Pi Hediyem Var Cybersecurity Game #17

After a long hiatus, I’m back with the first Pi Hediyem Var (I Have Pi Gift) game of 2019. Just like in previous games, I will be giving away 3 Raspberry Pi 4 devices through a draw among university students who successfully complete this game. I would like to express my gratitude to Erdinç BALCI, the Country Manager of Keepnet Labs Turkey, who is the Pi sponsor for this game, both on my behalf and on behalf of all gamers.

Regarding the game, one of your organization’s employees realizes that after entering their credit card information on a deal website they visited to get a service, they were redirected to a different website. Suspicion arises that their credit card information may have been stolen, and the employee seeks your assistance to shed light on this matter. Our hero, who has been reading news about cyberattacks on websites using the Magento e-commerce platform lately and is part of the Corporate SOCIAL MEDIA (SOME) team, visits this website from their virtual system to begin analyzing web traffic for suspicious code detection, and our story begins here.

To successfully complete the game, you need to answer all of the following questions in detail, along with evidence (code snippets, screenshots, etc.).
To answer the questions, you must first download the suspicious file that needs to be examined from the following link: https://www.dropbox.com/s/yyfretoo11hopq8/ctf17.zip?dl=0. You can analyze the file using the Fiddler tool. (zip password: infected)

Instructions & Questions:

  1. Find the files containing malicious code.
  2. Decode at least a 50-character hidden string (strings) from the code. (Using ready-made deobfuscator programs is prohibited.)
  3. Based on the previous step, identify which web address the malicious code sent the stolen information to.
  4. Based on your analysis, state at least 5 pieces of information that the malicious code could steal from the customer.
  5. Based on the information obtained from code analysis, make an educated guess about which hacking group may have developed the malicious code.

For those who haven’t won a Raspberry Pi before and wish to participate in the draw or want to be included in the list of those who have successfully completed the game, they must send the detailed solution path, their name, surname, age, and contact information to me or my email address with evidence (code, screenshots, etc.) by Saturday, July 27th at 20:00.

A blog post containing the solution path of the game will be published in the coming days, and the lucky winner will be announced on this page and my Twitter account.

Note: While solving this game, please remember that you are dealing with malicious software and conducting code analysis. I strongly recommend working with an isolated and up-to-date virtual system software (such as VMware, VirtualBox, etc.).


Good Luck

Hediye Pi

image_pdfShow this post in PDF formatimage_printPrint this page
Leave a Reply

Your email address will not be published. Required fields are marked *

You May Also Like
Read More

Antimeter Tool

Generally I prefer writing my articles in Turkish and I support my articles with proof of concept codes, videos and small tools. In my previous article, I created a small tool called antimeter which scans memory for detecting and also killing Metasploit’s meterpreter. I did not expect that much interest…
Read More
Read More

WhatsApp Scammers

Introduction I recently received my share of calls and messages from foreign cell phone numbers, disturbing almost everyone, especially in Turkey, who has used the WhatsApp application in recent days. Of course, as in my articles on other scams (Exposing Pig Butchering Scam, LinkedIn Scammers, Instagram Scammers), I rolled up…
Read More
Read More

New Job, New Me

It’s been quite a journey, after 10 long years filled with career successes and six promotions, I started my role as a Mid-Level Security Specialist at IBTech in June 2007. Just last week, I bid farewell to my position as Technical Leader. It turns out that leaving behind colleagues you’ve…
Read More