Advent of Cyber '24 Side Quest
This guide contains the answer and steps necessary to get to them for the Advent of Cyber '24 Side Quest room.
Table of contents
- T1: Operation Tiny Frostbite
- T2: Yin and Yang
- T3: Escaping the Blizzard
- T4: Krampus Festival
- T5: An Avalanche of Web Apps
- The End?
T1: Operation Tiny Frostbite
The keycard for the first challenge can be found in the following room (this was hinted in the questions section of this task.)
In the hint we are led to the github repos we have been looking at for the AoC task. Before digging deeper there, I will run an nmap scan to see if we can find something.
Besides ssh and the regular webpage, there seems to be another http server on port 8000.
Navigating there, we can see there is a hidden C2 server login page.
We don't have any credentials, but this might be where the github repos come in. We can see another user that commented on the issue.
Looking on his profile page, we can see some repos. This C2 repo might be of interest.
In this repo there is a script used for the server in flask.
In this script we can see various functions including a login function and several endpoints. It also includes default credentials and a secret.
I already tried the default credentials, but this didn't work. However, since we have a secret key, we can try to force a session cookie using flask-unsign.
In the script we can see that the login function looks for two values:
- "logged_in" = True
- username
We can try with the admin user to forge a session cookie using the following command:
In our browser we open the developer console and add a cookie whilst on the login page. Make sure to use the following values:
- Name = session
- value =
- path = / (this enables the cookie for all endpoints)
Now we simply reload the page and we should be able to look at the dashboard.
Success! Now we can look at the data page and get out keycard for the first challenge.
References: https://blog.paradoxis.nl/defeating-flasks-session-management-65706ba9d3ce https://flask.palletsprojects.com/en/stable/config/
- What is the password the attacker used to register on the site?
After opening the pcap file we can filter on the http traffic.
For the first question, we are looking for registration credentials. This is probably located on a register page. In our case, there is a register.php page. We will filter this on POST requests as well so we get data which has been POSTED to the server.
Click for answer
QU9DMjAyNHtUaW55X1R
- What is the password that the attacker captured?
For this we can use a similar approach, but instead we will be looking at login requests rather than register requests.
Click for answer
pbnlfVGlueV9TaDNsbF
- What is the password of the zip file transferred by the attacker?
We are looking for a zip archive. This wasn't found in the http objects unfortunately. I did find two interesting looking executables which my be of interest later on.
We could look for the magic bytes of a zip file. Which in this case would be 'PK' or '50 4B' in Hex form.
We can filter out the traffic from port 22 and 80 to make things more clear. In this filter we can look for the hex value of '50 4B'.
We see something in packet 158339 coming from the host to the assumed attack machine via port 9002. It also contains something similar to an sql database called 'elves.sql'.
To extract this archive we must follow the TCP stream. Then make sure to format the data in 'raw' format instead of 'ASCII'. Save it as a '.zip' file.
Unfortunately, the zip archive is password protected which we don't have. Yet.
We do however, have two executable that we found were downloaded from the attack machine to the host machine: 'ff' and 'exp_file_credentials'. Running their has through virustotal gives us an idea of what we are working with. It seems to be some kind of Linux backdoor. More specifically (from the community notes), a Tinyshell backdoor. https://github.com/creaktive/tsh/
Now the next few steps were a bit lost on me (maybe if I put a little more time into it, I might understand), so I followed some steps in the following write-up.
The basic idea is that we have a copy of a malware executable as well as its source code. This source code tells us how it encrypts the data (i.e., the network traffic we logged on port 9001) and what we need to decrypt the data.
It starts with a secret and two initialization vectors. This secret is stored in the executable. Using a reverse-engineering program such as Binary Ninja we can look through the file and find the secret in the data header.
Now that we have the secret, we should use a script that performs the same steps as the malware to decrypt the data. This was also used from the above mentioned link. Take not that it is required to export the relevant entries to a text file using:
We can now run the script and we should see some of the commands that have been executed via the shell.
We can see the command that has been used to create the archive at then end (including the password). It also shows us some of the sql commands used which reveal the password we need for the next question. If this was not the case, however, we could use the archive password to open the database and look for the password inside.
Click for answer
9jYW5fRW5jcnlwVF9iVXR
- What is McSkidy's password that was inside the database file stolen by the attacker?
With the password we can extract the database file and open it to find the password. Be sure to note, this isn't an actual database file. It is a dump file containing various commands. Simply opening it up in a text editor should be enough to find the password.
Click for answer
faXRfSXNfTjB0X0YwMGxwcm8wZn0
T2: Yin and Yang
- What is the flag for YIN?
Click for answer
- What is the flag for YANG?
Click for answer
T3: Escaping the Blizzard
- What is the content of the file foothold.txt?
Click for answer
- What is the content of the file user.txt?
Click for answer
- What is the content of the file root.txt?
Click for answer
T4: Krampus Festival
- What is the content of flag.txt?
Click for answer
- What is the content of user.txt?
Click for answer
- What is the content of root.txt?
Click for answer
T5: An Avalanche of Web Apps
- What is the value of flag 1?
Click for answer
- What is the value of flag 2?
Click for answer
- What is the value of flag 3?
Click for answer
- What is the value of flag 4?
Click for answer
The End?
- What is the flag you get at the end of thesurvey? Please make sure to copy the flag before closing the tab!
Click for answer