Challenge

10.1.1.143, an Apache box. gobuster turned up a /transfer/ directory holding CompanyConversion2025.zip, which was password protected.

Cracking the zip

zip2john plus john against rockyou recovered the password phoenix12:

zip2john CompanyConversion2025.zip > hash.txt
john hash.txt

Inside was a CSV with a flag and a table of employee credentials:

flag:{M1n1Cryp70Ch4ll3ng3}
login,password,FName,LName,email,ext,EmployeeID
sarah,2ac9cb7dc02b3c0083eb70898e549b63,...
amy,4bfe029d971ddb359dabed0d0ab968a329ed0ab0,...
jason,d2lubmlldGhlcG9vaA0K==,...
mack,y33gc4ffj0eq,...

The four passwords

Each password field was encoded or hashed a different way, and each was worth points:

  • d2lubmlldGhlcG9vaA0K== is base64 -> winniethepooh
  • y33gc4ffj0eq is ROT13 -> l33tp4ssw0rd
  • 4bfe029d971ddb359dabed0d0ab968a329ed0ab0 is a SHA-1 hash, cracked with hashcat -> jordan23
hashcat -m 100 hash.txt rockyou.txt
  • 2ac9cb7dc02b3c0083eb70898e549b63 is an MD5 hash, cracked with hashcat -> Password1
hashcat -m 0 hash.txt rockyou.txt

Flags

  • M1n1Cryp70Ch4ll3ng3 (zip contents)
  • plus the four recovered passwords: winniethepooh, l33tp4ssw0rd, jordan23, Password1