not, like, used to do CTFs, and I did myself to be, like, the the really better tester of someone maybe of like, like you that doesn't have all the tools installed, doesn't have like, is doing it on the work computer. And, it was interesting, and it took me a long time. It did it? Because you were there also to test for the because in in the light during the light event, we had two hours. don't know. And mean, so, the week before on a Saturday you did the QA yeah. Yeah. It's a big QA. Yeah. yeah. Yeah. So Blake, I think, did it in our our Blake did it in, like, fifty minute or something, and I was like, yeah. This is this doesn't count. Yeah. Fucking destroying it. There's one last, missed the part with de anonymizing the server. What was the trick, please? Oh, server status. Oh, yeah. Yeah. Yeah. Yeah. Or you just had to open the the source code, and you could find the, yeah, the link to this. Yeah. Server status was both in robot.txt, but also somewhere in the forum like, Yeah. see see the uptime or whatever. Alright. Let's go for the the because the last two ones the last three ones are kind of long and but there's the explanations are long or the theory is long. Okay. Here we go. So this my hand was clearly, leading us towards SQL injection. Traditional SQL injection, you need to understand how queries bad queries are built, and they are so, it's a mix of a programming language and user input, and the separators are traditionally, single quotes. So, when you concatenate the strings, if you escape out of the single quoted area, you are no longer in the user input. You are now on the control plane, of the of the query. This is kind of similar to the early prompt injection attacks the, in the early LLM days. But so so you can imagine a query for a login being like where username equals the user input and password equals the, password input. And so, if you do single quote, you are escaping you basically say username empty, and then you can and then you are in the SQL and the control side of the of the the query that you basically, you speak database language. And if this needs to log you in, it needs to return true. It needs to to match something. So we will say, you know, empty username or, universal mathematical truth or one equal one. And then, the the rest could make the server crash, because it will be an invalid query if after there's the legit single quote from the source code query. So you put in, comments. So in SQL, in SQL, dash dash, in MySQL, depending on the SQL dialect, dash dash is a comment. In some cases, it's a semicolon, I think, and there's a bunch of others. It's easy to Google. So this should make a login, query return true, which, from the application's perspective, might let you log in. Now this was a really quick theory around SQL injection. This is an intense and complex field of exploitation, that is a bit dated because lots of application web application framework now prevent you from doing raw SQL queries or mixing user input like that, but still very interesting. So I encourage you to go and learn about SQL injection on your own if this is something you wanted to, to dig more into. And I would add to that that the best way to learn about SQL injection is when the, the thing is transparent. When you can see the query and see the user input, how it affects the query, this is very good way to learn. But a bit out of scope for our CTI exercise here. So I'm gonna try that, and I was in. Instantly in. You could, if you are most advanced player, will probably maybe said already that in the chat, but what you could have done here also is look at what we do on the front end and just bypass it. So you can see that we accept many different, SQL injection, but we're not running it for real. So some of the good ones would not have worked. So some people did bypass it like that complete like like cheating, not cheating, but, like, circumventing the, what's in the challenge. Now we, the question that we got, is about our username and an email. So we're gonna go and if we take a look here. So the panel account you are assigned in, account name. So the account is vore admin. So let's copy this and paste it here. I went straight for the settings for that. By the way, like, I knew I remembered that the these were the names. And so, settings is usually settings are your profile like here, but nothing is clickable over here, so this is why I went straight for it. And then the recovery address. You wanna say something, Eric? Yeah. There was a question like, can you explain what we're seeing in that panel? Let me take a moment to explain what is a panel. We're talking. here about ransomware as a service operation, Something that someone will purchase access or in that case having a revenue split. Meaning that anytime there's a victim that will pay out the ransom money, there will be a split. Like in that case, 70% to Skolproxy and 30% to you, the, distributor for the, for for this. The panel is I just wanna, oh, sorry. stop you for one sec. I think this is a a Steelers, panel, not, Oh, yeah. Yeah. You're right. ransomware. You're right. Okay. Yes. Yes. So, Sorry. yeah, Sorry. explain. the difference, but. go ahead. So, it's not yeah. Run somewhere is more complicated. Like, here, it's a steeler panel, which means me, I can ask to have an InfoStealer model where bundle in something I can distribute afterwards. And this panel is how I configure this campaign. So I am able to to view what are all my victims, the people that got delivered, that click and downloaded that file, and executed it afterwards. So this way, I can see my revenue stream, how many users have, have taken the bite. And as, like a distributor of Infos Theater, I'm an affiliate, but each person would have an account for their own, their own operation. Campaigns. And, yeah, campaigns. Yeah. Campaigns are good, yes. It's a good so, yeah, it's a it's a it's this is a mimic of what is actually happening online. And, of course, having access to a panel for security researchers like us is the most, like, precious thing because with the panel, now you get access to victims very quickly. And, yeah, this is the holy grail for for a security researcher. and this is an admin account, so we see, like, everyone. Right? We could see the traffic is like the affiliates, and and hear news like, oh, Defender is flagging the v three loader rebuild. So I there's a a ton of nice role play