https://4n6post.com/tags/northsec/Recent content in NorthSec on 4n6Posthttps://4n6post.com/writeups/northsec/2025/beginner_track_hackademy/2025-05-24You know, I almost nicknamed you The Kid. But they told me that you are skilled. Let’s put this to the test with some fundamentals. Training module: http://hackademy.ctf Note: If this is your first NorthSec and that you are not in a competitive team (bottom 50% scores), small hints and pointers can be given to you to help with this track. Use !help in Discord to ask. Serialize 101 Serialize 101 :white_check_mark:https://4n6post.com/writeups/northsec/2025/chatgpt/2025-05-24Potential Flag Data md 2 lines NOHRVPX11JGCF LYRZIDU8LV9478OA Flag 1 Click to reveal the final flag flag 1 lines FLAG-LYRZIDU8LV9478OA Your team submitted flag “metadata chapters” for 0 point! [video] 1/4 To construct the flag you need FLAG- concat with florence2 output from drumm cover concat with the other drumm string from VP to the end. Flag 2 You can find Flag two by looking at the Chapter Name in the video player or using strings.https://4n6post.com/writeups/northsec/2025/container/2025-05-24Small Container While the Bonsecours is obviously a cruise ship, civilian ships can be chartered to carry cargo in containers. These containers are smaller than what you are used to see for haulage. To request a physical container, you need to prove ownership of the container to the stevedor. This cargo is interesting to us. Try to extract the hidden secrets in this container. small.tar bash 2 lines docker load -i small.https://4n6post.com/writeups/northsec/2025/crew-members-hub/2025-05-24Challenge Context The Wiz, I’ve got a special task that requires every bit of your brain power. I need you to infiltrate the CVSS Bonsecours Crew Members Hub and create your own crew account. This act will play a key part in the success of the heist. To help you out, we managed to get our hands on a pentest report that assessed the hub. The pentest was done by a third-party firm named Sharkz4Hire — what kind of name is that?https://4n6post.com/writeups/northsec/2025/gift_shop/2025-05-24Everybody can participate in games and stupid activities aboard the ship and get prize money that can be cashed in at a Gift Shop. Limbo dancing is definitely not in my task definition. Why care about some trinkets? We’ve studied the gift shop and there is an unusual item there. Chief thinks that this is a key item to crack the ship’s vault open. The problem is that our key card is maxed out at $1.https://4n6post.com/writeups/northsec/2025/internet_access/2025-05-24Cruises are not known for their generosity. They’ll nickel-and-dime you at every opportunity. They’re out here to make money, just like us… It is by design that the Internet on the ship is bad. It creates a bad connection for everybody, but we know that the bandwidth could be better if we could remove the throttling they put in place. We need this for a specific reason: when the casino part of the heist will happen, we want everybody on their phone, live streaming the jackpot, and thus paralyzing the network while keeping everybody distracted.https://4n6post.com/writeups/northsec/2025/life_saving_device/2025-05-24The cruise makes stops in coastal cities, and provide a pin badge per cabin to help passengers recognize each other, and for the crew to identify passengers. In case of an emergency, this can be a life-saver. Just like all the lifebuoys aboard. Instructions have been provided on them, but they are incomplete. We’re looking for the real emergency protocol in case an emergency state is declared. Maritime security in case of danger relies on collaboration and information sharing.https://4n6post.com/writeups/northsec/2025-05-24The NorthSec Websitehttps://4n6post.com/writeups/northsec/2025/2025-05-24NorthSec < NSEC 2025https://4n6post.com/writeups/northsec/2025/number_station_sync_with_the_dealers/2025-05-24Step 1 The casino dealers are key allies in ensuring the success of the heist, but you’ll need to coordinate with them covertly. We’ve been working to get them on our side for a while now, but there’s some radio technology involved now, Wiz. They communicate using a secret number station to dispatch their teams. Your task is to figure out how their system works and use it to signal our team over the radio — without being detected.https://4n6post.com/writeups/northsec/2025/packing_heat/2025-05-24You don’t need to know why, but when time will come, I’ll need a weapon and ammo. Bringing something onboard this high security ship was impossible, but we have a way out. There is a weapon on this ship, usable in extreme cases such as a pirate attack. It looks like there is a pirate aboard, so I guess we can use it. The pirate is you, Wiz, you get it?https://4n6post.com/writeups/northsec/2025/pursuer_copter/2025-05-24Unfortunately I dont have the context and files. Just an image of the file and the flag. Click to reveal the flag flag 1 lines FLAG-WEWILLNEEDACHOPPERhttps://4n6post.com/writeups/northsec/2025/sailorkidz/2025-05-24I dont have the pre-context unfortunately. I do have the image initially provided. This was solved but I think I lost the results I had. The characters were decypherable to words. Click to reveal flag flag 7 lines AHOY! CONGRTULTIONS ON SOLVIN' DIS DIFFICULT PUZZLE. LIKE aLL GOOD SaILDORKIDZ, YE NEEDS a REWaRD. IF YE WRTS T' HOIST a FLaG, HERE KE ONE: FLAG-COHAUFYOXLASSYPD Unfinished A music file was provided but not finished.https://4n6post.com/writeups/northsec/2025/ship_the_add-on/2025-05-24The steps that were taken to get our access cards were colossal. While we’re working on making it a skeleton key, members of the crew that will see us with our