Echo Response — OffSec Challenge Solutions 🛡️#

Cyber Realm · Season 1 · Proving Grounds: The Gauntlet#

Welcome to my solution repository for the OffSec Echo Response cybersecurity challenge series! This repo contains detailed writeups, investigation reports, and solution scripts for each weekly challenge from the “Proving Grounds: The Gauntlet” event.

📖 About Echo Response#

“In the vast multiverse where magic and cybersecurity intertwine, the OffSec Legends, elite guides and guardians, have long upheld the fragile balance between the Cyber Realms. But now, shadows stir.”

Echo Response is a high-stakes cyber defense simulation featuring escalating scenarios inspired by real-world threats. Each week brings new challenges testing detection, forensics, malware analysis, and incident response skills.

📂 Challenge Solutions#

✅ Week 0 - Tutorial Challenge #

Status: COMPLETED
Category: Incident Response, Log Analysis, Encoding
Difficulty: Easy

Scenario: Introduction to Echo Response challenge format through Base64 decoding and web server log analysis. Participants decode a cybersecurity awareness poem and identify a path traversal attack targeting SSH private keys.

Key Skills:

Base64 encoding/decoding
Web server log analysis
Path traversal vulnerability detection
Security incident investigation
Answer format familiarization

Key Findings:

Successfully decoded Base64-encoded tutorial message
Identified path traversal attack from IP 192.168.1.101
Detected SSH private key exfiltration (/home/dave/.ssh/id_rsa)
1,678 bytes exfiltrated with HTTP 200 status (successful attack)

Files:

✅ Week 1 - ProtoVault Breach #

Status: COMPLETED
Category: Incident Response, Digital Forensics, OSINT
Difficulty: Beginner

Scenario: A database breach at ProtoVault with ransom demands. Investigation revealed hardcoded credentials, public S3 buckets, and Git history leaks.

Key Skills:

Git forensics and artifact recovery
ROT13 decoding
AWS S3 security analysis
Source code security review

Files:

✅ Week 2 - Stealer’s Shadow #

Status: COMPLETED
Category: Incident Response, Malware Analysis, Threat Intelligence
Difficulty: Intermediate

Scenario: Data exfiltration incident at Megacorp One (The Etherians). Sophisticated multi-stage attack using blockchain payload delivery, LOLBin abuse, and registry hijacking to steal credentials and sensitive data.

Key Skills:

Sysmon log analysis and Windows forensics
Blockchain-based payload investigation
LOLBin (Living Off the Land Binaries) detection
Email and browser artifact forensics
C2 infrastructure mapping
Credential theft analysis
Advanced social engineering techniques

Novel Techniques Discovered:

Smart contract payload delivery via Ethereum RPC
Fake CAPTCHA social engineering
IMEWDBLD.EXE abuse for malware download
Registry file association hijacking

Files:

✅ Week 3 - Quantum Conundrum #

Status: COMPLETED
Category: Reverse Engineering, Cryptanalysis, Binary Analysis
Difficulty: Insane

Scenario: Break Megacorp Quantum’s “unbreakable” and “quantum-proof” encryption protecting the Obscuran Key. Reverse-engineer a sophisticated multi-layer cipher, analyze binary code, and decrypt the encrypted vault to extract the hidden flag.

Key Skills:

Binary reverse engineering with Ghidra
Cryptanalysis and custom cipher breaking
Algorithm analysis and reconstruction
Bit manipulation and matrix operations
Python decryption script development
Base64 decoding and data parsing
Security vulnerability assessment

Novel Techniques Discovered:

7-layer transformation pipeline (Ring rotation, Add/Subtract constants, Cyclic shifts, Quadrant swaps, Bit-pair swap, Variable rotation)
Weak keystream generation via simple arithmetic
Hardcoded salt exploitation
Matrix-based obfuscation techniques

Files:

✅ Week 4 - Echo Trail #

Status: COMPLETED
Category: Incident Response, Cloud Security, Digital Forensics
Difficulty: Intermediate

Scenario: Multi-stage attack against Empathreach (NGO-Hub) involving phishing, MFA bypass, Azure cloud exploitation, and database exfiltration. The adversary seeks the Nullform Key metadata hidden deep within NGO-Hub’s systems.