element into into it. Thanks, Eric, for taking the time to, go through it. I was I was too focused on flagging. Alright. So the second part of the flag is the recovery email address, which we're getting closer and closer to a person. Right? E Bogachev. And for those who, understood the Slavic reference from earlier, this is a real name of a FBI most wanted cybercriminal, the the guy behind Game Over. So some lore, for you there. But so we success successfully found the the two flags. Now this this, next mission, the pivot is interesting. So I'm gonna go and unlock it for everyone so we can discover it all at the same time. Here we go. Mission six. So now, we are gonna pivot from that email into a platform like a blue team platform, search. And we call this Flare style credential exposure search, which is something we we unfortunately not necessarily do with cyber criminal infrastructure, but we know that we have some stealer logs that have impacted, criminals or that their email addresses is in our stuff. Not necessarily their computers is compromised, but other computers of people who dealt with them are compromised. So we are going to search, the recovered, recovery address, the recovery address we just recovered, to surface the operator's own infected device record. In this case, he got infected. And then we're gonna extract information out of it, an email password pair, and then when was the stealer executed. And, this was done by my boss, Eric Clay, and it's a very, interesting, very similar looking, to Flare platform, but it's entirely fake. But, he he accepted the challenge. I I said, oh, we should pivot into Flare for this part. And I I promise you it's not an advertisement, but it might have you want to go after Steeler logs, eventually in one of your incident response, cases upcoming. Should I should I go in right away, you think, or are we in mission six? I think I'll let you I'll give you five minutes because it's not super hard at this point, and the rest is is long. But I want you to play. And remember, we're pivoting on the private email of e Bogachev that we just connected at the previous mission. Here, what you'll be working with is a Steeler log. A stealer log is a result of an exfiltration of data from a computer's victim, by an info stealer malware. The malware, what it does is that it's a very often low privilege operation execution, which, often, is not detected by antivirus or EDRs. What it does is that it will take all kind of data that is available in the browser details, things like session cookies, passwords, the values that you have input for some forms, and even some some files. And these are one of the main things that Flare helps organization with is finding when these happen because more than often, it's gonna be on a home computer, but where the person will add credentials saved in their browser. And, in the in the case here, you will be investigating a threat actor that got infected themselves. Things that threat actors will want to use, hacking tools and, hacking tools have been found to be including info steers, and we see these all the time. So enjoy exploring the privacy of mister Bogachev here. And, yeah. It's, Steeler logs can be very interesting. And the one that was crafted here is I think it was based on a real one. Like, we took a real victim and we did some changes to, of course, anonymize everything and create something that fits this scenario. So, interesting. So this is gonna be a podcast section while you try to, solve the challenge. But the what I I like is that what I did prior to AI would not have been possible. It would have taken too much time. But so, yes, it it started from a a a clean log, but what I wanted to do something so that I can do one challenge every year about stealers. Right? So I, Claude wrote for me an, a shuffler of stealers. So it will find different password patterns, and it will shuffle them, and it will find PII, and it will shuffle it. So I would yes. I started from a fresh log, but I this code runs on top of it and changes everything. And I and I analyzed it manually to make sure that it was reliable. And same with the his the browser history and everything. So, what what I like about this is that you'll see other stealer, stealer challenges in the future, and I now have a safe way of putting, like, legitimately looking stealers in people's hand, which I think is really interesting. For me, my first stealer changed a lot of of of things. I never considered working at Flare before, but when I did my first IR case and I stumbled upon the stealer, I I was like, oh my god. This is revealing so much. This is super interesting. There's so many pivot points and yeah. So all remember our first teeter. Like, we all remember our first kiss. That that time when you figure out that, yes, childhood is over. Okay. Yes. Let's go after Baggett Chev. Again, this is where the the mandate that we gave, in our mission intro, kicks in in an interesting way. So we, so tenant feed is affecting what we configured in the platform, but Google search searches everywhere. Not sure it changes anything No. to be fair. If I put in then the email, I I stumble upon an infected device entry, and so this is, Stellar dogs. And if we take a look at the content so, creation date, first seen, last seen. If we take a look at the content, we have an estimated infected app, which is something that is required from the mission. So the moment when the studio was executed, month month, day day, year year, and then with AMPM. So this is exactly the format we need. No need to shuffle it. Let's copy that in here. And then next up, we want an email password pair of the ProtonMail account. So basically what matched here, we need to hunt it down in the, credential section. We can also download the raw log. So let's do that. We are now at char six. Let's do that and keep it here. Now we are looking for Bogachev as a username and ProtonMail. So this is a VPN thing. Oh, account.proton.me. So this is probably the combo we're looking at we were looking for. Interestingly enough, this is the same. So this guy is doing password reuse. So if we use that, it would have worked. Now they want in a it in a specific format, which is kind of traditional. But so username, column, password. And this is why putting a a column in your password is a really pro gamer move if you want to prevent threat actor from leveraging them, and also