https://rizzykun.github.io/tags/xor/Recent content in XOR on RizzykunHugo -- gohugo.ioen-usTue, 07 Oct 2025 01:45:47 +0000https://rizzykun.github.io/p/get-clawed/Tue, 07 Oct 2025 01:45:47 +0000https://rizzykun.github.io/p/get-clawed/<img src="https://rizzykun.github.io/p/get-clawed/img-03.png" alt="Featured image of post SUN CTF 2025: Get Clawed" /><h1 id="sun-ctf-2025-forensic"><a href="#sun-ctf-2025-forensic" class="header-anchor"></a>SUN CTF 2025 Forensic </h1><p>Challenge : Get Clawed</p> <p>Analyze a disk image and network traffic capture to uncover hidden data.</p> <p>Open .pcap file find : </p> <p>Suspicious HTTP GET traffic containing ?guid= stood out — indicative of possible C2-style communication.</p> <p>REFERENCE : </p> <p><a class="link" href="https://qiaonpc.github.io/post/get-clawed/" target="_blank" rel="noopener" >https://qiaonpc.github.io/post/get-clawed/</a></p> <p><a class="link" href="https://warlocksmurf.github.io/posts/cyberspacectf2024/" target="_blank" rel="noopener" >https://warlocksmurf.github.io/posts/cyberspacectf2024/</a></p> <p>Open disk, find sus: </p> <p><img src="https://rizzykun.github.io/p/get-clawed/img-01.png" width="1127" height="491" srcset="https://rizzykun.github.io/p/get-clawed/img-01_hu_8ee32b5a1642d330.png 480w, https://rizzykun.github.io/p/get-clawed/img-01_hu_72606db62f56fc41.png 1024w, https://rizzykun.github.io/p/get-clawed/img-01.png 1127w" sizes="(min-width: 1024px) 800px, 100vw" loading="lazy" decoding="async" alt="Screenshot 1" class="gallery-image" data-flex-grow="229" data-flex-basis="550px" > </p> <p>Use c2 script get link : </p> <p><img src="https://rizzykun.github.io/p/get-clawed/img-02.png" width="1040" height="777" srcset="https://rizzykun.github.io/p/get-clawed/img-02_hu_405d0d9df567d89d.png 480w, https://rizzykun.github.io/p/get-clawed/img-02_hu_28032dccab1677e3.png 1024w, https://rizzykun.github.io/p/get-clawed/img-02.png 1040w" sizes="(min-width: 1024px) 800px, 100vw" loading="lazy" decoding="async" alt="Screenshot 2" class="gallery-image" data-flex-grow="133" data-flex-basis="321px" > </p> <p><a class="link" href="https://gist.githubusercontent.com/warlocksmurf/e19b5c0d8ab85e07573203ccaa6b39ef/raw/0b3ee0b5e7bc99bbbd4f618a6e025c6d4d6e3aee/sussy" target="_blank" rel="noopener" >https://gist.githubusercontent.com/warlocksmurf/e19b5c0d8ab85e07573203ccaa6b39ef/raw/0b3ee0b5e7bc99bbbd4f618a6e025c6d4d6e3aee/sussy</a></p> <p>Base64 it and get what to do with .clawed :</p> <p><img src="https://rizzykun.github.io/p/get-clawed/img-03.png" width="1533" height="858" srcset="https://rizzykun.github.io/p/get-clawed/img-03_hu_6cc5531c3c299475.png 480w, https://rizzykun.github.io/p/get-clawed/img-03_hu_3238e42a8ab87a43.png 1024w, https://rizzykun.github.io/p/get-clawed/img-03.png 1533w" sizes="(min-width: 1024px) 800px, 100vw" loading="lazy" decoding="async" alt="Screenshot 3" class="gallery-image" data-flex-grow="178" data-flex-basis="428px" > </p> <p>We get the key, decrypt XOR, me can export png now :</p> <p><img src="https://rizzykun.github.io/p/get-clawed/img-04.png" width="643" height="363" srcset="https://rizzykun.github.io/p/get-clawed/img-04_hu_32b1ca8ae158dacc.png 480w, https://rizzykun.github.io/p/get-clawed/img-04.png 643w" sizes="(min-width: 1024px) 800px, 100vw" loading="lazy" decoding="async" alt="Screenshot 4" class="gallery-image" data-flex-grow="177" data-flex-basis="425px" > </p> <p>Man see flag, man happy</p>