“Gang Busted” — GrabCON CTF writeup

Depois de baixar e descompactar o arquivo, o diretório principal extraído foi “data”:

Quando listei o diretório, descobri que eram alguns dados adquiridos do Android. A maioria desses diretórios estava vazia. Para limpar isso, emiti o seguinte comando dentro do diretório “data”:

$ find . -empty -type d -delete

De acordo com a descrição do desafio, devemos encontrar a plataforma de mídia social que foi usada. Nesse caso, a plataforma mais provável é o Skype:

Isso nos dá a primeira parte da bandeira:

GrabCON{Skype_<email>_<group_name>_<member_name>}

Esta ferramenta é muito simples. Basta abrir o banco de dados desejado e iniciar a análise.

Depois de pesquisar todos esses bancos de dados, o s4l-live:.cid.6c41bc4408002e1f.db foi muito interessante. Para navegar pelas tabelas, basta clicar na aba Browse data .

Naveguei por todas as mesas (e claro que demorou muito…) e encontrei algumas mesas que me chamaram a atenção. Em seguida, selecionei a segunda linha da tabela talksv14 e cliquei duas vezes na coluna nsp_data , que me retornou o seguinte:

{
    "_forceToRecents": 0,
    "_isHighlight": 0,
    "_needsSync": 0,
    "conv": {
        "_convProps": {
            "color": "hsv_0.5723270440251572,1,212_0.5371900826446281,1,242_reverse",
            "consumptionhorizon": "1630472727022;1630473487204;16809682010359575515",
            "consumptionhorizonpublished": "1630472727022;1630473485571;16809682010359575515",
            "isemptyconversation": "False",
            "isfollowed": "False",
            "lastimreceivedtime": "2021-09-01T05:05:20.158Z"
        },
        "_forceSyncThreadDetails": false,
        "_searchTerms": "31337 Hax0r Plan 8:live:.cid.894d225aeeb5246d",
        "_threadMembers": [
            {
                "id": "8:live:.cid.894d225aeeb5246d",
                "role": "Admin"
            },
            {
                "id": "8:live:.cid.6c41bc4408002e1f",
                "role": "Admin"
            }
        ],
        "_threadProps": {
            "capabilities": [
                "AddMember",
                "ChangeTopic",
                "ChangePicture",
                "EditMsg",
                "CallP2P",
                "SendText",
                "SendSms",
                "SendFileP2P",
                "SendContacts",
                "SendVideoMsg",
                "SendMediaMsg",
                "ChangeModerated"
            ],
            "createdat": "1629381096619",
            "creator": "8:live:.cid.6c41bc4408002e1f",
            "creatorcid": "0",
            "historydisclosed": "true",
            "lastjoinat": "1629381096760",
            "membercount": "2",
            "members": "[\"8:live:.cid.894d225aeeb5246d\",\"8:live:.cid.6c41bc4408002e1f\"]",
            "topic": "31337 Hax0r Plan",
            "version": "1629381097916"
        },
        "_timestamp": 1630472727022,
        "convViewVersion": 1630473492319,
        "id": "19:[email protected]",
        "isBricked": false,
        "isFake": false,
        "lastMessage": {
            "_countsType": 1,
            "_isEphemeral": false,
            "_isMyMessage": 0,
            "_serverMessages": [
                {
                    "clientmessageid": "16809682010359575515",
                    "composetime": "2021-09-01T05:05:20.158Z",
                    "content": "<a href=\"https://mega.nz/file/TsNFFS5I#_oYRNNTLDD9ZZ47Is-P8K9lQCl8BGC5RDeE65aUS2N0\">https://mega.nz/file/TsNFFS5I#_oYRNNTLDD9ZZ47Is-P8K9lQCl8BGC5RDeE65aUS2N0</a>",
                    "conversationLink": "https://azwus1-client-s.gateway.messenger.live.com/v1/users/ME/conversations/19:[email protected]",
                    "conversationid": "19:[email protected]",
                    "from": "https://azwus1-client-s.gateway.messenger.live.com/v1/users/ME/contacts/8:live:.cid.894d225aeeb5246d",
                    "id": "1630472727022",
                    "messagetype": "RichText",