Key Skills:

Email forensics and phishing analysis
Network traffic analysis (PCAP)
Azure AD log analysis and authentication investigation
SMTP protocol analysis
Azure Cloud Shell forensics
Azure Arc SSH lateral movement detection
Database exfiltration analysis
Windows Event Log analysis (Sysmon)
Multi-source log correlation
MITRE ATT&CK threat mapping

Novel Techniques Discovered:

Typosquatting domain abuse (mcrosoft.com)
Azure MFA bypass patterns
Azure Arc SSH for lateral movement
Cloud Shell exploitation
MariaDB mysqldump for data exfiltration

Files:

✅ Week 5 - Emerald Anomaly #

Status: COMPLETED
Category: Incident Response, Malware Analysis, Network Forensics
Difficulty: Hard

Scenario: Supply chain attack against MEGACORPONE through a backdoored Python MCP (Model Context Protocol) server. Sophisticated multi-stage attack using typosquatting, obfuscation, credential exfiltration, and SMTP relay validation to compromise CLIENT14 and steal employee credentials.

Key Skills:

Python malware reverse engineering
Obfuscation analysis and decoding
Typosquatting detection and analysis
Sysmon Event ID 22 (DNS Query) analysis
PCAP analysis for SMTP authentication
Base64 credential decoding
Network IOC extraction
Multi-stage attack chain reconstruction
C2 infrastructure mapping

Novel Techniques Discovered:

CRYPTO_SEED character substitution cipher
GitHub domain typosquatting (avatars.githubuserc0ntent.com)
MCP server supply chain backdoor
Dual-infrastructure attack (C2 + SMTP relay)
Azure infrastructure EHLO spoofing
Keyword-triggered credential exfiltration

Attack Chain:

Backdoored MCP server deployed on CLIENT14
PowerShell commands with “pass”/“securestring” trigger exfiltration
Credentials sent to typosquatted domain (100.43.72.21)
SMTP relay (79.134.64.179) validates stolen credentials
Attacker gains email access for lateral movement

Files:

✅ Week 6 - Nullform Vault #

Status: INVESTIGATION COMPLETE ✅
Category: Malware Analysis, Reverse Engineering, Digital Forensics
Difficulty: Hard

Scenario: The final confrontation - analyzing Obfuscated_Intent.exe, a sophisticated UPX-packed malware sample designed to exfiltrate sensitive documents. The malware employs anti-debugging checks, ICMP reconnaissance, recursive filesystem scanning, and PowerShell-based HTTP exfiltration to steal office documents and emails. Investigation successfully concluded. All IOCs documented. The Nullform Key has been secured.

Key Skills:

UPX unpacking and binary analysis
PE file format analysis
Anti-debugging technique identification
PowerShell obfuscation analysis
Hex encoding/decoding
Import table analysis (WS2_32.dll, IPHLPAPI.DLL)
ICMP protocol analysis
HTTP exfiltration detection
C runtime function analysis (_wsystem)
MITRE ATT&CK technique mapping

Novel Techniques Discovered:

UPX packing for binary obfuscation
Hex-encoded URL strings in PowerShell commands
XOR-encoded file extensions (key 0x7a)
ICMP “w00t” payload for connectivity verification
_wsystem() for PowerShell command execution
Invoke-RestMethod PUT for individual file uploads
Anti-debugging checks (IsDebuggerPresent, CheckRemoteDebuggerPresent)

Attack Chain:

Execute UPX-packed malware (Obfuscated_Intent.exe)
Perform anti-debugging checks to evade analysis
Send ICMP ping with “w00t” payload to verify C2 connectivity (203.0.113.42)
Recursively scan C:\ for target file types (.pdf, .doc, .docx, .xls, .msg)
Construct PowerShell commands with hex-encoded exfiltration URL
Execute _wsystem() to run PowerShell Invoke-RestMethod
Upload files via HTTP PUT to http://203.0.113.42:8000/

Files:

✅ Week 7 - Codex Circuit #

Status: COMPLETED
Category: Network Forensics, Incident Response, PCAP Analysis
Difficulty: Easy

Scenario: At the heart of the Cyber Realms lies the Codex Circuit - the foundation of every permission, boundary, vault, and soulprint. With Voidweaver ready to activate it, a critical alert emerges: confidential MegaCorp documents have surfaced on a public forum. The Security Operations Center suspects internal misuse of Slack collaboration tools.