make our life harder when we parse them. So I'm gonna paste that right here. And, I think by default, the way I copied it, it's a space or a tab, and I'm gonna put the column, and this should work. I'm gonna keep it in my clipboard just in case. And then mission complete. We, use Flare to, found more information, but this is only the beginning of the pivot. Okay? Next is what is when we're going we're gonna go on the offensive, and we're gonna dive deeper into the the the stealer, Unlocking mission seven for everyone, and then let's take a look at the description. We are looking at the vault offline cracking. Download the operator stealer log and crack his keypad's vault offline. So that's the thing when I started studying stealers and looking for what's what more than traditional credentials and URLs was in there, I found out that they were stealing KeePass databases. And I found this very clever from an attacker perspective because you can almost be certain that the password to unlock the vault is gonna be either gonna be straight in the other stolen passwords or is gonna be derived from a stolen password. Luckily enough, I was proud of my OPSEC because, I don't use browser based password managers. So even if they steal my KeePass, they won't have any hints of what password I use on it. But for I think for a lot of people, it can be eye opening. So there's a, here we go. Like, we say go after the log, crack the password vault, and we're gonna go, where should I stop? We have one hour left. I wanna get you started real good. So I'm gonna go found the vault, and, explore the log a little bit, and then I'm gonna stop there and let you figure out how to crack. I I I we give the tools name and then on the next page anyway. And then but then after, like, five minutes, I'm gonna then solve it, together. So we're looking for the password of the vault and then private c two server extracted from the vault and the password to log in to the c two server. We're getting really close to the bad guys now. Okay. So the what's interesting about, having access to a vault is you are now you now have the possibility of doing an offline attack. This is orders of magnitude faster than doing online's online attacks. However, the like, for in KeePass, case, for example, they did they do use modern, hash function that are memory hard and they they use, like, PDKDF two. So it requires a lot of iteration and we adapt it based on the hardware speed. So it's not like like brute forcing des 56. It's not instant. So we still need to be a little bit clever about your your cracking attack. Now the log, there's a download link, but I already downloaded it earlier. And then we mentioned useful tools like Hashcap and John the Ripper. Now going, after the log let's clear this. Challenge six. Okay. Now, I I really like, the the logs are really interesting. Right? So you have, like, all of the passwords, including the URL. This is why they are a lot more, impactful to, the the, u r u ULP, so URL login password or combo list. These these were the things that were done more before. Now with this, since you have, like, the URL, you can try and and impersonate a person, you know, which service it is. UAPs do also have URLs, but they they're often recycled credentials. And combo lists were only usernames and passwords. Now we could go in here and and look at the different stuff in there. There's a list of processes that we're running at the time of infection that is also interesting, from an incident response perspective. You user information is extracted, including, like, location, hardware IDs, you know, screen resolution, keyboard, the the the machine that it's running under. So it really going it's really going after lots of stuff. And the autofill is a fun one. So anything that you typed in that is remembered by your, browser, basically, is stored in there. And lots of media fire link and and, you know, you can guess the infection vector or at least the risky behavior of that individual, which kind of can explain why it got compromised. And these are big. If the computer installed is old, you'll you'll see a lots of lots of stuff in there. Lots of PII usually. But so in for every profile on that computer. So what we'll see is that, let's say, there's a kid that downloads a Roblox generation tool or a Grand Theft Auto six preview build. They run it, it doesn't work. But the thing is that the info stealer will also catch the data associated with mom and dad's profiles. So it's scary. Yep. Definitely. And you you see, like, Dropbox, links. So when you have links that can work, you know, without authentication, like shared Google drives or, YouTube unlisted, then stuff like that can all end up in the history. Browser cookies are also in there. So lots of juicy stuff that can be leveraged by, attackers. And they for cookies, they have checkers. So you using a cookie is usually fairly technical. Like, it involves, like, burp or specific browser extensions. But the bad guys, they, like, automated it with, like, shady looking tools that that does that for them. OpenBullet, Silver Bullet, BLT BL tools. Some of them are cracked and and laced with malware, so be careful if you wanna try these things. Do it in the VM. But so, Bitcoin wallets are also stolen. Oh, here in this case, it's actually not a wallet. It's a authenticator. So you can generate, TOTP tokens with the content of this this thing. And then the file grabber, usually grabs files, text files, but in this case here, it's a a vault. So we're gonna go ahead and extract this. We're gonna just keep that file. Not all files. Just select the files. What is why is that not working? Okay. Here we go. Up. And, do we have it here? So we extracted the vault. Let's look at the vault key pass password database 2 point X. So this is, the vault can be open, but you can try the the the password, manually. Right? You will, go after, like, one attempt at a time, you know, and then didn't work. I can maybe go and check the most common password from that list here and try that. Or you know what? Let's go with bug at shit. In in in case just in case this is a shared computer. Oh, the one the one that we saw we used earlier. So let's try that one, and it's not working. So okay. We we need to, whip up the the big gear. So we need at this point, we need to do some of the password cracking thing that we were talking about earlier. And so I'm gonna deal with this, extract the vault. Realize, like, you can also unzip the whole, one second. Just let me check. I don't wanna cut up their okay. So there's no let's do stealer content. Then from here, I'm gonna unzip the whole thing. Yeah. That's gonna work. And then let's say I look at, this. So password column here is the format. So let's say I wanna build a word list in order to try to crack that, vault. Okay? I could do something as simple as grip anchor it with password. Okay? And then, do this on the passwords file. And then I have a list of passwords, but now I need to clean it up and do this with cut field space no. Delimiter space field 2. 