AKUMA
  • README πŸ₯·πŸ½
  • Red Teaming πŸ‘Ή
    • Loading 50% πŸ˜’
  • πŸ‘ΏBLUE TEAM
    • YARA rules
  • πŸ“¦Containers
    • DOCKER
      • Docker Security & Pentesting
        • Commond Docker error
      • 8 Best Practices for Docker Host Security
  • Windows Hardening πŸ›‘οΈ
    • Windows Active Directory Pentesting
      • Dll Hijacking
      • MSDT - Microsoft Support Diagnostic Tool Vulnerability
      • AD Enumeration TOOL
      • AD Certificate Templates
      • Kerberos Delegation
    • Windows Security Controls
      • Applocker Basics
    • Powershell Cheat sheet
    • AMSI Bypass
  • Linux Hardening πŸ›‘οΈ
    • Page 1
  • Network Services Pentesting
    • Footprinting Cheat sheet
      • 21-FTP
      • 161-SNMP
      • 445-SMB-139
      • 2049-NFS
      • 53-DNS
      • 587-SMTP
      • 143-IMAP/POP3
    • Juicy Curl
  • Pentesting Web
    • 100 Web Vulnerabilities, categorized into various types
    • Deserialization
      • Node.js Deserialization
    • SHODAN DORK
    • Vulnerabilities PAYLOADS
      • Directory Traversal Payload
      • Html-Injection-Read-FIle
      • Html-Injection
      • OS-Command-Injection
      • SQL-Injection-Auth-Bypass
      • PHP-Code-Injection
      • SQL-Injection
      • SSRF Basic
      • SSRF
      • XML-External-Entity
      • XSLT (eXtensible Stylesheet Language Transformations)
      • XSS Cheat Sheet
        • XSS
        • XSS -
        • XSS-polyglots
        • Cloudflare's XSS protection
    • Base Information
      • File-Extension-Inclusion
        • File-Inclusion-Windows
        • File-Inclusion-Linux
        • File-Extension
      • Media-Type-(MIME)
      • Windows-Sensitive-Files
      • Linux-Sensitive-Files
      • Linux-Log-Files
  • Blogs
    • How I Passed HTB Certified Penetration Testing Specialist
    • A comparative analysis of Open Source Web Application vulnerability scanners (Rana Khalil)
    • Sean Metcalfe Path for AD
    • Secure Docker - HackerSploit
  • Projects
    • HOME LAB
      • HOME LAB Blogs | Active Directory
        • Active Directory Lab Setup - 101
        • Active Directory Lab Setup - 102
        • Active Directory Lab Setup [ AD Enumeration ] - 103
        • Active Directory Lab Setup [AD Attacks ] - 104
      • Home Lab | Splunk Setup & Configuration
    • HOSTING A WEBSITE AND HARDENING ITS SECURITY
  • CTF- Writeups/ Solutions
    • HTB - Advanced Labs
      • Fortress
        • Jet
        • Akerva
        • Context
        • Synacktv
        • Faraday
        • AWS
      • Endgames
        • Ascension
        • RPG
        • Hades
        • Xen
        • P.O.O.
    • idekCTF 2024 🚩
    • TFC CTF 2024 🏳
    • DeadSec CTF 2024 🏴
      • Bing2 (web)
      • Mic_check (misc)
      • Windows Server (OSINT)
    • ImaginaryCTF 2024 🚩
      • cartesian-1 [Forensics]
      • packed [FORENSICS]
      • bom [FORENSICS]
      • BANK [MISC]
    • NahamCon CTF 2024 🏳
      • all WARMUPs
      • Base3200
      • The Hacker Webstore
      • iDoor
      • All About Robots
      • Thomas DEVerson
      • Helpful Desk
      • Curly Fries
    • Cyber Apocalypse 2024: Hacker Royale 🏴
      • Unbreakable [MISC]
      • StopDropAndRoll [MISC]
      • Character [MISC]
      • Delulu [pwn]
      • Tutorial [pwn]
      • Maze [Hardware]
      • TimeKORP [web]
  • Tools
    • Content Discovery & Form Manipulation
      • ffuf
      • RustScan
      • Feroxbuster
      • Dirsearch
      • Gobuster
      • Wfuzz
      • Webshell
      • websocket
Powered by GitBook
On this page
  • QRRRRRRRR
  • That’s not my base
  • copypasta
  • Twine
  • eicar
  • Read the rules
  • Uriel
  1. CTF- Writeups/ Solutions
  2. NahamCon CTF 2024 🏳

all WARMUPs

QRRRRRRRR

  • A long QR code

  • this is called rMQR code

  • https://www.qrcode.com/en/codes/rmqr.html

  • this can be read using scandit app available on android playstore

flag{a44557e380e3baae9c21c738664c6142}

That’s not my base

  • encoded string :

