IT and security stuff

CyberSecurityRumble 2021 – Result Writeup

Open the attached file, we see an email that was to a student.

Delivered-To: hans.deutschmeister@gmail.com
Received: by 2002:a05:6a10:6e24:0:0:0:0 with SMTP id hv36csp1769646pxb;
        Thu, 28 Oct 2021 08:41:43 -0700 (PDT)
X-Google-Smtp-Source: ABdhPJzTPP2UoVvgA4KOhfex4CDy+JgFqUmMn/iGTNk6kYcN7ELxhJB2X3/ZR8P1HZjR9KFIBL9W
X-Received: by 2002:a05:6402:35d6:: with SMTP id z22mr7159038edc.93.1635435703075;
        Thu, 28 Oct 2021 08:41:43 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1635435703; cv=none;
        d=google.com; s=arc-20160816;
        b=fgeqyR8Wy6D5AxXEB9tXBDHkArJFpsgcw5R67tsDPp9fdXKyrJ0GIxpjvqXPRd7/L1
         cOv5Wn9j4NXW0OO5ejuyWlRXkdgRIc8LC8L1eSRskIoTm11LVhDNNeiZqrocWIJosMwB
         iXYA2H1GH7EEfjOLMNKCFaVLxUME477hLSqHdmjLq9NXQH4iRiKCFc1h7KEscMbvJ45S
         e+aBP+soMzIMDEALKepfuNsQdZCxBQantDnwu4RkMqW/MS+7dCePp5tggO4AXg/zZAGy
         iKDyo1VB+zr78uMXUStrPAPgv8pGAUsuy/SuMkx2iTGcxDn30sT75LoknBH1JV5G85Iw
         PrsQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=to:reply-to:subject:message-id:mime-version:from:date
         :dkim-signature:dkim-signature;
        bh=i1biUzTXjsp8Jx3FG9EGAdoI9li12Uf+du9Bbss9np8=;
        b=gFWTFCNxFWd6Q6R6QvpNqnuC1eEkVPDK4vv84C2PHJqu7BXKngcfXCZIJ4U/Zhfsva
         7SiqEJgvofK8j0FroiP8ndDymYJP+esr+5s5I/JfhfX7/j/4I3voaB/qxpk30OV27D7D
         0l0BsZs3HXLiYZm5Xls1OOock6zwe3ewI6o8XVPZLd0qAaAGbst7aXAfLEwN1ituptOd
         +29dqwnSLZ1vgmfjJvHdDbfMqjcD9QkpxxqiuLi+rBVSSWScy7xF47P5XGL7KNuvjJFq
         xWTQRW/YwRhVCgWhvA4ZmVSjayRIsBWin5fB4cJwujLXx4OQDPT3nplXXwyozkxHqEMV
         LXAA==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@covimedical.de header.s=s1 header.b=ZIFaqcIe;
       dkim=pass header.i=@sendgrid.info header.s=smtpapi header.b=JdnAZHxY;
       spf=pass (google.com: domain of bounces+23590480-83a0-hans.deutschmeister=gmail.com@em4163.covimedical.de designates 168.245.109.58 as permitted sender) smtp.mailfrom="bounces+23590480-83a0-hans.deutschmeister=gmail.com@em4163.covimedical.de"
Return-Path: <bounces+23590480-83a0-hans.deutschmeister=gmail.com@em4163.covimedical.de>
Received: from xvfrsdpx.outbound-mail.sendgrid.net (xvfrsdpx.outbound-mail.sendgrid.net. [168.245.109.58])
        by mx.google.com with ESMTPS id 21si4686339edw.425.2021.10.28.08.41.42
        for <hans.deutschmeister@gmail.com>
        (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);
        Thu, 28 Oct 2021 08:41:42 -0700 (PDT)
Received-SPF: pass (google.com: domain of bounces+23590480-83a0-hans.deutschmeister=gmail.com@em4163.covimedical.de designates 168.245.109.58 as permitted sender) client-ip=168.245.109.58;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@covimedical.de header.s=s1 header.b=ZIFaqcIe;
