R3CTF

misc

hideAndSeek

Ben is a superpower who loves playing hide and seek. He can teleport to anywhere to no one can find him, but he seems unaware that his ability only works within a certain range

Rules:

The adorable Ben will only appear within the range of (0, -50, 0) to (128, 50, 128).
Ben will every 10 seconds and reappear in a new location after 10 seconds.
A "newtp" has been added for all players to teleport to any coordinates.
Connect info: 34.81.163.238

version 1.19.2

很抽象的mc游戏题开始确实是用PCL2模拟器进入游戏去玩

看到给了个newtp命令还查了很多教程去学MC的tp命令是如何使用但是发现没啥用在地图里面逛了一会儿

用newtp大概传送了一些坐标命令格式如下

想传送到的坐标(x, y, z)
newtp x y z

后面直接翻log日志文件找到flag

读日志可以发现这个”Ben”的尸体类型应该是村民并且他的名称就是flag

R3CTF{Jus7_play_m0r3_h1de_2nd_seek_w1th_Ben}

h1de@ndSe3k

其实做法和上面差不多这次就算是Ben隐形了也没关系我们只需要传送几次等待一段时间 Ben会自己因为某种原因卡死我们再从日志里面找他的死亡记录就行但是因为服务器好像是关掉了没法复现了当时也是傻了应该用上一题的方法再试一下

Blizzard CN Restarts

但是没玩过魔兽

找个修改器打开看一下

全部解压出来使用FileLocator开搜找到flag

forensics

TPA 01

e01镜像直接丢进火眼分析出个嵌套证据

其实做这个题的时候分析过程还挺复杂的感觉想的过于复杂了归其原因还是经验太少我甚至仿真起来了

翻文件夹的时候找到wsl 在结合嵌套证据感觉预期解应该是要把这个系统恢复出来

但是好在有取证工具不用恢复出来也可以做下面就是由于我翻文件系统不仔细发现的另一种途径

010直接把密文翻出来了

但是在火眼里面直接能看到还能看到一个关于密钥的提示

key：
Do you like watch videos on youtube?Something fun there:https://www.youtube.com/@d3f4u1t-lolol

F14G：
Hi players,welcome !Ops,what's that?2d422fc7f2c628c55520984c0673964eb5454dea72f79b1022a34728294c5bf8I guess u need a key to decrypt it.SELECT something FROM somewhere with the windows10 lol~

根据提示 SELECT something FROM somewhere 想到应该和sql语句有点关系

先看一下key里面提到的视频

有个字符串提出来看看

0x6d617962652075206e6565642c746861742773206e6f74206162736f6c7574650a726f6f743a5040357357307264466f7255

maybe u need,that's not absolute
root:P@5sW0rdForU

给了个密码尝试登陆mysql 成功登陆

select * from secret;

FFD8的头一眼jpg图片保存下来给出了AES解密的key

其实这里也可以用一个项目ibd2sql来解密数据库secret.ibd也可以

TPA 02 - 📱

Peggy is an employee at a company and, like many others, occasionally uses her personal mobile phone for work-related tasks. Unfortunately, she has become the target of a phishing attack. Your task is to uncover the details of this attack by finding the attacker's phone number and Peggy's password.

Submit your findings in the format r3ctf{number_password}. For the phone number, remove any symbols and spaces. For example, if the attacker's phone number is +1 123-456-7890 and the password Peggy entered is passwd, your flag should be r3ctf{11234567890_passwd}.

两部分一个是找攻击者的手机号码一个是找Peggy的登陆密码

先看流量直接追踪tcp流在第31个流找到login登录页面

先找到password:l0v3_aNd_peace

再看给的手机文件夹直接用火眼分析分析出两个手机号

根据语境可以得知是15555215556这个号码应该是Peggy的同事来询问Peggy是否也收到了钓鱼信息

那下面的15555215558 应该就是攻击者的手机号码直接组合起来

r3ctf{15555215558_l0v3_aNd_peace}