kreee00's almanac

TCP1P CTF 2024 - Writeup

Akram Faisal — Fri, 20 Dec 2024 00:00:00 GMT

Night Live at Indonesian

Oeman is a nightlife maniac tourist in 2007 - 2010, he came back to Indonesia to enjoy the nightlife but the place was closed, what was the name of the place? And who was the person who closed the place?

We were given 5 images of unidentified nightclub(s) and a text file with a link to a Facebook account. The link was https://www.facebook.com/stacy.putri?mibextid=LQQJ4d . I go through the account and most of the pictures are about the nightclub. I can't find any clue.

Each images have watermark of "indonesiaclubbing.com". Went to the link and can't find any clue as well. At the end I took this image below

and search using Yandex Image Search. I found this article about closure of a nightclub. It mentioned the name of politician that asked for the closure so I search him up on Wikipedia and finally got the flag

TCP1P{Basuki Tjahaja Purnama, 29 June 1966}

The Investigator

Help Jieyab found the newspaper. When was this newspaper published?

The flag name is date TCP1P{Date Month Year}

Upon the success of previous challenge, I tried to use Yandex Image Search again but to no avail. Google Image Search also doesn't show any similar images. I realised that the newspaper is in Dutch language. So I ran a google search "dutch newspaper archive" then came across these two links below

https://libguides.ru.nl/news/delpher
https://www.delpher.nl/

The second link I need to use VPN to access. Then I just search the newspaper's main title "Links Frankrijk wil rechtse pers breken" and the original uncropped article came up.

As you can see on left top there's the published date for the newspaper.

TCP1P{17 December 1983}

The Pentagon

A few days ago, I saw a funny post on a social media platform.

As far as I remember, there are five accounts that frequently post funny and random content.

I only remember two names: Udin Kurniawan Jaeger and Paijo Abdul Uchiha.

I recall that one of them uses a fake account. The humor in his posts is quite random, and I like it.

I want to know the real name of the person using that second account because I want to connect with him on his main account.

Please help me find his full real name.

The flag is the full name

Example: TCP1P{Kresna Yang Asli}

First thing I did, i google-ed both names given, "Udin Kurniawan Jaeger" and "Paijo Abdul Uchiha". Both showed a Reddit account but unfortunately both are suspended or deleted. So I use sherlock on both usernames sherlock ud1nwanj4eger paij0uch1h4. Turns out they got 9gag account. I went through ud1nwanj4eger's posts and stumbled upon ths one particular post with 14 comments

So I went through each comment and found a clue

At first I thought it was another 9gag posting so I go to this url https://9gag.com/u/DAJjWLRzVpw. But nothing came up. Then when I re-read the comment it says "that app with the photo logo", Instagram came to my mind. Thus, I just change the link to https://www.instagram.com/p/DAJjWLRzVpw/. It works! At the account bio it got mentioned "Second Account" which mentioned in challenge question. There's a link that direct you to a Discord channel. In the channel there's a bot with the same username, but when i try to chat it replied with

... Then I watch each posts on the Instagram account. One of the video, the audio sound distorted. I save the audio and play it using Audacity. Tried to play it at x0.5 but still sound like nonsense. So i try to reverse...and voila. The audio provide me with a password tcp1p_th3p3nt490n_1s4w3s0m3 , i send to the chat with the bot and finally

I opened the link and found the flag!

TCP1P{Slamet Setiawan Uzumaki}

Journalist

Oh no, help Jieyab to Found this video> Link vidio : https://drive.google.com/file/d/18zOX75x9gjITueQmwv0Bl9iffdQSYi5A/view?usp=sharing Hint : Flag is time or date the video was uploaded *Pro tips Convert your time in WIB ( UTC+7) on the date metadata

I randomly screenshot one of the scene in the video and search using Google Image Search

Found out the place is Shifa Hospital in Gaza City. So I open YouTube and type in this "shifa hospital gaza city jazeera". Watched all related videos to find the one that have the same reporter as the one in challenge video provided. Finally found the exact video >> https://www.youtube.com/watch?v=9dxQSvkow7Q

TCP1P{2 Apr 2024}

Curtin CTF 2024 - Writeup

Akram Faisal — Sat, 28 Dec 2024 00:00:00 GMT

Car on Fire Part 1

Screenshot the video and do a quick google image search. Found the article and the name of owner