       dkim=pass header.i=@sendgrid.info header.s=smtpapi header.b=JdnAZHxY;
       spf=pass (google.com: domain of bounces+23590480-83a0-hans.deutschmeister=gmail.com@em4163.covimedical.de designates 168.245.109.58 as permitted sender) smtp.mailfrom="bounces+23590480-83a0-hans.deutschmeister=gmail.com@em4163.covimedical.de"
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=covimedical.de;
	h=content-type:from:mime-version:subject:reply-to:x-feedback-id:to;
	s=s1; bh=i1biUzTXjsp8Jx3FG9EGAdoI9li12Uf+du9Bbss9np8=;
	b=ZIFaqcIeKt1rzHQmuTW5W9+SMKBUfvYA/KyKmjGN8HaaH2PB2xo8AleFqLf2TplnuwEM
	kZuI4vh+9AO8EeKMrcAwNQ43GW1pAGmk5RJoDceC+fQeN8bFRFllbwTNrwGSX1T3BwnvlZ
	7/3WcD52LE8hsR/MonDCzEaZEhT2yqMBlWzQQBezU1H6TEAdMACLFbCEtRK3yGUOZI+9kd
	83zk+TEdvZZ4CAHChqRDTduJmXN71jSQx+s6BlyaDQw//WdKDrTtQMbpC8FXzTSTmoDjU4
	6zesIRVLzYIOpZz9h53+reVo5McFyGwbsoed20mZNZEFpFJmwegDXM3BuzRxC5jg==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sendgrid.info;
	h=content-type:from:mime-version:subject:reply-to:x-feedback-id:to;
	s=smtpapi; bh=i1biUzTXjsp8Jx3FG9EGAdoI9li12Uf+du9Bbss9np8=;
	b=JdnAZHxYDBTJEXduwbLk7mOLEqHq+UFUIgUl0dNJJ0C8SEVfd1cNyAsBbwccarEEVEkI
	jLUeEdE/HKGCumSZTpeCPz7NcGYhTocyvVOJFVEB3aB/o9dhHJu5uQXiqyY7Zlti3egJPo
	jzoHjgi9tOuKKy4/IJaPLH8LeV4GxWFgo=
Received: by filterdrecv-55446c4d49-vth2g with SMTP id filterdrecv-55446c4d49-vth2g-1-617AC4B4-60
        2021-10-28 15:41:41.157838607 +0000 UTC m=+4900892.997162287
Received: from MjM1OTA0ODA (unknown)
	by geopod-ismtpd-2-0 (SG) with HTTP
	id ffKaBWQ8RYGwJw-ESgeF-A
	Thu, 28 Oct 2021 15:41:40.703 +0000 (UTC)
Content-Type: multipart/mixed; boundary=d5fb934eea53bfa57c7072ebad7a334624b44d2e1ebdd5e6b1538dee85aa
Date: Thu, 28 Oct 2021 15:41:41 +0000 (UTC)
From: CoviMedical <ergebnis@covimedical.de>
Mime-Version: 1.0
Message-ID: <ffKaBWQ8RYGwJw-ESgeF-A@geopod-ismtpd-2-0>
Subject: Ihr Testergebnis liegt vor / Your test result
Reply-To: CoviMedical // Support <support@covimedical.de>
X-Feedback-ID: 23590480:SG
X-SG-EID: 
 =?us-ascii?Q?ZSbQwBDx=2FEZBwcOvGQ8Cw5moFIdOHOWD9ERnmRZXpviT=2Fq=2FunG5s78J6xM7QjN?=
 =?us-ascii?Q?VCCKYBtqmUyfl5jLr2qFGt70uubTNzcfALFjN+I?=
 =?us-ascii?Q?1YLn4ZE9f3liUaFPNBulf8gCt9aNHgfC1doSuzH?=
 =?us-ascii?Q?HkFCYdeiwXSlLNKNIvB6AXkUV4hOQtaGlf79eOm?=
 =?us-ascii?Q?Nh1AWwGeb0wITHSvNk6=2F+khk2mWrXIERMTpL6Or?=
 =?us-ascii?Q?P5N2QIZniMTzIG793pUpNXlWIkodir6XG43JZD?=
To: Hans Deutschmeister <hans.deutschmeister@gmail.com>
X-Entity-ID: 75BcTBzX2H3Xh3TFnYKUcw==

--d5fb934eea53bfa57c7072ebad7a334624b44d2e1ebdd5e6b1538dee85aa
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset=iso-8859-1
Mime-Version: 1.0

<!doctype html>
<html>
    <head></head>
    <body>
                    <h3>Deutsch</h3>
            <h1>Hallo Hans Deutschmeister</h1>
            <p><p>Ihr Testergebnis liegt nun vor und befindet sich im Anhan=
g dieser Mail.</p></p>
