Root Me : plateforme d'apprentissage dédiée au Hacking et à la Sécurité de l'Information

Trusted

BoBNewz — 2026-04-21T10:11:53Z

You are called to investigate an employee's machine. For some time now, strange things have been happening on his computer, and the employee has lost access to his passwords.
An initial investigation has confirmed the presence of a malicious individual on the machine.

We ask you to find :

- The CVE used by the attacker to gain initial access.
- The password of the employee's e-mail account.
- The attacker's IP address.
- The C2 used by the attacker (e.g. Havoc).
- The ID of the persistence sub-technique according to MITRE ATT&CK.

The flag is as folllows : RM{CVE-XXXX-XXXXX_password_attacker-IP_attacker-C2_MITRE-ATT&CK-ID}

sha256sum : 29cade26d102e12191f49a72da235b0eeca8953725c85a090beb0b81a95d45ff

- Forensic

Invocation

BoBNewz — 2026-04-21T10:11:48Z

A hacker infiltrated a company's system and encrypted an essential file.
Fortunately, a memory dump of the victim machine was carried out, along with the recovery of some network traces.

Analyze events and retrieve the contents of this file !

sha256sum : aaba88eb944aaf65af1c261a291be20a2e1a34e09a7575a8362767cb389be6a2

- Forensic

ICMP exfiltration

M4tou — 2026-04-21T10:11:43Z

Your SOC has detected a successful intrusion on an administration server. The intrusion was carried out from the outside using the administrator's password, although he was not present at the time. We suspect that his password had been previously compromised ,but there is no trace of this on the IDS.

However, N1 SOC analysts isolated suspicious ICMP traffic the previous day. The alert criterion was the length and shape of the load, which was inconsistent with Linux.
The CSIRT team deployed on site succeeded in recovering a suspicious binary, whose name seems to be directly linked to the SOC detection.

Find the exfiltrated data !

sha256sum : c5d9abda3504725a90fed54c27fc4ccea8510315dbc1daac7934f0e5841986e3

- Forensic

Heist of the century

Ayweth20 — 2026-04-21T10:11:33Z

Two young criminals have carried out a robbery at the town's bank.

The police managed to arrest them as they left the bank, but they need your help. It seems they have seized the two criminals' phones but have been unable to unlock them. They are counting on you to help them unlock these phones by providing the PIN (apparently an 8-digit code) and the password.

Format : RM{PIN:PASSWORD}

sha256sum : 2400EEAA80A0D59A780A912D6739B9B8E8274E1B5C1EFAF891B872AA83B6BDDF

- Forensic

Remote Support

makhno — 2024-11-08T11:00:40Z

Your system administrator asks you to help him harden his machine using the tools he has installed.
You've taken a network capture and a memory dump, so show him that he's still a long way off !

The flag is of the form sha256(part1+part2+part3+part4+part5)

sha256sum : 857193e8e203c02b53da645b59dcf88790f0cc5763941ddf1dd1a3f195ec1486

- Forensic

MasterKee

Ayweth20 — 2024-11-08T11:00:33Z

A colleague has set up a useful system on his new machine.
He insists he's the only one who can access it using what he knows, but you want to show him that anyone could access it without him even being there.
Your challenge is to show him that you're capable of much more than he imagines.

sha256sum : 5c8777a28a0ef8b1f438a143bfe13772ab60770ec350d9475b69c2fb5ab01577

- Forensic

Air-gap exfiltration

Yorf — 2023-10-20T09:49:03Z

On his rounds, the guard found a drone sitting on a windowsill.
Curiously, it was facing an office in a "protected zone" whose network is isolated by an "airwall".
Your security officer asks you to check that no data has been exfiltrated.

sha256sum : 7f73bdc8a1227621d98180af9a41ab1656075abd93ecfc3f780bc7b2ec1c59b6

- Forensic

Capture this

Zey_Roxx — 2023-10-20T09:48:59Z

An employee has lost his Keepass password. He couldn't remember it, and couldn't find his password file. After hours of searching, it turns out that he has sent a screen of his passwords to one of his colleagues, but it's still nowhere to be found.

He's asking for your help to find him.
It's up to you

sha256sum : 028c8561f087da873b08968d55141dcfc8f10a47e787f79c35b2da611a5e07ce

- Forensic

Web3 - Put on your mask - Step 2

Dridri — 2023-10-20T09:48:56Z

Dear Investigator,

After identifying the suspects and the links between the people, it is high time to recover the funds from the Ethereum wallet where the victims' money is received. We would like to recover the public/private key pair so that our engineers can proceed with the seizure of the loot.

The validation flag is the result of : sha256(privatekey:publickey)
with publickey in "checksummed" format (upper and lower case)
and privatekey which look like 4fb9[...]09af (without the 0x)

sha256sum : bc5b352dff02e898592433b7fa56224ccefd4557404f678d0167a1fd8fba62ed

- Forensic

Web3 - Put on your mask - Step 1

Dridri — 2023-10-20T09:48:53Z

Dear Investigator,
our intelligence services are on the verge of bringing down a large network of crooks operating on the dark web. On November 12, 2022, we managed to install a backdoor on the host machine of the potential ringleader and were able to recover a memory dump of the virtual machine that was running.

We need to know some on-chain information to better analyze the organization of the scam.

Could you search on the network for :

the Ethereum address of the victim extorted of ether funds that fed the gang leader's account
the Ethereum address of the buyer of a stolen credit card
the name/username of the buyer of the card
the card number

The flag is the condensed sha256(addrVictim:addrBuyer:BuyerName:CardNumber)

Be careful : the addresses are in checksummed format (upper and lower case)

sha256sum : bc5b352dff02e898592433b7fa56224ccefd4557404f678d0167a1fd8fba62ed

- Forensic