F5 Badge CTF

This is a very brief and rundown explanation of the F5 badge CTF

Badge

So the badge is quite standard hackerware style badge

Pasted image 20250920101930.png|300 Pasted image 20250920102033.png|300

It came with this information sheet.

Pasted image 20250920102054.png|300 Pasted image 20250920102122.png|300

To unlock the vendor lights, you go to the vendor lights, and they'll use a UART probe to unlock the flag

Pasted image 20250920102532.png|300

Here is a video of the badge (and solving the CTF).

https://www.youtube.com/shorts/PX8abV82OjI

Thanks to https://tubepilot.ai/tools/youtube-shorts-embed-code-generator/ for helping me generate the embed code.

f5 Badge CTF

The CTF challenges, files and other information can be found at https://hackerware.io/f5 . I put some rough notes on how to solve the challenges here. Its relatively straightforward looking through the logs kind of thing. I solved it with iscara.

A)

Pasted image 20250808030933.png

Steps

  1. Import into excel using read from text
  2. Sort by sequence number
  3. Base64 decode

Pasted image 20250808031416.png

Pasted image 20250808031409.png

B)

ChatGPT. Just put the logs inside and it'll give you the flag

Pasted image 20250808040225.png

C)

So we get logs

[OpsLog] 12:05 WARN: service-check ok
[SecLog] 1753877065 WARN: cache-hit id=5045
[OpsLog] 12:08 INFO: service-check ok
[OpsLog] 12:11 WARN: service-check ok
[OpsLog] 12:06 WARN: service-check ok
[SecLog] 1753876933 INFO: user-login id=3489
[OpsLog] 12:05 INFO: service-check ok
[SecLog] 1753877086 INFO: heartbeat id=8887
[DevLog] 1753877066 WARN: token-refresh id=1207
[DevLog] 1753876821 WARN: disk-io id=6900
[DevLog] 1753876800 INFO: cpu-usage id=4479
[DevLog] 1753876949 DEBUG: heartbeat id=1320
[OpsLog] 12:08 WARN: service-check ok
[OpsLog] 12:11 DEBUG: service-check ok
[OpsLog] 12:11 WARN: Partial message fragment=KRMVARL3N5XGK=== Encoded:Base32
[DevLog] 1753876864 INFO: thread-pool id=6418
[DevLog] 1753877048 DEBUG: heartbeat id=5348
[DevLog] 1753877195 DEBUG: disk-io id=4390
[DevLog] 1753876873 INFO: db-conn id=1790
[DevLog] 1753876968 WARN: token-refresh id=2882
[OpsLog] 12:06 WARN: service-check ok
[OpsLog] 12:07 WARN: service-check ok
[SecLog] 1753876861 WARN: user-login id=143
[OpsLog] 12:07 INFO: service-check ok
[SecLog] 1753877059 WARN: latency-check id=1990
[OpsLog] 12:10 DEBUG: service-check ok
[SecLog] 1753876911 INFO: db-conn id=1388
[SecLog] 1753876823 INFO: cache-hit id=5518
[DevLog] 1753877169 ERROR: user-login id=9861
[SecLog] 1753876834 WARN: token-refresh id=2000
[DevLog] 1753876844 DEBUG: thread-pool id=8589
[SecLog] 1753877100 CRITICAL: payload=504f58450a1a1b57 Encoded:XOR key=0x2A
[OpsLog] 12:09 INFO: service-check ok
[DevLog] 1753877007 INFO: cache-hit id=3401
[OpsLog] 12:04 DEBUG: service-check ok
[SecLog] 1753877000 INFO: disk-io id=3834
[DevLog] 1753877112 WARN: cpu-usage id=6684
[SecLog] 1753876842 ERROR: token-refresh id=6661
[DevLog] 1753876888 INFO: cache-hit id=8760
[OpsLog] 12:09 WARN: service-check ok
[DevLog] 1753877120 DEBUG: latency-check id=7954
[OpsLog] 12:05 WARN: service-check ok
[DevLog] 1753876892 INFO: cpu-usage id=9134
[SecLog] 1753876990 INFO: heartbeat id=1370
[SecLog] 1753876945 ALERT: Suspicious traffic fragment=bar bar Encoded:
[SecLog] 1753876854 DEBUG: disk-io id=7185
[SecLog] 1753876998 INFO: audit-event id=7952
[DevLog] 1753876903 INFO: disk-io id=2708
[DevLog] 1753877040 INFO: token-refresh id=3532
[SecLog] 1753877075 INFO: latency-check id=6791
[DevLog] 1753876896 INFO: user-login id=5900
[DevLog] 1753877125 INFO: audit-event id=3090
[SecLog] 1753876882 WARN: cpu-usage id=9885
[SecLog] 1753876827 INFO: heartbeat id=4795
[DevLog] 1753876880 DEBUG: cache-hit id=2471
[DevLog] 1753876870 ERROR: API crashed fragment=GAYDCID2MVZG6===
[OpsLog] 12:11 WARN: service-check ok
[OpsLog] 12:07 DEBUG: service-check ok
[DevLog] 1753877089 INFO: heartbeat id=6825
[SecLog] 1753877035 WARN: db-conn id=4991
[DevLog] 1753877143 WARN: latency-check id=1412
[OpsLog] 12:08 INFO: service-check ok