            <p><p>Das Ergebnis-PDF ist verschl=FCsselt und ist durch ein Pa=
sswort zus=E4tzlich gesch=FCtzt.<br />
<strong>Das Passwort ist Ihre pers=F6nliche Postleitzahl</strong></p></p>
            <p><p>Wir w=FCnschen Ihnen alles Gute und viel Gesundheit!<br /=
>
Ihr CoviMedical-Team</p></p>
                    <h3>English</h3>
            <h1>Hi Hans Deutschmeister</h1>
            <p><p>Your test result is now available and can be found in the=
 attachment to this email.</p></p>
            <p><p>The result PDF is encrypted and is additionally protected=
 by a password.<br />
<strong>The password is your personal zipcode</strong>.</p></p>
            <p><p>We wish you all the best and good health!<br />
Your CoviMedical Team</p></p>
            <img src=3D"http://url3790.covimedical.de/wf/open?upn=3Dr5KPVVU=
hB6BcoaKmN3ihe9O-2BQPQeA6MNCF9ITEh-2FyJ2MYd9oC-2Frs7vOqz-2FS8t1iuWjuXW6DUwJ=
jzc-2FNZ1D-2BfhQNn51Wv-2BdeeeMZS9FGjwGIWoNL9ixkh1UzTOBISt3CRwybtDbcOSsRrqBT=
NExcGHJ-2BZTH4WWYU-2Fwgf4dm14Cb9aIOMjZzr15KOi8JVQWqm4ze2upj3rB-2FwDoGjcJlnW=
xMIs7lUSsNIZU-2FhmU3rRKiU-3D" alt=3D"" width=3D"1" height=3D"1" border=3D"0=
" style=3D"height:1px !important;width:1px !important;border-width:0 !impor=
tant;margin-top:0 !important;margin-bottom:0 !important;margin-right:0 !imp=
ortant;margin-left:0 !important;padding-top:0 !important;padding-bottom:0 !=
important;padding-right:0 !important;padding-left:0 !important;"/></body>
</html>
--d5fb934eea53bfa57c7072ebad7a334624b44d2e1ebdd5e6b1538dee85aa
Content-Disposition: attachment; filename="result.pdf"
Content-Transfer-Encoding: base64
Content-Type: application/pdf; name="result.pdf"

JVBERi0xLjcKJb/3ov4KMSAwIG9iago8PCAvRXh0ZW5zaW9ucyA8PCAvQURCRSA8PCAvQmFzZVZl
cnNpb24gLzEuNyAvRXh0ZW5zaW9uTGV2ZWwgOCA+PiA+PiAvTGFuZyA8ZWUyNDZlZTRlOTNjMTE3
NWFlYWY1NDQ5NzRkMTgxOTQwMzU3ZWI3NTU3YTNkZTVlZmQzNDk2Zjc3MzE0M2VjYj4gL09wZW5B
Y3Rpb24gWyAzIDAgUiAvWFlaIG51bGwgbnVsbCAwIF0gL1BhZ2VzIDQgMCBSIC9UeXBlIC9DYXRh
bG9nID4+CmVuZG9iagoyIDAgb2JqCjw8IC9DcmVhdGlvbkRhdGUgPGVkMjNmN2QyYzM0OWUxYzMz
ZDQ2YTNjNWMzM2QzNWQ1OGI2Mzg5ZmNjZGFhNzljYzYwMDFkMWZjODI2OWEyOTEzOTFjYTAxZTkx
NjA4YjA4YjNjYTA0OWMzMmU1NDU2MT4gL0NyZWF0b3IgPDc2ZDAwN2FiYjE1ZWJlM2ZhOTdjZGI2
YzNmYzI5YmM1MzBhNmNhMGE2MWFiODkyYjRkYzFmNTg3YjQ4YTM2MDA+IC9Qcm9kdWNlciA8NTRk
OGQwYTQ5ZTg5NjQ0Njg5NWJlOGNkZWMyZDc3ZGM5YjBmZjlkZDIyYzBiMGQ0YTEyZWJlNzhlZjNh
ZTgxNGRjODcwN2UzNzZhZjUxNTZiNjFmYzFhMGM1NjlkYzFkZmE0MDU3NDdjM2I5ZDFjMTk1MzVj
NDNkYjZlYmZkOTQ+ID4+CmVuZG9iagozIDAgb2JqCjw8IC9Db250ZW50cyA1IDAgUiAvR3JvdXAg
PDwgL0NTIC9EZXZpY2VSR0IgL0kgdHJ1ZSAvUyAvVHJhbnNwYXJlbmN5ID4+IC9NZWRpYUJveCBb
IDAgMCA2MTIgNzkyIF0gL1BhcmVudCA0IDAgUiAvUmVzb3VyY2VzIDYgMCBSIC9UeXBlIC9QYWdl
ID4+CmVuZG9iago0IDAgb2JqCjw8IC9Db3VudCAxIC9LaWRzIFsgMyAwIFIgXSAvTWVkaWFCb3gg
WyAwIDAgNjEyIDc5MiBdIC9SZXNvdXJjZXMgNiAwIFIgL1R5cGUgL1BhZ2VzID4+CmVuZG9iago1
