[Drym]

I'll throw this out again : I have most very easy/easy/medium done, couple hards too, I'm looking for tips on Forensics - Data Breach.

[CipherGhost]

I have Russian roulette block chain flag if someone want to exchange
DM me

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[Jonwi]

Will to trade meds for whoever got recovery

[CipherGhost]

Now I have Russian roulette and lucky faucet

I need pwn (except tutorial and pet competition)
Any other
Hard and insane flag is accepted

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[peRd1]

I'll throw this out again : I have most very easy/easy/medium done, couple hards too, I'm looking for tips on Forensics - Data Breach.

Feel free to ping me for tips on that data breach.

[xemyll]

Stack with BoxCutter:

local_28 = 0x540345434c75637f
local_20 = 0x45f4368505906
uStack_19 = 0x68
uStack_18 = 0x374a025b5b0354


reversed_local_28 = local_28 ^ 0x3737373737373737
reversed_local_20 = local_20 ^ 0x373737373737
reversed_uStack_19 = uStack_19 ^ 0x37
reversed_uStack_18 = uStack_18 ^ 0x37373737373737


local_28_str = reversed_local_28.to_bytes((reversed_local_28.bit_length() + 7) // 8, byteorder='big').decode('utf-8')
local_20_str = reversed_local_20.to_bytes((reversed_local_20.bit_length() + 7) // 8, byteorder='big').decode('utf-8')
uStack_19_str = chr(reversed_uStack_19)
uStack_18_str = reversed_uStack_18.to_bytes((reversed_uStack_18.bit_length() + 7) // 8, byteorder='big').decode('utf-8')

string_28 = local_28_str[::-1]
string_20 = local_20_str[::-1]
string_18 = uStack_18_str[::-1]

print("Reversed local_28:", string_28)
print("Reversed local_20:", string_20)
print("Reversed uStack_19:", uStack_19_str)
print("Reversed uStack_18:", string_18)

print(string_28 + uStack_19_str + string_20 + string_18)

HTB{tr4c1ng_th_c4ll5} - is wrong flag.

Any thoughts ?

[nnrrkk]

any help on
What is the name of the file located at record number 45? (for example: randomname.pdf)                                                                               
> Annual_Report.xlsx                                                                                                                                                 
[+] Correct!
                                                                                                                                                                     
What is the size of the file located at record number 40? (for example: 1337)                                                                                         
> 41                                                                                                                                                                 
[-] Wrong Answer.
What is the size of the file located at record number 40? (for example: 1337)                                                                                         
                                                                                                                                                                     
> 42
[-] Wrong Answer.
What is the size of the file located at record number 40? (for example: 1337)                                                                                         
                                                                                                                                                                     
>


forensic

if you go to the ****DATA**** section, check out "Actual Size" convert that hex to dec

[ab23]

any help on
What is the name of the file located at record number 45? (for example: randomname.pdf)                                                                               
> Annual_Report.xlsx                                                                                                                                                 
[+] Correct!
                                                                                                                                                                     
What is the size of the file located at record number 40? (for example: 1337)                                                                                         
> 41                                                                                                                                                                 
[-] Wrong Answer.
What is the size of the file located at record number 40? (for example: 1337)                                                                                         
                                                                                                                                                                     
> 42
[-] Wrong Answer.
What is the size of the file located at record number 40? (for example: 1337)                                                                                         
                                                                                                                                                                     
>


forensic

try to use this mft parser
https://github.com/omerbenamram/mft

[peRd1]

MFTexplorer. Check there the size and you need to convert from Hex

[st1ff56]

any hints for Web -  Flag Command &  KORP Terminal