regular cards will know that we don’t have clearance. This requires assembly, and had to be taken care inside the ship. The plan was to have the material sent to the cabin, but it got intercepted. Now we need to take care of that before “Copper Island”, the company that specializes in Data disposal takes care of it.https://4n6post.com/writeups/northsec/2025/welcome_aboard/2025-05-24I have assigned a cabin to you. This is your base of operations. It’s not the biggest cabin, but you should make yourself at home, but not too much. Walk around the ship, be observant, and look everywhere for clues. Flag and report any oddity ASAP. Got it? A maritime signal flag welcoming us aboard? Decoration, or our presence was detected? We will be on the lookout. Trivial flaghttps://4n6post.com/writeups/northsec/2025/welcome_to_the_ctf/2025-05-24 Welcome to the CTF! To make your life easier with some of the challenges, a shell server is available for your use. ssh root@shell.ctf Password: shellftw! Remember: DO NOT run near the pool and do not count cards. Have fun aboard the CVSS Bonsecours! ah yes, very croissant, very baguette! Rules Flaghttps://4n6post.com/writeups/northsec/2023/dream_server_dfir/2023-05-21Example Direction: Lock Picking Lawyer Server Category Item Blue 1 Gmail in session of browser Blue 2 Email in URL of the payload download Blue 3 Image of the phishing, Edge cache Blue 4 USB key friendly name LNK Blue 5 C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces{GUID of the interface}{GUID of the config file}.xml Blue 6 Splashtop logs Blue 7 Volatility notepad pid 6184 Blue 8 Volatility svchost -k ClipboardSvcGroup, photorec Blue 9 MD5 MEMORY.DMP Blue 10 MD5 AppData/Local/Packages/CanonicalGroupLimited.https://4n6post.com/writeups/northsec/2023/key_replicator/2023-05-21Example Direction: Lock Picking Lawyerhttps://4n6post.com/writeups/northsec/2023/necktie/neck_tie_connection/2023-05-21Serial Connection Connection Type: Serial Baud Rate/Speed: 115200 Port: COM3 Client: PuTTY Reference Reverse Engineering of ESP32 Flash Dumps with Ghidra or IDA Pro (Medium) USB Command Example Plain Text 2 lines USB: neopixel 3 70 0x990099https://4n6post.com/writeups/northsec/2023/necktie/necktie_qrcode/2023-05-21https://4n6post.com/writeups/northsec/2023/2023-05-21NorthSec < NSEC 2023https://4n6post.com/writeups/northsec/2023/the_clock/2023-05-21Other Write-Up See SD Card Data for more information. Challenge Walkthrough 1. Splash Screen Flag When the device boots, a flag flashes very quickly on the splash screen. Capture it by recording a video (e.g., with a phone) and extracting the frame. 2. Debug Mode & PIN The device initially functions as a clock with a serial port option to enable debug mode. Debug mode requires a “pin” (a number between 0 and 9999), generated on first boot and unique per device.https://4n6post.com/writeups/northsec/2023/the_rules/2023-05-21https://4n6post.com/writeups/northsec/2023/warmups/2023-05-21Download mypcap.pcap Spoiler Command: bash 5 lines tshark -r mypcap.pcap -Tfields -e data \ | cut -c -2 \ | sed ':a;N;$!ba;s/\n/ /g' \ | sed 's/ //g' \ | xxd -r -p tshark -r mypcap.pcap -Tfields -e data uses tshark to read the pcap file and output only the packet data field in hexadecimal. cut -c -2 takes only the first two characters of each line, which is typically the first byte of each packet’s data.https://4n6post.com/writeups/northsec/2022/hackademy_authorization_1/2022-06-01Check the html Or in the PCAP:https://4n6post.com/writeups/northsec/2022/2022-06-01NorthSec < NSEC 2022 - Extra Information Datahttps://4n6post.com/writeups/northsec/2022/portobello53/portobello-53-denial/2022-06-01Context Why do you need DNS logs anyway? We both know that DNS servers are just address books of Internet resources and I’ve never seen anyone abuse a plain old address book. The appliance would have blocked anything malicious anyway. I bet you don’t even have a certification to understand the protocol anyway. Here’s a link to download the PCAP 5. Don’t waste your time on the network capture, I skimmed through it and found that your test device fd00:6e73:6563:3232::beef did nothing suspicious.https://4n6post.com/writeups/northsec/2022/portobello53/portobello-53-anger/2022-06-01Part 1 - Version 1 3232::3 had base64 encoded strings. After decoding, found a flag. ID3 is the magic number for MP3 files, but can’t get it to play as an MP3. “Tripping on Mushrooms” by S3RL is a real song, apparently. (See below for solution.) md 1 lines flag-radio-mycoverse-is-a-scam PART 1 and 2 - Version 2 Very similar. You can see in the original PCAP if you look at TXT records using:https://4n6post.com/writeups/northsec/2022/portobello53/portobello-53-bargaining/2022-06-01Packet Analysis Within your method of looking through the packets (using Wireshark), searching for the word flag- brought me directly to the flag. Using the “Follow UDP Stream” feature in Wireshark, you can see the whole flag inline. txt 1 lines Flag-we_have_a_bad_case_of_ophiocordyceps_unilateralis Part 2 – Version 1 Farther down, the server returns commands: ls –la cat wallet-priv.txt The hex code is returned. Part 2 – Version 2 Converted to text:https://4n6post.com/writeups/northsec/2022/portobello53/portobello-53-depression/2022-06-01Part 1 – PunnyCode After noticing multiple xn-- CNAMES in the PCAP, I narrowed down to host 9 and observed many of these entries. After removing the excess and focusing on the head before it turns into junk, you can grab the first 6 sections to toss into the punycode converters: bash 1 lines tcpdump -nr portobello53.pcapng 'src fd00:6e73:6563:3232::9' | cut -d " " -f 8- | cut -d "." -f -1 | egrep xn-- | head tcpdump -nr portobello53.