• URL: https://play.picoctf.org/practice/challenge/348
• Title: FindAndOpen
• Tags: Modern, Forensics, picoCTF 2023
• Author:
• Started: 16 July 2025
• Solved: 16 July 2025
• Description: Mubarak Mikail

Someone might have hidden the password in the trace file. Find the key to unlock this file. This tracefile might be good to analyze.

This one was kind of tricky. I opened dump.pcap using Wireshark and found this suspicious packet

The frame number was 48 so I used tshark for this one

• URL: https://play.picoctf.org/practice/challenge/456
• Title: Event-Viewing
• Tags: Medium, Forensics, picoCTF 2025, browser_webshell_solvable
• Author: Venax
• Started: 16 July 2025
• Solved: 16 July 2025
• Description:

One of the employees at your company has their computer infected by malware! Turns out every time they try to switch on the computer, it shuts down right after they log in. The story given by the employee is as follows:

1. They installed software using an installer they downloaded online
2. They ran the installed software but it seemed to do nothing
3. Now every time they bootup and login to their computer, a black command prompt screen quickly opens and closes and their computer shuts down instantly.

See if you can find evidence for the each of these events and retrieve the flag (split into 3 pieces) from the correct logs! Download the Windows Log file here

…