ECTF-2014 – Tummala Dhanvi's Blog

T_1000 ECTF Recon-120 writeup

This is the toughest recon that I have ever seen (or in other words the worst one :P)

First result that you find when you search for T_1000 is the terminator so I tried all the names related to the movie such as the director, the producer, the actor who acted as the T_1000 but no result 🙁 I have also tried skynet which is considered to make the terminator in the film 😛 my team mate was kidding saying to enter the flag as Rajinikanth 😀

After asking admins about the challenge, I have concluded that T_1000 was not related to movies 🙂

My team mate solved the forensics-500 which relates to the channel #nitk-maliciousbots which contain the bot named T_1000 , so I thought this was end of the recon so I tried to get the flag by asking the bot in private message, but this was only the half of the challenge 🙂

Again from the clue whois T_1000, the output of the whois command in irc is as follows

@31337_h4X0R (cinch@2a01:7e00::f03c:91ff:fe56:df09)

BOT_T_1000 is connected via holmes.freenode.net (London, UK)

Operator in:

#nitk-maliciousbots

so we got a new thing to google for 🙂 ie.. 31337_h4X0R, it seems that 31337_h4X0R has a twitter account here is the account https://twitter.com/31337_h4X0R

This account has very few tweets and it contain this photo

And finally if you grep for the strings in the photo we get the flag as follows

flag{I_am_N0t_Ge0Hot}

Eight Cats Hid The Flag ECTF 2014 Recon 100 writeup

From the question and the clue given we can surely say that the flag is in one of the github of the admin’s.

First I have got the idea of downloading all the files and grep them for the flag (this method did not work because the flag was deleted, so you can’t find the flag in any of the repositories )

I tried manually checking all the commits of the admin’s but I didn’t succeeded bcoz the commit was very old like a month old, I didn’t go that deeper into the commits 🙁

here is link of the commit in which the flag was deleted https://github.com/karthiksenthil/Learn-Git/commit/9cd4ecad6f7c545ef5ac31622d503de811191d7b
flag{0ctocat_c4n_play_h1de_and_s33k}

Meet The Team – Ectf 2014 Recon-80

I have attached the screen-shot of the question 🙂 of Recon-80

The question is very simple but getting the blog of the team becomes hard because ECTF is organised for the first time.

The ECTF organizers doesn’t have a good blog which contains all the write up’s that they have solved, it seems like they have created blog just for the case of the challenge as the blog contains only one post which makes it difficult for the search engines to get the get that link (if any of you googled for the blog and did not get the link don’t blame google as it is doing a great job)

The name of team which is organising the ctf is NIA (no internet access). They have mentioned it in the clue also but you will never get to know that it is the name of the team for more details visit this link http://nia-ctf.github.io/

Bingo you got the blog link in the ctftime.org at this address https://ctftime.org/team/8096 and you get the link as http://nia-ctf.github.io/ so you got the flag, there was some small confusion regarding the format of the flag but the admin would have helped you at that time 🙂

flag:http://nia-ctf.github.io/