12. Oh, and here here I go. So now I have a list of passwords. I can, sort them and make sure they are unique. Now I have a very short candidate 20, six passwords that I can try. So I'm gonna redirect this to a file, candidate passwords dot t x t. And then, this is what I'm gonna use later in order to try to crack that, password. Yes. So see you, in we're getting close to the end. See you in five. Because, I mean, installing the tool and all, c one five. Yeah. So here we are exploiting, very common vulnerability, humans. We humans will not remember passwords. So this is why we're using password manager, which you all should do, by the way. You need to have complex passwords to make sure that it cannot be broken, but complex passwords are difficult to remember. And, yes, you should be using passphrase, but will you remember a passphrase for every single thing in your life? So this is the the various problems associated with protecting, protect protecting data. But now here, threat actor has made a very, very bad mistake is, yeah, reusing a password or saving a password. So you you'll see. You'll see. It's, and, it's a bad mistake, but it's a mistake that we've all done. My mom uses the same password for everything, by the way. So, please don't act my mom. Oh, I was not muted. Sorry. I thought I was muted. It's, okay. Yeah. I'm sorry for your mom, man. But have a I have a friend that was a victim of an Infosteater malware, by the way, recently. And, yeah, the damage is very, very fast. And getting back your stolen identity is a nightmare because you have so many accounts. And he said he wanted to give shout out to Nintendo. He said Nintendo is probably the easiest one that he found and where, the damage was easy to, recover, but, like, Facebook's, x, Google. Steam, Google, all of that was very complicated. So, yeah, rare than to than to win. The only thing. The yeah. I, so I'm gonna hot take and I'm biased. But I for me, password like, for my parents, for example, I've been only studying online adversaries, and I think there's very little physical adversaries depending on your context. So think about your threat model. If you are in an okay sane relationship with sane family members, the only local threat is, drive by, is, someone who's gonna steal your ship. But if they do so, they're gonna go after your TV, not after your password, physical password book. So my hot pay is for my parents, it was write down your password in a book somewhere. Like, no one gives a shit about these passwords. Everyone loves you, you know, that you're not at risk. You're at risk from your own computer, from online activity. You're not at risk from neighbors or me or, you know, my brother. So so, like, reuse the same password as much as you want on shitty sites, but for banking, for, you know, Facebook, email, use a good one. For email is the most important email is the crown jewels. Right? You can reset everything from the email. So that one needs to be the the most hardcore. And they I don't I didn't even do two s, with them. It's too complicated. Yes. So, yeah. Well, Kim. unless your dad is having steamy affairs and he wants to make sure your mom doesn't go and learn about all of that because Yeah. The it's a thread model thing. If you if you can trust the people close. by. Yes. Welcome back. Oh, Alright. I think we can John the Ripper this. man. I'm trying to remember the syntax of this tool. Let's hope that it's gonna I'm gonna I'm gonna nail it, but, yeah, let's go. Yes. So speaking of steamy affairs, John the Ripper John the Ripper is not about ripping pants. Okay. I I I'll stop. No. So, John Ripper comes with a lot of different, little tools, and, I the the the version, distributed, with Linux distribution is not the most comprehensive one. I think there are licensing obligations that the that the distros don't want to, oblige to that restricted. But if you get it from the website, there's a package called jumbo, and this comes with a lot of different tools. And as you can see here, like, almost anyone who made up their own hashing format, John has an extract an extractor for it, and it and it goes way back. Right? Half of these are the PL files, which mean Perl, old school programming language. I worked in Perl for three years professionally, so it has a a soft spot for me. But, but you you can see that all of these different different tools and the the the reason for these tools is to extract the hashing and for the the the the the thing that you're trying to reproduce by, creating a password. So it's stored in the file somewhere in a format, and John would extract it in a format compatible with its own cracking, capability, so that it will crack and then compare. And once there's a match, it will tell you, I solved it. Here it is. The the way to use it looks like this. Right? You you keep pass to John, use use you pass it, key b d x database, so the one I extracted earlier. And then it outputs on standard out, like, all of the characteristics. So this is most likely the the, some configuration for John here and the the the name of the file. But here it's probably configuration of the PBKDF setup or the crypto or the versioning, somehow of what it's using, and it's to tell John how to hash this stuff. And then this is likely, like, the, you know, HMac and other garbage that, this is the thing you need. Probably the largest one is the thing we need to crack. It doesn't really matter. Like, all it all that matters is that we hashed material. Let's see. And then, I don't know, the bin. I'm gonna save this here. And then I invoke, regular John, and then it says, space password file. And I wanna I wanna give it, the the word list that I have created. So this is a word list. I haven't done this since August. It's cracking