NSO Group Technology Blog

03 March : twisty

Twisty The Challenge Author: trupples Inspired by stackola's game, I wanted to build my own version, but in C. What could go wrong? In this challenge, we are given 2 files: An X86_64 executable 'twisty' and the corresponding libc (libc-2.23.so). Running the binary the following game starts: Pressing '?' shows

03 March : trip_to_trick

Trip to Trick This deceptively simple challenge proved a great exercise in abusing FILE structs. Literally gifting you the entire libc of the process, as well as two arbitrary QWORD writes - you'd expect exploitation to be a walk in the park. In the following sections we'll dive into what

03 March : Strange PCAP

Strange PCAP The Challenge We managed to get all the data to incriminate our CEO for selling company secrets. Can you please help us and give us the secret data that he has leaked? https://ctfx.hacktm.ro/ Challenge Overview We received a pcap file, that on quick review, we see is a

03 March : secrets communicated

HackTM2020 - secret communicated The challenge is given as a this_is_it.img file: file this_is_it.img this_is_it.img: DOS/MBR boot sector; partition 1 : ID=0xee, start-CHS (0x0,0,1), end-CHS (0x3ff,255,63), startsector 1, 4294967295 sectors, extended partition table (last) gparted this_is_it.img fdisk -l this_is_it.img Found valid GPT with protective MBR; using GPT. Disk this_is_it.img: 15269888

03 March : RR

The task's description points at data recovery from a broken RAID array: "One of my drives failed" Reusing All of Internal Disks The ZIP contains 3 disk images, the 2nd of which is faulty: 512M 1.img 0B 2.img 512M 3.img 1.img & 3.img are different, ruling out a (completely trivial)

03 March : quack-the-quackers

"Quack The Quackers" writeup What we have A quack_the_quackers.rom file information that this is a file from a `digispark` device Step 1 Looking up `digispark` on the net we found that it is based on an `atmel attinyXX` processor. Thus we loaded the ROM file with IDA-PRO with the ATMEL

03 March : papa_bear

Papa Bear The question: Author: trupples Papa bear loves knitting, and even more so taking thin wires and spinning them together to make a strong, bushy rope. Code: The answer: We received a binary called papa_bear. This binary has a very big buffer which looks pretty similar to the one

03 March : old-times

OLD Times (OSINT) Challenge description There are rumors that a group of people would like to overthrow the communist party. Therefore, an investigation was initiated under the leadership of Vlaicu Petronel. Be part of this ultra secret investigation, help the militia discover all secret locations and you will be rewarded.

11 November : Cobol OTP challenge

Description To save the future you have to look at the past. Someone from the inside sent you an access code to a bank account with a lot of money. Can you handle the past and decrypt the code to save the future? Setup The challenges include two files otp.cob

11 November : PNBNC

Challenge description A friendly hacktivist dropped us a backdoor on a server owned by a deforestation enterprise. Sadly noone knows how to operate it, she has given us the binaries. Figure it out and obtain the secret documents. First impression We are given two binaries, one called bridge and the

TECHNICAL BLOG