Magnet Virtual Summit 2021 CTF

It's that time of year again and we are back virtually for the Magnet User Summit. This year we get some new devices for the CTF competition. Here, I will dive head first into the Chromebook.

Question 1 - Promise Me (5 points)

How many promises does Wickr make?

We can navigate to the PDF found in the Downloads folder at the following path:

chromebook.tgz\.\decrypted\mount\user\Downloads\Wickr-Customer-Security-Promises-November-2020.pdf

On page 3, it gives Wickr's Customer Security Promises as shown below.

Figure 1: wickr promises

As you can see there are 9 of them.

Question 2 - Road Trip! (5 points)

What city was Eli's destination in?

Under Google Maps Queries we can sort the Destination Address column and see the only results were for Plattsburgh, in New York.

Figure 2: Google Maps Queries destinations

Question 3 - Smile for the camera (5 points)

What is the MD5 hash of the user's profile photo?

Drilling down into the file system we can navigate to the Avatar Images folder to the picture at the path:

chromebook.tgz\.\decrypted\mount\user\Accounts\Avatar Images\eflatt610@gmail.com

We can see the MD5 hash was 5ddd4fe0041839deb0a4b0252002127b. Oh hey Eli!

Figure 3: Avatar information from Chromebook

Question 4 - The folder to store all your data in (5 points)

How many files are in Eli's downloads directory?

Navigating to the following path shows what was downloaded:

chromebook.tgz\.\decrypted\mount\user\Downloads

We can see 6 documents were downloaded to the Chromebook.

Figure 4: Downloads folder

Question 5 - Autofills, roll out (10 points)

Which word was Autofilled the most?

This one I was a little confused about what the real answer was. Heading over to the Chrome Autofill section we can see three different entries and one with the most entries, a count of 3. The value which is what is actually filled in was "e.flatt610@gmail.com", but that was incorrect. The Name column shows "email" which was the answer. I wouldn't have thought the actual value input would have been the proper answer but shows I was incorrect.

Figure 5: Chrome Autofills

Question 6 - Dress for success (10 points)

In bytes, what is the logical size of this bird's image?

The question and the name give hints on what to look for here. Found in the Downloads folder was an image called tux.png, the Linux mascot, who is a penguin. Get it?! The logical size was 46,791 bytes.

Figure 6: tux.png

Question 7 - Key-ty Cat (10 points)

What are the last five characters of the key for the Tabby Cat extension?

A quick Google search showed Tabby Cat had an GUID string of "mefhakmgclhhfbdadeojlkbllmecialg".

https://chrome.google.com/webstore/detail/tabby-cat/mefhakmgclhhfbdadeojlkbllmecialg?hl=en

Navigating to the following path will give us the Extension folder and any details for it:

chromebook.tgz\.\decrypted\mount\user\Extensions\mefhakmgclhhfbdadeojlkbllmecialg\2.0.0_0

Inside the "manifest.json" configuration file we can see the key string is very long. The last five characters were DAQAB.

Figure 7: Tabby Cat manifest.json

Question 8 - Time to jam out (10 points)

How many songs does Eli have downloaded?

I didn't see any audio files in the Downloads folder so I kept digging and came across a Music folder at the following path:

chromebook.tgz\.\decrypted\mount\user\MyFiles\Music

We can see that there are only 2 mp3 files in the folder.

Figure 8: Music folder

Question 9 - It's about the journey not the destination (25 points)

How many miles would the trip have been if Eli took the long way? Answer to the single decimal digit (ex. 9.1).

When I think trips I think Google Maps and seeing what directions can be taken. There were two paths we could take to get this answer. The easy way was to find in Chrome Web Visits a hit for "Burlington, VT to Chick-fil-A - Google Maps".

https://www.google.com/maps/dir/Burlington,+VT/Chick-fil-A,+400+NY-3,+Plattsburgh,+NY+12901/@44.6924626,-73.5384464,12z/data=!4m10!4m9!1m2!1m1!1s0x4cca7a55b69b55e5:0xc35fe519720e498e!1m5!1m1!1s0x4cca4738fe36755b:0x41c2a04f9e4e5e38!2m2!1d-73.4872913!2d44.6970959

Heading to the URL we get Google Maps results showing the "long way" would have been 81.2 miles.

Figure 9: Google Maps web visit

Another way that this could have been solved is by looking at the screenshot taken and saved in the Downloads folder. It shows the same Google Maps page

chromebook.tgz\.\decrypted\mount\user\Downloads\Screenshot 2021-03-04 at 3.17.06 AM.png

Figure 10: Google Maps screenshot

Question 10 - Repeat customer (25 points)

What was Eli's top visited site? (Domain Name)

Heading on over to Chrome Top Sites we can see that "https://protonmail.com/" had the highest rank (lowest number) of 1.

Figure 11: Chrome Top Sites

Question 11 - Vroom Vroom (50 points)

What is the name of the car related theme?

I had trouble understanding the question at hand during the live CTF but looking at it afterwards, it was much easier than I made it out to be. I did a keyword search for "theme" and it resulted in a picture of a Lamborghini found in an extension path:

chromebook.tgz\.\decrypted\mount\user\Extensions\dkkklbgbfaeockpgbkleblklmcjdbnbj\1_0\images\theme_frame.png

Figure 12: Lamborghini theme

What I didn't realize at the time was I needed the full name of the actual theme. Doing a Google search of the extension GUID led me to the answer "Lamborghini Cherry", on the Chrome Web store.

Figure 13: Theme on Chrome Web Store

Search This Blog