CURTIN_CTF{Michael_Morris}

Crash at the Airdrome Part 1

Do a quick google image search. Found article and wikipedia. >> https://en.wikipedia.org/wiki/Lion_Air_Flight_904

CURTIN_CTF{CFM56-7B24E_19-02-2013}

Crash at the Airdrome Part 2

Search google "boeing 737-800 first flight"

CURTIN_CTF{31_07_1997}

Crash at the Airdrome Part 3

Did a LOT of research and digging. The distance at first I got it wrong but thankfully found the correct answer from this link >> https://airport.globefeed.com/Distance_Between_Airports_Result.asp?from=DPS&to=BDO . The name of PIC is just a basic Google Search. and Lastly the part number of Terrain Awareness and Alerting System PK-LKS Boeing 737-800 i got it from this accident report >> https://asn.flightsafety.org/reports/2013/20130413_B738_PK-LKS.pdf .

CURTIN_CTF{861_Mahlup_Gozali_965-1690-055}

picoCTF: Hidden in Plainsight Writeup

Akram Faisal — Tue, 28 Oct 2025 00:00:00 GMT

Hidden in plainsight

:::penguin_oldmoney This is an easy forensics challenge. The clue is to discover "hidden" payload and "extract" the flag.

Whenever I got an image in a forensics challenge, first step is to use exiftool. The image given is named img.jpg. I downloaded the image to my local linux machine. :::

exiftool img.jpg

Below is the result of the command.

…/forensics/hidden-in-plainsights ❯ exiftool img.jpg
ExifTool Version Number         : 13.36
File Name                       : img.jpg
Directory                       : .
File Size                       : 73 kB
File Modification Date/Time     : 2025:10:27 20:54:44+08:00
File Access Date/Time           : 2025:10:27 20:59:18+08:00
File Inode Change Date/Time     : 2025:10:27 20:55:25+08:00
File Permissions                : -rw-r--r--
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
JFIF Version                    : 1.01
Resolution Unit                 : None
X Resolution                    : 1
Y Resolution                    : 1
Comment                         : c3RlZ2hpZGU6Y0VGNmVuZHZjbVE9
Image Width                     : 640
Image Height                    : 640
Encoding Process                : Baseline DCT, Huffman coding
Bits Per Sample                 : 8
Color Components                : 3
Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)
Image Size                      : 640x640
Megapixels                      : 0.410

As you can see in the comment, there's a weird looking string. I would assume it is a base64 encoded string. So I try to decode the string using below command.

echo "c3RlZ2hpZGU6Y0VGNmVuZHZjbVE9" | base64 --decode

Output = steghide:cEF6endvcmQ=

There's another clue given there, steghide, that means we need to use steghide tool to solve this challenge, but first let's decode the base64 string given. I would assume that's the password to be used with steghide.

echo "cEF6endvcmQ=" | base64 --decode

Output = pAzzword

Now that we know what tool to use and the password, we can move on to the next step.

:::tip Run steghide --help if you don't know what command and flags to use. :::

steghide --extract -sf img.jpg -p pAzzword

Output = wrote extracted data to "flag.txt".

I run ls to list all available files inside my directory, and yes there's a new file created named flag.txt

Next just run cat command to print the content of the text file

cat flag.txt

Output = picoCTF{h1dd3n_1n_1m4g3_1c55ccd0}

Voila!

Automating the Unfixable: How I Tamed a Critical Polkitd Memory Leak

Akram Faisal — Tue, 09 Dec 2025 00:00:00 GMT

In the world of server maintenance, few things are as terrifying as opening htop and seeing red bars everywhere.

Recently, I ran into a critical issue on one of our Virtual Private Servers (VPS). The server was becoming sluggish, and services were timing out. When I investigated, I found that a single process was eating up almost 100% of both our RAM and our Swap memory.

The culprit? polkitd (The PolicyKit Daemon).

This is the story of how I went from manual server restarts to engineering a fully automated, fail-safe memory management solution.

🚨 The Incident: When 4GB Isn't Enough

It started with a simple observation: the server was running out of breath.

My first reaction was standard triage. I assumed we were simply under-provisioned or experiencing a temporary spike. I added an additional 4GB of Swap file (bringing the total memory cushion to 8GB) hoping that would give the server enough breathing room to stabilize.

I restarted the service manually to flush the memory:

sudo systemctl restart polkitd

The memory usage dropped. The red bars in htop turned green. I thought the job was done.

