Blackhat MEA '23 Quals - Forensics - USB100

BlackHat Conference is a renowned cybersecurity event where experts discuss the latest trends and research in the field. It includes a challenging Capture The Flag (CTF) competition that tests participants’ hacking and security skills. I personally experienced the Online Qualifying Round, which was both challenging and fun, and it further highlights the high caliber of the BlackHat CTF

First Challenge that I solve was this USB100.

First things first, i downloaded the challenge file and unziped it using the follwing command

 7z e USB100.zip

Now, normally i would open this with Wireshark and try to analyze it but i aimed for a deferent approach this time and chose the easy way.

I ran Binwalk to see what kind of information and files are stored in send.pcapng, and i found the following.

There is a windows executable stored inside of this file and now all we need to do is extract it and it’s hexadecimal is AC723, So i wrote down the following command.

binwalk -e --dd=".*" send.pcapng

So i immediately copied the executable to my windows desktop and ran it on Powershell and Bingo….. WE GOT A FLAG.

Thanks a lot for reading along to the end.

kh4tt4k

Peace! 👋👋👋