Challenge Objective: Analyze network traffic (PCAP) to uncover Slack-based data exfiltration, identify the users involved (internal employee and threat actor), determine the timeline of events, and recover the exfiltrated customer data.

Key Skills:

PCAP analysis using Scapy
Slack API forensics (files.upload, file_shared events)
HTTP/HTTPS traffic analysis
Timeline reconstruction from packet data
User attribution via conversation context
File extraction from network captures
Excel file parsing and analysis
JSON payload analysis
Timestamp conversion (Unix to GMT)
Insider threat detection

Key Findings:

Exfiltrated File: sensitive_customer_list.xls (6,656 bytes, 3 customer records worth $300,000)
Internal User: Ava (U09KA40P3F0) shared file at 2025-10-10 11:51:36 GMT
Threat Actor: James Brown (U09KRBDV8S1) exfiltrated to rogue workspace
Rogue Workspace: secret-ops-workspace.slack.com (Team ID: T09KSNJU27Q)
Legitimate Workspace: team-megacorp.slack.com (Team ID: T09KR3R0PFB)
Attack Duration: 6 minutes 12 seconds (from internal share to exfiltration)

Attack Chain:

Ava uploads customer list to company_documents channel
File shared to channel members at 11:51:36 GMT
James Brown (legitimate member) downloads file
James Brown uploads same file to rogue workspace at 11:57:48 GMT
Sensitive customer data now exposed on unauthorized Slack workspace

Files:

✅ Week 8 - Last Ascent #

Status: COMPLETED
Category: ICS/SCADA Forensics, Incident Response, Privilege Escalation
Difficulty: Insane

Scenario: The final ascent - a critical incident response scenario targeting Megacorp One’s Energy Systems Division. Autonomous wind turbines have been manipulated and taken out of MegaCorp One’s control. The power stabilization layer has been compromised, and the Codex Circuit’s protective perimeter is now vulnerable.

Challenge Objective: Investigate a sophisticated multi-stage attack spanning phishing, kernel exploitation, credential theft, SSH pivoting, and ICS/SCADA manipulation. Reconstruct the complete attack chain from initial access to turbine shutdown.

Key Skills:

ICS/SCADA Forensics and Modbus protocol analysis
Windows privilege escalation analysis (CVE-2024-35250)
SSP DLL credential harvesting detection
Sysmon log analysis (78MB+ logs)
Browser forensics (Chrome history)
SSH key forensics
Binary masquerading detection
IT-OT convergence attack investigation
MITRE ATT&CK technique mapping

Key Findings:

Phishing Domain: microsoft-login.com (typosquatting Microsoft)
Browser: Chrome 137.0.7151.56
Privilege Escalation: CVE-2024-35250 (ks.sys/MSKSSRV kernel vulnerability)
Exploit Tool: BitLockerDeviceEncrypton.exe (note typo - masquerading technique!)
Credential Harvester: ssp.dll injected into LSASS
Captured Credentials: carmen.santos:Qwerty09!
Pivot Info: SSH username vyos with router2.privkey
Attacker IP: 192.168.1.253 (Router2/VyOS)
Impact: All 4 wind turbines forced into 24-hour lockout

Attack Chain:

Phishing via microsoft-login.com → Initial access
BitLockerDeviceEncrypton.exe → CVE-2024-35250 → SYSTEM privileges
ssp.dll → LSASS injection → Credential capture
SSH pivot via router2.privkey → Router2 (192.168.1.253)
MonitorTool.exe exploitation → RESOURCES server compromise
Modbus commands → PLCs (192.168.2.1-192.168.2.4) → Turbine lockout

Files:

🎯 Learning Objectives#

Through these challenges, I’m developing expertise in:

