zero day ctf toolkit
ngl i didnt plan to build a "project", i just wanted to finish the zero day ctf. but by the end i had written a whole pile of python to crack each stage so im calling that the project lol.
my brain was fried most of the night but heres what i ended up making:
what it does
- reads raw pcap files without wireshark/tshark (i parse the ethernet/ip/tcp myself) and rebuilds the http + tls sni so you can tell which device on the wifi was who
- pulls hidden data out of jpeg comment fields, 200 images each had a little base64 piece and i reassemble them in order
- cracks a zipcrypto password from a wordlist (the fast check-byte trick), then opens the encrypted sqlite db and even reads the deleted/purged rows that were still sitting in the file
- rebuilds a file that got split into 13 parts across a relay + dead letter queue, picking the right parts by their sha256
- and the final boss: a .exe with a tiny custom cpu inside. i disassembled it, figured out the ~8 opcodes, reimplemented the vm, and worked backwards through the access check to get the key
how i built it just python, capstone for the x86 disasm, numpy + pillow for the image stuff. a lot of it was me staring at hex going "ok what is this byte"
what i learned honestly a ton. how zipcrypto is weak, how sqlite leaves deleted data lying around, how tls sni basically deanonymizes you, and how you can hide an access check inside a fake little cpu
challenges the shell they gave me had almost nothing in it, no grep no unzip no python, so i had to get creative. and the last challenge needed a file (maintenance.dat) that wasnt even with the exe, it was hidden as an attachment in the hackerpack. took a while to find
whats next clean these scripts up into actual cli tools instead of the mess they are right now
Built With
- capstone
- forensics
- python
- reverse-engineering