IDAgb2JqCjw8IC9GaWx0ZXIgL0ZsYXRlRGVjb2RlIC9MZW5ndGggMTc2ID4+CnN0cmVhbQp8xJ7G
DTOKzKVTZVtiGL/ACsHHfU5kiIO0w0GzBBjzXFZ790422epmCKsL/8fPCFlp7H5Da8qNhMXIlCMc
UgGaBL38/X0H4Rpu9SJXZ8iDDa0NlDSFeZEJBatEYttNXu5f+P+hRg9w7/A3d24WatPLI39jVSSE
cPb1WvHL90Wf8ot4Yt6xyGW5egxSGSEmok4MZVIlBtOFKe/TIY7p61QWGtotWe4seH67Kv8veo/U
j2VuZHN0cmVhbQplbmRvYmoKNiAwIG9iago8PCAvRm9udCA3IDAgUiAvUHJvY1NldCBbIC9QREYg
L1RleHQgXSA+PgplbmRvYmoKNyAwIG9iago8PCAvRjEgOCAwIFIgPj4KZW5kb2JqCjggMCBvYmoK
PDwgL0Jhc2VGb250IC9CQUFBQUErTGliZXJhdGlvblNlcmlmIC9GaXJzdENoYXIgMCAvRm9udERl
c2NyaXB0b3IgOSAwIFIgL0xhc3RDaGFyIDIwIC9TdWJ0eXBlIC9UcnVlVHlwZSAvVG9Vbmljb2Rl
IDEwIDAgUiAvVHlwZSAvRm9udCAvV2lkdGhzIFsgNzc3IDY2NiA0NDMgMzg5IDUwMCAyNzcgMjc3
IDI3NyA2NjYgNTU2IDQ3OSA2NjYgMjc3IDUwMCA2MTAgNTAwIDMzMyA1MDAgNTAwIDUwMCA0Nzkg
XSA+PgplbmRvYmoKOSAwIG9iago8PCAvQXNjZW50IDAgL0NhcEhlaWdodCA5ODEgL0Rlc2NlbnQg
MCAvRmxhZ3MgNCAvRm9udEJCb3ggWyAtNTQzIC0zMDMgMTI3NyA5ODEgXSAvRm9udEZpbGUyIDEx
IDAgUiAvRm9udE5hbWUgL0JBQUFBQStMaWJlcmF0aW9uU2VyaWYgL0l0YWxpY0FuZ2xlIDAgL1N0
ZW1WIDgwIC9UeXBlIC9Gb250RGVzY3JpcHRvciA+PgplbmRvYmoKMTAgMCBvYmoKPDwgL0ZpbHRl
ciAvRmxhdGVEZWNvZGUgL0xlbmd0aCAzMzYgPj4Kc3RyZWFtCnyTNj9ZvrIPvZps7pe0TEMRGefJ
uYkEA+IrAGK7PyWel4gy5K94beb6na5FhBhNVsbWYs/B61iIFVUEeMVviDDKJsp9dKdzSekr8NZH
JmE+QtKPrrCgxZfCnvDswFFc1ogsSkruJbU3WuO/Yuk9PXxVKkU9WWtqn8/0Xkx942R7J709h00E
asnujpKSD7OqWHZYR+sexipAgLCMMjXjI8BCNPSE1yTtPVtx7xy6ZM5tFEsVY+nmnQrMeFl0jFuK
jIC4+w04XYjRv6fB8D0K8fkT4IIBklOeIryzknnNu/8rmfFm60I4pufuf3TFWfJeGDqnDrfk3u06
MxeWzELhMGqcnV4W3rUZExEnFTPiPjxyGDs4Bgx7KhM+utSTk265c80ppHc/1AzDf+zGssh0al9L
afI4jyW2bme7lKeWGYwPN4MBSEBcAAHobQ6AHwzciWVuZHN0cmVhbQplbmRvYmoKMTEgMCBvYmoK
PDwgL0ZpbHRlciAvRmxhdGVEZWNvZGUgL0xlbmd0aDEgMTI0MzYgL0xlbmd0aCA3NTIwID4+CnN0
cmVhbQqAfqezNgbmh+OmE8QB/GjEoWRhq4MApYhX2ARWYgykGfQu2es2h/oEgwyaaCdqYP9IEmWk
FRAx2r02/L9nL1Sz78Vpit/hh/CeLNZEEe+jz8ITyh5bOl3k7ygLEQXa+cCqWXIyphQgYnrH5bPH
cgLZqO9pUvkNQZzBxp1Y077GHB3/MyGvueudLuJt2U26Wu1YzjO3aeMMR0BZJd+h2VwM64KFI5KC
Kineve/T+EC4Bjs7cbAYpaAeGqgSupjEqych6bhHr3k65nM9ubz+UUJ7LmXm4ZLUp3aKUskE3q9I
6q+2+86DDdWe9awYMOGlU5T2iJe6ySSYQSHVJhlj4i+SSX0+2ZvyJWhpe7ry5A85BkKCnFOEossY
WkqgwaMAbrz5fD18GRVxY6jj6gsD6OYsnYfsGV0tosGhT5MpsTGbLG2+AErJE8zXZ7VGX1jDg3CT
raPPRONI7OENKEbnfzr70bm3lJXxPMkP+VPZ9jpcuGTKNZtmdmjLIgXt8w4MD091qgjCHGPn945u
sBxgZLQpvuVM5sser4nkqTevvptOD19vY6O41o9aBH4afNMDR+zdMZqjXGRoWHm1pn1pxP82NmNO
yrxTq95m/q9YCc12pQLpNAGG0/GQxmIhetavBBMK/8r/gO1O4Xa5FVi1EC/nhh/qH8q40cBYN8wN
WYPjQC2vX/xNA8osfkqSs/TzoidJ67lEEMkCDznsiYijDeJDK/mqcoytA2NUkG7JSDAJmvXDAcFn
Hr2N46ppZrDOP8EHllo8th1pJ5f7GBNVxm4alBVGfVzc0asOWCFOE6ULevLpfy+XxdUL8yxQBJOM
ifgAnMelLWHAfJkdq0udKSyn91Jxf2rZf9x7wyMPIJEI4CS1UOf63PSREsQ1oTHt1sqeeD71OK+9
2/P2sGNSPXmiknsGzGirCUzPAgFeberhxXUMp0zcw5J4PQV+67ZWAu2S2BfqLke06eA4U4avIlCv
TlPYMn3q1EAphexOlAPHhVLSVH6k/OFmXQ2wbpI86S8rICw0fWyb+fG5xWlvrLuNpUR7/Kh4B2XL