Incident Response: Systematic investigation methodologies
Digital Forensics: Evidence collection and analysis
Malware Analysis: Threat detection and reverse engineering
Security Operations: Monitoring, detection, and response
Cloud Security: AWS and Azure infrastructure security
Python Automation: Security tooling and scripting
OSINT Techniques: Open source intelligence gathering
Azure Security: Azure AD, Azure Arc, Cloud Shell investigation
Email Security: Phishing detection and analysis
Network Forensics: PCAP analysis and traffic inspection
Reverse Engineering: Binary analysis, decompilation, and obfuscation reversal
Cryptanalysis: Breaking custom encryption schemes
DNS Security: Typosquatting detection and analysis
Log Analysis: Web server log parsing and pattern detection
Encoding/Decoding: Base64 and other encoding schemes
Web Security: Path traversal and directory traversal attacks
Supply Chain Security: Backdoor detection in legitimate software
Credential Theft Analysis: Exfiltration detection and prevention
ICS/SCADA Security: Modbus protocol analysis, PLC forensics, IT-OT convergence
Privilege Escalation: Kernel exploitation analysis, CVE research

🛠️ Tools & Technologies#

Programming: Python, Bash/PowerShell scripting, C/C++ analysis
Version Control: Git forensics
Cloud: AWS (S3, IAM, Secrets Manager), Azure (Azure AD, Azure Arc, Cloud Shell)
Cryptography: Encoding/decoding, cipher analysis, custom algorithm breaking, Base64, ROT13, XOR
Security: OWASP practices, security frameworks, MITRE ATT&CK
Forensics: Log analysis, artifact recovery, PCAP analysis, Sysmon, Windows Event Logs
Network Analysis: Wireshark, Scapy, tcpdump, SMTP protocol analysis, Slack API forensics
Email Analysis: SMTP protocol analysis, phishing detection
Database: SQL, MySQL/MariaDB forensics
Windows: Sysmon, Event Viewer, Windows Event Logs, PowerShell forensics, LSASS analysis
Reverse Engineering: Ghidra, Python decompilation, binary analysis, obfuscation reversal, PE analysis
Malware Analysis: Static analysis, dynamic analysis, IOC extraction, UPX unpacking, anti-debugging detection
DNS: DNS query analysis, typosquatting detection
ICS/SCADA: Modbus protocol analysis, PLC forensics, industrial control system security
Privilege Escalation: Kernel vulnerability analysis, CVE research, exploit analysis
Detection Engineering: Yara rules, Snort rules, Sigma rules
Web Security: Path traversal detection, access log analysis, vulnerability assessment

📊 Progress Tracker#

Week	Challenge Name	Status	Category	Difficulty
0	Tutorial Challenge	✅ Completed	Log Analysis/Encoding	Easy
1	ProtoVault Breach	✅ Completed	Forensics/IR	Beginner
2	Stealer’s Shadow	✅ Completed	Malware/IR	Intermediate
3	Quantum Conundrum	✅ Completed	Reverse Eng/Crypto	Insane
4	Echo Trail	✅ Completed	Cloud/IR	Intermediate
5	Emerald Anomaly	✅ Completed	Malware/Network	Hard
6	Nullform Vault	✅ Completed	Malware/RE/Forensics	Hard
7	Codex Circuit	✅ Completed	Network/PCAP/IR	Easy
8	Last Ascent	✅ Completed	ICS/SCADA/Priv Esc	Insane

