Lab 11.3: Synthesis Mini-CTF

Introduction

Welcome to the Synthesis Mini-CTF of the Operating Systems course!

This challenge integrates the skills acquired throughout the session:

• System configuration
• Process and memory analysis
• Windows security
• PowerShell and scripting
• Inter-process communication
• Threat detection

Format

• Type: Capture The Flag (CTF)
• Duration: 90 minutes
• Points: 100 points total
• Flags: Format FLAG{flag_text}

---

Rules

1. Individual work - No collaboration during the CTF
2. Allowed resources:
   • Course notes
   • Microsoft documentation
   • Sysinternals tools
3. Prohibited resources:
   • Communication with other students
   • Online solutions
4. Submission: Copy the flags into the answer document

---

Environment

You have a prepared Windows VM with:

• Sysinternals tools installed
• PowerShell available
• Clues hidden in the system

Make sure to have a snapshot before starting!

---

Challenges

Challenge 1: System Reconnaissance (15 points)

Objective: Find hidden information in the system configuration.

Instructions:

1. A flag is hidden in the user environment variables
2. Find the variable containing the flag

Hint: The variable name starts with "SECRET_"

Configuration for the instructor (to do before the CTF):

# Add the environment variable
[Environment]::SetEnvironmentVariable("SECRET_CTF", "FLAG{env_vars_reveal_secrets}", "User")

Expected solution: FLAG{env_vars_reveal_secrets}

---

Challenge 2: Windows Registry (15 points)

Objective: Explore the registry to find a hidden flag.

Instructions:

1. A flag is hidden in a registry key
2. Search in HKCU:\Software\

Hint: The key is called "CoursSE"

Configuration:

# Create the registry key
New-Item -Path "HKCU:\Software\CoursSE" -Force
Set-ItemProperty -Path "HKCU:\Software\CoursSE" -Name "Flag" -Value "FLAG{registry_hunter_pro}"

Useful command:

Get-ItemProperty -Path "HKCU:\Software\CoursSE"

---

Challenge 3: Hidden Files (15 points)

Objective: Find a hidden file in the system.

Instructions:

1. A hidden file contains the flag
2. It is located in the user's Documents folder
3. The file uses an Alternate Data Stream (ADS)

Configuration:

# Create the file with ADS
$path = [Environment]::GetFolderPath("MyDocuments")
Set-Content "$path\readme.txt" -Value "This is a normal file."
Set-Content "$path\readme.txt:secret" -Value "FLAG{ads_are_sneaky}" -Stream "secret"

Useful command:

Get-Item "$path\readme.txt" -Stream *
Get-Content "$path\readme.txt" -Stream secret

---

Challenge 4: Suspicious Service (20 points)

Objective: Identify a suspicious service and find its flag.

Instructions:

1. A service was created with a description containing a flag
2. The service is not started
3. Find it among the installed services

Configuration:

# Create a fake service (requires admin)
New-Service -Name "SvcCTF" -BinaryPathName "C:\Windows\System32\cmd.exe" `
    -DisplayName "Windows CTF Helper" `
    -Description "FLAG{service_enumeration_master}" `
    -StartupType Manual

Useful commands:

Get-Service | Where-Object { $_.DisplayName -like "*CTF*" }
Get-WmiObject Win32_Service | Where-Object { $_.Description -like "*FLAG*" }

---

Challenge 5: Process and Memory (20 points)

Objective: Analyze a process to find a flag.

Instructions:

1. A PowerShell script runs in the background
2. It contains the flag in its command line arguments
3. Use analysis tools to find it

Configuration:

# Start a process with the flag in argument
Start-Process powershell -ArgumentList "-NoExit -Command `"Write-Host 'Background process'; while(`$true){Start-Sleep 60}`"" -WindowStyle Hidden
# The real flag would be in the arguments
Start-Process powershell -ArgumentList "-NoExit -Command `"`$flag='FLAG{process_forensics_win}'; while(`$true){Start-Sleep 60}`"" -WindowStyle Hidden

Useful commands:

Get-WmiObject Win32_Process | Select-Object Name, ProcessId, CommandLine
Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -like "*FLAG*" }

---

Challenge 6: Network and Connections (15 points)

Objective: Analyze network connections to find a clue.

Instructions:

1. A server listens on an unusual port
2. Connect to the server to get the flag
3. The port is between 8000 and 9000

Configuration:

# Server script to run before the CTF
$listener = [System.Net.Sockets.TcpListener]::new([System.Net.IPAddress]::Loopback, 8888)
$listener.Start()
Write-Host "CTF server listening on port 8888"
while ($true) {
    $client = $listener.AcceptTcpClient()
    $stream = $client.GetStream()
    $writer = [System.IO.StreamWriter]::new($stream)
    $writer.WriteLine("FLAG{network_detective}")
    $writer.Flush()
    $client.Close()
}

Useful commands:

# Find listening ports
Get-NetTCPConnection -State Listen | Where-Object { $_.LocalPort -gt 8000 -and $_.LocalPort -lt 9000 }

# Connect
$client = New-Object System.Net.Sockets.TcpClient("127.0.0.1", 8888)
$reader = New-Object System.IO.StreamReader($client.GetStream())
$reader.ReadLine()

---

Bonus Challenge (10 points)

Challenge 7: Scheduled Task

Objective: Find a flag hidden in a scheduled task.