password is not something you do this often, I have to say. It's probably word list or dictionary. Let me just read on this. Word list dash dash word list and then file name. Okay. So, John dash dash word list word list. My word list. So it was named I put it in the stealer content. Okay. Candidate password. You know what? Let's move it out of there. Stealer candidate password. Copy this here. Start again. Dash dashboard list, candidate passwords, and then our vault. So, you can see that it's really fast. Lots of warning. Yeah. Maybe password longer than four two rejected. Proceeding with word list. It tried, you can see that the rate of hashing. So it's trying, 13,000 keys per second, which is not bad. But so it tried everything and it didn't work. Now I'm gonna add the mangling rules. And by default, there's a set of rules. So I just need to put in dash dash rules. So this will, ex outer that that list into many more passwords, and, it will augment it significantly. Because imagine for each candidate password, it it generates a thousand passwords, then it explode it's exploding the side, the size of the list of things to try. There's a couple of of errors, like face fade to fade to use use pages. Maybe I would need to run it as root, but I I think it oh, you know what? No. No. No. No. I make I'm making a big mistake here. I'm passing the vault, not the hashed material. This is what we're looking for. Okay. Let's step back to before I added the rules and see if it changed anything. Okay. No. It was super quick. K. I'm gonna add back the rules. Because the vault itself, John doesn't know how to handle it. Right? So do we have any warning that is, critical? No. Proceeding. Rules word list. So it's okay. I'm concerned with this. Like, the word list is, local list. It's not and the rules is is word list. Not too sure about that. But, ETA, this is on in ten minutes. Okay. That these are not passwords that are from, my word list, so I am not using it correctly. Let's try to add that equal here. So and okay. Now it it became instant. Okay? So I noticed I made a mistake. The this was not the right format to to call the word list. I recalled it from when I was looking at this earlier. There was the equal, but sometimes this is depending on every tool that changes. But so, so I recognize this because I recognize that these passwords were not in the word list that I created. So I knew it was not working on something I wanted. Now I changed that, to an enter here, candidate password with the rules, and it did crack it. Okay? So I if I use dash dash show, it will show the password. By default, it's not showing them. And, oops, invalid combination. Yeah. I just want you to show. Dash dash show. Now, default's password is this password. Okay. How different is it from our candidates? Because it it was not in there. Right? Oh, it what? It is in there. Yeah. That's sad. So we didn't need to to crack it. That's a bug. Okay. Let me try again then. Without the mangling rules, it should've worked. So I need to delete my pot file because John is caching these. Let's delete that. Then start again without the rules. Hash material, no rules, and enter here. Okay. So it the so it is, in there. I guess I need to fix my. So, anyway, we've learned about using mangling rules to alter, cracked passwords, but, this the the technique to reuse the the the passwords from the stealers remaining. Now we have the password to the vault, and let's, open up. Challenge six vault, and then enter. And now what do we have here? And where are our challenge? So infrastructure, we have backup VPN, dedicated VPN, scope proxy privacy too, panels, we have some stuff, accounts, we have some stuff. Okay. Privacy too, I remember this from the challenge description. Let's go and, whoops, this side. Let's go and stuff that in. Now objectives, the password and the key password oh, that I have here. Up. Here I go. The private c two server SSH target extracting from the vault in the SSH slash slash format, which is not a usual format, by the way. So if we look at this, yeah, username, app, and the port. Yeah. Let's keep all of that. And then, oh, there's a note. Deploy via sudo do not connect without VPN. Okay. And, the password to log in to that c two server entry. So the password here, big password, serious password. Whoops. That didn't work. Up. Hey. All the flags are completed. Oh, I need to remind myself at the end there's a video and if we want sound, I need to switch back to a tab sharing. I'm telling it so that I put myself in check. Now let's go and unlock the last challenge. And the last challenge is a long one, so, we will finish on time, I think. Okay. Where is that description again? Let's go back to homes. Go proxy. Eight. Alright. Full compromise. Log in, become rude. With what you obtained from the KeePass Vault, you can log in into the c two server, but that is not the end of the story. UNIX Linux Federation is an age old art. There are many ways to do it. Sometimes sudo requires a TLTP token for security, could be on a phone, could be in a browser extension. Set UID binaries, pseudo permissions, hence left behind in the home of the operator. Login, privileges, get it, and destroy. Cool. Cool. Sounds cool. This is the kind of scope we never get when we do research. Alright. So for, if we remind remember the what we just submitted as a flag, there's this thing here, but it's not in the format, ready for my CLI. Oh, I left this as child six, but it was child seven. Anyway. So child eight. I'm gonna put this straight in my notes so I don't forget. So if I format this properly, this would be SSH space this guy and then P2222. Now I'm logging in. The password is this thing here, And we should oh, What am I doing wrong here? I tested this not not a long time ago. Yes. Yes. Do we have reports that it's not working elsewhere? Yeah. Nobody seems to have it working. So Okay. Let me stop sharing because, I don't wanna reveal. I okay. I redeployed earlier and maybe something got confused with the the password, or the IP. Oh, Thanks for your patience. I don't based on the comments, some people have been at this stage for an hour now, so thanks for? your patience. Oh, yeah. Yeah. What did I fucked up? Queue in the the music. Yeah. Amazing. session. There's. a I yeah. Okay. Let me I'm gonna redeploy the, the the servers. I can reset the password at that time. Let me get the. Okay. I I don't know. I