Posts

Python Escape from LA This challenge is about breaking out of a restricted shell to execute a program that resides in the directory. In this case, we are provided a Python shell but we cannot import any modules that would let us perform advanced tasks such as executing a binary.

Question 7 HR Incident Response In this challenge, we are given a website with CSV upload capability and are asked to somehow gather information from the contents of the file: C:\candidate_evaluation.

Sparkle Redberry: Dev Ops Fail In this challenge, we are asked to see if there are any credentials exposed as a result of git operations. We list the contents of the current directory and notice the directory containing the git repository.

Question 6: Badge Manipulation The objective for this challenge is simple – we need to bypass the authentication mechanism. The way the authentication works is the machine “Scanomatic” scan a QR code on an employee badge and grants access depending if the QR code matches a proper record in the back-end database.

Pepper Minstix: Yule Log Analysis As part of this challenge, we are looking at Microsoft Event Viewer Logs to discover an instance of password spraying that eventually succeeded. Password spraying is when attackers use different usernames in rotation to attempt login.

Holly Evergreen: CURLing Master We know that the candy striper machine can be turned on by sending a request to port 8080 on localhost (127.0.0.1). But we do not know what request to send.

Wunorse Openslae: Stall Mucking Report We are told that a Samba share with shared network credentials is used to upload the file on the server. These shared credentials can be revealed via ps if they were entered in command-line mode.

Tangle Coalbox: Lethal ForensicELFication The poem that introduces the challenge talks about certain “text editors” leaving behind clues. Vim immediately comes to mind. We know that Vim logs information about deletions and searchers into a file called .

Minty Candycane: The Name Game This challenge presents us with an onboarding system written in Powershell. There’s a command injection vulnerability in the system that allows us to injection arbitrary commands after the ; is used to end the previous

Bushy Evergreen: Essential Editor Skills This challenge asked us to exit a vi terminal screen. This one was quite easy. We know that the way to do that is ESC + :q or ESC + :q!