CyberDefenders: BlueTeam CTF Challenges

AfricanFalls

SHA1SUM	475b5c8c679ef034541edbd761faad5b5441656e
Published	June 15, 2021
Author	DFIRScience
Size	672 MB
Tags	Windows FTKImager Disk Tor

Instructions	Unzip the challenge (pass: cyberdefenders.org)

Your progress

0% Completed0/11 Questions

Your score

0/525

Digital Forensics

Last solve

6 days ago by Thuldrak

John Doe was accused of doing illegal activities. A disk image of his laptop was taken. Your task is to analyze the image and understand what happened under the hood.

Tools:

#	Question	Weight	Solved
#1	What is the MD5 hash value of the suspect disk?	25	419
Hint Report an issue

#2	What phrase did the suspect search for on 2021-04-29 18:17:38 UTC? (three words, two spaces in between)	25	325
Hint Report an issue

#3	What is the IPv4 address of the FTP server the suspect connected to?	25	325
Hint Report an issue

#4	What date and time was a password list deleted in UTC? (YYYY-MM-DD HH:MM:SS UTC)	25	309
Hint Report an issue

#5	How many times was Tor Browser ran on the suspect's computer? (number only)	50	316
Hint Report an issue

#6	What is the suspect's email address?	50	291
Hint Report an issue

#7	What is the FQDN did the suspect port scan?	50	277
Hint Report an issue

#8	What country was picture "20210429_152043.jpg" allegedly taken in?	50	299
Hint Report an issue

#9	What is the parent folder name picture "20210429_151535.jpg" was in before the suspect copy it to "contact" folder on his desktop?	75	278
Hint Report an issue

#10	A Windows password hashes for an account are below. What is the user's password? Anon:1001:aad3b435b51404eeaad3b435b51404ee:3DE1A36F6DDB8E036DFD75E8E20C4AF4:::	75	252
Hint Report an issue

#11	What is the user "John Doe's" Windows login password?	75	232
Hint Report an issue

Submit Writeup