w3pwnz

From: Jessica To: w3pwnz Subject: New email from our contact Attachments : executable2.ndh Thank you again for your help, our technical staff has a pretty good overview of... lire la suite

From: Jessica To: w3pwnz Subject: unknown binary, need your help Attachments : executable1.ndh Hello again, Thank you very much for your help. It is amazing that our... lire la suite

From: Piotr To: w3pwnz Subject: Another weird link Attachments : web3.ndh Thank you again for these informations! we have just credited your account with $1700. Our spy... lire la suite

After decrypting the secret message, we got a new email, from Piotr this time, a supposed technical operative. From: Piotr To: w3pwnz Subject: Any idea how to use this file?... lire la suite

The bmp file has no padding bytes, and its size matches the image dimensions (4374054 = 810*1800*3 +0x36 for the header). On the other hand, applying an LSB filter reveals that something is wrong on the left side of the... lire la suite

File sp111 After opening the sp111 text file, we guessed that it was encrypted with vigenere. We tried an auto-decrypt with http://www.apprendre-en-ligne.net/crypto/vigenere/decryptauto.html, revealing that... lire la suite

File: 11925.ndh Once again it is a VM file. We quickly take a look at the hexdump to find the remote port used (4004). % tail 11925.ndh|hexdump -C 00000000 00 16 b7 0e 00 02 02 04 00 00 02 03 04 03 03 03... lire la suite

According to the description http://sci.nuitduhack.com was a url shortening service. After searching about how these services work i found two “common” practises. The first was inserting urls in the database and then... lire la suite

In the sp113.pdf found in the bitmap “Wallpaper image”, we can see “author: SciteekSmith”. Google is our friend : http://lmgtfy.com/?q=SciteekSmith There is 1 result : http://www.facebook.com/SciteekSmith... lire la suite

There is one file : sciteekadm.cap It’s a 802.11 capture. Let’s crack it with aircrack-ng and a wordlist. Then we decrypted the capture with Cain. We opened the decrypted capture with Wireshark. We can see a png file.... lire la suite

Le week end dernier, se sont déroulées pendant 48h, les préqualifications du CTF de la Nuit Du Hack 2011 ! Les consignes étaient claires : * Les 10 premières équipes seront qualifiées d'office pour le CTF, et gagneront... lire la suite