Configuration:

# Create a scheduled task with the flag
$action = New-ScheduledTaskAction -Execute "cmd.exe" -Argument "/c echo FLAG{scheduled_task_investigator}"
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date).AddYears(1)
Register-ScheduledTask -TaskName "CTF_Task" -Action $action -Trigger $trigger -Description "Hidden CTF challenge"

Useful command:

Get-ScheduledTask | Where-Object { $_.TaskName -like "*CTF*" }
(Get-ScheduledTask -TaskName "CTF_Task").Actions

---

Answer Sheet

Name: ______________________
Date: ______________________

Challenge 1 (15 pts): FLAG{_____________________}
Challenge 2 (15 pts): FLAG{_____________________}
Challenge 3 (15 pts): FLAG{_____________________}
Challenge 4 (20 pts): FLAG{_____________________}
Challenge 5 (20 pts): FLAG{_____________________}
Challenge 6 (15 pts): FLAG{_____________________}
Bonus (10 pts):       FLAG{_____________________}

Total: _____ / 110 points

---

Evaluation Criteria

Challenge	Points	Difficulty
1. Env variables	15	Easy
2. Registry	15	Easy
3. ADS	15	Medium
4. Services	20	Medium
5. Process	20	Hard
6. Network	15	Medium
7. Bonus	10	Hard

---

Instructor Guide

VM Preparation

# Full CTF setup script
# Run as administrator before starting

Write-Host "Configuring the Mini-CTF..." -ForegroundColor Cyan

# Challenge 1 - Environment variable
[Environment]::SetEnvironmentVariable("SECRET_CTF", "FLAG{env_vars_reveal_secrets}", "User")

# Challenge 2 - Registry
New-Item -Path "HKCU:\Software\CoursSE" -Force | Out-Null
Set-ItemProperty -Path "HKCU:\Software\CoursSE" -Name "Flag" -Value "FLAG{registry_hunter_pro}"

# Challenge 3 - ADS
$docPath = [Environment]::GetFolderPath("MyDocuments")
Set-Content "$docPath\readme.txt" -Value "This is a normal documentation file."
Set-Content "$docPath\readme.txt:secret" -Value "FLAG{ads_are_sneaky}" -Stream "secret"

# Challenge 4 - Service (requires admin)
if ((New-Service -Name "SvcCTF" -BinaryPathName "C:\Windows\System32\cmd.exe" `
    -DisplayName "Windows CTF Helper" `
    -Description "FLAG{service_enumeration_master}" `
    -StartupType Manual -ErrorAction SilentlyContinue)) {
    Write-Host "Service created" -ForegroundColor Green
}

# Challenge 5 - Process
Start-Process powershell -ArgumentList "-WindowStyle Hidden -NoExit -Command `"`$flag='FLAG{process_forensics_win}'; while(`$true){Start-Sleep 60}`"" 

# Challenge 7 - Scheduled task
$action = New-ScheduledTaskAction -Execute "cmd.exe" -Argument "/c echo FLAG{scheduled_task_investigator}"
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date).AddYears(1)
Register-ScheduledTask -TaskName "CTF_Task" -Action $action -Trigger $trigger -Description "Hidden CTF" -Force | Out-Null

Write-Host "Configuration complete!" -ForegroundColor Green
Write-Host "Don't forget to start the network server (Challenge 6) separately."

Starting the Network Server (Challenge 6)

# Run in a separate window
$listener = [System.Net.Sockets.TcpListener]::new([System.Net.IPAddress]::Loopback, 8888)
$listener.Start()
Write-Host "CTF server listening on port 8888..."
while ($true) {
    $client = $listener.AcceptTcpClient()
    $stream = $client.GetStream()
    $writer = [System.IO.StreamWriter]::new($stream)
    $writer.WriteLine("FLAG{network_detective}")
    $writer.Flush()
    $client.Close()
    Write-Host "Client served."
}

Cleanup After the CTF

# Cleanup script
[Environment]::SetEnvironmentVariable("SECRET_CTF", $null, "User")
Remove-Item "HKCU:\Software\CoursSE" -Recurse -Force -ErrorAction SilentlyContinue
$docPath = [Environment]::GetFolderPath("MyDocuments")
Remove-Item "$docPath\readme.txt" -Force -ErrorAction SilentlyContinue
Stop-Service "SvcCTF" -ErrorAction SilentlyContinue
sc.exe delete "SvcCTF"
Get-Process powershell | Where-Object { $_.CommandLine -like "*flag=*" } | Stop-Process -Force
Unregister-ScheduledTask -TaskName "CTF_Task" -Confirm:$false -ErrorAction SilentlyContinue
Write-Host "Cleanup complete." -ForegroundColor Green

---

Conclusion

This Mini-CTF tests your mastery of fundamental concepts:

• Windows system exploration
• PowerShell usage
• Basic forensic analysis
• Security and detection

Good luck! 🎯

---

Mini-CTF developed as part of the Operating Systems course - MODULE 11