SamCTF{} write-up

Yesterday i come across “SamCTF” it was really wonderful CTF specially if you are new to Capture The Flag event. So let’s here is my approach how i solved it.

CTF Url : https://samifriends.weebly.com/samctf.html

Note : Before going to see solutions please try it by yourself. you will enjoy.

So at first we have been given one ZIP file. To extract it we need password which can be found at website from which we downloaded ZIP file.

Extracted ZIP file

Let’s open the folder and see what things we have. we got 1 jpg file,1 zip file and one folder.

ZIP content

Let’s unzip this sam.zip file.

sam.zip extracted

So we got another zip file. So i thought that it may contain more zip files and extract it manually is not good idea so i done some google search and i found some interesting solution for unzip all nested zip files.

google search string “ How to recursively unzip nested ZIP files? ”

command :

while [ "`find . -type f -name '*.zip' | wc -l`" -gt 0 ]; do find -type f -name "*.zip" -exec unzip -- '{}' \; -exec rm -- '{}' \;; done

command

So after apply command as we can see we need to give some password. here we have note13.txt file which can help us.

Note13

So password is “ludbaimas”

So after giving password in terminal again unzipping was started and asked me password for another zip file.

Sam7.zip password prompt

So this time we are having two files note12.txt and key.txt, let’s open one by one.

note12.txt

As we can see First letter of every word is capitalized so password can be the first letter of each word.

“PAULWALKER” and yes it’s the password for sam7.zip file

So after giving password in terminal again unzipping was started and asked me password for another zip file.

But wait this time we didn’t get any Text file from which we can get password.

So now i tried some zip password cracking tools and i found the password.

cracking zip password

Password : tankyou

So after giving password in terminal again unzipping was started and asked me password for another zip file.

sam28.zip

Let’s see note10 file.

note10

Yes, earlier we have found key.txt file. so let’s use that key and decode this string. ( i used https://cryptii.com/ website to decode this)

vigenere ciper

Password : cybersecurity

So after giving password in terminal again unzipping was started and asked me password for another zip file.

sam51.zip

Let’s see note9.txt file. (OSINT challenge)

note9.txt

So after some googling we found our password.

Password : MichaelEmerson

Again i entered this password in terminal.

sam72.zip

Let’s look note8. another OSINT challenge.

note8

Password : TheMentalist

Again i entered password in Terminal.

sam91.zip

So here we can see our command line approach is very useful. think if we extracted all zip file manually.

Now let’s see note7

note7

So as hint suggest it’s pika language. So i used decode.fr website to decode it.

Password : johnhammond

Again i entered password in Terminal. This time we can see our script could not unzip “sam97.zip.gz.bz2” file. So i manually unzipped it.

After extracting “sam97.zip.gz.bz2” file. we need to repeat this process at “sam99.zip” after unzipping it we found two zip files so firstly i unzipped “note6.bz2” and found one note.

note6

It’s look like password for another zip file. so i tried “Ascii85” in cryptii.com and decode the password.

Password : liveoverflow

With help of this password we can unzip sam100.zip file.

Again we see 1 zip file and 1 text file.

note5

At first look it’s look like a PNG image not text file.so i renamed it to note5.png and yes i was right. it was png file and it looks like this.

qrcode

So i decoded this qrcode online and i found password

qrcode decoded

Password : ippsec

After extracting sam101.zip file again we get new zip file. where we can found note4.txt file which looks like this

note4.txt

So first i thought it’s morse code but nope i was wrong then i tried different decoder and finally found that this is “Tap Code”

tap code decoder

Password : hineedhelp

Again we found one text file. note3.txt

note3.txt

It’s look like base32. when i decoded it with base32 i found some numbers. like this

decoded string

So after some time i thought let me change this 48 to 0 and 49 to 1 and remove 32.

so string looks like this

string

So now after decoding binary to text we found this result.

morse code

It’s morse code and after decoding it we found password.

Password : ZIPPASSWORD

Again after unzipping sam103.zip file we found 1zip file and 1text file.

let’s see note2.txt

note2.txt

So it was straight forward. after converting “blackpanther” in 1337(leet) language we found our password.

password : 814CKP4N7H3r

Again after unzipping sam104.zip we again found 1ZIP file and 1text file.

let’s see note1.txt

note1.txt

So yes after unzipping first zip file we found 1 image file, 1 folder and 1 zip file. so in that folder we find following text

wordlist

So after going to twitter we found this

twitter

So in his follower list we found person “Razzak” and we found this tweet.

Tweet

So we can see this is some weird text. i have seen this text in previous CTF. you can read write-up for that via this link.

so it’s “Malbolge Language”. so let’s decode it online.

Password : NanoWifiPineapple

So this password is not for sam105.zip file. we can decode hak5.jpg online.

(steganography image decoder jpeg)

So after decoding jpeg we get wordlsit.

Mission,Pumpkin,Vulnhub,Happy,Birthday,To,Sam,NordVpn,Account,admin123,106Sam,Sam106,sam106,Magicbox,Help,Samaritan,Notion,Wordpress,webshell,Cyber,Wolf,A4my,Netw0rk,H4cking,Netw0rk,3ecurity,Helpme,helpme,text,me,on,instagram

So using this wordlist we can unzip sam105.zip file.

Password : 106Sam

So after unzipping sam105.zip we again get new zip file.

We got 106sam.txt file like this

sam106.text

It’s look like Hex dum of file. so what i did was remove all the things except HEX values.

after splitting HEX value i did Hex to ascii conversion and again i got HEX numbers so again i did HEX to ASCII so we got sting like this

RW1haWw6IHRob21vMTk5NUBnbWFpbC5jb20KUGFzczogS2Fpc2VyMDkKRVhQSVJBVElPTjogMDUv
MDkvMjAyMgpTYW1DVEZ7MmQ5NmU1ZDU2MjNkN2ZkMmRjNWJkNGVmZDA1MjUzZTF9Cg==

So it’s base64 string so after decoding it. we got our flag.

flag

So it was really awesome challenge for beginners.

you can find all Extracted files from link below.

https://github.com/raj1997/CTF-Write-up/tree/master/Sam_CTF