🏆 Achievements#

✅ Week 0: Mastered challenge format and identified path traversal attack
✅ Week 1: Complete investigation with all questions answered
✅ Week 2: Advanced malware analysis and blockchain-based attack detection
✅ Week 3: Reverse-engineered and broke “quantum-proof” encryption system
✅ Week 4: Cloud security incident response and Azure exploitation analysis
✅ Week 5: Decoded obfuscated backdoor and identified dual-infrastructure attack
✅ Week 6: Reverse-engineered UPX-packed malware and documented complete exfiltration chain
✅ Week 7: Analyzed Slack-based data exfiltration and recovered customer data from PCAP
✅ Week 8: ICS/SCADA forensics - traced attack from phishing to turbine shutdown via CVE-2024-35250
✅ Identified 45+ critical security vulnerabilities across eight challenges
✅ Created automated analysis scripts for log parsing and forensics
✅ Documented comprehensive remediation steps
✅ Discovered novel attack techniques:
- Blockchain payload delivery (Week 2)
- LOLBin chaining (Week 2)
- Azure Arc SSH abuse (Week 4)
- 7-layer cipher obfuscation (Week 3)
- CRYPTO_SEED obfuscation (Week 5)
- GitHub typosquatting (Week 5)
- MCP supply chain backdoor (Week 5)
- UPX packing + hex-encoded PowerShell exfiltration (Week 6)
- XOR-encoded file extensions + ICMP “w00t” payload (Week 6)
- Anti-debugging evasion (IsDebuggerPresent/CheckRemoteDebuggerPresent) (Week 6)
- Slack API forensics for insider threat detection (Week 7)
- Rogue workspace exfiltration via collaboration tools (Week 7)
- CVE-2024-35250 kernel exploitation (Week 8)
- SSP DLL credential harvesting (Week 8)
- IT-OT pivot via Modbus protocol (Week 8)
✅ Demonstrated expertise in multi-cloud environments (AWS, Azure)
✅ Successfully performed binary reverse engineering and cryptanalysis
✅ Mastered PowerShell-based forensics and log analysis
✅ Developed proficiency in Sysmon event analysis
✅ Advanced PCAP analysis and SMTP protocol forensics
✅ ICS/SCADA attack investigation and Modbus protocol analysis

📝 Repository Structure#

1
echo-response-offsec-challenge/
2
├── README.md                          # This file
3
├── assets/
4
│   ├── echo-response-logo.png         # Repository logo
5
│   ├── tutorial.jpg                   # Week 0 banner
6
│   ├── protovault-breach.jpg          # Week 1 banner
7
│   ├── stealers-shadow.jpg            # Week 2 banner
8
│   ├── quantum-conundrum.jpg          # Week 3 banner
9
│   ├── echo-trail.jpg                 # Week 4 banner
10
│   ├── emerald-anomaly.jpg            # Week 5 banner
11
│   ├── nullform-vault.jpg             # Week 6 banner
12
│   ├── codex-circuit.jpg              # Week 7 banner
13
│   └── last-ascent.jpg                # Week 8 banner
14
├── WEEK 0 - Tutorial Challenge/
15
│   ├── README.md                      # Challenge overview
16
│   ├── INVESTIGATION_REPORT.md        # Detailed forensic analysis
17
│   ├── analyze_tutorial.py            # Analysis script
18
│   ├── access.log                     # Web server logs
19
│   └── tutorial.txt                   # Base64-encoded message
20
├── WEEK 1 - ProtoVault Breach/
21
│   ├── README.md                      # Challenge overview
22
│   ├── INVESTIGATION_REPORT.md        # Detailed forensic analysis
23
│   └── analyze_leak.py                # Solution script
24
├── WEEK 2 - Stealer's Shadow/
25
│   ├── README.md                      # Challenge overview
26
│   ├── INVESTIGATION_REPORT.md        # Detailed forensic analysis
27
│   ├── analyze_attack.py              # Solution script
28
│   └── log.txt                        # Sysmon event logs
29
├── WEEK 3 - Quantum Conundrum/
30
│   ├── README.md                      # Challenge overview
31
│   ├── INVESTIGATION_REPORT.md        # Detailed security assessment
32
│   ├── solve_decrypt.py               # Decryption script
33
│   └── Understanding_7_Transformations.md  # Transformation analysis
34
├── WEEK 4 - Echo Trail/
35
│   ├── README.md                      # Challenge overview
36
│   ├── INVESTIGATION_REPORT.md        # Detailed forensic analysis
37
│   └── analyze_logs.py                # Azure log parser script
38
├── WEEK 5 - Emerald Anomaly/
39
│   ├── README.md                      # Challenge overview
40
│   ├── INVESTIGATION_REPORT.md        # Detailed forensic analysis
41
│   ├── analyze_backdoor.ps1           # PowerShell decoder script
42
│   └── mcp_backdoor_server.py         # Backdoor source code
43
├── WEEK 6 - Nullform Vault/
44
│   ├── README.md                      # Challenge overview and Q&A
45
│   ├── INVESTIGATION_REPORT.md        # Complete forensic investigation
46
│   ├── Obfuscated_Intent.exe          # Malware sample (UPX-packed)
47
│   ├── ioc_report.csv                 # IOCs in CSV format
48
│   └── ioc_report.md                  # IOCs in Markdown format
49
├── WEEK 7 - Codex Circuit/
50
│   ├── README.md                      # Challenge overview and Q&A
51
│   ├── INVESTIGATION_REPORT.md        # Detailed forensic analysis
52
│   ├── analyze_slack_exfiltration.py  # PCAP analysis script
53
│   └── find_exfiltration.py           # Exfiltration detection script
54
├── WEEK 8 - Last Ascent/
55
│   ├── README.md                      # Challenge overview and Q&A
56
│   └── INVESTIGATION_REPORT.md        # Complete ICS/SCADA forensic analysis
57
└── ...

