Juniors CTF 2016 :: The Good, The Bad and The Junkman

hello everyone and welcome back to another YouTube video my name is John Hammond we're still looking at the junior CTF uh captur the flag game and competition that went on last weekend um all right so I want to showcase this uh other challenge in forensics there's a 500.1 called The Good the Bad and the junkman um so no real prompt here I cleaned up the store recently and now some stuff is missing I think it must be somewhere here so um I'll show it to you here you can download this thing it's just a raw file um now in my case when I was working with this I actually had some trouble being able to like download it and get it to extract so we'll see if I can get it again once we have it downloaded I'll just I use the archive manager to be able to extract these and it's taking a little bit of time to download 14 seconds 13 seconds blah blah blah so what I ended up because I couldn't get it to extract I honestly even just tried using some like online converters and I converted it to another file format and then I was able to extract that way so if I can extract it I'll just again showcase what I what I had done but you can try and extract it here and okay so yeah par an error curle extracting files a parser filters is unsupported so I probably have it jotted down what I actually used CD cyber writeups online CTF Juniors the good to bad dayment so I had used an online converter here which you're totally reading the solution which is just fine but I'll showcase it to you anyway I use an online converter to convert files here and I think I was able to download it there okay so no they deleted it but yeah I just use this dwon convert files.com seriously and I could just converted it to a tar and I was able to AR uh extract that so so it saved into this thing so I would CD into that and that has Google so there is a bunch of files in here I'm assuming like Chrome configurations bunch of user data and stuff from here which you can look through by hand if you really wanted to Chrome cleanup Tool uh crash reports there wasn't anything in there cleanup tool Chrome cleanup tool and there's some stuff here if you really want to look through that um but what I ended up doing was because I was too lazy to look through all this stuff was I created a simple while loop first I just ran fine so I'd have the list of all the files in here with an absolute path or like I'm sorry with a relative path with a DOT slash and then I would I would I would Loop through every single one of them so while read line as I Loop through all those outputs in each individual line I would do strings on that line and it would literally take the strings of every single file that I saw so it looks like a bunch of nonsense what it's scrolling by um but what I wanted to do now is I can grip for flag and I use dasi to make it like case insensitive and there's a bunch of stuff here again uh so what I ended up doing in that case was concatenated or I sorry I appended it to a file uh that I ended up calling like all flags. text that's what you saw in uh the folder above me or the directory that I that that is above me so you can see it there what I ended up doing was now opening that up and taking a look at it more definitively so i' look for flag and there were about 221 matches I could see down at the very bottom so I honestly just looked through these one by one and I just hit the enter key to kept scrolling by and scrolling through it to see if there was anything interesting that popped up and I see like some JavaScript code I see some other things that don't look particularly interesting other than Yandex searches that looked interesting um and I kept going through here and one of the ones that I saw eventually also other than all these Jon objects that look peculiar but they're probably just for technical thing the creation uncore Flags variable is probably use for some code it does um but I kept rolling through here all these jpeg oh sorry these PNG images and now I find this interesting thing and that they search YouTube but they see a youtube.com search query flag CTF some interesting some interesting here go go be Boulder the fact that it has CTF I'm like oh okay this looks very very very clear this looks like I clearly have the right thing so they had searched that through YouTube and I tried I tried this as the flag and that didn't work um so but since they had searched it on YouTube I was like okay can I can I recreate that can I do that exact same thing so I I Googled it I think finding it on on YouTube is just as equally as fine but I had just ran it through Google flag CTF interesting go here and we get this YouTube video with which is 6 seconds long and this must be it it says description is well done you are fine me and the video uh has this this this image here that says flag a little bit of magic so that's it that is our flag that we can submit and you saw that in the uh text that I had the solution that I jotted down but that's really all I did I didn't do any like extreme I didn't use any cool or fancy uh forensics tools to be able to look at Google Chrome and recover Google Chrome's like data settings and stored cach and stuff like that I literally just ran strings on everything and look for flag so um that's what I had done I hope to know I wonder if anyone like once the writeups actually released for the CTF or if anyone can film in on some cool utilities or Cool Tools to be able to recover like Google Chrome data and stuff like that uh until then I guess I'll just deal with strings on on on everything but there's our flag you can submit that and get 500 points so a good a good challenge but just a interesting unique uh interesting tactic um interesting and unique tactic sorry jumbling those words there uh is just running everything through strings you can do that with the fine command and just looping through every single one of them so sweet thanks for watching guys hope you're enjoy these and I'll see you in a later video