B6CL5snZSI2Dv5I0pUoh1J4ec66dGu6p1LWwF0S2elRsR3oaA/sUJuF/GeiywrqUGRmb/M8FZe2i
Qka2jVoAk8sC7XYdKCZHTBL/xuAbvLWJfI4Bg7GbJf+QwwJ1mFT8nSdf8F4qDBM5O6fyBfkQOGd1
lgkDzyZKRB6VuZb5jsJaf3ZTLGjVnrQxTrbQjs0upDOsgW/49KfHrwIiCgHjW5ceZGtmpUhsJQjZ
tj0bTQHswwjfulbyy0GVd5w/HkKfgox4csr8Spql83Gadm2zb9JPoEFNM7HrzBmpIt4CCf7mGrat
F2Y4waGBkZl3AFkZg0fYSt+QL+tO4qav/GQVV25opZm1fGOZtb9exE5CiS4z+POND6LbUu/HiwlQ
qVR2ENQz/fWooLNK9wdrewqIExD0X88sgswdHG2E4J7j+ZkPRpZhhDmgb0/4s0HCahQ7/pcBjqL3
25JZgInorZGR1qSE4m7L7XpFx2aZ9b7xI2rrXR9hhLMo8F0gbBh08jo1CJDgTZqb9nw+unfvl2bn
5TrdqO2syEtyn4rrh4LrWJkZSJOBjlDjVSwwkea0i6zQjab6m6PinG82jW0aYd2XgZDalaep7Oxx
5qTUlnamtQ9p5GsQAT03XMJqFzM0KdakMBvgJ6/7TmZTA+g3W5o4NnG+9LwvwGX7S+AWzEg1Spug
997lIf0Rt+Ed1tte6kWS+JjaVVDCDNkD/hBigynptoOnP0awARQmbWqVQzmzwIHNGu6y0NlvwWTI
oH8aycltkdSMdPUc2uO4Ohhx6VdEIuMg7DdP5A8lgTQ8QINRFyviOFdZBaDZBlhowz0h0xE1TfAK
PoOvdx1qPcHpO/5rtUxdUQUPUVKYNyVOATw4Cda49P20QhlPRsdVKxDVGmODzV62Rgvc6TINPBkB
ppjN5Uapr5VC+czB4CnaFzVo1nOMXzN8SOYSx/tykR3o2sHcdyA9kbY+d5m2hrRRGDUdaUxia65R
mchPAJMWNy3z0m4AveEmXpVWv09Wsnh/roXzE0ZZ1ylSVClljZqBxUWxWNu4q9kIHn+oSn+WW6I3
8Kkc7j4JQhiR4TP0OwA9Rfq+C4CBEzIUouykIdE6BTKg/jjXUN02O1USTx9CG7ot4qeK5saYLGMe
3ClDOB+/McGpVG+W09AM+b8iNd1FvDMwImD56allXP7VAMYMWuUytIlTdfsB9uGsQ315nkHbs41Q
pMH+AxmmOyPg0njI2xrzkwTyS18I9WlwY+rwRtx/RWZWcQwwat2iVGJMe28ioCz2tzugk1zeqYnb
tY0N5Ig/ONlJjzvMsqqV1803sA819kxqKJAKcQQvLKhdmUnZYjH7krGEYkEwtUio2QO0uAFH4dK6
mrnRwVtb+J6w3N48ULPwSWd1dlbm3bvA4K7G84ByUCmBty2IzgoduXNfgGvbzGfNiutGpQM6vsZu
0NmG4WVcputYW6+JsLCzWWdNrhiqnHiFMXDzcpEV+SVX4PAGMLB1ymU8ZoLB+x3V+dzTTIo+mOcU
03aoItfciHBzt/+UY5dJY8E5t60xUu/ukZ+ykbprKl4jHyKvfkJalwpoZmYNgkCKUd8OGI/qpuCA
0mzprQjwBb9rmtXu3XO20vCcDKkmP59Xp001NvTgXTD8XBpSf3CBrXk47GtIKB85KzBXzgKZAwhR
WtRJp5Ln/47pNrbboycyWiOpJBxw5ezq5WcTeOhBwOlfm3wBWDbK1W5bG3cER8pmMzoM9XdV9yLZ
693bC6La93nElE+1dkYfA8641nPwISLBmV2aUyMVi98FlmnUT+2PwRa2ApguY/tszvg556BVg1nx
SlkqeupavK/MeJr6biOWkzwtVQ9L5QqHXLtAvHL8NO4lycrGc271u9Q4seMvLy6P6WBiQXPUZsgg
5XE/hVxgYM6LU7V9yEqIpUD8Ll42s2Ym8omhuAAWRkL/avSooBmn52oSpbZQebji4uZ1IJqti3TJ
sQ9Wg4tqaKypoFFR2Rcw9UYcGcRZY+zkLG/dEzbt9uhnReGDwA3Z9xXjl67xHAS1REp1JU5o2ahv
e0QHywba1PasU22/OcnienDfNgJvXuD3KfnCKnYyP+AYkjzsWU8k1BMWq3W2zQmXkUbsR/p97w3R
a5hAsiUgnI0tzhbrOloCrTLa/tTJYvC5QYa0L06h7AxnD0w9czEEdkwQ91+d3/li7ot6rCz3LZcO
dMWGuOqkxP4jYPHEY0xYnIzzZO1jmN03OiqqPblt15xTZUQMbandbRMSEix1S/t6VhYIWt+MrrxR
BNulK/Cz41htsBFrILXZGZFuY5orbJKX3ijUyOKg8H2jvJPUeUqVk37pTGj6ySavIBehgmk9Qyt+
unJrJwC7AqRrQ81KRrxiEjDJDMZASOqFOJz1t9EtE8hXd+Cp8lySbtle+itoF2el07SdfJxH+7OJ
HHQr6Zjopy9YxFWbDETfSKD2GiLeOL3yRTZH3QFlMBNv5+3kTu5fnumtvL/B1YlTKga2E14VyO9c
tvWYLK2FwHo/U8aZDUUzmRFCTLb3hCcXai+ipfd+T8SaGFtM0/RP3Hf7ovvimisGA5B4QWBcUBKM
o8GDxyUm4e1tiLgnyhRCWQESstWZLQT/OI/du3t0Bg08gldU4FwPac/vsLr/BWpD32UNlkzcKPZI
69rzOjTrSVAzJymLATfJeqehK3s+dBx/wgZFTWvv6wDK3OY/n0Lkiumlh+usl/dgj28BH1LScxsF
