CTF Write-Ups

Skip to main content

Search This Blog

CTF Write-Ups

Posted by Kevin Pagano

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

Here is a collected list of all of the write-ups I've done for CTFs.

2023

Magnet Virtual Summit

2022

Magnet User Summit

Cellebrite CTF

Heisenberg's Android

Marsha's iPhone

Magnet Virtual Summit

BloomCON 0X06

Belkasoft CTF March

2021

Cellebrite CTF

Heisenberg's Android

Marsha's iPhone

Marsha's iTunes Backup

Magnet Virtual Summit

Belkasoft CTF March

BloomCON 0x05

Networks - Who Am I? (Challenge 1)

Networks - Exfiltration Investigation (Challenge 2)

2020

Magnet Weekly CTF

Android

Week 1 - Hosts File

Week 2 - Chrome Artifacts

Week 3 - Motion Photos

Week 4 - Evernote GUIDs

Linux

Week 5 - Hadoop Logs

Week 6 - Error Codes

Week 7 - IP Interfaces

Week 8 - PHP Cluster

Memory

Grand Prize

Magnet Virtual Summit

2019

Magnet User Summit

2018

Magnet User Summit

Misc

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

Archive

March 20236
February 20231
January 20232
December 20223
November 20222
October 20221
September 20222
August 20223
June 20228
May 20224

Show more Show less

Popular Posts

Cellebrite CTF 2021 - Heisenberg's Android

Cellebrite is back with another CTF competition and this year's takes it up a notch. I want to start by giving major props to Heather, Paul, Ronen, Sahil and Ian for putting on a great competition . Now lets get started with the walkthroughs. First up, is the Samsung Note 10 owned by "Heisenberg". Evidence : https://d17k3c8pvtyk2s.cloudfront.net/CTF21/CTF21_Heisenberg_SM-N970U1_QualcommLive_2021-07-22.zip Password : 02DB2ECE91DB67E8FA939FC3DC15D16B Device Identification (10 points) What is the Bluetooth MAC Address of the first vehicle Heisenberg's Android connected to? Pulled from the file at the following path: Dump\data\misc\bluedroid\bt_config.conf We get bluetooth connections which we can easily see in the ALEAPP report below that the answer was " 34:C7:31:F8:61:3B ". Figure 1: Bluetooth connections report in ALEAPP Application Analysis (10 Points) Which website did Heisenburg look for guidance on how to mount a USB drive on his phone? (The answer sh

Hitchhiker's Guide to DFIR v1 Officially Released!

A short and sweet post to announce that the DFIR Discord community book The Hitchhiker's Guide to DFIR: Experiences From Beginners and Experts has officially reached release v1.0. Kudos to all the authors and contributors so far. I had the pleasure of writing a chapter on Capture The Flag (CTF) challenges and tips. If you want to contribute and write a chapter, reach out in the Discord channel ( here ). Leanpub Download (it's free!): https://leanpub.com/TheHitchhikersGuidetoDFIRExperiencesFromBeginnersandExperts Bookwire: https://www.bookwire.com/book/USA/the-hitchhikers-guide-to-dfir-9798986335902-andrew-rathbun-85169559 Github: https://github.com/Digital-Forensics-Discord-Server/TheHitchhikersGuidetoDFIRExperiencesFromBeginnersandExperts DFIR Discord Channel: https://discord.com/channels/427876741990711298/972463050034663474

Cellebrite CTF 2022 - Marsha's PC

Previous: Heisenberg's Android | Beth's iPhone | Marsha's iPhone Cellebrite has returned with another CTF competition for the masses. This year they decided to reuse the evidence files from last year's CTF but with a completely new set of questions. You can download the evidence here thanks to NIST CFReDS: https://cfreds.nist.gov/all/Cellebrite/Cellebrite2021CTF Let's kick things off with Marsha's PC. #1 Device💻 🆔 What is the Serial Number of the disk acquired? A fairly simple question if you know where to look. We get an Acquisition Log text file in the base of the evidence folder that has pertinent details to the acquisition. We can see the serial number is 170615BA93CC . Figure 1: Digital Collector acquisition log #2 🔑 How did the user most recently sign into Windows? PIN Fingerprint Facial Recognition Trusted Signal This was something I learned that was new to me. Windows has a registry key that will tell you what type of provider was used for the

© 2021 STARK 4N6

Powered by Blogger