But a few days later, the creep started again. It wasn't a sudden spike; it was a slow, consistent memory leak. The daemon was hoarding memory and refusing to let it go, eventually threatening to crash the entire node.

🕵️ The Investigation

As a Computer Science student and DevOps enthusiast, I knew that constantly restarting a service manually wasn't a "solution"—it was a chore. I needed to understand the why.

I dove into the internet. I scoured forums, StackOverflow, and eventually landed on the official polkit source repository.

I wasn't alone. I found threads of other sysadmins complaining about the exact same behavior. When I asked in the community if there was a patch available, the answer was disheartening: "Up until now, there is still no fix."

I was at a crossroads. I couldn't fix the C code in polkitd overnight, and I couldn't wait for an upstream patch while my production server risked downtime.

🛠️ The Solution: If You Can't Fix It, Manage It

If I couldn't stop the leak, I had to contain it. I decided to build a "governor" for the process—an automated system that watches polkitd and restarts it gracefully before it becomes a problem.

I designed a two-layer defense system.

Layer 1: The Smart Hook (EarlyOOM)

For the primary defense, I utilized earlyoom, a daemon usually used to kill processes when memory is critically low. However, I didn't want to wait until the server was crashing to take action.

I wrote a custom Bash hook script that:

Identifies the polkitd process ID.
Reads the specific memory usage from /proc/[pid]/status.
Calculates its consumption percentage against the total available RAM.
Triggers a graceful systemctl restart if it exceeds a 12% threshold.

This ensures the service is refreshed without forcefully killing it, maintaining system stability.

Layer 2: The Fail-Safe (Systemd Resource Control)

Scripts can fail. Cron jobs can hang. As a DevOps engineer, you always need a backup plan. I needed a hard ceiling that the operating system would enforce, regardless of whether my script was running.

I used systemd's built-in resource control to set a hard limit on the service. I applied this using the following command:

sudo systemctl set-property polkit.service MemoryMax=1500M

This command modifies the service unit configuration on the fly. Now, if my hook script fails to catch the leak and polkitd balloons past 1.5GB, systemd will step in and throttle or restart the process to save the rest of the system (and my Docker containers) from crashing.

🚀 The Result

I deployed the solution on a Monday. Since then, I haven't had to SSH into the server to clear memory once.

Before: Daily manual checks, fear of crashes, 100% swap usage.
After: The hook script runs silently in the background, keeping polkitd lean, and the server metrics are stable.

I packaged this entire solution, including the detection logic, the hook scripts, and the installation steps—into an open-source tool so others facing this specific bug can implement a fix in minutes.

Check out the repo here: 👉 github.com/kreee00/polkitd-memory-manager

🧠 Lessons Learned

This project reinforced a few key DevOps philosophies for me:

Don't wait for upstream: Sometimes the "official fix" is months away. You have to build the bridge yourself.
Observability is key: Without tools like htop and understanding how to read /proc files, I would have just kept buying more RAM.
Automation > Manual Intervention: If you have to do it twice, script it. If it keeps breaking, automate the fix.

Dealing with memory leaks is never fun, but turning a system instability into a reliable, automated, "set-it-and-forget-it" solution was a massive win.

Thanks for reading my blog post :)

My No-Nonsense Guide to Setting Up SEEDLab Ubuntu on VMWare (Because VirtualBox is Cramping My Style)

Akram Faisal — Wed, 28 Jan 2026 00:00:00 GMT

First I just want to explain WTH is SEED Lab. Based on its website, Seed Lab is a Hands-on Labs for Security Education.

Started in 2002, funded by a total of 1.3 million dollars from NSF, and now used by 1180 institutes worldwide, the SEED project's objectives are to develop hands-on laboratory exercises (called SEED labs) for cybersecurity education, and to help instructors adopt these labs in their curricula.

:::tip If your university or course requires specific labs, the SEED website has a massive list of them, from software security to crypto and network attacks. This VM is your all-in-one playground for those. :::

There is a page on their website which helps students setup the lab on VirtualBox. But on my machine I already have VMWare installed, and I don't want to have multiple VM Software cluttering up my system. To addon, the file provided by SEEDLab is in .vmdk format which is native to VMWare. TBH I don't get why they don't just use VMWare instead of VirtualBox but whatever right? (Maybe it's a licensing thing, but the .vmdk file is a huge hint for us VMWare users).

