Reply to thread

Message: <blockquote data-quote="Sweet_Johnson" data-source="post: 28410425" data-attributes="member: 582370">DAY 1 : The Bandit YetiTHM{IT'S A Y3T1 CHR1$TMA$}Use the ls command to list the files present in the current directory. How many log files are present?2Elf McSkidy managed to capture the logs generated by the web server. What is the name of this log file?webserver.logOn what day was Santa's naughty and nice list stolen?FridayWhat is the IP address of the attacker?10.10.249.191What is the name of the important list that the attacker stole from Santa?santaslist.txtLook through the log files for the flag. The format of the flag is: THM{}THM{STOLENSANTASLIST}=====DAY 3 =====What is the name of the Registrar for the domain santagift.shop?NAMECHEAP INCFind the website's source code (repository) on github.com and open the file containing sensitive credentials. Can you find the flag?{THM_OSINT_WORKS}What is the name of the file containing passwords?config.phpWhat is the name of the QA server associated with the website?qa.santagift.shopWhat is the DB_PASSWORD that is being reused between the QA and PROD environments?S@nta2022===== DAY 4 =====What is the name of the HTTP server running on the remote host?apacheWhat is the name of the service running on port 22 on the QA server?sshWhat flag can you find after successfully accessing the Samba service?{THM_SANTA_SMB_SERVER}What is the password for the username santahr?santa25===== DAY 5 =====Use Hydra to find the VNC password of the target with IP address 10.10.208.109. What is the password?1q2w3e4rUsing a VNC client on the AttackBox, connect to the target of IP address 10.10.208.109. What is the flag written on the target’s screen?THM{I_SEE_YOUR_SCREEN}===== DAY 6 =====What is the email address of the sender?<a href="mailto:chief.elf@santaclaus.thm">chief.elf@santaclaus.thm</a>What is the return address?<a href="mailto:murphy.evident@bandityeti.thm">murphy.evident@bandityeti.thm</a>On whose behalf was the email sent?chief elfWhat is the X-spam score?3What is hidden in the value of the Message-ID field?AoC2022_Email_AnalysisVisit the email reputation check website provided in the task. What is the reputation result of the sender's email address?riskyCheck the attachments. What is the filename of the attachment?#Division_of_labour-Load_share_plan.docWhat is the hash value of the attachment?0827bb9a2e7c0628b82256759f0f888ca1abd6a2d903acdb8e44aca6a1a03467Visit the Virus Total website and use the hash value to search. Navigate to the behaviour section. What is the second tactic marked in the Mitre ATT&CK section?Defense EvasionVisit the InQuest website and use the hash value to search. What is the subcategory of the file?macro_hunter===== DAY 7 =====What is the version of CyberChef found in the attached VM?9.49.0How many recipes were used to extract URLs from the malicious doc?10We found a URL that was downloading a suspicious file; what is the name of that malware?mysterygift.exeWhat is the last defanged URL of the bandityeti domain found in the last step?hxxps[://]cdn[.]bandityeti[.]THM/files/indexWhat is the ticket found in one of the domains? (Format: Domain/<GOLDEN_FLAG>)THM_MYSTERY_FLAG===== DAY 8 =====What flag is found after attacking the provided EtherStore Contract?flag{411_ur_37h_15_m1n3}<img src="/styles/default/xenforo/smilies/default/happy.gif"  class="smilie" loading="lazy" alt=":)" title="Happy    :)" data-shortname=":)" /></blockquote>

Verification: Dahaya deken beduwama keeyada?

Top Bottom

Search

Latest ads

Reply to thread