Project Sekai - ✅-forensics-employee-427-recovery

Project Sekai

🔒 WolvCTF 2023 / ✅-forensics-employee-427-recovery

Employee 427: Recovery - 500 points

Category: Forensics Description: Employee 427 stood up, infuriated, by what has happened to his sensitive files As Employee 427 began pondering what to do, reality set in Employee 427 is in big trouble. Employee 427 has a meeting on Monday where the whole Finance department will be awaiting Employee 427's diagram they have been working for so, so long on Employee 427 thought "If I do not figure out a way to recover this diagram, I am surely fired" Employee 427 loved their job. Employee 427 does not want to be fired Employee 427 hopes that you, yes you, again, can somehow - by some miracle - be able to recover the file that Employee 427 is dependant. The only data available for you is the same triage Files: No files. Tags: dree#0001, Hard

Sutx pinned a message to this channel. 03/17/2023 1:39 PM

@Legoclones wants to collaborate

@afterworld wants to collaborate

oh shit i was working on this

13:56

the whole time

13:56

LOL

lol

H:\data\[root]\Users\emplo\Desktop\IMPORTANT DO NOT DELETE

13:56

check this

yeah that's where redacted photo is

13:57

JPG

13:58

so no layers, means flag probably isn't from reconstruction

13:58

probably have to find stuff elsewhere in the filesystem

13:59

probably in unallocated space

14:00

let me run binwalk see what it finds

14:02

https://github.com/awesomecorp3234243523/private-documents/blob/main/profts.rar

private-documents/profts.rar at main · awesomecorp3234243523/privat...

Contribute to awesomecorp3234243523/private-documents development by creating an account on GitHub.

14:02

that's found in browser history

14:02

if you download and unrar you get 2 files

yuh

14:02

found this

14:02

in unalloc

One is redacted, other is invalid file

whats wrong

14:03

with all of these images

14:03

is it xor with some key

idk

14:07

I wonder if we have to do some sort of reconstruction from the jpg data given in rar

14:07

Like the beginning of profits.jpg is just null bytes until 0x1209

yeah

So I took all the data from 0x1209 and pasted it at the beginning of profits_redacted.jpg

14:08

Got this

Image attachment

14:08

I think the photo width is wrong

14:08

Might get something at the top if I can get it right

14:09

actually no this looks weird idk what the data is

its some weird

You get some pixels that look like this and idek how

Image attachment

Legoclones

Got this

Also, this picture looks different in Discord than it does on my computer...

Legoclones

used /ctf submit

❌ Incorrect flag.

whoops wrong one

what is this chall

16:18

not even on ctfd

16:18

oh they renamed

16:20

Employee 427: Recovery has had it's name changed to Employee 427: Locate. If you have any leads for this challenge, go through them again now. Employee 427: Recovery will be a new challenge released before the 24 hour mark

@hfz wants to collaborate

@crazyman ai wants to collaborate

maybe i need to see the old challenge first

@Legoclones should have saved it

Not much to it

17:33

PowerShell console history

cd '.\Desktop\IMPORTANT DO NOT DELETE\'
ls
rm profits.jpg; #pastebin-dot-com-slash-75Muuu8m
echo this dude is going to be so screwed at his meeting LOL
exit

https://pastebin.com/75Muuu8m

Employee 427: Compromise Flag - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

they changed mega link

that's pretty much all from the first one

ah ok

17:35

oh actually

17:35

they just changed name and description, didnt change file

17:35

its just that they will release a new one named recovery later

17:36

Image attachment

17:36

description change

Legoclones

that's pretty much all from the first one

from first chall right, not this one?

Legoclones

https://github.com/awesomecorp3234243523/private-documents/blob/main/profts.rar

ah ok

17:38

so this chall is about this?

did attachment is same?

yeah

Sutx

Click to see attachment 🖼️

this link is the same as updated one

17:40

also im confused, its there an hour ago but chall was released 4 hours ago

Image attachment

sahuang

from first chall right, not this one?

yeah

sahuang

also im confused, its there an hour ago but chall was released 4 hours ago

yeah idk what happened there

17:41

so you have to reconstruct the file? not really sure. The profits.rar file gives us stuff, but when we attempt to turn it into an image, we only get junk

you got that link from this chall file?

17:42

it says profits.rar does not exist

17:42

ah

17:42

they changed the rar to this?

i need to quick check the first two challenges

wait what

17:43

https://github.com/awesomecorp3234243523/private-documents/blob/main/profits_old.jpg

private-documents/profits_old.jpg at main · awesomecorp3234243523/p...

Contribute to awesomecorp3234243523/private-documents development by creating an account on GitHub.

17:43

that's the flag

yeah

17:43

oh

17:43

lmfao

17:43

didnt click in

17:43

17:43

f

WTF

i see, they removed rar and put both images here

WHAT THE FUCK

Legoclones

used /ctf submit

✅ Well done, challenge solved!

WHAT BULL

yeah idk what happened there

WHAT THE FUCK

17:44

WHAT THE FUCK

17:44

BROKEN CHALL

17:44

LITERALLY WAS BROKEN

idk about next chall tho

yeah I'm 90% sure that's what it was

Image attachment

17:44

100% broken

17:44

look at commit

17:44

...

will they give a different file for next challenge?

not sure

is this chall same file as previous one

Legoclones

https://github.com/awesomecorp3234243523/private-documents/blob/main/profits_old.jpg

yeah thats why im confused rar isnt there

bruh

17:45

they are trying to cover this shit up

17:45

17:45

at least be honest about chall breaking

17:45

so people can reattempt

17:45

instead of putting it off as "rename"

they said "If you have any leads for this challenge, go through them again now."

1

17:45

dang well at least we got it

kek

17:46

yeah true

not sure about next one

17:46

will see

hmmmm

17:46

solved?

yup

yeah solved #deleted-channel

17:47

recovery waiting for release

hmmmm

18:12

so this chall is Locate?

18:15

so recovery need to recovery this https://raw.githubusercontent.com/awesomecorp3234243523/private-documents/main/profts.rar ?

18:16

or it's the sol for Compromised?

dont know about recovery yet

@Legoclones

18:20

did we use profts.rar in 1?

Yeah we gotta wait on recovery

18:20

That was the sol for compromised

oh

Recovery isn't released yet

okay okay

Exported 132 message(s)