KringleCon
SANS Holiday Hack Challenge - 2018
What phrase is revealed when you answer all of the KringleCon Holiday Hack History questions? For hints on achieving this objective, please visit Bushy Evergreen and help him with the Essential Editor Skills Cranberry Pi terminal challenge.
At the Essential Editor Skills terminal, enter
:q!to quitvi
Loading, please wait......
You did it! Congratulations!Answer all the 6 questions: Firmware; ATNAS; Business card; Cranberry Pi; Snowballs; The Great Book
Who submitted (First Last) the rejected talk titled Data Loss for Rainbow Teams: A Path in the Darkness? Please analyze the CFP site to find out. For hints on achieving this objective, please visit Minty Candycane and help her with the The Name Game Cranberry Pi terminal challenge.
The following URLs are used to solve The Name Game Cranberry Pi terminal challenge.
Browse to the CFP site @ https://cfp.kringlecastle.com/
Click on the CFP menu and navigate to https://cfp.kringlecastle.com/cfp/cfp.html
Edit the URL by removing cfp.html, i.e., https://cfp.kringlecastle.com/cfp/. The directory listing appears.
Click on the rejected-talks.csv to load the file in the browser.
Search for "Data Loss".
The author was John McClane.
The KringleCon Speaker Unpreparedness room is a place for frantic speakers to furiously complete their presentations. The room is protected by a door passcode. Upon entering the correct passcode, what message is presented to the speaker? For hints on achieving this objective, please visit Tangle Coalbox and help him with the Lethal ForensicELFication Cranberry Pi terminal challenge.
Enter the following command
ls -lato list the current directory
View the
.viminfofile by executingcat .viminfo
Execute
./runtoanswerand enter the nameElinore
Using the hints given by Tangle Coalbox, browse to http://www.hakank.org/comb/debruijn.cgi and review the de Bruijn Sequence. Generate the sequences and start to brute force attack the door code.
Enter the room and talk to Morcel Nougat. The message was Welcome unprepared speaker!
Retrieve the encrypted ZIP file from the North Pole Git repository. What is the password to open this file? For hints on achieving this objective, please visit Wunorse Openslae and help him with Stall Mucking Report Cranberry Pi terminal challenge.
Using the data set contained in this SANS Slingshot Linux image, find a reliable path from a Kerberoastable user to the Domain Admins group. What’s the user’s logon name (in [email protected] format)? Remember to avoid RDP as a control path as it depends on separate local privilege escalation flaws. For hints on achieving this objective, please visit Holly Evergreen and help her with the CURLing Master Cranberry Pi terminal challenge.
Bypass the authentication mechanism associated with the room near Pepper Minstix. A sample employee badge is available. What is the access control number revealed by the door authentication panel? For hints on achieving this objective, please visit Pepper Minstix and help her with the Yule Log AnalysisCranberry Pi terminal challenge.
Run evtx_dump.py to dump Windows Event log file into XML format.
Use regex to grep for entries with valid IPv4 entries. Use the regex from https://www.shellhacks.com/regex-find-ip-addresses-file-grep/
The password spraying attack has succeeded. A successful logon event is represented by event ID 4624. As the attack was performed against the OWA, it would be a web-based logon; IIS processes logon requests through the advapi process. Read here for more information. This returns us a list of mailboxes that were successfully logged on via the web.
Next, we look for failed logons. This assumes that the attacker was not lucky to have succeeded at the first attempt. Failed logons are identified by event ID 4625 and Status\Sub-Status Code 0xC000006A . Read here for more information.
There're only two IP addresses for failed logons. Matching against the list of successful logons, the IP address of interest is 172.31.254.101 and the subject was minty.candycane.
Santa uses an Elf Resources website to look for talented information security professionals. Gain access to the website and fetch the document C:\candidate_evaluation.docx. Which terrorist organization is secretly supported by the job applicant whose name begins with "K"? For hints on achieving this objective, please visit Sparkle Redberry and help her with the Dev Ops Fail Cranberry Pi terminal challenge.
Browse to the URL https://careers.kringlecastle.com/
Append the document name to the URL https://careers.kringlecastle.com/candidate_evaluation.docx
Santa has introduced a web-based packet capture and analysis tool to support the elves and their information security work. Using the system, access and decrypt HTTP/2 network activity. What is the name of the song described in the document sent from Holly Evergreen to Alabaster Snowball? For hints on achieving this objective, please visit SugarPlum Mary and help her with the Python Escape from LA Cranberry Pi terminal challenge.
Last updated
Was this helpful?