Important Note: This guide uses VMWare Workstation Pro, but the steps are almost identical for VMWare Player (the free version). If you're using Player, just look for the "Create a New Virtual Machine" option, it's the same.

In this blog I won't be teaching how to install VirtualBox or VMWare, that is up to you to find the tutorials on YouTube or whatnot, believe me, there's a lot of them. (Pro tip: search "install VMWare Workstation 17" or whatever version you have).

Okay moving on.

Downloading the Pre-built Virtual Machine Images

As you can see from the screenshot above, there are several links which you can download from. Just choose whichever you like most 🤷🏻‍♂️. Sometimes one mirror might be slower depending on your location. But for me, the DigitalOcean link worked fast and reliable so I will paste the link below.

DigitalOcean Download Link

Storage Check: The download is about 2.6 GB, so make sure you have enough space and a decent internet connection. Go grab a coffee or a snack.

After downloaded just extract the zip file and you will get a list of files like in image below.

Okay done with 1st step. Good Job! Now let's move on to setting up on your VMWare hehehehehe 😈

Setup Pre-built Image in VMWare Workstation

Just for your information my VMWare version are as below. Don't worry if yours is slightly different (like 17.x or 16.x), the process is nearly identical.

Product: VMware® Workstation Pro 25H2
Version: 25.0.0.24995812

Okay, first fire up your VMWare.

Click on Create a New Virtual Machine and you will be greeted with the windows as below.

Choose Custom (advanced). This gives us more control, and it's actually simpler for importing an existing disk. Click next.

This screen is about hardware compatibility. Just leave it as the default (usually the latest version your VMWare supports). This ensures best performance. Click on next.

Very Important Step: Choose I will install the operating system later. If you choose the other option, VMWare might try to create a new blank disk, which is not what we want. We already have the OS on the .vmdk file. Click next.

For Operating System choose Linux and Version choose Ubuntu. Make sure to choose the 32-bit version because our pre-built SEEDUbuntu image is 32-bit (even though it says 16.04). Don't choose "Ubuntu 64-bit". Go to next.

This one it just ask you to name your Virtual Machine. The name is up to you but for my one I will just put SEEDUbuntu. Then for the Location, it is basically asking for a directory where VMWare will save all the VM Files.

:::tip I just choose the folder which I extracted the zip file earlier cause I don't want to make it messy and all over the place. This keeps everything self-contained. When done with the course I can just delete the entire folder and it's all gone, no leftover files scattered around. Hashahahhahah. Go next. :::

Starting below just follow the recommended suggestion. You can click "Next" through these pretty quickly.

For virtual RAM Memory based on website it says that 2GB (2048MB) is enough but I have extra RAM in my laptop so why not LOL. If you're tight on RAM, 2048MB is perfectly fine. If you can spare it, 4096MB (4GB) will make things snappier.

The Critical Step: For above, choose Use an existing virtual disk. This is where we tell VMWare, "Hey, don't make a new one, use the SEEDLab disk I already have." Click next.

Click Browse and go to the folder which you extracted the zip file earlier.

Choose the file named SEEDUbuntu-16.04-32bit.vmdk with the type of VMWare virtual disk and click Open. Double-check you're selecting the .vmdk file, not the .vmx or .vmsd.

Once you confirmed it's the correct file, click on next.

Just choose Keep Existing Format. There's no need to convert it.

If satisfied, click on Finish. Don't worry about the summary details too much.

Sometimes this page will pop-up, just close it, not important. It's just VMWare's info page.

If you see this that means your Virtual Machine is setup correctly, just click on Start up this guest operating system...

...and Voila! The VM should boot up into a login screen.

Login Credentials (SAVE THIS!):

Username: seed
Password: dees

One last step is to install the VMWare Tools (well, the open-source version) and you are ready to rock this course! This step is crucial for things like copying/pasting between your host machine and the VM, better screen resolution, and shared folders.

Open a terminal. You can find it in the applications menu or just press Ctrl+Alt+T.

Type below command inside the Terminal and Enter. This updates the package list and installs the open-vm-tools package, then reboots to make sure everything is activated.

sudo apt update && sudo apt install open-vm-tools
sudo reboot now

After the reboot, you're all set! The VM will automatically log in with the seed user. Now you can start exploring the labs on the Desktop or follow your course material.

Done!