F#S<YRXdP0Fd=,%J4c$Ph7XV(gF/*]%C4B<qlH+%3xGHo)\
  • It is base92:

flag{784454a9509196a33dba242c423c057a}

copypasta

  • The flag is hidden in the text printed by the challenge

  • simply copy paste the text in the terminal and we get the flag

β”Œβ”€β”€ πŸ‘½AKUMA πŸ₯· ➀➀ 🌐10.10.0.12
β”œβ”€β”€[ο„•   ~/Desktop/CTF/nahamcon2024]
└─ βš” >
I'd just like to interject for a moment. What you're referring to as Linux, is
in fact, GNU/Linux, or as I've recently taken to calling it, GNU plus Linux.
Linux is not an operating system unto itself, but rather another free component
of a fully functioning GNU system made useful by the GNU corelibs, shell
utilities and vital system components comprising a full OS as defined by POSIX.

Many computer users run a modified version of the GNU system every day, without
realizing it. Through a peculiar turn of events, the version of GNU which is
widely used today is often called Linux, and many of its users are not aware
that it is basically the GNU system, developed by the GNU Project.
flag{1f68e019b29650f6e8ea15a7808f76fd}
There really is a Linux, and these people are using it, but it is just a part of
the system they use. Linux is the kernel: the program in the system that
allocates the machine's resources to the other programs that you run. The kernel
is an essential part of an operating system, but useless by itself; it can only
function in the context of a complete operating system. Linux is normally used
in combination with the GNU operating system: the whole system is basically GNU
with Linux added, or GNU/Linux. All the so-called Linux distributions are really
distributions of GNU/Linux!

zsh: command not found: I'd just like to interject for a moment. What youre
flag{1f68e019b29650f6e8ea15a7808f76fd}

Twine

  • An image is provided

  • flag is in the strings of the image

β”Œβ”€β”€ πŸ‘½AKUMA πŸ₯· ➀➀ 🌐10.10.0.12
β”œβ”€β”€[ο„•   ~/Desktop/CTF/nahamcon2024]
└─ βš” strings twine.jpg | grep flag
flag{4ac54e3ba5f8f09049f3ad62403abb25}
flag{4ac54e3ba5f8f09049f3ad62403abb25}

eicar

β”Œβ”€β”€ πŸ‘½AKUMA πŸ₯· ➀➀ 🌐10.10.0.12
β”œβ”€β”€[ο„•   ~/Desktop/CTF/nahamcon2024]
└─ βš” md5sum eicar
44d88612fea8a8f36de82e1278abb02f  eicar
flag{44d88612fea8a8f36de82e1278abb02f}

Read the rules

  • flag is present in HTML comment

flag{90bc54705794a62015369fd8e86e557b}

Uriel

  • We are given a string which is encoded. And hint is also given that it is encoded twice.

%25%36%36%25%36%63%25%36%31%25%36%37%25%37%62%25%33%38%25%36%35%25%36%36%25%36%35%25%36%32%25%33%36%25%33%36%25%36%31%25%33%37%25%33%31%25%33%39%25%36%32%25%33%37%25%33%35%25%36%31%25%33%34%25%36%32%25%33%37%25%36%33%25%33%36%25%33%33%25%33%34%25%36%34%25%33%38%25%33%38%25%33%35%25%33%37%25%33%38%25%33%38%25%36%34%25%36%36%25%36%33%25%37%64
  • This is an URL encoded string which gives the flag after decoding it twice.

flag{8efeb66a719b75a4b7c634d885788dfc}
PreviousNahamCon CTF 2024 🏳NextBase3200

Last updated 10 months ago