This is the fourth and the last of the forensics challenge in the CSAW CTF 2014 competition. It was much harder than the three before, but it was also much more interesting.

The challenge starts with the following text:

OH NO WE'VE BEEN HACKED!!!!!! -- said the Eye Heart Fluffy ...

This is the first exploitation problem and it starts with the following text:

I trust people on the Internet all the time, do you?

Written by ColdHeat

eggshells-master.zip

Unzipping and Analyzing the Files

Let’s unzip the provided zip file:

$ unzip eggshells-master.zip

This creates a directory called eggshells-master ...

This is the only networking problem, and it is only 100 points, so it turned out to be very easy.

The problem starts with the following text:

Something, something, data, something, something, big

Written by HockeyInJune

pcap.pcapng

Inspecting the Wireshark File

The file extension .pcapng correspond to files for ...

The third forensics challenge starts with the following text:

see or do not see

Written by marc

pdf.pdf

Hacking PDFs, what fun!

In general, when dealing with reverse-engineering malicious documents, we follow these steps:

 1. We search for malicious embedded code (shell code, JavaScript).

 2. We extract any suspicious ...

This was the first forensic challenge. It starts with the following text:

dumpsters are cool, but cores are cooler

Written by marc

firefox.mem.zip

Unziping firefox.mem.zip

The given file has a funny extension .mem.zip. Before we go ahead and unzip it, let's try to learn ...

The purpose of this problem is to teach about the need for encrypting your data. The FTP protocol sends clear text over the wire, i.e the data is transmitted without any encryption. SSH/Secure File Transfer Protocol is a network protocol providing secure file transfer. Using SFTP, instead of ...

This is the first crypto-problem, and it was supposed to be the easiest one. For this reason, I was expecting simple cryptographic algorithms, which turned out to be true.

The problem starts with the following text:

There's no heartbleed here. Why don't we use these ciphers?

nc 54 ...