ojqXwk5AbeQ7n5XPLVcMfnJd/CXaLVcM8FeC/fVdmEnrZT35DaTuxZY7Cd9SvvrCrvENTMWqdqpI
3ReEQRKuZzOBw+6RSbYLL1fnZvGmHKXuL1yrrKMBGs2dZCQjah7SYn2kxXwc7GpV91vj+jqY0rZ6
SX/mXvyqS32r5mODYENC943Cd+cyTOnegALOs3okCdEz+iCm/hxN2JUD/8SLFTwNgSd29aZQpfxJ
t6aadDT/bTgN/vmB5Ucnh14K498a124YTF97Zg16As3retL79cS1cQKwcPctRAKd5fvbfAW1EhkH
fJn733ru8A6GTCNUIAON5M2EnFPlNDIccCn4/zcGTpNdMYSJYy825z8qH9+r3UjCrhQSY3+B2llr
//Q8taWB4o+AYMfz5YVaovNIQ9k0kG45CnfQRu1ucvzFjgp1BO9bw4QRAWD1AHymLgDzHZDkwIK/
aWCI5xc+O6csAQ02cp7hDp16TpDOh++wG0oYK7VSqQOoObSLEuu2JJGmAztBCegm1q79q2CrIhyc
JTOzrsFLemhjhs4ENZ7WCiOZTYkZDw+UCmTJDYNjM85tF9JCr07PqJeNOqr9HlN5dDa8iwk7lvAw
zWmSejF5gEyhDxdelNzVheEqlqz8PLHzhzlEKd1mPY4olrjwEtA7qyUb3rOc2r+RjAhnKyPKYjeF
OzdisIUFvd1rY7FCX1IsU2D4wcF9gB/y4QSfCrIEu7oJT4uCNmgavcZyGU3RgcoQrMetxKO9bjod
2wzPuydQffkiaTYfQXN/KG50gD++rle8hhFh9oaD/iPl4oBcOE3Oah0Ey3VYPOsjvAMP9WBkxfaG
C3eIvUvRZxDCXGQYmBLS5s/ppF2rGXyGo8dAlQvY0ir+lzcs9jys3jI38yMMgF1r4Fr/MGG163KY
pllBY28e+mHl4A8FamcXgsAJcSsWU2QcREKgrBndRO7VuP8C+r6BeBbwtCbVi3pv17YgJGh3ZXDA
2Bo22NcIF5EXReSR3/BO3+9E9dCNe5qYJxH9kemEdefk3BrDkHydNkFOjPegFRgMgg5FtpSkSL5V
TkiBinBAJlKm+kGEXXJnV8ng/iol3aS+xc/Qrw6dSWiDqVBHQPz/b3MdOFVL0Mqyuui5Bg+dwFwv
QCtio7fF2HXUXkVmnaKRm59kitGe78Al/Jee5nTRuz1MBDkT+04bci76CJj+vJQJiTZcCGVExZrz
luznRg6wG19o8dKIPRGs9y90dkuAVRDxGUfg7mh7qgitx7CAxY+l0HkGDRWF/ZCZwVNmtf6yrkpc
MP92b0mrPtL3tgtFNouJAKec0PkGPpsZup7/WkOhDYoqO6+ehzu46o/SEDOdlAB36RFnu4Bx+aqR
kqDjsh8Tn4JqXxE28K/OpcTyL4dabisMCbp/RORkTwWHosH+w8OwZ++A0PRY0xvvT5DPDudS4mYu
4ITZDrwUJa85KXNf3NPaRRTdcKfMNULoa0BgBFmhCMiWYx+eX3FMpsXq8zyvyRMRWam3AQvne34W
3YecNbfociKC7C2kfntsGNV6qe3ZkUCaTgcWboHWrSAhzYLCYCnkHDdvcPt3G0UjTvXqrtwYj10l
XDV2yWP5o4nXjghuY9I2S/E3PXoG4/rR911KGjU/PhKPlF4lkvphKzWK5zcJf1lbp+S5gonsKt6r
kf7aIHRMALFL6UEegreIjugocc36AuPzPFuxlE5QlA2Vt0NMjJCn8bLb7uCLOWQKpb54LbhCaZkO
j91ZLaxmWG/Zzc/YB7wKYCOr6rZPw748XkklC7uHgh7/fwGSqejE/sLRFwyiMx0qT9/vx3KnLnnu
kv2/YpDyu/Y41bzCsl53uFE9vHWphgIjIzM/cDz1N/g4npezOGSwNYgXZKsImbJ3ySUxljYFRv3E
8CfVxe2LptFSesjjFoNsPDN/p4SDoHbrtJodn6Ftm9fYJ7UFwb4uf6kAQLNWof74gypt8uDq6iiQ
2x0aq75tyDSWYQoIj/C4RjvUXtS0TarorUJn9++wUpfrcFgR9BPn6suZF9egaP89WGZGCsLrHOn9
3hF0gB7Gy7qdNg1GTI6abp8O5aTtMVAz7VI60H9Nrvp+yXEj+pkRXMjnlTCBY9GX/27vVWg+RPn9
yGbMyWNib4CHVaEqN0vgf460tzYej6bD1oZxJrCrvpO2+p0GgD0ep/BR1umDdoRxanAlzETWGuEG
TRxdpo2HkX0f1j4fDE8A0athAHfN9Ro1kOmwmvC0C2GLdG3edLbel6cWovFzyfc5uqiOVzM4DfKE
J0+U5Il3JkcNQMBO5ipWrK1X55hDijnKIlZLIZzfPqouJoU44wYvrugThVs0oI7l5jdLiq7Ua7pX
Zz/aWuDZDb1PUPBvxnsxQdWNyuI+raQut3es69ZIGvrHUw+gc8jM2nwlr/mBj0K9XnVKppSkZyUt
iHu7IcCjZR6nkniJRykp3t9vu7ouHY34mzsKCFjy+cvdCChSbo5BcEZ1+vtI/2wju39uz8ucTwza
xKVo7oaurheaPJV+Dx+RgAs1sL2hL7Gz227An1F9jPE0hKLUld6MqQdFYqUynZL0qgVebTfjDAIS
m1lWWFweuH8+rsPwC/KHBs+caRA3poltvx415JrkzAn/w8tPchPd8yEnd+VgqxQyg/C5vXK8C3vp
nVC7TlBZHdIZQuQqbOBQTnkUsc4dzxKJKEojj4jOCd60O78blDAhzO5p0zC/9DpCxGQhQKlHpLdv
N4ej5dC8oxC11jwjY7oSgcO4MmHjNHClFbKA+igcAS8jG+dtflj/bhpI4dD5nmDtJsx2v51IOD8v
