https://joe.lothan.net/Recent content in Home on Joe LothanHugo -- gohugo.ioen-usThu, 18 Jun 2026 00:00:00 +0000https://joe.lothan.net/blog/ticker-tape/Thu, 18 Jun 2026 00:00:00 +0000https://joe.lothan.net/blog/ticker-tape/Last Saturday night the Knicks won the NBA finals for the first time in over 50 years. The mood in the city that night was jubliant, or so I was told, as I was watching the game at a wedding out of state. (I do believe the Knicks win blessed the wedding, or maybe vice versa) So when Mayor Mamdani announced on Sunday there will be a ticker-tape parade on Thursday, I was excited about an opportunity to celebrate in the city.https://joe.lothan.net/blog/helix-android/Thu, 06 Feb 2025 12:00:00 +0000https://joe.lothan.net/blog/helix-android/Bad vibes I often find myself needing to edit text on an emulated Android system and it’s always a pain. Rebuilding from source takes too long. Editing the file on my computer and then adb pushing it over is cumbersome. So I often reach for the toybox implementation of vi to read and edit files, but it leaves a lot to be desired. The thing I miss the most is syntax highlighting.https://joe.lothan.net/blog/emulating-exploiting-uefi/Fri, 29 Sep 2023 00:00:00 +0000https://joe.lothan.net/blog/emulating-exploiting-uefi/https://joe.lothan.net/ctfs/2023-crack-the-elf/Wed, 11 Jan 2023 12:00:00 +0000https://joe.lothan.net/ctfs/2023-crack-the-elf/The Challenge A Tiny one to start, based on the works of TheXCellerator in Tmp.0ut (link) We’re given a tiny x86_64 ELF binary (only 301 bytes!), which uses TheXCellerator’s libgolf to mangle the ELF header. The binary is runnable on 64-bit Linux, but breaks many static analysis tools that trust the ELF header. TinyTurb0 > readelf -a ./tiny_turb0 ELF Header: Magic: 7f 45 4c 46 58 58 58 58 58 58 58 58 58 58 58 58 Class: <unknown: 58> Data: <unknown: 58> Version: 88 <unknown> OS/ABI: <unknown: 58> ABI Version: 88 Type: EXEC (Executable file) Machine: Advanced Micro Devices X86-64 Version: 0x58585858 BinaryNinja also has trouble, but by using “Make Function at This Address” at byte 0x78 (the end of the ELF header and Program header), we can read the IL.https://joe.lothan.net/ctfs/2021-advent-otw/08-strip-me/Tue, 22 Mar 2022 12:00:00 -0600https://joe.lothan.net/ctfs/2021-advent-otw/08-strip-me/Challenge Description Santa wants to make sure he doesn’t leak the location of his secret base through image metadata. Therefore, he uses this web service to strip metadata from his photos before publishing them. But he isn’t sure whether it’s secure. Can you tell him? Overview We are given a website that takes an image and returns it striped of it’s metadata, but we don’t have the site’s source code. After a bit of web fuzzing, we find that the filename parameter is vulnerable to command injection, which we can use to get a shell on the machine and grab the flag.https://joe.lothan.net/blog/mikrotik-authentication-revealed/Thu, 10 Feb 2022 00:00:00 +0000https://joe.lothan.net/blog/mikrotik-authentication-revealed/https://joe.lothan.net/ctfs/2021-advent-otw/00-warmup/Mon, 20 Dec 2021 15:51:25 -0600https://joe.lothan.net/ctfs/2021-advent-otw/00-warmup/Challenge Description Due to some Grinchey shenanigans, this year the OverTheWire Advent Bonanza CTF will run from Tuesday December 07 until Sunday December 19, however, as is tradition we have a cosy day0 warmup challenge from Retr0id to keep you busy: Be sure to keep the flag for when the CTF begins, the flag format is AOTW{???