I think the stealer is not the same as Wet. what I have in the source and whoops. Oh, wait. Wait a second. I'm getting another mistake. We'll do it live. Yes. No. Will this be available later? Yeah. I don't know. I I don't know what what is our plan with this because But it's a live server that is running and that you, that you can attach then. Yes. we will be getting running for. a while. Cool. Yeah. Yeah. Yeah. Cool. And also, by the way, it is automatically resetting itself after every fifteen minutes. So if you're taking too long, you might have to restart where you are doing the session on that, that, SSH terminal. Hey. Thank you for the great comments, by the way. This is this is so cool to hear you all, like, commenting on this. Yeah. Like, you can see it. It's not easy doing these things, by the way. It's It's a long time, but so Eric and I both were, lecturers at university. So we have some experience. You you did it for more than ten years, I believe. Right? Thirteen years. Yeah. Thirteen years. I did it for five years and then I had young children and I I gave up. It was. I I was working full time and doing this every evening. You were working full time as well, I I think. Yes. I have no no need for a VPN. Oh, the VPN. myself. Yeah. Oh, sorry. No. I I saw that comment earlier. And so the VPN was more of a, a hint for, like, it was it's it was for the lore, like Gorbachev telling himself I should never log log in from my ISPIP because police could arrest me. Whereas in this, I know there are VPNs credential in the this the KeePass database, so it's it might be confusing. It was not it's not part of the challenge. You can connect directly because we're law enforcement. We're not, Yeah. Sorry about that. So it's not because I'm not using a VPN that there's a problem. I I really need to regen the gateway, but now I'm having Debian images that are missing. Claude is looking at it. Should be quick, I hope. I So what were you teaching, Eric? was teaching web development. And this is why, like, for the CTF, anything web, JavaScript, and all of that, yeah, that that went well. But, it was, it started with things like Java two enterprise edition, like, very old school. And at the end, I was teaching, like, Vue dot JS. So, it was fun, like, showing students what are the technologies that we are using in real life. And also, because I have cybersecurity background, talking about security, on top of that. So, yes. Okay. And by the way. yeah. Olivia and myself, by the way, are also, part of, NORTSEC. NORTSEC is, I have my sweatshirt here today, Montreal based conference and CTF. One of the biggest c on-site CTF in the world. So, so we're super proud of this and, I'm the scenario designer. I'm the one that created the story behind. Like, Skullproxy, that was not me. I Well, the hate for a scope proxy. No. a team based. Yeah. Yeah. yes. We we'll we might do a better scenario eventually, but, we've. got. work. It's do. Balancing work and these things is difficult. oh, yeah. I didn't sleep much. difficult. Like, you guys don't know, but I'm getting, it's good. emails and I'm getting Slack messages and, reset the question. Okay. This should work now. Let's try. Alright. Okay. It's working. I it was a password different password, thing. I put in the password I just extracted from my vault. Sorry about that. So everyone who was stuck at this stage, go back and play. We I can put the password in the chat, Yeah. Yeah. Yeah. but, like, be careful with the server. We don't wanna or am I I'm spoiling, challenging for everyone now with this, but it's okay. So, okay, I'm gonna screen share again, and let's dive back into it. Okay. Whoops. That's not the right shell. Clear. Let's log in again. Okay. The password from the vault. And so security verification for a scalar proxy private operation operator server. Welcome back, Please wait a few seconds. So I am waiting. I hope that not everyone is hammering the server now. Maybe you are. The I tried to put some limits on the amount of sessions and all earlier. That's not good. Let me go check what's going on behind the scenes. It's the I'll share just my terminal window So you get you guys have something to see. I love the memes. I love the the gifts. Everybody, the thank you. Like, someone would say it's midnight at their their place, and it it makes it entertaining. I mean, we're we're being together for two hours and a half now. So, good vibes. Yes. Oh, I got my shell. Alright. I can go on. So what's going on here? Oh, flag. Let's go. Flag. We always do love flags. So flare, you logged in, but can you root question mark? I'm gonna put that in the wait. Hang on. Where is it? Okay. Put that here. I'm gonna, before I do so, I'm gonna reshare the whole screen instead of just the thing. I feel like a streamer, but without the experience of a streamer. Okay. So, we did get the the the flag dot txt, and now we need, for last, the root flag. But you'll see that there's a couple of steps in between. I'm gonna look at the notes file here. So ops notes, panel redeploy, sudo deploy, pause plus restarts. Security, put the deploy pseudo rule behind the rotating two FA code back in June. No more shared root password. To do, git repo, for the panel still needs recloning on this box. Rotate the payout while that before the weekend. Alright. I'm gonna just take a look at my sudo permissions, using sudo. I cannot even do that without the verification code. However and this let's say you were not stuck on the password. Sorry about that, by the way. I'm glad I managed to fix it. You would have been maybe stuck here, but the the hints were sprinkled, a little bit around. Two FA code here. And then, here, we have before that page, Here we have, sometimes they're required to to could be on a phone, could be in a browser extension. So if we go back to our stealer from a previous step, I'm gonna open a new shell here. We remember that we did see, actually, a browser extension that talked about authenticator with which is a TLTP tool. Now this, again, plugging my own research here, but I in talks that I give about Steeler logs, I managed to prove that if you have access to these files, you can reproduce the TOTP token of, browser extensions. So let's look at this in raw form. Okay. It doesn't work. Let's go with the CLI. Studio content, wallets, authenticator, sync, and then, let's do a head of every file here. Account, that looks