0x0w1z

Learning Memory Forensics & Collection of Memory Forensics Labs Writeups/Notes from MemLabs.

Selfish Notes that I will read again.

Currently Machine is Active, will be Unlocked once it is Retired.

Currently Machine is Active, will be Unlocked once it is Retired.

Currently Machine is Active, will be Unlocked once it is Retired.

Titanic is an easy difficulty Linux machine that features an Apache server listening on port 80. The website on port 80 advertises the amenities of the legendary Titanic ship and allows users to book trips. A second vHost is also identified after fuzzing, which points to a `Gitea` server. The Gitea server allows registrations, and exploration of the available repositories reveals some interesting information including the location of a mounted `Gitea` data folder, which is running via a Docker container. Back to the original website, the booking functionality is found to be vulnerable to an Arbitrary File Read exploit, and combining the directory identified from Gitea, it is possible to download the Gitea SQLite database locally. Said database contains hashed credentials for the `developer` user, which can be cracked. The credentials can then be used to login to the remote system over SSH. Enumeration of the file system reveals that a script in the `/opt/scripts` directory is being executed every minute. This script is running the `magick` binary in order to gather information about specific images. This version of `magick` is found to be vulnerable to an arbitrary code execution exploit assigned [CVE-2024-41817](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41817). Successful exploitation of this vulnerability results in elevation of privileges to the `root` user.

This challenge was Simple forensics challenge which i created for the NCA-CTF where players were given an image which wa

This challenge was made for the CTF which was organised by our teamNCA@Nepal. This challenge was a Forensics challenge w

In this challenge by CyberSpace we were given a picture named enc.png and the python source code which was used to add s

This challenge was Forensics Category challenge in CyberSpace CTF 2024 in this challenge we were given a .DAT name ( cat