}. Overview We’re given a PNG, but after some investigation, we find it’s not just a PNG.https://joe.lothan.net/ctfs/2021-advent-otw/09-santas-secrets/Sun, 19 Dec 2021 17:35:43 -0600https://joe.lothan.net/ctfs/2021-advent-otw/09-santas-secrets/Challenge Description Santa built a service to allow elves to encrypt secret data without having access to the keys. (Download Files) Overview We’re given a python webserver with an encrypted flag and the key that was used to encrypt it, but we can only read the encrypted flag and use the key to encrypt data, not read the key itself. Using a bug in python data encoding, we can overwrite successive bytes of the key, use it to encrypt known data, and brute force the entire key, using it to decrypt the flag.https://joe.lothan.net/ctfs/2021-advent-otw/07-jigsaw/Sun, 19 Dec 2021 11:14:23 -0600https://joe.lothan.net/ctfs/2021-advent-otw/07-jigsaw/Challenge Description Santa has hidden a secret message on the backside of a jigsaw puzzle that he completed. Sadly, one of his elves dropped the completed puzzle, shuffling all the pieces. Can you verify that it is indeed impossible for the Grinch to recover this message? Downloaded File Overview We are given a bunch of PNGs with jigsaw pieces on them, looking at their metadata we can order them and extract a secret messagehttps://joe.lothan.net/ctfs/2021-advent-otw/12-christmas-true/Sat, 18 Dec 2021 10:37:09 -0600https://joe.lothan.net/ctfs/2021-advent-otw/12-christmas-true/Challenge Description Santa and Grinch forces have declared a fragily truce. It is your job to keep the truce going by keeping Christmas cheer high. Read more on how to do this by following the provided link. (that link) Overview For this challenge, you had to make pancakes and soup, donate to a charity, and/or wear christmas clothes to get a flag. No, really. Hardest flag to find? A good looking christmas sweater.https://joe.lothan.net/ctfs/2021-adversary-quest/tabnabbed/Fri, 12 Feb 2021 19:47:25 -0600https://joe.lothan.net/ctfs/2021-adversary-quest/tabnabbed/Challenge Description: Good job! Your work helped us avert greater damage at the victim. Unfortunately the group came back and infiltrated another host. This time they hacked into the customer’s central git repository host, installed a hook that enforces their source code indentation ideology and kicked the legitimate admins out. Before the admins lost access they were able to create a snapshot. With their consent, can you find a way back into the host at: tabnabbed.https://joe.lothan.net/ctfs/2021-adversary-quest/matrix/Wed, 10 Feb 2021 19:47:16 -0600https://joe.lothan.net/ctfs/2021-adversary-quest/matrix/Challenge Description: With the help of your analysis, we got onto the trail of the group and found their hidden forum on the Deep Dark Web. Unfortunately, all messages are encrypted. While we believe that we have found their encryption tool, we are unsure how to decrypt these messages. Can you assist? Write-Up: We are given crypter.py, a semi-obfuscated python script and a bunch of encrypted text on the darkweb forum.https://joe.lothan.net/ctfs/2021-adversary-quest/proclaimation/Wed, 10 Feb 2021 19:47:09 -0600https://joe.lothan.net/ctfs/2021-adversary-quest/proclaimation/Challenge Description: A mysterious file appeared on a deep dark web forum. Can you figure out what we can’t see right now? Write-Up: We are given a strange 512 byte file proclaimation.dat that file sees as a boot partition. $ wc proclamation.dat 1 8 512 proclamation.dat $ xxd proclamation.dat | head 00000000: bc00 20b4 0730 c031 c9b7 8ab6 61b2 61cd .. ..0.1....a.a. 00000010: 10b4 0231 d230 ffcd 10eb 465e 83c6 14b2 .https://joe.lothan.net/ctfs/2021-adversary-quest/many-neurotoxin/Sat, 06 Feb 2021 19:51:06 -0600https://joe.lothan.net/ctfs/2021-adversary-quest/many-neurotoxin/Challenge Description: Our investigation revealed that CATAPULT SPIDER uses artificial intelligence to classify images. We initially believed that they only encrypt cat pictures - but we now learned that they encrypt all images except Doge photographs. We recovered their classifier and model and believe it should be possible to subvert their classification method to protect images against encryption. We are providing a TAR file that contains their classification logic, model, and three pictures that must be protected at all