lOFd6JSgsVLvGYJIe63XZUhlFNpBzwzT/8cFNGL8K1UvdmGZ4Ilte3CoagB529zd09JUd6gi9vSL
KxdmxB7BHuLsR0eMk7VQZbdeKaJiNbXbA8VNLxFS0Xe7Oo4smwkDsRbYGMXlUrFFD/a7ZmnbWyfo
8xPYDG2preEFpib5PocTR0xh3ntfJnsxojzHd7d/o+isEzh2S1EyfhcO2cgmsIE5yCZp9q38qC4c
vAt6346NHQT9c2ByPQHQXdeZU8fSJJhNFFP3KX10cyPnoMM6pHfk+Xq6utPiY8nqeX5AAvUylyOV
c4ct+/5+Sv86AW+vSXrgKnt4QRH96QKcLIZAfDNYJuslJp8ukSQ4MDnr4nCWZlUw8pvmPsCkkZZT
Q0INX0vVNmt8v0dOvPv4utrUu3pfZE9KAhDwjaJfiJBN/9vizDvMK8ElazZu6IZH6Ny004p06YYd
1iadwvOtDY5F91BLFvVz44EMnF6GghqDSCWMtZdMQHx4Ox+hvpFjf24raBY5k/D8cXOEo0Ku9CeU
OAkKm7fNoGOcaS9w4XcXpcqu2JlohnKU5OGty68tO6cIxt46cpurVDmeTM8Ehb/q9mb9VXMoPW2F
9t6Fz0dXgpEbyGMEm1i2Q+5q/LYsX4cMaPhOuBIUjXeWaT7Xc94/x6GyN4VE47iYGyVqHceVsqS1
T1oNISB/MHIoh1X9vQsLGjVjFxYwfxZTDBhMbMpqu76nbC0K8gUHhAyi2X9pInUKFyxn9OOo5rzE
+m/G4N9tRfwYQNdrykZCXIrN12dubhDLJ0VxTw5fJr/EhRhy3revezLABQzu9CXPm0UL1/Ycz7Vl
DRMIJyHP+Lh8TfOaYwDXINNfxt8L9SefpCcMm0Sr4QzqjTDRN6UQr7B1SDmT8IJHZjX2rkw/z7ij
BHd9Fspkip9hPUzH9pTyWX1Mq4EaBZSYZdo2GNYMkmjt1KP/67b8eZO+c4AszEjmRIKalY4sCneO
ic/SY5BHBms/vkT53YvH122YQIZXE9abv7Ptm73qj4+pLXRRMlwVVmQF1dPkaoDMKhXDBh7Koish
76j9ldhkCkZzYIK0D4XziWNPSDglOJrZZmGO62VMuWboxpWvT/a7eD2WdbKwjWuQ/Dczz9Y74j1x
Ez/fTO+tE3nTkukUaCt37i5e91aDXcR4kZMWl8cI5YKzjp5ikfayhiitbEAWWErkSH7woO2DxZ5+
DPfkCuXj68ezETMKcgT8CH7Hk7+pzJD6DJbcOL45RQE6JPLP9z3rYWgMPQKGgkMdiv4XwmILzMDA
bypG9SBbVFFZ1GkBBy0TrslO/D/2E05qTlXyZe5Kxqm9DPNaNFxDhXmqTs+PFna0TQmxO9YHALX5
co96ZiNcsg3Hsuk+iVg5QipZQ4mtQzAy5KLay+s+9kN1s5G0tVnRxDTfIn4tvA4jJkn9Rrfyh/Sa
oX2c0GGyND8PK77kXRvBvT6tOFlsk0Rjth4wZri3mTjDIJeUuVcgdverlza7t4GuWCJJF9jwuiU8
9Yqshv8kWTwLamzd/TTA9tLPBLVhDTNp/jzNWLQ3l59l26HDPB4QAae3yvXNyvh7y5zoeQhoMeZM
pu5vdcgCoJvDiQX6IgKD/ZoOsc4HF/PkMiiUsL67aO75O7M3bFvyllah2Qa35cEoZbyxuGJJ9Y7L
JG31HX7oFF0ZNeVIJYDeDBhzLrZef1NSgzUF7pjSzOlZCff8DWJ369a6R8S5SuromVaiCqPfWPfU
mnSVMFFh1Zb0mgsZuENN5b2Oyqb6QKUMYCbAcZHe4sX/3mikbf/3dDC/rujkkNxIn+M/x+QSf5oo
MgIMzXWlPZ4SDTV24w5ZhmxuP3vw9VYE74B3x7e8bgnQCoTm/UiSnpAwQ/X6oly4yWNarpSU9H2A
a9bp4AKCp3HA4AY1C1Jq6AM2EwCDaLiG6jJFYjMScfdZNaQsU7Zpe+CLqKhub6mKtGU256rBVgIO
8a9lwso+SAUpoE1ftzVW2pVH6JWgzdaJuWQGZLhoHIdfmP/p30zBSg0OZxlmLiVLdZa6Jj5zUMjE
XxIHywJlIq16OsGsWFYiuBrSc0PrEgHgerT6l2HABl8l1H2UwDymuyu4O9fnR79BXU26zgiPRCKP
AXDYBGN3imNek5yXqHQuRi/ovb317QFOKD5FbtKZjmiv16cveKW8430hB+WgAc6v23JLlz3+ewJo
V6GH9XR/TQokeWXfB+yoUmnEhKL6l8f72KJKPhb+O3V3d/pCwfVlkGGejBrMaIlMNP/R0JR3LPed
lZzv+Y9KmXIwKB0Eq8UVM2X+2PklTR9MlhkchR7oSLhfVurldaR7pbQA8bVLm/OsudEwt/dk2e9R
lAI8cgkXhgk6gVyYXezcc7vhvSBc9OWSUIl5eiGeipPCpCQezHtgYkmnJ7hG26d6c3TILkKSUz3w
xrBtvz0oBnMSwW5QmFdjB8WZV7ulw3Wm6E2h03K4ONE+hYYMvwNxecy0oir25kvb9gFPYQvRns9M
Na9FdeKQV5TVfVXSUFkN3TycgH5iDeRT8Ld31hZJwtYuUQ2RhJyzGkR1CcwpGHyGmiilY+Uo4F77
rB3ov9tt09aPhhFvqw1/C+9R7lJawjiYM3hapmRGwA9XHbMxRv+aMZkVQrrVb/W9LqzI3oQ9lDSl
4QV/6Q9yniwgOo0xZc2jkUWalvkyCxXQDvHkwIACVzE/J6i5RjD/AnvyYQDe3GZ0Ob2qHPdIlhG3
