WHITEHATCREW-CFT POC.

My first github repo.

Just me reading and all new to IT

1. tutorial A-- [TUTORIAL] Simple Mathematic

Jawapan anda harus dibalut dengan ' WHC{ nombor }' atau ' WHC{ text }' Untuk soalan di bawah, boleh submit dalam bentuk nombor seperti:

Soalan: 8+2 Jawapan: 10 Anda harus submit: WHC{10}

Jom cuba, nyatakan jumlah bagi soalan di bawah:-

15+30

Answer:

1. print("15+30")
2. Run output : 45
3. WHC{45}

B--[TUTORIAL] Simple OSINT

'Jawapan anda harus dibalut dengan ' WHC{ nombor }' atau ' WHC{ text }'

Contoh:- Hacker mana yang anda boleh hubungi di forum dragonforce jika ada sebarang masalah? WHC{nanovim}

Jom kita cuba, soalan untuk anda:- Nyatakan admin yang menganjurkan CTF ini (case sensitive)'

Answer:

1. search 'https://dragonforce.io/threads/whitehat-crew-selection-open-now.9011/#post-97048'
2. owner thread : DirbusterX
3. WHC{DirbusterX}

C--Tutorial

We do this for fun but yet for a serious matter. Please dont bruteforce the flag or try to pentest the site. No DDOS to the site please.

Send me " WHC{I_Agree_To_The_Terms} " in the Flag Box below.

Answer:

1. WHC{I_Agree_To_The_Terms} copypaste jek

2. Darkweb A--TorPaste

We found a dangerous information on the Darknet. Can you please try to obtain the info?

http://torpastezr7464pevuvdjisbvaf4yqi4n7sgz7lkwgqwxznwy5duj4ad.onion/aRr1wftJbeX7cMjQ/

THIS ROOM IS PURELY OPTIONAL IF YOU ARE NOT COMFORTABLE GOING INTO DARK WEB. PLEASE USE VPN + TOR UPON VISITTING THE SITE

Answer:

1. Open tor browser (sey pakai phone apps " https://imgur.com/a/0EnSzTb ")
2. Copy paste the link "http://torpastezr7464pevuvdjisbvaf4yqi4n7sgz7lkwgqwxznwy5duj4ad.onion/aRr1wftJbeX7cMjQ/"
3. There will be a flag on screen " " WHC{D4RK_W3B_B3G1NN3R} " (sorry dia x bagi screenshot)

3. Forensic A--Beginner Forensics

Download Wireshark to analyze .pcap file

Download the Sample File and Open it with Wireshark

There is supposed to be less than 10 items. Click on everything and find a human readable text.

What does the text said, and what number is the item number is the text? How many rows of the "No." column

Flag Format i.e : WHC{36:Hello it's me}

ps: to make it easier, right-click on any item and click Follow > TCP Stream

Answer:

1. Download the "set1.pcap" file ( .pcap file ini tgk google, dia capture like listing atau packet data, bru tau so mcm log la.)
2. Run di log viewer apps ( https://imgur.com/a/Fp8sBob)
3. Flag ada disitu ( sb satu line jek yg complete ayat dia)
4. WHC{5:What, me worry} ( 2-3x dok tulis balik) -_-

B--topiputih

Apa makna topi putih?

Pass : WHITEHATCREW

Answer: metadata from picture

1. Download file and use 7z zipper to extract file(phone)
2. https://imgur.com/a/c8tLju3 ( extracted data)
3. Open browser go to " https://www.metadata2go.com/ "
4. Open the picture from your folder.
5. Found flag at creator name " https://imgur.com/a/0eLdj8c "

C--A walk in the park

Classical! Easy just like a walk in the park.

Answer: tbh i forget how but i remembered " 0x0000 list"

1. Download the file and extract using zipper
2. Got the picture
3. Try and error everything from metadata to string overflow
4. The flag should be in line with "0x0000xxx"

4. Malware A--Malware A - 1

A "not-so-good" developer brought aboard disaster to a common programming language and you guessed it, someone exploit it to create malware.

What is the file SHA256 hash? WHC{SHA256}

Answer:

1. Download the file and extract them
2. Open totalvirus and drop the file there to analyze
3. https://imgur.com/a/IZ6HDym
4. Flag " WHC{ba47f657a4745c96a62c444100d6c38bbff772b47ac03e83dc3ef5d94bc1d77c} "

B--Malware A - 2

What is the threat name, hosts and classification?

Format : WHC{threat name|hosts|classification}

Answer:

1. search Data SHA256 from test Mal-A1.
2. Found https://www.joesandbox.com/analysis/450613/0/html
3. Data threat name and classification obtain here https://imgur.com/a/zfBpyyW
4. Host data found here https://imgur.com/a/vCC69ym

C--Malware A - 3

What is the Static File Name? Format: WHC{name.exe}

Answer:

1. Data found from here https://www.joesandbox.com/analysis/450613/0/html

D--Adventure Time 100 This is the only non-Dynamic Challenge

Sometimes all you need is a good short break of thrilling adventure.. or is it?

Read Carefully

Answer:

1. Download the file and extract
2. See inside 😂 there alot of file, so see the hint back
3. https://imgur.com/a/lMTCWmm. 4 try and error again Adventure Time.bat run in notepad
4. found the flag WHC{} HERE https://imgur.com/a/VwXsJyh

5. Cryptography

A--Beginner Cryptography 10 Decode this base64:

YmFzZTY0X2lzX292ZXJyYXRlZA==

Enwrap it in WHC{} like this:-

WHC{your_decoded_text_here}

Answer:

1. Open browser or cryptography tool here i use web https://amp.base64decode.org/
2. Copy paste the " YmFzZTY0X2lzX292ZXJyYXRlZA==" and run
3. Result https://imgur.com/a/pZaCyAN
4. Wrap them up with WHC{RESULT}

B--anencephaly

What is this pokemon?

Answer:

1. Download file and extract
2. Run the " anencephaly" file as doc ( use CODE pad)
3. Result https://imgur.com/a/JTy0yxf
4. Run the thingy 😂 and we got some >+- symbols.....
5. Copy those sign and search on web. Result : brainfuck coding
6. Run those BF coding in https://imgur.com/a/4vceJ90
7. Take the result run back in base64 encoder
8. The flag is the result https://imgur.com/a/HzUNVsx

C--botak

An old uncle is so tired trying to get his password came to you, he forgot his password. Can you try to brute force his password back?

Answer:

1. Download the file and extract
2. Open the file i as doc in notepad or code pad
3. https://imgur.com/a/c0OOVQJ read with care.
4. Found something strange. Copypaste them and run at decode.fr
5. https://imgur.com/a/FbzEvJD
6. Remember THOSE word "penat"
7. The result is the flag

Thank that all from me

Grimmy081