ChatGPT didnt work

There are 4 interesting lines


[OpsLog] 12:11 WARN: Partial message fragment=KRMVARL3N5XGK=== Encoded:Base32

[SecLog] 1753877100 CRITICAL: payload=504f58450a1a1b57 Encoded:XOR key=0x2A

[SecLog] 1753876945 ALERT: Suspicious traffic fragment=bar bar Encoded:

[DevLog] 1753876870 ERROR: API crashed fragment=GAYDCID2MVZG6===

1st line
https://gchq.github.io/CyberChef/#recipe=From_Base32('A-Z2-7%3D',true)&input=S1JNVkFSTDNONVhHSz09PQ&ieol=CRLF

Pasted image 20250808032832.png

2nd one
Pasted image 20250808032852.png

3rd
guessed its one because 3 letters, and we can caesar cipher it.

4th
https://gchq.github.io/CyberChef/#recipe=From_Base32('A-Z2-7%3D',false)&input=R0FZRENJRDJNVlpHNj09PQ
Pasted image 20250808032928.png

Then we brute forced flags. We know start and end so only need brute middle

1 0010 11 001 # failed
1 11 0010 001

D)

Logs given:

[BuildLog] 2025-07-30T14:45:00Z INFO: step-45 completed
[BuildLog] 2025-07-30T14:48:00Z INFO: step-48 completed
[BuildLog] 2025-07-30T14:22:00Z INFO: step-22 completed
[CacheLog] 2025-07-30T14:38Z INFO: cache-miss key=203
[BuildLog] 2025-07-30T14:54:00Z INFO: step-54 completed
[BuildLog] 2025-07-30T14:09:00Z INFO: step-09 completed
[BuildLog] 2025-07-30T14:05:00Z INFO: step-05 completed
[Trace] 2025-07-30T15:23:01Z DEBUG: spanId 1001 finished
[BuildLog] 2025-07-30T15:02:00Z INFO: step-62 completed
[Trace] 2025-07-30T15:23:09Z DEBUG: spanId 1009 finished
[BuildLog] 2025-07-30T14:41:00Z INFO: step-41 completed
[BuildLog] 2025-07-30T14:06:00Z INFO: step-06 completed
[BuildLog] 2025-07-30T14:31:00Z INFO: step-31 completed
[BuildLog] 2025-07-30T14:45:00Z INFO: step-45 completed
[BuildLog] 2025-07-30T14:01:00Z INFO: step-01 completed
[BuildLog] 2025-07-30T14:23:00Z INFO: step-23 completed
[BuildLog] 2025-07-30T15:01:00Z INFO: step-61 completed
[BuildLog] 2025-07-30T14:50:00Z INFO: step-50 completed
[BuildLog] 2025-07-30T14:29:00Z INFO: step-29 completed
[BuildLog] 2025-07-30T14:46:00Z INFO: step-46 completed
[GitLog] 2025-07-30T15:21:30Z INFO: merge branch 'bugfix/login'
[BuildLog] 2025-07-30T14:11:00Z INFO: step-11 completed
[BuildLog] 2025-07-30T14:57:00Z INFO: step-57 completed
[BuildLog] 2025-07-30T14:07:00Z INFO: step-07 completed
[BuildLog] 2025-07-30T14:53:00Z INFO: step-53 completed
[BuildLog] 2025-07-30T14:16:00Z INFO: step-16 completed
[BuildLog] 2025-07-30T14:14:00Z INFO: step-14 completed
[DockerLog] 2025-07-30T15:22:05Z WARN: image pull latency=1200ms
[UnitTest] test_case_06 PASS
[BuildLog] 2025-07-30T14:37:00Z INFO: step-37 completed
[BuildLog] 2025-07-30T14:12:00Z INFO: step-12 completed
[UnitTest] test_case_02 PASS
[Trace] 2025-07-30T15:23:10Z DEBUG: spanId 1010 finished
[BuildLog] 2025-07-30T14:52:00Z INFO: step-52 completed
[BuildLog] 2025-07-30T14:32:00Z INFO: step-32 completed
[BuildLog] 2025-07-30T14:24:00Z INFO: step-24 completed
[UnitTest] test_case_10 PASS
[BuildLog] 2025-07-30T14:20:00Z INFO: step-20 completed
[BuildLog] 2025-07-30T14:39:00Z INFO: step-39 completed
[BuildLog] 2025-07-30T14:36:00Z INFO: step-36 completed
[BuildLog] 2025-07-30T14:59:00Z INFO: step-59 completed
[BuildLog] 2025-07-30T14:17:00Z INFO: step-17 completed
[Metric] 2025-07-30T15:22:20Z INFO: CPU 87%
[BuildLog] 2025-07-30T14:42:00Z INFO: step-42 completed
[Trace] 2025-07-30T15:23:04Z DEBUG: spanId 1004 finished
[BuildLog] 2025-07-30T14:40:00Z INFO: step-40 completed
[UnitTest] test_case_01 PASS
[BuildLog] 2025-07-30T14:43:00Z INFO: step-43 completed
[BuildLog] 2025-07-30T14:25:00Z INFO: step-25 completed
