Challenge information

Stop The Heist

Oh no! Attackers might have stolen our precious documents from the super secret share. We need to know what they took exactly...

Author information: This challenge is developed by OHaalstra@deloitteNL.

Part 1 : Locate the payload.

The attackers seem to have gotten a foothold on our system. And executed some malicious code. We need to know what the code does.

Part 2 : Stolen files

To report to the authorities we must know exactly which files have been taken by the attacker. Are you able to figure this out?

Part 3 : Password cracking

Can you please find out whether the attack was caused by a weak password? We need to know whether the users are adhering to our password policy. Our password policy for the domain is CTF{[ROCKYOU_1]_[ROCKYOU_2]!} where [ROCKYOU_1] and [ROCKYOU_2] are distinct words from the rockyou.txt list.