> For the complete documentation index, see [llms.txt](https://ctf.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ctf.zeyu2001.com/2021/the-infosecurity-challenge-tisc-2021/level-1-scratching-the-surface.md).

# Level 1 - Scratching the Surface

## Scenario 1

### Challenge 1

> We've sent the following secret message on a secret channel.
>
> Submit your flag in this format: TISC{decoded message in lower case}

We have a .wav audio file.

Open in Sonic Visualizer, and see that the channel 2 spectrogram looks like morse code.

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-dd0db2698d7e203bd7bf785775751dcaff375e2e%2Fcf58423721c24761824c606e6c31dac9.png?alt=media)

Extract the second channel into a seperate `out.r.wav` file:

```
sox file1.wav out.r.wav remix 2
```

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-131ba42e8db906705b1dad640815a950575fed91%2F8fe77edfcbe343d6b4e883c8ecf56751.png?alt=media)

Decode the morse code:

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-ac5807619d154c64fd810a9a70a0e15dd2e39157%2Fc233c919fbb84a428464b443bfca411d.png?alt=media)

The flag is `TISC{csitislocatedinsciencepark}`

### Challenge 2

> This is a generic picture. What is the modify time of this photograph?
>
> Submit your flag in the following format: TISC{YYYY:MM:DD HH:MM:SS}

We can see this in the EXIF data.

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-21b52f2064b6c25619cad8725944c23f4c312fc2%2F26441b3e108347d1af4aa70ed840edaf.png?alt=media)

The flag is `TISC{2003:08:25 14:55:27}`

### Challenge 3

> Nothing unusual about the Singapore logo right?
>
> Submit your flag in the following format: TISC{ANSWER}

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-026dbe4f34c0b2b4608777b63d63e4aee928036d%2F3053fbc761904742866deb82ecc39b52.png?alt=media)

Binwalk shows us that there is a zip archive hidden in the file.

Extract it and we get a `picture_with_text.jpg`.

We can clearly see that before the JPEG magic bytes, there is some text.

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-60338cf5372b715d0d7ea4d8bee1d4ec7bd767b1%2F0038a38172c2445294dfae0b328cee77.png?alt=media)

This is a substitution cipher, the answer is

```
ANSWER TO THIS CHALLENGE IS HERE APPLECARROTPEAR
```

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-f0cdab65facad73378a0d952fa5119367bf133b6%2Fdf6d3b47b68b44659dbe22e5a7f494cb.png?alt=media)

## Scenario 2

> Excellent! Now that you have show your capabilities, CSIT SOC team have given you an .OVA virtual image in investigating a snapshot of a machine that has been compromised by PALINDROME. What can you uncover from the image?
>
> Once you download the VM, use this free flag TISC{Yes, I've got this.} to unlock challenge 4 - 10.
>
> Check MD5 hash: c5b401cce9a07a37a6571ebe5d4c0a48
>
> For guide on how to import the ova file into VirtualBox, please follow the VM importing guide attached.

### Challenge 4

> What is the name of the user?
>
> Submit your flag in the format: TISC{name}.

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-5aa08f70f1e8622aa8adb7b8ea33cb48aa932c81%2F57e31d232ab64dbea1903d1a621b9bd0.png?alt=media)

The name is adam.

### Challenge 5

> Which time was the user's most recent logon? Convert it UTC before submitting.
>
> Submit your flag in the UTC format: TISC{DD/MM/YYYY HH:MM:SS}.

Windows Security Logs log the Logon events (event ID 4624).

Note that the required time is in UTC, which is provided in the raw XML.

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-b7c429b1b4d1fb420d2acd28be09d51618a702be%2F0ceeee44239d48d691a57bc1300947dd.png?alt=media)

### Challenge 6

> A 7z archive was deleted, what is the value of the file CRC32 hash that is inside the 7z archive?
>
> Submit your flag in this format: TISC{CRC32 hash in upper case}.

The command `7z l -slt archive.zip` shows us extended info for the files in the archive, including the CRC32 hash.

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-2d18842b43e977e8ec0fcd1053eae8c56f2cdf83%2Fc58f0cac3c3a41bd8ce92102bd6dc60e.png?alt=media)

We can see the CRC value in the output.

```
CRC = 040E23DA
```

### Challenge 7

> Question1: How many users have an RID of 1000 or above on the machine?
>
> Question2: What is the account name for RID of 501?
>
> Question3: What is the account name for RID of 503?
>
> Submit your flag in this format: TISC{Answer1-Answer2-Answer3}. Use the same case for the Answers as you found them.

This information can be obtained using `wmic useraccount get name,sid`. The RID is the last part of the SID shown.

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-fce4c11666c9d87805caa0d0573eb7c03279ae7c%2F891fe4f9f1ee4fe8940454b5ba2729ad.png?alt=media)

The flag is `TISC{1-Guest-DefaultAccount}`.

### Challenge 8

> Question1: How many times did the user visit <https://www.csit.gov.sg/about-csit/who-we-are> ?
>
> Question2: How many times did the user visit <https://www.facebook.com> ?
>
> Question3: How many times did the user visit <https://www.live.com> ?
>
> Submit your flag in this format: TISC{ANSWER1-ANSWER2-ANSWER3}.

Edge has a `History` SQLite database that contains the web history.

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-9acf4e94b2d01f1290ea61586b5163ae7890a3f7%2Fb27e8abd63034c2cba5a5ef2d6fe307b.png?alt=media)

The who-are-we page was visited twice. The other two websites were visited 0 times.

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-2107b15f7cdd8d18201973a817dc5103002deb1a%2F7753f4f3bf5640ab9e55599b7ff47abe.png?alt=media)

The flag is `TISC{2-0-0}`.

### Challenge 9

> A device with the drive letter “Z” was connected as a shared folder in VirtualBox. What was the label of the volume? Perhaps the registry can tell us the "connected" drive?
>
> Submit your flag in this format: TISC{label of volume}.

We can find recently mounted devices in registry keys. The following registry key contains the mounted shared folder as a subkey:

`Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\`

![](https://3167364547-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MX1bWRlBzHpEPe1TYDD%2Fuploads%2Fgit-blob-19db7fb4d8e3e8a8a296f16329f3f5f27bc240f9%2F4df19a2ae2f64282a8d960ff40cf07bd.png?alt=media)

The name is `vm-shared`.

### Challenge 10

> A file with SHA1 0D97DBDBA2D35C37F434538E4DFAA06FCCC18A13 is in the VM… somewhere. What is the name of the file that is of interest?

I wrote a simple PowerShell script to find this.

```powershell
Get-ChildItem -Path "C:\" -Recurse -Force |

ForEach-Object {
    if ((Get-FileHash -algorithm sha1 $_.FullName).Hash -eq "0D97DBDBA2D35C37F434538E4DFAA06FCCC18A13")
    {
        Write-Output $_.FullName
        break
    }
}
```

This outputs `C:\Users\adam\AppData\Roaming\Microsoft\Windows\Recent\otter-singapore.lnk`, which links to `otter-singapore.jpg`.