[Security] 2025-07-30T15:22:35Z WARN: multiple failed logins user=admin
[BuildLog] 2025-07-30T14:10:00Z INFO: step-10 completed
[UnitTest] test_case_05 PASS
[BuildLog] 2025-07-30T15:03:00Z INFO: step-63 completed
[BuildLog] 2025-07-30T14:47:00Z INFO: step-47 completed
[CacheLog] 2025-07-30T14:31Z INFO: cache-hit key=101
[BuildLog] 2025-07-30T14:55:00Z INFO: step-55 completed
[Trace] 2025-07-30T15:23:03Z DEBUG: spanId 1003 finished
[GitLog] 2025-07-30T15:20:00Z INFO: commit abc123 message="Add feature X"
[UnitTest] test_case_04 PASS
[BuildLog] 2025-07-30T15:05:00Z INFO: step-65 completed
Hash: 4890680219db6848ca52cc9599a65caa373ad646189c1e7788cb31dc5a9f71f6
[BuildLog] 2025-07-30T14:51:00Z INFO: step-51 completed
[Alert] 2025-07-30T15:22:25Z ALERT: memory usage > 90%
[BuildLog] 2025-07-30T15:04:00Z INFO: step-64 completed
[UnitTest] test_case_09 FAIL
[Trace] 2025-07-30T15:23:05Z DEBUG: spanId 1005 finished
[BuildLog] 2025-07-30T14:27:00Z INFO: step-27 completed
[BuildLog] 2025-07-30T14:26:00Z INFO: step-26 completed
[BuildLog] 2025-07-30T14:58:00Z INFO: step-58 completed
[BuildLog] 2025-07-30T14:44:00Z INFO: step-44 completed
[BuildLog] 2025-07-30T14:56:00Z INFO: step-56 completed
Edge.enc: H4sIAKdJiWgC/6tKLcpXMFDIz0tVMAQAnQEp+QwAAAA=
[NetLog] 2025-07-30T15:22:15Z WARN: high latency region=us-west
[BuildLog] 2025-07-30T14:19:00Z INFO: step-19 completed
[BuildLog] 2025-07-30T14:49:00Z INFO: step-49 completed
[BuildLog] 2025-07-30T14:52:00Z INFO: step-52 completed
[Trace] 2025-07-30T15:23:06Z DEBUG: spanId 1006 finished
[Security] 2025-07-30T15:22:30Z INFO: login success user=deploy
[UnitTest] test_case_03 PASS
[BuildLog] 2025-07-30T15:08:00Z INFO: step-68 completed
[BuildLog] 2025-07-30T14:38:00Z INFO: step-38 completed
[Trace] 2025-07-30T15:23:13Z DEBUG: spanId 1013 finished
[BuildLog] 2025-07-30T14:33:00Z INFO: step-33 completed
Prod.enc: mreb 1 bar 1} Encoded:ROT13
[BuildLog] 2025-07-30T14:35:00Z INFO: step-35 completed
[Trace] 2025-07-30T15:23:02Z DEBUG: spanId 1002 finished
[Trace] 2025-07-30T15:23:16Z DEBUG: spanId 1016 finished
[UnitTest] test_case_07 FAIL
[BuildLog] 2025-07-30T14:13:00Z INFO: step-13 completed
[Trace] 2025-07-30T15:23:08Z DEBUG: spanId 1008 finished
[BuildLog] 2025-07-30T14:30:00Z INFO: step-30 completed
[BuildLog] 2025-07-30T14:28:00Z INFO: step-28 completed
[Trace] 2025-07-30T15:23:07Z DEBUG: spanId 1007 finished
[UnitTest] test_case_08 PASS
[BuildLog] 2025-07-30T14:34:00Z INFO: step-34 completed
[BuildLog] 2025-07-30T14:21:00Z INFO: step-21 completed
[UnitTest] test_case_05 PASS
[BuildLog] 2025-07-30T14:15:00Z INFO: step-15 completed
[BuildLog] 2025-07-30T14:04:00Z INFO: step-04 completed
[BuildLog] 2025-07-30T14:43:00Z INFO: step-43 completed
[Trace] 2025-07-30T15:23:15Z DEBUG: spanId 1015 finished
[BuildLog] 2025-07-30T14:18:00Z INFO: step-18 completed
[Trace] 2025-07-30T15:23:11Z DEBUG: spanId 1011 finished
[BuildLog] 2025-07-30T15:06:00Z INFO: step-66 completed
[Trace] 2025-07-30T15:23:14Z DEBUG: spanId 1014 finished
[UnitTest] test_case_02 PASS
[BuildLog] 2025-07-30T15:00:00Z INFO: step-60 completed
[Trace] 2025-07-30T15:23:12Z DEBUG: spanId 1012 finished
[CacheLog] 2025-07-30T14:37Z INFO: cache-hit key=202
[BuildLog] 2025-07-30T14:03:00Z INFO: step-03 completed
[Trace] 2025-07-30T15:23:17Z DEBUG: spanId 1017 finished
[BuildLog] 2025-07-30T14:40:00Z INFO: step-40 completed
[UnitTest] test_case_06 PASS
Staging.enc: VFlQRXswIDE=
[BuildLog] 2025-07-30T14:02:00Z INFO: step-02 completed
[Trace] 2025-07-30T15:23:18Z DEBUG: spanId 1018 finished
[BuildLog] 2025-07-30T14:08:00Z INFO: step-08 completed