CUbqZCwrdKMvDakDAopka9oJTBpAky2nkh/hPwH3Z/b7MdgbPQzySNcBzWXa+UYZgskBbkP35eYz
wQagTH7o7WLyUGt/BGuAcYbTGAe6KkiSB2/vykn/0a/S48BNC2ucAvjU0yQ0zqsBti4PqITPNElS
ha1+6myE4gyUvKHdfWuMJCItRnIUFIHtdYVIzsOrdjSp/0o4cPvAhq2WL4SUZd+7WJtDWpA7/b3R
QNwzyb+ZpfVbNA8PmWP/vUiTLQI7brozbr5AHyIoylqqVZPG5khZDuA2PcYmTm1mldBbH24xwhVj
3XaDntRhlJAc+jmzozj3KhqzivVVwSmc386nuCBoCR/byfshXo0Pd64gtTCesAxg4kqcyN8CHOBZ
o5guwagGQRORoUHPCZz3aFf2MdE45XCigm4aYAh2bLMi2IdLPJ8wNd6vEfCDRwtACSnQJHNFUWMt
bPzUZxBcRec7DjwOi16Eyos4lOB5PAJOgBHxbYiNujG3LBBVBikOPy6RL0+5uw3GYZMdb78PrOw1
bjNC+RfSCK0JNZgV0rzfyyVTZXbLAn0+O/HdcTRSMUsutdQiFo8TvV3PziwMy0kbJl3F1rARRSin
pylUSPASWr1EwGG6Ek3Bt0RdZORXXY4+xCuinRq3iKYgBMd9VfreOMRXHTB9NezcFHv5TCvhz238
YGVuZHN0cmVhbQplbmRvYmoKMTIgMCBvYmoKPDwgL0NGIDw8IC9TdGRDRiA8PCAvQXV0aEV2ZW50
IC9Eb2NPcGVuIC9DRk0gL0FFU1YzIC9MZW5ndGggMzIgPj4gPj4gL0ZpbHRlciAvU3RhbmRhcmQg
L0xlbmd0aCAyNTYgL08gPDliNWE5ZTUwMGZiODdlOWQ0MTcxZTIyZmE3N2ViNWE3MmJhODU3ZDJl
MmVhYTQ2NzRlYzhlZDY5ODMxYzc3ZmRmNDAwYmUyNzFjMzA0ZjY4NzVkZDFjNTI3MmEzZmVmMD4g
L09FIDwzZGU4OWZlNWQ5MzdjZjhhMGIxMTA1ZGQ3YzYwYTBjMjRiZDNjYTBlODE1YjU5Y2QwMmE1
OTU4MWQzNjE2NWJlPiAvUCAtNCAvUGVybXMgPDkxY2IzYTgyMjc1NGRmMmE1OWZjZDcxMTMyNDI1
YmNjPiAvUiA2IC9TdG1GIC9TdGRDRiAvU3RyRiAvU3RkQ0YgL1UgPDY3MTcxZWY2ODFlZjkxZWQ1
YmVhNzE2ZmE1ZWNlZGE4OWI4NjU5ZTFlN2U0YzViODEwYmUzN2JlZmIxZGRkNmNjYzAyMTcwMTVh
MWVlYmNlMmM4NGU1NzYwN2QyMjIyNT4gL1VFIDxlNmU1Y2JlMWJlZjRiYTEyZTc0YTQzZThhMDc5
OTcwZWQ5MzY2NDMzMzk1NWU3NmQyMjM5NmZlNjkzNjdkM2ZjPiAvViA1ID4+CmVuZG9iagp4cmVm
CjAgMTMKMDAwMDAwMDAwMCA2NTUzNSBmIAowMDAwMDAwMDE1IDAwMDAwIG4gCjAwMDAwMDAyNDIg
MDAwMDAgbiAKMDAwMDAwMDU5MyAwMDAwMCBuIAowMDAwMDAwNzUyIDAwMDAwIG4gCjAwMDAwMDA4
NTQgMDAwMDAgbiAKMDAwMDAwMTEwMSAwMDAwMCBuIAowMDAwMDAxMTU4IDAwMDAwIG4gCjAwMDAw
MDExODkgMDAwMDAgbiAKMDAwMDAwMTQzNyAwMDAwMCBuIAowMDAwMDAxNjM1IDAwMDAwIG4gCjAw
MDAwMDIwNDMgMDAwMDAgbiAKMDAwMDAwOTY1MSAwMDAwMCBuIAp0cmFpbGVyIDw8IC9Eb2NDaGVj
a3N1bSAvNEU5N0NEQ0UxMkQ5ODhBRTExQjQyOUJFMjVBRDg4RTUgL0luZm8gMiAwIFIgL1Jvb3Qg
MSAwIFIgL1NpemUgMTMgL0lEIFs8YTdlN2YzMDQ0YWUwMjNmMWQxZmFjNDQ4YmYyNTU5MmM+PDJj
MTYwZmMzNjkxZTg1ZmFmMjdkMjBlNmFhM2RlYmM3Pl0gL0VuY3J5cHQgMTIgMCBSID4+CnN0YXJ0
eHJlZgoxMDE5OQolJUVPRgo=
--d5fb934eea53bfa57c7072ebad7a334624b44d2e1ebdd5e6b1538dee85aa--

So what we have so far :

  • The name of the student : Hans Deutshmeister
  • The password is your personal zipcode
  • A base64 string which is the PDF file

First thing I did was decode the base64 string.

Then i needed a password to open this file. My teammate Ava_kyoko had an good idea for that. Since the guy is German, and Germnay has 5 digits numerical zipcodes, we went and generated a password list with a bash script.

Then turned the PDF file into a John hash. And went with the bruteforce.

BINGO!

One thought on “CyberSecurityRumble 2021 – Result Writeup

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.