Forensics

1 min read

Writeups for the Digital Forensics and Packet Analysis challenges from CubeCTF 2025.

Challenges

  • Discord - Forensic analysis of a disk image (.ad1) reveals encrypted Discord cache files, leading to PyInstaller extraction, decompilation, and AES-CBC key derivation from a Discord Snowflake ID.
  • operator - Network packet capture (PCAP) analysis reconstructs a multi-stage backdoor binary sent over TCP and replays payload streams to extract a secret flag.

Back to CubeCTF 2025

2 items under this folder.

Terminal

sigsegv@ctf:~/challenges
$ls
[1]incantation/
[2]discord/
[3]operator/
[4]is-this-stego/
[5]gnisrever/
[6]legal-snacks/
[7]todo/
[8]check-it-out/
[9]note-editor/
[10]mini-dsp/
[11]the-old-way/
[12]free-flagging/
[13]intro-to-web-part-1/
[14]intro-to-web-part-2/
[15]intro-to-web-part-3/
[16]intro-to-web-part-4/
[17]real-christmas/
[18]death-by-latex/
[19]help-desk/
[20]hidden-secrets/
[21]patient-zero/
[22]robot-rock/
[23]welcome-home/
[24]whats-up-doc/
[25]i-see-you/
[26]ill-be-reading-that/
[27]operational-oversharing/
[28]the-auditor/
[29]this-seems-odd/
$
Enter # or cmd · 'help' for info