                    "originalarrivaltime": "2021-09-01T05:05:20.158Z",
                    "properties": {
                        "urlpreviews": "[{\"key\":\"https://mega.nz/file/TsNFFS5I#_oYRNNTLDD9ZZ47Is-P8K9lQCl8BGC5RDeE65aUS2N0\",\"value\":{\"url\":\"https://mega.nz/file/TsNFFS5I#_oYRNNTLDD9ZZ47Is-P8K9lQCl8BGC5RDeE65aUS2N0\",\"size\":\"2198\",\"status_code\":\"200\",\"content_type\":\"text/html\",\"site\":\"mega.nz\",\"category\":\"generic\",\"title\":\"File on MEGA\",\"favicon\":\"\",\"thumbnail\":\"https://sa1-urlp.secure.skypeassets.com/infodel30/894cddc7-c2ba-4c48-8a67-04ee5824d712.png\",\"thumbnail_meta\":{\"width\":240,\"height\":240},\"user_pic\":\"\"}}]"
                    },
                    "type": "Message",
                    "version": "1630472727022"
                }
            ],
            "composeTime": 1630472720158,
            "content": "<a href=\"https://mega.nz/file/TsNFFS5I#_oYRNNTLDD9ZZ47Is-P8K9lQCl8BGC5RDeE65aUS2N0\">https://mega.nz/file/TsNFFS5I#_oYRNNTLDD9ZZ47Is-P8K9lQCl8BGC5RDeE65aUS2N0</a>",
            "conversationId": "19:[email protected]",
            "createdTime": 1630472727022,
            "creator": "8:live:.cid.894d225aeeb5246d",
            "cuid": "16809682010359575515",
            "messagetype": "RichText",
            "properties": {
                "urlpreviews": "[{\"key\":\"https://mega.nz/file/TsNFFS5I#_oYRNNTLDD9ZZ47Is-P8K9lQCl8BGC5RDeE65aUS2N0\",\"value\":{\"url\":\"https://mega.nz/file/TsNFFS5I#_oYRNNTLDD9ZZ47Is-P8K9lQCl8BGC5RDeE65aUS2N0\",\"size\":\"2198\",\"status_code\":\"200\",\"content_type\":\"text/html\",\"site\":\"mega.nz\",\"category\":\"generic\",\"title\":\"File on MEGA\",\"favicon\":\"\",\"thumbnail\":\"https://sa1-urlp.secure.skypeassets.com/infodel30/894cddc7-c2ba-4c48-8a67-04ee5824d712.png\",\"thumbnail_meta\":{\"width\":240,\"height\":240},\"user_pic\":\"\"}}]"
            }
        },
        "memberConsumptionHorizonsSorted": [
            {
                "consumptionHorizon": 1630471256133,
                "consumptionHorizonUpdateTime": 1630471254613,
                "id": "8:live:.cid.6c41bc4408002e1f"
            },
            {
                "consumptionHorizon": 1630472727022,
                "consumptionHorizonUpdateTime": 1630472726999,
                "id": "8:live:.cid.894d225aeeb5246d"
            }
        ],
        "mriNamespace": 19,
        "threadDetailsVersion": 1629381097916
    },
    "counts": {
        "consumptionHorizonTimestamp": 1630472727022,
        "convHashUsedForCalc": "rmx/b4bVPTfy7lbE6a8xdxrVpZI/9tTV0vY5Td9tCcM=",
        "hasUnread": 0,
        "highPriorityUnreadCount": 0,
        "numMessagesSentByUser": 3,
        "unreadCount": 0,
        "unreadCountOverflowed": false
    },
    "syncInfo": {
        "messageHistoryStartTime": 2,
        "messagesStale": false,
        "messagesSyncState": "3c3000000031393a3462636239376662633436373462376362306664363964356563386665643161407468726561642e736b79706501fcc038a8560100008165cb9f7b01000000"
    }
}

Neste ponto, temos o seguinte sinalizador e o ID do membro criador do grupo:

GrabCON{Skype_<email>_31337_Hax0r_Plan_<member_name>}
"creator": "8:live:.cid.6c41bc4408002e1f"

Como podemos ver, na linha 6 e linha nsp_pk , o valor é o mesmo que encontramos para o ID do membro criador do grupo. Dê um duplo clique na coluna ao lado e então o seguinte json é mostrado:

{
    "_phoneNumbersForDbIndex": [],
    "city": null,
    "color": {
        "colors": [
            "#49409A",
            "#8378DE"
        ],
        "key": "blue",
        "primaryAccent": "#49409A",
        "secondaryAccent": "#8378DE"
    },
    "country": null,
    "displayNameOverride": "evil mike",
    "emails": [
        "[email protected]"
    ],
    "fetchedDate": 1630470959118,
    "fullName": "evil mike",
    "gender": 0,
    "mri": "8:live:.cid.6c41bc4408002e1f",
    "phoneHashes": [],
    "phones": [],
    "province": null
}

Finalmente, a bandeira completa é:

GrabCON{[email protected]_31337_Hax0r_Plan_evil_mike}