T_1000 ECTF Recon-120 writeup

Screenshot from 2014-10-23 16:23:30

This is the toughest recon that I have ever seen (or in other words the worst one :P)

First result that you find when you search for T_1000 is the terminator so I tried all the names related to the movie such as the director, the producer, the actor who acted as the T_1000 but no result 🙁 I have also tried skynet which is considered to make the terminator in the film 😛 my team mate was kidding saying to enter the flag as Rajinikanth 😀

After asking admins about the challenge, I have concluded that T_1000 was not related to movies 🙂

My team mate solved the forensics-500 which relates to the channel #nitk-maliciousbots which contain the bot named T_1000 , so I thought this was end of the recon so I tried to get the flag by asking the bot in private message, but this was only the half of the challenge 🙂

Again from the clue whois T_1000, the output of the whois command in irc is as follows

@31337_h4X0R (cinch@2a01:7e00::f03c:91ff:fe56:df09)

BOT_T_1000 is connected via holmes.freenode.net (London, UK)

Operator in:

#nitk-maliciousbots

so we got a new thing to google for 🙂 ie.. 31337_h4X0R, it seems that 31337_h4X0R has a twitter account here is the account https://twitter.com/31337_h4X0R

This account has very few tweets and it contain this photo

shellshock

And finally if you grep for the strings in the photo we get the flag as follows

Screenshot from 2014-10-23 18:14:40

flag{I_am_N0t_Ge0Hot}