cost.https://joe.lothan.net/ctfs/2021-adversary-quest/module-wow/Thu, 04 Feb 2021 19:50:45 -0600https://joe.lothan.net/ctfs/2021-adversary-quest/module-wow/Challenge Description: Diving deeper into CATAPULT SPIDER’s malware, we found that it also supports handing off tasks to external modules. We identified one such module that looks like it might be used to validate a key or password of some sorts, but we’re really not sure. Can you validate our assumption, and, if possible, extract the key? Write-Up: This challenge is really interesting, we end up doing frequency analysis on some ciphertext to decrypt a key - but the “plaintext” is in x86_64 assembly language.https://joe.lothan.net/ctfs/2021-adversary-quest/very-protocol/Thu, 04 Feb 2021 19:50:40 -0600https://joe.lothan.net/ctfs/2021-adversary-quest/very-protocol/Challenge Description: We were approached by a CATAPULT SPIDER victim that was compromised and had all their cat pictures encrypted. Employee morale dropped to an all-time low. We believe that we identified a binary file that is related to the incident and is still running in the customer environment, accepting command and control traffic on veryprotocol.challenges.adversary.zone:41414 Can you help the customer recover the encryption key? Write-up: For this challenge we are given a (46MB!https://joe.lothan.net/ctfs/2021-adversary-quest/egghunt/Thu, 04 Feb 2021 19:50:09 -0600https://joe.lothan.net/ctfs/2021-adversary-quest/egghunt/Challenge Description: After moving laterally, PROTECTIVE PENGUIN compromised a number of additional systems and gained persistence. We have identified another host in the DMZ that we believe was backdoored by the adversary and is used to regain access. Please download a virtual machine image of that host and identify the backdoor. Validate your findings in our test environment on egghunt.challenges.adversary.zone. Write-Up: This was hands-down my favorite challenge. I knew nothing about BPF before starting and I learned a lot.https://joe.lothan.net/ctfs/2021-adversary-quest/much-sad/Sat, 30 Jan 2021 19:50:36 -0600https://joe.lothan.net/ctfs/2021-adversary-quest/much-sad/Challenge Description: We have received some information that CATAPULT SPIDER has encrypted a client’s cat pictures and successfully extorted them for a ransom of 1337 Dogecoin. The client has provided the ransom note, is there any way for you to gather more information about the adversary’s online presence? Write-Up: For this challenge, we’re given a ransom note from a client and asked to track down the adversary’s online presence. Apparently Catapult Spider encrypted a client’s cat pictures and extorted them for 1337 dogecoin.https://joe.lothan.net/ctfs/2021-adversary-quest/tulebox/Sat, 30 Jan 2021 19:50:05 -0600https://joe.lothan.net/ctfs/2021-adversary-quest/tulebox/Challenge Description: We just received another report that PROTECTIVE PENGUIN was identified at a company that provides access to mapping software as a service. The adversary allegedly elevated privileges and then moved laterally to a backup server. We were provided with a Virtual Machine Image of the mapping service. Can you analyze the image and reproduce the attack? If you think you’ve got it, the victim let us stand up an exact replica of their environment so that you can validate your results:https://joe.lothan.net/ctfs/2021-adversary-quest/portal/Sat, 30 Jan 2021 19:50:00 -0600https://joe.lothan.net/ctfs/2021-adversary-quest/portal/Challenge Description: PROTECTIVE PENGUIN gained access to one of their victims through the victim’s extranet authentication portals and we were asked to investigate. Please download the Portal Code and see whether you can reproduce their means of initial access vector. We stood up a test instance of the authentication portal for you to validate against. Write-Up: This challenge had an interesting authentication bypass via a buffer overflow. Let’s take a look.