Washi Posted August 31, 2022 Posted August 31, 2022 Fasten your seatbelts; Flare-On 9 starts on September 30! https://www.mandiant.com/resources/blog/announcing-ninth-flareon-challenge 3
kao Posted August 31, 2022 Posted August 31, 2022 The timing couldn't be worse... but I'm still going to enjoy it immensely!
bluedevil Posted October 1, 2022 Posted October 1, 2022 7th challenge (anode) is a 55mb nodejs executable. Now waiting disassembler for loading it.
w00she Posted October 1, 2022 Posted October 1, 2022 (edited) Any tips on how to approach the third challenge ? Edited October 2, 2022 by w00she
Coca Posted October 2, 2022 Posted October 2, 2022 On 10/1/2022 at 10:47 PM, w00she said: Any tips on how to approach the third challenge ? Expand Reveal hidden contents U = up
Coca Posted October 2, 2022 Posted October 2, 2022 About the ch4, the VirtualAlloc function is only a decoy? thx
Rol Posted October 2, 2022 Posted October 2, 2022 I also have problem this challenge. I try have put BP into "SDL_TEXTEDITING" and "SDL_TEXTINPUT" but It is not working
Ralf Posted October 2, 2022 Posted October 2, 2022 On 10/2/2022 at 5:37 AM, Coca said: About the ch4, the VirtualAlloc function is only a decoy? thx Expand it's very important for get correct strings
deepzero Posted October 2, 2022 Posted October 2, 2022 > About the ch4, the VirtualAlloc function is only a decoy? thx no > I try have put BP Keep looking. For example Reveal hidden contents remember the action happens when you hit return key Quick question regarding challenge 5, is it possible to solve this offline without data from the flare-on server? or is an online connection required?
kao Posted October 2, 2022 Posted October 2, 2022 (edited) @deepzero: all FLARE challenges can be solved offline. EDIT: to clarify - you don't need to communicate with flare-on servers. But you might consider making your own server for... something... Edited October 2, 2022 by kao 1
Aeri Posted October 2, 2022 Posted October 2, 2022 Hi, Can someone give me a small hint for ch6 ? I really don't get it right now. Something is obviously missing. Am I supposed to work with the provided sample ? I though it would be related to some past challenge's binaries, but nothing can interact with it ... This is a bit frustrating to face something like this
f355 Posted October 2, 2022 Posted October 2, 2022 anyone can give me a hint on ch4? Reveal hidden contents Patched the exe so now I can enter passwords for the binary and see if that returns the flag. Should I write a brute forcer for the password?
Aeri Posted October 3, 2022 Posted October 3, 2022 On 10/2/2022 at 10:58 PM, f355 said: anyone can give me a hint on ch4? Reveal hidden contents Patched the exe so now I can enter passwords for the binary and see if that returns the flag. Should I write a brute forcer for the password? Expand Reveal hidden contents Patching may not be the right approach. Bruteforcing is definitively not the right approach. Maybe what you've patched is acting as a way to check if the password is correct ... Take the time to understand what you've patched. It's here for a reason.
vfsrfs Posted October 4, 2022 Posted October 4, 2022 hi can some give me a hint for ch6? Any help would be greatly appreciated. Reveal hidden contents Found the client code (dotNet), but I have no idea where to look for the server code.
loossy Posted October 4, 2022 Posted October 4, 2022 hello I'm on challenge 5. I'm doing an analysis, but I don't know what points to look at. Could you give me a little hint?
Washi Posted October 4, 2022 Author Posted October 4, 2022 On 10/4/2022 at 4:07 PM, loossy said: I'm doing an analysis, but I don't know what points to look at. Expand Reveal hidden contents You have a network trace, and an executable that generated it somehow. Find out how it did it
Washi Posted October 4, 2022 Author Posted October 4, 2022 @vfsrfs Reveal hidden contents It's all in the same program, just maybe not in the place you may expect it from a typical .NET application...
endered Posted October 5, 2022 Posted October 5, 2022 Hi, could someone give me a hint on ch7 pls? Reveal hidden contents Can I solve it just by relying on that JS code alone? I didn't find any more valuable code other than JS code. But the JS code doesn't behave the same way as binary when I run it locally, there is an apparently weird `if` condition that doesn't trigger when executing the binary.
kao Posted October 5, 2022 Posted October 5, 2022 (edited) @endered: Reveal hidden contents On 10/5/2022 at 4:50 AM, endered said: JS code doesn't behave the same way as binary when I run it locally Expand Figure out why is that and how to work around it. Edited October 5, 2022 by kao
Even Posted October 6, 2022 Posted October 6, 2022 Could I talk through my thought process with someone here on 6? I believe I'm looking at the pertinent part of the binary, and I've made progress and have written it up in notes and can discuss how I've made it this far, but I could use a sanity check.
loossy Posted October 6, 2022 Posted October 6, 2022 I'm doing challenge 5. The first communication was decrypted, but a binary that did not know what it meant came out. In the second communication, it was "CLR" and could not be decrypted. Are there any points I should focus on?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now