Sans holiday hack 2018 writeup. Monteiro Endeavors, LLC

Sans holiday hack 2018 writeup Rating: 7,1/10 1313 reviews

Holiday Hack Challenge 2017

sans holiday hack 2018 writeup

I configured Burp's intruder tool to perform a sniper attack on the checkpass. It turned out that an elf named Elinore wrote the poem. The built in query is exactly what was needed when combined with a little observation. The payload looks to mimic WannaCry, containing various encryption routines. Badge Manipulation The sixth objective required me to bypass the badge reader lock on a door.

Next

SANS Holiday Hack 2018 Writeup

sans holiday hack 2018 writeup

In this part, we have a memory dump and a file and we need to recover the key. Here you'll find a web log filled with failure and success. A fake account was created to enter the Packalyzer website. This will allow for me to run another command. From here I reviewed the two users listed and chose based on the two active sessions and the ability to reach high value targets. The most beautiful event of 2018 has ended.

Next

SANS Holiday Hack Challenge 2018 Solutions

sans holiday hack 2018 writeup

Whose account was successfully accessed by the attacker's password spray? Her motive is to cause a war to profit from selling spells to both sides. The parser might not count it as a comment until it sees another character after it. After participants solved a few challenges, the conference itself comes under siege. Password reuse can really make redteaming a very pleasent experience. Who was the mastermind behind the whole KringleCon plan? From there, we work our way through the story like Samantha Coleman before we drop into the juicy part of the challenge. Have you heard of password spraying? Today is the start of KringleCon, our new conference for cyber security practitioners and hackers around the world.

Next

The 2018 SANS Holiday Hack Challenge

sans holiday hack 2018 writeup

My role is primarily Windows based, and while I mainly use Linux at home, my own use cases never push me to learn like the Holiday Hacks do. Using the two rules was enough to complete this part of the objective. The last thing I noticed is how the application routed requests. Signed with 3lv3s it works perfectly, logging us in as Santa. Then disass on main to see where we are and see the check. Solution 4 Using the following git command allows me to search for a string against all commits: git log -p --all -S 'Password' I can change the —S option to a —G to search a regular expression.

Next

Writeup

sans holiday hack 2018 writeup

Using this method the correct passcode was revealed to be 0120 or triangle square circle triangle. I could hold my own just fine on my security team, but I still had a lot to learn. When a PowerShell script takes input for a command its possible to break the desired command and instead run a command you want to run. To make this easier, I used the Python library. Breakpoints were set on lines 36, 40, 46, 50, 55, and 63: The malware is executed by clicking the green play button or hitting F5.

Next

SANS Holiday Hack Challange 2017: Writeup

sans holiday hack 2018 writeup

What are the names of at least six insider threat moles? I've deleted an important file, which suppressed my server access. I go through and adjust source. Password spraying however is a reverse brute force attack that tries a single password for each username in a long list of usernames before cycling back to the top of the username list and trying the next password across all accounts and so on. The toy soldiers suddenly get grumpy and outright mean. Dev Ops Fail For this terminal Sparkle Redberry asked for help proving that credentials that were accidently committed to a git repo were successfully removed.

Next

SANS 2018 Holiday Hack Writeup

sans holiday hack 2018 writeup

Once we convert the pairs back to numbers, we get a 60 digit sequence: 000100000001000031230000001100000012000100000020000000120003. One tells me she was disturbed by a bloke. Look at the commits in the web interface. Find that account based on logs. Ed will provide and an overview of how people performed on various challenges and also share important lessons learned that you can apply immediately. It was also the first one I tried.

Next

SANS 2017 Holiday Hack Writeup

sans holiday hack 2018 writeup

I changed the drawing number because I think it's a better way. KringleCon had a deeper and much more subtle purpose. Network Traffic Forensics The answer is Mary Had a Little Lamb. After that I ran the program with run and after hitting the breakpoint told it to jump to the winnerwinner function with the command jump winnerwinner. Here I clench my merry elf fist - Words get filtered by a black list! This allowed me to call the functions from the script and manually step through refining the command. The trick is to sniff traffic and then quickly well within a couple of minutes get the keys.

Next

SANS 2018 Holiday Hack Challenge

sans holiday hack 2018 writeup

To make it fair, the Man devised A fair and simple compromise. I think the main reason I was hired in my current role was because I could navigate Powershell. Run the CandyCaneStriper executable to complete this challenge. The first step was to remove the powershell. Now most of these are variations on the same so we will group all those together.


Next

Holiday Hack Challenge 2017

sans holiday hack 2018 writeup

In the Land of Oz, Glinda the Good Witch. Dev Ops Fail In this challenge we need to find a password. . These maps were used to bypass the badge door and gain access into the room. Please visit Hans in Santa's Secret Room for an update. I noticed a reference to a server-side file called app. Answer A: Getting 4 or more infractions puts you on the naughty list.

Next