good. So that would be the file we're looking for. Okay. So I'm gonna open it with this. So the, these are, Chrome users level DB or index DB. The one is encapsulated in the other. I don't know the details, but, they are by basically binary files, but where most of the text is in plain text. And if you look at this, you have account, a name, encrypted, false, hash, a hash, index zero, issuer, someone, secret something, type TOTP. So this is a TOTP token. The secret is here, and the rest might not be important. We'll figure it out. So I'm gonna copy the secret to have it nearby. And then, there is a, what is it called? OTP. OTP, to to OTP. Let's put the demand page. That's not at all what I'm looking for. What's the name? The t o t p. Nothing appropriate. I forgot the tool's name. Okay. Let's go here and ask. TOTP generator CLI. TOTP CLI. TOTP. Well, TOTP. I don't. don't have it installed. Are Where did I do this? Anyway, okay. Let's, you on the shell or you're in the, on your. No. machine? I'm on my machine. I'm on. my. machine. But it doesn't matter. We'll we'll do it web based. I prefer local tools, because you don't you're not leaking it, online, but for challenge. Oh, I probably did it with CyberShift now that I think about it. Okay. Let's try. It does everything, this thing. TOTP. Generate TOTP. Let's go. So name, account, interval 30, and then the key here. Is this gonna work now? Do I need to change it now? Okay. Let's go up. It probably timed me out. We'll see. Oh, it did work. Cool. So you can, let it hang. Okay. So the dash l for sudo gives you your your sudo permissions. So I am able to run user local bin deploy as root without a password. Okay? This is pretty cool. So if I run deploy, what does it do? Pulling latest tree, fatal, not a git repository or any of the parent there directories. Restarting service, failed to restart. Okay. So this run as root, and it's from, user local bin deploy. So let's take a look at, what this file is. I don't have this. Okay. Let's do then, this and then type into x x d. And you can copy the file. You can download it. Okay. So it's a binary file. It's a Linux binary file. The I was talking about headers earlier. This is the elf header, but it here it's in plain text. How big is that binary file? User. I have to admit here, giving you a little bit of the context of the challenge. Before LLM, I would have done a bash script or something simple Python script, something that you can look at easily. But with LLM, reverse engineering is getting baby easy. So I was like, I wanna do a Rust binary. So this is a 12 megabyte Rust binary that does very little things. So I want you to understand that. Now what we saw that it does is that it gave a git errors. Right? So let's say I run it again. Deploy. It gave the output of, like, if I would be doing a git pull, a git repository. Okay? So if I, run git pull, for example, FATA not a git repository. So it is executing another executable. Now let's look again at the, the pseudo. By the way, the TTP, we only entered it once because it will remember for a couple of minutes. Now there's another red flag in that configuration, and it's environment keep path. It's adding my user's path to the default entries which include root. Okay? This means that my path that I control as the user e Bogachev will be appended or will be given to a setuid binary running as root that is trying to run git. Okay? So if I alter my path and I I say, like, then so this is classic path injection vulnerability. I'm gonna do a git file here that is gonna be, echo cuckoo. Cuckoo, a little bit of French class here. Now I'm gonna make this executable. F plus six bin git. And then, I'm gonna path inject. So I'm gonna export, path equals my home directory and the regular path. Okay? Now if I look at my environment variables for my path, it will run files here before running files elsewhere. Now if I run deploy again, instead of the git error, I'm getting cuckoo now. So this means that I am now running echo cuckoo as root. Now where was the flag we were looking for again? It was, I think, in but can you route? So here, what we'll do is change our code exec and do ls route and see, if that works. So run run deploy again. And then, oh, I forgot to sudo. it. Run sudo deploy, and then I see flag dot txt. So now I can, do, you know, instead cap root dot flag dot txt. We'll see what we get here. Oh, you know what? I'm gonna do, like, echo and then, no, s t art. Some s t art. Nice art. Thanks, Eric. And then because I just make a markers around the flag in case there was binary or something. So Flare, congrats. You phoned. Yes, sir. We got this. So this type of vulnerability is very frequent with homegrown scripts and, and binaries, not not as much because it's usually like like, for sudo, for example, I had to modify the sudo config to enable something like that. But with setuid binary, this was really frequent. So, you know, something to think about. I'm going to then share only my browser tab so we have the sound for when I put in the last flag. Let's Headphones warning. yeah. Headphones warning. You know, AI video warning. Okay. The I only I already had one submitted. And then congrats, Yupon. Boom. We're good. So, basically, we were tasked with destroying the infrastructure. This is somewhat realistic. They did do a path injection, but not on get on tar. Clearly, going, MI six wouldn't do that. One second. So neutralized, And then Hurray. very water is now clean. Read all about it. People are happy. six unmake Skull Proxy. Cybercrime collective neutralized. Get your morning post. Thank you, sir. Read all about it. Yes. Yes. Yes. Yes, sir. Cool. Alright. We have we we're booked, Eric and I, anyways. So we have twelve minutes for questions if you have anything for us. Yeah. I hope you enjoyed it. And, if you have, ideas for next one, let us know. I I mean, we we will keep darkroom alive. We might change it a little bit, but, yeah. So I'm gonna okay. There's a couple of things I can do. I'm gonna, like, put dark mode the dark room again in the state that it was before, so without the unblock challenges or maybe not. I'll leave it like that for, for an, until the this meeting is over, so at least you can you can play. I will go and extract our top, contestants. Let's go and do that now. Active directory type CTFs. Yeah. Yeah. You can do a CTFs about, everything. These are hardcore to build. That's more of a