Test BlogPost with Image OO

NepHack is an annual Jeopardy-style Capture the Flag (CTF) competition with a set of tasks/challenges that reveal clues that guide the participant in solving various kinds of technical challenges.

I decided to join NepHack 3.0 as I was very new to the cyber-security community and wanted to make some friends.
The competition started on 25th January 2020 at 10 am GMT+545 and ended on 26th January at 5.
Here is a brief walkthrough of the challenges and solutions that were presented in NepHack 3.0.

P.s I am a complete beginner thus my methodologies might differ completely from the experts, feel free to correct me if I am wrong and give feedback.

We will be starting from relatively easy ones and doing others in no particular order.

It seems like the text is encrypted in Crockford Base 32 encoding.

CDWPWTB3C5P5YSKCC5KQPRVJDXHPPSKFE9J76BB2C5SPACSJBXYG

So what comes to our mind when we hear the word social? 

Facebook, right?
So the organizer of the event was Cynical Technology. So we need to check their Facebook page. 

The text looks encoded in base64, so we decode it using the following bash script.


echo ‘Y3luaWNhbF9mbGFne1dlX0xvdmUtU29jaWFsX01lZGlhfQ’ | base64 -d

Pvcure grkg vf grpuavdhr bar bs gur rneyvrfg naq fvzcyrfg zrgubq bs rapelcgvba grpuavdhr. Vg’f fvzcyl n glcr bs fhofgvghgvba pvcure{plavpny_synt}>>plavpny_synt{Pvcure_grkg_jr_ner_ureb}.Erghea gur arj fgevat trarengrq.

 algorithm. and if we decode that using website 

, it looks as if there are 200+ folders and each with a flag.txt inside them.

We need to look into all sub-folders and all the flag.txt files,

We can do this using the following bash script,

So from the description, the first number looks like a DMS link. We can open the website using the DMS link as, http://<DMS-Number>

It is quite impossible for us to enter the value manually.
We use the 

 written in JavaScript and spam the script in the console 10 or more times.

Go Home