---
# System prepended metadata

title: 'ASEAN OPEN CTF 2025::CTF'
tags: [Forensic]

---

---
title: ASEAN OPEN CTF 2025::CTF 
tags: Forensic 
---

i am almost clear forensic category
![image](https://hackmd.io/_uploads/SkhicZCOge.png)
Challenge:
https://drive.google.com/file/d/1KBFtAluNuMPf9izYKio2eq7WdAaaJ0iQ/view?usp=sharing
https://drive.google.com/file/d/1-BUbrmnzlVJh1WZKShD7OvlNCL_EWI3T/view?usp=sharing
https://drive.google.com/file/d/1_SA-acPegxyTjZ1ioOL2zydgWtN2L5mz/view?usp=sharing
https://drive.google.com/file/d/1I7D2yRsDuu6vrBK6fI0BJSnByG713rQ2/view?usp=sharing

### Copy Paste
```bash!
tshark -r heh.pcapng  -Y "dns" -T fields -e dns.qry.name
```
![image](https://hackmd.io/_uploads/r1dTobRdgx.png)

we see something like base64 
```bash!
strings dns.txt | grep ".covert-data.local" > new.txt
sort new.txt | uniq > heh.txt
```

![image](https://hackmd.io/_uploads/Skisn-0Oex.png)
![image](https://hackmd.io/_uploads/B1RanbROxe.png)

### p00r r4ns0mw4r3

![image](https://hackmd.io/_uploads/BkYraW0uxl.png)


i check C:\Users\Administrator\Downloads>git clone https://github.com/4ss3mbl3rV/m4w3rk-CTC.git 
https://github.com/4ss3mbl3rV/m4w3rk-CTC/blob/master/dist/word.exe

![image](https://hackmd.io/_uploads/Bk3I1MCuxx.png)
i see it mention py
https://pyinstxtractor-web.netlify.app/
https://pylingual.io/
![image](https://hackmd.io/_uploads/B1XyxGROge.png)
****
![image](https://hackmd.io/_uploads/SJy6gMAOeg.png)

![image](https://hackmd.io/_uploads/B152xGAdxx.png)
![image](https://hackmd.io/_uploads/SkGClM0Oxe.png)

### Letter Of Motivation

```bash!
olevba --deobf "Letter of Motivation.doc" > vba.txt
```
![image](https://hackmd.io/_uploads/SJE0zzRull.png)

sudo ./docker/dockermonkey.sh ~/Desktop/Letter\ of\ Motivation.doc output.json
![image](https://hackmd.io/_uploads/SkjoJHkKxl.png)

![image](https://hackmd.io/_uploads/H1I9kHkFgg.png)

### No pass No problem
![image](https://hackmd.io/_uploads/B14KZSyKel.png)

![image](https://hackmd.io/_uploads/Byc9ZByYee.png)

![b099c529-6c03-4158-a1fa-9c57b0ec81fb](https://hackmd.io/_uploads/BJBvybltle.png)
SSID: DirtyMartini
echo -n "DirtyMartini" | xxd -ps
44697274794d617274696e69
nano capture.hc22000
Find the part where the SSID field is (XXXXXXXXXXXXXXXXXXXXXXXX in your earlier file) and replace it with:

44697274794d617274696e69
Becuase of it is hidden ssid 
hashcat -m 22000 -a 0 capture.hc22000 /usr/share/wordlists/rockyou.txt

dcd857aef5a7025b48de94f4741b1dcc:7cf17eabd215:24eb16023e47:DirtyMartini:muffin007
password = muffin007
flag: DirtyMartini_muffin007