Roasted Vault
Author: 0xIDA
Platform: FlagYard · Category: forensics · Difficulty: Hard
Solvers
Summary
PCAP of AS-REP roasting against CORP.LOCAL service accounts. Crackable passwords are built from wiki AD password-policy templates + LDAP attributes. Decrypted vault-sync AES-GCM payloads yield a JPEG and a multi-step encoding recipe; OCR/vision of the image gives the secret phrase, then bubble-babble → hex → modhex → SHA-256 → proquint → MD5 produces the flag.
Solution
Step 1: Kerberos AS-REP roast + policy-built passwords
# Extract AS-REP (etype 23) → hashcat 18200 / john krb5asrep
tshark -r roasted.pcap -Y 'kerberos.msg_type == 11' -T json
# Users without preauth: svc_kiosk_bak, svc_legacy, svc_archive, svc_backup
LDAP attributes (department, title, whenCreated, pwdLastSet) + Confluence policies:
| Policy | whenCreated | Construction |
|---|---|---|
| v2019.01 | before 2020 | sAMAccountName!YYYY |
| v2023.01 | 2020–2022 | department + YYYYMM(pwdLastSet) + title |
| v2024.06 | ≥ 2023 | DEPT-YYYYMM-role-symbol (symbol from sa_rotate_role_suffix) |
Cracked:
svc_legacy!2019
it_storage202401archive
it202402backup
FIN-202404-backup-$
Step 2: Decrypt vault-sync envelopes
POSTs to vault-sync.corp.local/api/v1/vault/sync carry:
{"user":"svc_backup","payload":"<b64>","kdf":"pbkdf2-sha256/200000/salt=username"}
key = pbkdf2_hmac("sha256", password, username, 200000, 32)
# AES-GCM: 12-byte nonce prefix + ciphertext + 16-byte tag
svc_backup payload includes secret_doc.jpg (b64) and:
Flag = FlagY{md5(T5)}
T1 = bubble_babble_encode(<secret-doc-phrase>)
T2 = hex(utf8_bytes(T1))
T3 = modhex(T2)
T4 = sha256(utf8_bytes(T3))
T5 = proquint_encode(T4)
Step 3: Secret phrase + recipe
Image graffiti (vision): CH40S_3V3RYWH3R3
from bubblepy import BubbleBabble
import hashlib
T1 = BubbleBabble().encode(b"CH40S_3V3RYWH3R3")
# xibog-matef-byguh-zasuh-kysoh-dokah-ledef-fugof-fuxox
T2 = T1.encode().hex()
T3 = T2.translate(str.maketrans("0123456789abcdef", "cbdefghijklnrtuv"))
T4 = hashlib.sha256(T3.encode()).digest() # raw 32 bytes
# proquint 16-bit BE words → hyphenated
T5 = proquint_encode(T4)
flag = "FlagY{" + hashlib.md5(T5.encode()).hexdigest() + "}"
Flag
FlagY{42bcdddd8925ae620bfeb69eaaa9eda3}
Live submit: success (lab 14, 290 pts).
Tools
- tshark (Kerberos/LDAP/HTTP export-objects)
- john/hashcat mode 18200
- Python: PBKDF2 + AES-GCM, bubblepy, custom proquint/modhex
- Vision OCR of embedded JPEG