Nordic thing than a. Flare. Yeah. Yeah. Yeah. Unless oh, you know what? For for IEM, like, a credentials oriented could be good. Yeah. Yeah. Like, And by the. way, we'll do this again. We have a session plan, like a CTF, just like this plan in December, and we already, started building the challenges and we, crowdsource from our own engineering team. So it's gonna be, interesting once again. So, yeah. If you like what you did today, we'll be back. Winter. And speaking. of. of plugs, we're doing a Halloween themed hacker jeopardy as well on, the the week of I think it's the Wednesday. May maybe that's not confirmed, though, but, I think so. So, yeah, that's happening. No t shirt is not no. There there are shirts, actually. Oh, Angela. posted, it's there's a giveaway in Discord, the darkroom September 30 giveaway channel. So, yes, for you people collecting all the shirts. Service capacity. Yeah. But maybe there's a lot of people still, in there. The server. Yeah. So I made, I made, explicit protection against multiple sessions. So if you run cloud, at the same time as you're trying to do it yourself, it's like a a 15 connection max per IP. So, so yeah. So you need to be aware of that. Chief vibes officer, That's Dylan? it it was likely be there. Right? That's you, Dylan. Do you wanna. join us? Oh, no. You still, you have issues at home. I'm still trying to extract this code. Give me a second. Are you what OS are you saying? It's Me? Debian? Yeah? It's a PopOS, but it's a Ubuntu derivative. Okay. But it I'm I'm just lazy. Like, I used to run Arch, and I got tired of all the config. Pop OS has nice default, but it's a bit dated. But they are about to release a new update, so I should be happier soon. I lost my command. I prepared the command early, but I rebooted. So, So just a little bit of, like, how I did the CPF. I was by myself, and I used, ChatGPT, actually. I was able to do a lot of the challenges in ChatGPT. Even breaking the KeePass, the vault, it was able to like, that was insane. Yes. But now that. we know that Yeah. go ahead. No. No. Yeah. Someone's was talking about my village collection. It's my Lego. It's it's Lego release one building per year, and they all collect, connect to each other. So, yes, it's my grown man toys. KLM airlines to Amsterdam. No. What else would so, yeah, using an AI, agentic AI to break challenges. I know that when we did this live in Las Vegas, some people were running agents on it, and it destroyed the infrastructure because that thing is just hammering and then replicating new agents. Yeah. So. But, yeah, I have to also say the we are creating a full container for everyone logging in via SSH. Like, it's all separate environments. I didn't want people to cheat. So this is making it hard on the system. So if you mix that with, like, swarm agents, and it will try to create basically, you know, containers, but, like, you know, several dozens of containers each allocating CPU and memory. So that's what happened in Vegas. And this is why I rate limited it today, based on source IP because I knew we would we would be distributed. Okay. Is this gonna work? Drum roll. How do you we pursue your cert? Not sure what you mean. Don't know what's going on with this. Good. Yeah. No. We don't have certifications yet. So, Flare is for, enterprise. So, yes, if if that's something that will be you think would be useful for your organization, let us know. We do offer free trial for, but, of course, it's for our organization because it's pretty much, visibility into the entire dark web and, yeah. Every company. earns its certification patch with dark room. Oh, okay. Okay. It's not it's not a real well, maybe it's a certificate. I don't know. Yeah. We're not the good ones to be talking about that. now. But okay. So I sorted, so this is everyone who's you know what? Let's do top 50 so everyone can recognize themselves. Oops. The terminals I okay. At that 50. Okay. So this is the list of everyone, and I sorted them by, who finished first because almost everyone will have the same points except that we do give, additional points for first blood. So this would be our top, 40 something. Some someone's trying to access the platform. I like that. The so we have maybe it worked, though. But let's see. But we do we did test it, for security. But so p PHD admin is first, Brad is second, MPDX d one, MD, Avgru Neva, Deltix, Tradus, Kamalce, Dua, Perla, Horace, Igre. Congratulations to all of you, in the list. And we can see that almost everyone had had the whole CTF, right, from the top 50. So very glad that you did follow along. Super proud of that. Thank you so much. This is great. And, especially given that we, we had a little, wrong password at the end of the show. But, yeah, the we're spending a lot of energy building this and preparing this, but this is the reward. Like, seeing you learning and seeing you building careers, this is why Eric and I were teachers, you know, the the sharing, and we don't mind repeating. And I've been I've been, helping people do CTF via Monterey hack for more than fourteen years. I've always, you know, teach the taught the basics. And so, yeah, that's, that goes. It's not minus. It's the difference between the for the like, the minus at the end is like, the difference between the the leader and the previous person, the the the the the first one. And it it's just to help me triage. The password for the VM, I shared it earlier in the chat. So if I can put it again but it's it's in the vault. So by fix, my the vault shutdown, and there's no way I'm gonna find this quickly. But so it it was put in the chat, but it's when I repair the infrastructure, I didn't made up a new password and share it in the chat. It's the password from the vault. So if you do the vault challenge, you will be able to log in to that SSH server. On this, we're at time. Thank you, Yes. everybody. Thank you, Olivier. And thank you by the way, there's a lot of people that work behind the scenes. You can see, like, Joe and Angela, Curie. So there's a lot of people that help, make this, a reality. Yes. Yes. Blake for QA, Blake. Yeah. Lily that increased the VM, Alex who fixed Telescale late yesterday because. I had problems. And so, Eric, who built darkroom, all of the we're here in front of the camera, but we're standing on the shoulder of giants. Yeah. Chloe for building the community. Yes. So, thanks everyone, and, see you soon. Bye bye.