ElvisAvduli

Échec OP 3/3

Challenge

The administrator tried to hide one of his IP addresses used to connect to this server. Recover the IP address and submit it as the flag in the format FCSC{<ip-address>}.

Quick answer

FCSC{192.168.37.1}

ElvisAvduli

Échec OP 2/3

Challenge summary

This task continues from the previous disk analysis. While exploring the mounted filesystem, we discovered a shadow-style file and evidence that a user obob exists. By searching for occurrences of obob and inspecting command history, we recovered a secret string that becomes the flag.

Goal: Find the secret string and format the flag as FCSC{<string>}.

Overview of approach

ElvisAvduli

Échec OP 1/3

Challenge summary

You are given a disk image fcsc.raw containing an encrypted disk. The administrator used LUKS encryption with a known passphrase. The challenge asks:

What is the date of creation of the filesystem in UTC?

The flag must be in ISO 8601 format inside FCSC{}. Example: FCSC{2022-04-22T06:59:59Z}.

Quick answer (flag)

ElvisAvduli

Échec OP 0/3

Challenge summary

This challenge gave us a disk image file named fcsc.raw. The goal was to find the unique identifier (UUID) of the partition table for the disk and submit it wrapped in the FCSC{} format as the flag.

Goal: Find the disk GUID and format the flag as FCSC{<GUID>}.

Tools used

ElvisAvduli

Dérèglement

Challenge description

A Microsoft Office document (2021-fcsc-reglement_de_participation.docx) was corrupted during editing. The task is to recover the file contents and retrieve the flag.

Analysis steps

1. Extract embedded files / unpack the DOCX

ElvisAvduli

Cap ou Pcap

Summary

During analysis of a provided pcap, a TCP stream was found that contained a hex-encoded ZIP archive. The archive (flag.zip) was reconstructed from the captured payload, extracted, and contained a flag file. This write-up documents the evidence, analysis steps, exact commands used to recover the ZIP, findings, and recommendations.

---

Evidence

ElvisAvduli

Analyse mémoire - Pour commencer (2/2)

Challenge Description

The memory dump was captured while a user was working on a highly sensitive document. If the workstation was compromised, this document may have been stolen. The task was to identify:

• The name of the document editing software (executable).
• The name of the document being edited (filename only, without the full path).

Flag format:

ElvisAvduli

Analyse Memoire 1/2

Overview

We use Volatility3 to analyze a memory dump and extract three items:

1. Name of the user that used the machine
2. Name of the machine (computer name)
3. Non-local IPv4 address of the machine