🚀 Quick Start#

To explore the solutions:

Clone this repository:

1
git clone https://github.com/umair-aziz025/echo-response-offsec-challenge.git
2
cd echo-response-offsec-challenge

Navigate to a specific week:

1
cd "WEEK 0 - Tutorial Challenge"
2
# or
3
cd "WEEK 1 - ProtoVault Breach"
4
# or
5
cd "WEEK 2 - Stealer's Shadow"
6
# or
7
cd "WEEK 3 - Quantum Conundrum"
8
# or
9
cd "WEEK 4 - Echo Trail"
10
# or
11
cd "WEEK 5 - Emerald Anomaly"
12
# or
13
cd "WEEK 6 - Nullform Vault"
14
# or
15
cd "WEEK 7 - Codex Circuit"
16
# or
17
cd "WEEK 8 - Last Ascent"

Read the challenge writeup:
- Check README.md for challenge overview
- Review INVESTIGATION_REPORT.md for detailed analysis

Run the solution scripts (if applicable):

1
# Python scripts
2
python analyze_leak.py
3

4
# PowerShell scripts
5
.\analyze_backdoor.ps1

📚 Learning Resources#

🤝 Connect#

Umair Aziz

GitHub: @umair-aziz025
Repository: echo-response-offsec-challenge

📄 License#

This repository is for educational purposes only. Challenge scenarios are property of OffSec. Solution writeups and scripts are my own work.

⭐ Star This Repo#

If you find these solutions helpful, please consider giving this repository a star! It helps others discover these resources.

Last Updated: November 26, 2025

“Will you uncover the truth before the balance collapses?”

Echo Response — OffSec Challenge Solutions 🛡️#

Cyber Realm · Season 1 · Proving Grounds: The Gauntlet#

📖 About Echo Response#

📂 Challenge Solutions#

✅ Week 0 - Tutorial Challenge#

✅ Week 1 - ProtoVault Breach#

✅ Week 2 - Stealer’s Shadow#

✅ Week 3 - Quantum Conundrum#

✅ Week 4 - Echo Trail#

✅ Week 5 - Emerald Anomaly#

✅ Week 6 - Nullform Vault#

✅ Week 7 - Codex Circuit#

✅ Week 8 - Last Ascent#

🎯 Learning Objectives#

🛠️ Tools & Technologies#

📊 Progress Tracker#

🏆 Achievements#

📝 Repository Structure#

🚀 Quick Start#

📚 Learning Resources#

🤝 Connect#

📄 License#

⭐ Star This Repo#

✅ Week 0 - Tutorial Challenge #

✅ Week 1 - ProtoVault Breach #

✅ Week 2 - Stealer’s Shadow #

✅ Week 3 - Quantum Conundrum #

✅ Week 4 - Echo Trail #

✅ Week 5 - Emerald Anomaly #

✅ Week 6 - Nullform Vault #

✅ Week 7 - Codex Circuit #

✅ Week 8 - Last Ascent #