2021weight 23.58EntrePlicas

RCTS CERT 2021 Defending the SOC

27 challenges with 50 published community solutions between them. Solution links go to CTFtime’s task page, which aggregates every writeup for a challenge - individual blog posts rot, the aggregator does not.

Full task list on CTFtime

Forensics10

Recover something from a file, a capture, or a disk image - often from a part of it the format says is unused.

Solve it with:File type identifier by magic bytes Magic byte and file signature table PCAP analyzer for CTF network forensics EXIF metadata viewer Learn: File forensics and carving Learn: Network forensics

Welcome to the challenge
100 pts3 writeups
- forensics
Same technique in picoCTF: FindAndOpen, c0rrupt, extensions
About us
100 pts2 writeups
- forensics
Same technique in picoCTF: FindAndOpen, c0rrupt, extensions
Hiding in plain sight
100 pts2 writeups
- forensics
Same technique in picoCTF: FindAndOpen, c0rrupt, extensions
Keyp it universal
100 pts2 writeups
- forensics
Same technique in picoCTF: FindAndOpen, c0rrupt, extensions
Knock Knock
400 pts2 writeups
- network
Same technique in picoCTF: FindAndOpen, c0rrupt, extensions
Judy also has a flag...
464 pts1 writeup
- network
- dns
Same technique in picoCTF: FindAndOpen, c0rrupt, extensions
Maybe the helper can help
100 pts1 writeup
- forensics
Same technique in picoCTF: FindAndOpen, c0rrupt, extensions
The lost Jetson
400 pts1 writeup
- network
Same technique in picoCTF: FindAndOpen, c0rrupt, extensions
Vacation time!
464 pts1 writeup
- network
Same technique in picoCTF: FindAndOpen, c0rrupt, extensions
Where did agent rooot login from
449 pts1 writeup
- network
- forensics
- ssh
Same technique in picoCTF: FindAndOpen, c0rrupt, extensions

Misc10

Everything that fits no other box: esolangs, puzzles, scripting exercises, and the jail escapes that have not yet earned their own category.

Solve it with:Brainfuck and esolang decoder Cipher identifier and automatic decoder Regex tester with match offsets and capture groups Learn: Recognising encodings

Changing our locks and dumping old Keys
100 pts4 writeups
- mission
Same technique in picoCTF: Permissions, Specialer, Codebook
Locked Outside
100 pts4 writeups
- mission
Same technique in picoCTF: Permissions, Specialer, Codebook
Something Suspicious
100 pts4 writeups
- mission
Same technique in picoCTF: Permissions, Specialer, Codebook
Blue team becomes Red Team
269 pts2 writeups
- mission
Same technique in picoCTF: Permissions, Specialer, Codebook
Getting the crown jewels
269 pts2 writeups
- mission
Same technique in picoCTF: Permissions, Specialer, Codebook
Know your enemy
191 pts2 writeups
- mission
Same technique in picoCTF: Permissions, Specialer, Codebook
Crime doesn't pay
481 pts1 writeup
- mission
Same technique in picoCTF: Permissions, Specialer, Codebook
Locating our attacker
443 pts1 writeup
- wireless
- mission
Same technique in picoCTF: Permissions, Specialer, Codebook
Oh there's another flag
430 pts1 writeup
- misc
Same technique in picoCTF: Permissions, Specialer, Codebook
Where in the world is
469 pts1 writeup
- time
- systems
- misc
Same technique in picoCTF: Permissions, Specialer, Codebook

Cryptography3

Recover a plaintext or a key from something that was supposed to protect it. In practice: identify the scheme, find the parameter the author got wrong, exploit it.

Solve it with:Cipher identifier and automatic decoder Vigenere cipher solver with automatic key recovery RSA decryption and attack runner Wiener’s attack on small RSA private exponents In-browser hash cracker with rule transforms Learn: Classical ciphers and frequency analysis Learn: RSA and the parameters that break it

A simple challenge
100 pts3 writeups
- crypto
Same technique in picoCTF: StegoRSA, Timestamped Secrets, AES-ABC
Decrypting the payload
100 pts3 writeups
- mission
Same technique in picoCTF: StegoRSA, Timestamped Secrets, AES-ABC
Hextraordinary security
100 pts1 writeup
- crypto
Same technique in picoCTF: StegoRSA, Timestamped Secrets, AES-ABC

Web2

Reach data or functionality the application meant to keep from you - through its inputs, its tokens, or its trust in the client.

Solve it with:JWT decoder and signature verifier JWT alg=none bypass generator Web attack payload catalog JWT secret brute force Learn: Web attacks and session tokens

Some type of juggling
100 pts2 writeups
- web
Same technique in picoCTF: Client-side-again, dont-use-client-side, Irish-Name-Repo 3
It is magic after all
100 pts1 writeup
- web
Same technique in picoCTF: Client-side-again, dont-use-client-side, Irish-Name-Repo 3

Reverse engineering1

Work out what a compiled program does without its source, then work backwards from the check to the input that passes it.

Solve it with:Strings extractor for binaries and blobs WebAssembly disassembler Java .class disassembler Python .pyc bytecode disassembler Learn: Binary exploitation

You are not allowed
100 pts1 writeup
- reverse
- engineering
Same technique in picoCTF: WinAntiDbg0x100, WinAntiDbg0x200, WinAntiDbg0x300

OSINT1

Answer a question about the real world from public sources. The work is pivoting between identifiers, not exploiting anything.

Solve it with:EXIF metadata viewer QR code decoder

Welcome to Lisbon
100 pts1 writeup
- osint
Same technique in picoCTF: Permissions, Specialer, Codebook

Forensics10

Welcome to the challenge

About us

Hiding in plain sight

Keyp it universal

Knock Knock

Judy also has a flag...

Maybe the helper can help

The lost Jetson

Vacation time!

Where did agent rooot login from

Misc10

Changing our locks and dumping old Keys

Locked Outside

Something Suspicious

Blue team becomes Red Team

Getting the crown jewels

Know your enemy

Crime doesn't pay

Locating our attacker

Oh there's another flag

Where in the world is

Cryptography3

A simple challenge

Decrypting the payload

Hextraordinary security

Web2

Some type of juggling

It is magic after all

Reverse engineering1

You are not allowed

OSINT1

Welcome to Lisbon

Other 2021 events