SUN CTF 2025: SOC Shift

Tue, 07 Oct 2025 01:45:49 +0000

Challenge : SOC Shift

Open excel file, have like 10,000 lines . Filter by country ISO code MY

Find sus base64 , go cyberchef Me get flag, me happy ;D

sunctf25{S1EM_b4s1cs_f0r_l0g_4n4Lys1s!}

SUN CTF 2025: Get Clawed

Tue, 07 Oct 2025 01:45:47 +0000

SUN CTF 2025 Forensic

Challenge : Get Clawed

Analyze a disk image and network traffic capture to uncover hidden data.

Open .pcap file find :

Suspicious HTTP GET traffic containing ?guid= stood out — indicative of possible C2-style communication.

REFERENCE :

https://qiaonpc.github.io/post/get-clawed/

https://warlocksmurf.github.io/posts/cyberspacectf2024/

Open disk, find sus:

Use c2 script get link :

https://gist.githubusercontent.com/warlocksmurf/e19b5c0d8ab85e07573203ccaa6b39ef/raw/0b3ee0b5e7bc99bbbd4f618a6e025c6d4d6e3aee/sussy

Base64 it and get what to do with .clawed :

We get the key, decrypt XOR, me can export png now :

Man see flag, man happy

SUN CTF 2025: Who's Alpha

Mon, 25 Aug 2025 09:14:47 +0000

Chall details

Field	Details
Author	warlocksmurf & Sai
Category	OSINT
Score	260
Description	One of the largest financial institutions in Malaysia, MoneyPro Sdn Bhd, has been breached by a notorious hacker group led by a mysterious figure known only as “Alpha.” As part of the Malaysia Cyber Defend Associate (MCDA) team, your mission is to uncover Alpha’s true identity. Flag format: `sunctf25{Firstname_LastName}`

Interestingly this chall only had 4 out of 81 teams that were able to solve it in time.

The challenge shipped with an incident report on the MoneyPro breach: Investigation Report (PDF).

🕵️‍♂️ Solution

From the Investigation Report given, The only lead we have is the social media account of a user named Bravo. That’s where the OSINT trail begins..

I searched through popular social platforms and eventually located Bravo’s X (Twitter) account.

Scrolling through his timeline revealed an interesting clue—a suspicious Google Drive link:

Exploring the Google Drive

The Drive contained:

A folder full of logos
A file named Private.zip
A Note.txt file

Opening the note revealed a password hint: it was a combination of Bravo’s mother’s name and an important day (the day he signed a RM10,000 contract). Both details can be found in his X posts.

Unlocking the Zip

With the password reconstructed, I unzipped Private.zip to find intelligence on the TigerP4tch group. Inside Bravo’s folder, I finally uncovered a partial name:

Lucas M.

The hunt for his last name was on.

Following Charlie’s Trail

Inside Charlie’s folder, a chat log between Bravo and Charlie revealed another breadcrumb. Bravo hinted that something important was stored on Pastebin.

Pastebin Recon

After some digging, I located a Pastebin account under the username Alice_R. However, the paste was password-protected.

Back in the Google Drive folder full of logos, I noticed Alice’s shop logo featuring a rose. The chat log mentioned the password is the flower on her shop logo. Trying rose as the password worked, unlocking the paste.

The Final Reveal

The unlocked paste finally exposed Alpha’s full name:

Lucas Moore

With that, Alpha’s identity was confirmed.

SUN CTF 2025 on Rizzykun