NahamCon CTF 2024 forensics

Taking Up Residence Forensics challenge Write-Up

أحمد ناصر
3 min readMay 29, 2024
  • After Downloading the challenge file, i checked the file type and i was a data file :
  • First thing i used foremost tool to extract any useful files from this data file :
  • after i extracted the files i started to check all the files , but i found nothing .
  • Thin i opened the data file using HxD editor ( or any hex editor )
  • Thin i search with “flag“ keyword, and i got some hits :
  • there are some python scripts, so i started to extract them manually :
first script
second script
  • so i tried to decode the encoded command in the first script, but there was an error in base64 :
  • so i used the second script :
  • thin i used chatgpt to parse the extracted script :
  • As you can see, we need two things : the KEY and the contents of the flag.txt file .
  • from the first script i get the KEY :
  • Thin i started to search about file contents, so i searched with “flag.txt” keyword and i got a hit :
  • now i found this site to decrypt fernet encryption :
flag{a4096cd70d8859d38cf8e7487b4cd0fa}

--

--

أحمد ناصر
أحمد ناصر

Written by أحمد ناصر

CyberSecurity Analyst || DFIR || CTF player

No responses yet