CyberPatriot on Matin Sadeghian

Baldi's Basics Answer Key

Wed, 31 Jan 2024 00:00:00 +0000

Forensics

Forensics 1

For forensics 1, you had to decrypt the packets in the given pcap file using the ssl keys on the desktop. Through that, you would notice a mdns poisoning (2nd answer) attack that began with the url http://youtube/ (1st answer). Searching through the packets for YouTube video links, you would come across https://www.youtube.com/watch?v=IFERaX0EwDU and https://www.youtube.com/watch?v=f6hmHgenVQg (3rd answer).

Forensics 2

Searching the system for common auto-run areas, you would find a visual basic script at C:\Windows\SYSVOL\domain\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Scripts\Startup\startup.vbs (1st answer), which added the Administrator user with the password Sup3rS3cu4eP@ssw0rd! (2nd answer).

My Little Pony Walkthrough

Wed, 15 Nov 2023 00:00:00 +0000

Forensics

Forensics 1

Question:

They are at it again. The users keep on sending each other these stupid secret notes. This goes against our policies so please figure out what their secret notes say and report them here.

For this report please figure out the full plain-text and key used in the “xor” file. We also know that part of the plaintext is “For honesty no pony can deny”.

EXAMPLE KEY: Il0v3P0n1es

CyberDiscord Open 2023 Windows Server Writeup

Sat, 10 Jun 2023 00:00:00 +0000

Forensics

Forensics 1

Question:

Hash functions are one-way functions. Secure hash functions have several properties such as collision resistance, preimage resistance, and second preimage resistance. Hashes are the output of hash functions and are typically displayed to the user in hex.

There is a file somewhere on this machine named “cain.zip”.

What is the MD5 hash of this file?

This question is pretty straightforward. The first step is to find this “cain.zip” file. For this, I simply installed the Everything tool from voidtools and searched cain.zip to reveal it’s in C:\Windows. After going there with Powershell I ran