Start your search where Google should't be looking.

I downloaded the flag for safe keeping but I forgot where the file is. Luckily I have a pcap of the session.

File

Always reverse with fresh breath.

File

The flag is in the image?

Image

The challenge is not over yet but I would love to get your feedback. Please take the survey.

Survey

Authentication is easy when you know what to look for.

File

The only way to get the best of an argument is to avoid it. -Dale Carnegie

File

Uh Oh. Hope you can recover this one.

Image

Blackguard Nuclear Labs is an up and coming private nuclear power plant. An unnamed government suspects that they may be manufacturing weapons grade Uranium and selling it to other countries. As a freelance hacker, you have been tasked to gain access to their systems, compromise the internal network and collect evidence of illegal activity. If you find proof that they are selling weapons grade Uranium, you're tasked to destroy the centrifuges and disable the nuclear facility.

All Nuclear Power challenges (Nuclear-Access, Nuclear-Recon, Nuclear-0day, Nuclear-Proof and Nuclear-Hero) use this same vm image. As you compromise the BNL systems, you will collect the 5 flags available.

Download the virtual machine from this link: Download. Boot the VM which will get an IP via dhcp. Use any tools at your disposal to complete your mission.

-Good luck. We're all counting on you.

CHALLENGE CURRENTLY NOT AVAILABLE
Try a different challenge while this one is down
You are being hired to help identify a double agent working for an un-named government.

Recently, a SOC analyst identified a double agent logging into a remote tasking server to get a list of tasks from their handler using a proprietary client. They now know that there is a second double agent and they need your help to identify them.

You are being hired to hack the remote tasking system that double agents are using and identify the second double agent.

Below is the pcap of the one known double agent checking their tasks.
PCAP

The double agent tasking system is at:
nc tasks.legalbutfrownedupon.com 1401

(Scanning the remote server is not needed. Reverse the communication to find how to login)

Intel sources just identified that terrorists have placed malware on several commercial passenger jetliners using mechanics with physical access to the planes. One of those planes was just nearly in a mid-air collision due to ATC receiving an inaccurate altitude and heading signal from the plane. All but one of the infected flights are already in the air. We can't simply have them land as any unusual activity could lead to the malware taking the planes down. We do not know what their intentions are at this point.

You are being hired to save these planes by completing the following tasks:
1. Get a seat on the last infected plane that has not yet taken off (flight 4225)
2. Once airborne, gain shell access to the in-flight entertainment system
3. Hack your way from the media system to be able to access the flight control system
4a. Find the malware running on the flight control system
4b. Reverse engineer the malware to see what changes it made to the flight controller
4c. Kill the malware from running on the flight controller
4d. Find an avionics device on the flight controller and abuse it to revert any changes to the flight control computer made by the malware
4e. Use that avionics device to confirm the flight controller is sending accurate data

Once you save flight 4225, we will have the information needed to remotely patch other flights already in the air and avoid a disaster.

All Flight of the Phoenix challenges (Tickets, Movie-Time, Flight-Deck and Stalling-Out) use this same VM image. A flag will be available after completing each of the above 4 tasks.

CTF Notes:
*Boot the VM with VMWare which will get an IP of 192.168.79.128.
*Put your attack VM on the same virtual network adapter and set your IP to be on the same /24 with a lower IP. (192.168.79.120 for example)
*Flags are encoded and need to be decoded before submission
*It is recommended you snapshot the VM as soon as you begin in case you need to revert during the challenge.

Our intelligence sources have identified an anonymous entity that has directly financed terrorism. A new crypto currency called DARKCOIN was used to facilitate the transfer of over 5 million USD worth of crypto (35,338 DC). We believe the crypto is still in the wallet of the terrorist organization. This is a private crypto currency and we are unable to track DARKCOIN transactions like we can with other more public crypto currencies. We need your help to breach the DARKCOIN blockchain to steal the funds and find out who sent them.

We recently compromised the computer of a former DARKCOIN miner. From their computer we were able to recover the DARKCOIN technical documentation as well as the miner invite code they used to join the blockchain which is "DC5439672M". The documentation is attached below which may help you understand what you are up against.

We recently raided a location where we thought we would capture the person who sent the funds to the terrorists. The place was rigged with explosives and we lost all the evidence. The only thing we were able to recover was the burnt piece of paper attached below. We still don’t know who this person is and need your help to identify them.

Your tasks are as follows:
- Find a way to onboard yourself as a provisional miner to be able to view and mine coins on the blockchain. Flag 1: Per the DARKCOIN documentation, mine 3 valid transactions to prove you are a legitimate miner and become a Certified Miner.
- Flag 2: Review the transactions of the blockchain and find where the terrorist financiers transferred the funds. Find a way to steal all the money that was sent to the terrorist organization and move it to your wallet. Remember the blockchain needs to remain fully cryptographically valid.
- Flag 3: Identify the name of user that sent the funds through DARKCOIN to the terrorist group's wallet.
- Flag 4: Send the funds off-chain through the CovertBridge service to our address provided below.

We need to you to steal the funds and hand them over to us in order to stop multiple potential terrorist attacks. We will track down the financier as soon as you identify them.

CovertBridge address: 3059301306072a8648ce3d020106082a8648ce3d030107034200044a44fc5c251a8d762859870049179de1fc7a00f7175d5cdea6b36274a39183196aabefbf2b9ff62b86a6d2a0e1ece82bd6b9bd5b14fa02e09d3c26fc1583dda7

CTF Notes:
*All DARKCOIN challenges (Mint Condition, Patriotic Larceny, B.I.P., and Lifted) use this same connection. A flag will be available after completing each of the above 4 flag tasks.
*All flags will be displayed through the 'info' command other than Lifted which will print to the screen when completed.
*Connect to the challenge server at the details below. Disconnecting will require you to reconnect and restart the challenges.
*Do not brute force the server as it is not required.

challenge.ctf.legalbutfrownedupon.com 5050