Isolated Interesting logs

[CacheLog] 2025-07-30T14:38Z INFO: cache-miss key=203
[GitLog] 2025-07-30T15:21:30Z INFO: merge branch 'bugfix/login'
[Security] 2025-07-30T15:22:35Z WARN: multiple failed logins user=admin
[CacheLog] 2025-07-30T14:31Z INFO: cache-hit key=101
[GitLog] 2025-07-30T15:20:00Z INFO: commit abc123 message="Add feature X"
Hash: 4890680219db6848ca52cc9599a65caa373ad646189c1e7788cb31dc5a9f71f6
Edge.enc: H4sIAKdJiWgC/6tKLcpXMFDIz0tVMAQAnQEp+QwAAAA=
[Security] 2025-07-30T15:22:30Z INFO: login success user=deploy
Prod.enc: mreb 1 bar 1} Encoded:ROT13
[CacheLog] 2025-07-30T14:37Z INFO: cache-hit key=202
Staging.enc: VFlQRXswIDE=

Used these cyberchef things to get the flag

  1. https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true,false)&input=VkZsUVJYc3dJREU9
  2. https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true,false)Gunzip()&input=SDRzSUFLZEppV2dDLzZ0S0xjcFhNRkRJejB0Vk1BUUFuUUVwK1F3QUFBQT0K
  3. https://gchq.github.io/CyberChef/#recipe=ROT13(true,true,false,13)&input=bXJlYiAxIGJhciAxfQ

Conclusion

Overall it was quite fun doing the CTF. The badge is an interesting reference for engagement.