CTF on the fidelyafr experience

SMT Program 2025: Various Write Up

Thu, 14 Aug 2025 00:00:00 +0000

Malware

Static

Description

Before you start analyzing a malware file, it is generally a good practice to take its hash and search it on VirusTotal to see if others have analyzed the same file before. For this challenge, we give you this SHA256 hash: `556700ac50ffa845e5de853498242ee5abb288eb5b8ae1ae12bfdb5746e3b7b1`.

Answer the questions at `nc 52.77.77.117 10031`

This is an easy/baby challenge to introduce you about how to use VirusTotal as a first stop for malware analysis. Visiting VirusTotal to look for the hash of the file will return the ILOVEYOU worm report.

HackTheBox Business CTF Cyber Skills Benchmart 2025: Operation Blackout Write Up

Sat, 24 May 2025 00:00:00 +0000

Cloud

[Easy] Vault

Vault is a vulnerable S3 bucket challenge with a twist. We’re given a static website hosted on S3 with a few public files that can be downloaded.

If we try to download one of the files, we can see that it gives or responds to us a link to another S3 bucket specifically used to store files.

Upon further inspection using the aws cli client, we’ve found the complete directory of this volnaya-vault bucket. It has public and private subfolders.

HackTheBox Cyber Apocalypse 2025: Tales From Eldoria Write Up

Sun, 30 Mar 2025 00:00:00 +0000

Web Exploitation

[SOLVED][very easy] Trial by Fire

Trial by Fire is a classic SSTI challenge. For those who are completely new to this, SSTI or Server-side Template Injection is a vulnerability in templating engine of a website that allows for arbitrary code execution. Like almost other web vulnerabilities, this is possible because user’s input is not sanitized.

Template engines are used to have consistent UI for the frontend side of the web. It combines dynamic input and the template to achieve that. For example, in this challenge, the website first ask for a name that will be rendered on the next page: