Knowledge Hub

Advent of Cyber 2022

TryHackMe130 answered prompts

Advent of Cyber 2022 TryHackMe walkthrough with 130 answered prompts and lab methodology notes.

Prompts and answers

  • Who is the adversary that attacked Santa's network this year?
    The Bandit Yeti
  • What's the flag that they left behind?
    THM{IT'S A Y3T1 CHR1$TMA$}
  • Use the ls command to list the files present in the current directory. How many log files are present?
    2
  • Elf McSkidy managed to capture the logs generated by the web server. What is the name of this log file?
    webserver.log
  • On what day was Santa's naughty and nice list stolen?
    Friday
  • What is the IP address of the attacker?
    10.10.249.191
  • What is the name of the important list that the attacker stole from Santa?
    santaslist.txt
  • Look through the log files for the flag. The format of the flag is: THM{}
    THM{STOLENSANTASLIST}
  • What is the name of the Registrar for the domain santagift.shop?
    NAMECHEAP INC
  • Find the website's source code (repository) on github.com and open the file containing sensitive credentials. Can you find the flag?
    {THM_OSINT_WORKS}
  • What is the name of the file containing passwords?
    config.php
  • What is the name of the QA server associated with the website?
    qa.santagift.shop
  • What is the DB_PASSWORD that is being reused between the QA and PROD environments?
    S@nta2022
  • What is the name of the HTTP server running on the remote host?
    Apache
  • What is the name of the service running on port 22 on the QA server?
    ssh
  • What flag can you find after successfully accessing the Samba service?
    {THM_SANTA_SMB_SERVER}
  • What is the password for the username santahr?
    santa25
  • Use Hydra to find the VNC password of the target with IP address MACHINE_IP. What is the password?
    1q2w3e4r
  • Using a VNC client on the AttackBox, connect to the target of IP address MACHINE_IP. What is the flag written on the target’s screen?
    THM{I_SEE_YOUR_SCREEN}
  • What is the email address of the sender?
    chief.elf@santaclaus.thm
  • What is the return address?
    murphy.evident@bandityeti.thm
  • On whose behalf was the email sent?
    Chief Elf
  • What is the X-spam score?
    3
  • What is hidden in the value of the Message-ID field?
    AoC2022_Email_Analysis
  • What is the reputation result of the sender's email address?
    RISKY
  • What is the filename of the attachment?
    Division_of_labour-Load_share_plan.doc
  • What is the hash value of the attachment?
    0827bb9a2e7c0628b82256759f0f888ca1abd6a2d903acdb8e44aca6a1a03467
  • What is the second tactic marked in the Mitre ATT&CK section?
    Defense Evasion
  • What is the subcategory of the file?
    macro_hunter
  • What is the version of CyberChef found in the attached VM?
    9.49.0
  • How many recipes were used to extract URLs from the malicious doc?
    10
  • We found a URL that was downloading a suspicious file; what is the name of that malware?
    mysterygift.exe
  • What is the last defanged URL of the bandityeti domain found in the last step?
    hxxps[://]cdn[.]bandityeti[.]THM/files/index/
  • What is the ticket found in one of the domains? (Format: Domain/ )
    THM_MYSTERY_FLAG
  • What flag is found after attacking the provided EtherStore Contract?
    flag{411_ur_37h_15_m1n3}
  • Deploy the attached VM, and wait a few minutes. What ports are open?
    80
  • What framework is the web application developed with?
    laravel
  • What CVE is the application vulnerable to?
    CVE-2021-3129
  • What command can be used to upgrade the last opened session to a Meterpreter session?
    sessions -u -1
  • What file indicates a session has been opened within a Docker container?
    /.dockerenv
  • What file often contains useful credentials for web applications?
    .env
  • What database table contains useful credentials?
    users
  • What is Santa's password?
    p4$$w0rd
  • What ports are open on the host machine?
    22,80
  • What is the root flag?
    THM{47C61A0FA8738BA77308A8A600F88E4B}
  • What is the Guard's flag?
    THM{5_star_Fl4gzzz}
  • What is the Yeti's flag?
    THM{yetiyetiyetiflagflagflag}
  • What is the Windows version number that the memory image captured?
    10
  • What is the name of the binary/gift that secret Santa left?
    mysterygift.exe
  • What is the Process ID (PID) of this binary?
    2040
  • Dump the contents of this binary. How many files are dumped?
    16
  • What is the architecture of the malware sample? (32-bit/64-bit)
    64-bit
  • What is the packer used in the malware sample? (format: lowercase)
    upx
  • What is the compiler used to build the malware sample? (format: lowercase)
    nim
  • How many MITRE ATT&CK techniques have been discovered attributed to the DISCOVERY tactic?
    2
  • What is the registry key abused by the malware?
    HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  • What is the value written on the registry key based on the previous question?
    C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wishes.bat
  • What are the names of two files created by the malware under the C:\Users\Administrator\ directory? (format: file1,file2 in alphabetical order)
    test.jpg,wishes.bat
  • What are the two domains wherein malware has initiated a network connection? (format: domain1,domain2 in alphabetical order)
    bestfestivalcompany.thm,virustotal.com
  • Going back to strings inside the malware sample, what is the complete URL used to download the file hosted in the first domain accessed by the malware?
    http://bestfestivalcompany.thm/favicon.ico
  • What is the "Percent Packets" value of the "Hypertext Transfer Protocol"?
    0.3
  • Which port number has received more than 1000 packets?
    3389
  • What is the service name of the used protocol that received more than 1000 packets?
    RDP
  • What are the domain names?
    bestfestivalcompany[.]thm,cdn[.]bandityeti[.]thm
  • What are the names of the requested files?
    favicon[.]ico,mysterygift[.]exe
  • Which IP address downloaded the executable file?
    10[.]10[.]29[.]186
  • Which domain address hosts the malicious file?
    cdn[.]bandityeti[.]thm
  • What is the "user-agent" value used to download the non-executable file?
    Nim httpclient/1.6.8
  • What is the sha256 hash value of the executable file?
    0ce160a54d10f8e81448d0360af5c2948ff6a4dbb493fe4be756fc3e2c3f900f
  • What are the connected IP addresses in the mentioned pattern?
    20[.]99[.]133[.]109,20[.]99[.]184[.]37,23[.]216[.]147[.]64,23[.]216[.]147[.]76
  • What is the office number of Elf Pivot McRed?
    134
  • Not only profile pages but also stored images are vulnerable. Start with a URL of a valid profile image; what is the hidden flag?
    THM{CLOSE_THE_DOOR}
  • What is the name given to file uploads that allow threat actors to upload any files that they want?
    Unrestricted
  • What is the title of the web application developed by Santa's freelancer?
    SantaSideKick2
  • What is the value of the flag stored in the HR Elf's Documents directory?
    THM{Naughty.File.Uploads.Can.Get.You.RCE}
  • What defence technique can be implemented to ensure that specific file types can be uploaded?
    File Extension Validation
  • What defence technique can be used to make sure the threat actor cannot recover their file again by simply using the file name?
    File Renaming
  • What defence technique can be used to make sure malicious files that can hurt elves are not uploaded?
    Malware Scanning
  • What is the value of Flag1?
    THM{McCode, Elf McCode}
  • What is the value of Flag2?
    THM{KodeNRoll}
  • What is the value of Flag3?
    THM{Are we secure yet?}
  • What is the value of Flag4?
    THM{SQLi_who???}
  • Filtering for Usernames: How many usernames fit the syntax above?
    8
  • Filtering for Usernames: One username consists of a readable word concatenated with a number. What is it?
    User35
  • Filtering for Emails: How many emails fit the syntax above?
    11
  • Filtering for Emails: How many unique domains are there?
    8
  • Filtering for Emails: What is the domain of the email with the local-part "lewisham44"?
    amg.com
  • Filtering for Emails: What is the domain of the email with the local-part "maxximax"?
    fedfull.com
  • Filtering for Emails: What is the local-part of the email with the domain name "hotmail.com"?
    hussain.volt
  • Filtering for URLs: How many URLs fit the syntax provided?
    16
  • Filtering for URLs: How many of these URLs start with "https"?
    7
  • What is the Challenge #1 flag?
    THM{n0t_just_your_u$ser}
  • From the Challenge 1 log, what user account was created?
    BanditYetiMini
  • What is the Challenge #2 flag?
    THM{wh@t_1s_Runn1ng_H3r3}
  • What was the User's path in the Challenge #2 log file?
    SIGMA_AOC2022\Bandit Yeti
  • What is the Challenge #3 flag?
    THM{sch3dule_0npo1nt_101}
  • What was the MD5 hash associated with Challenge #3 logs?
    2F6CE97FAF2D5EEA919E4393BDD416A7
  • What device can be used to probe the signals being sent on electrical wires between two devices?
    Logic Analyser
  • USART is faster than SPI for communication? (Yea,Nay)
    Nay
  • USART communication uses fewer wires than SPI? (Yea,Nay)
    Yea
  • USART is faster than I2C for communication? (Yea,Nay)
    Nay
  • I2C uses more wires than SPI for communication? (Yea,Nay)
    Nay
  • SPI is faster than I2C for communication? (Yea,Nay)
    Yea
  • What is the maximum number of devices that can be connected on a single pair of I2C lines?
    1008
  • What is the new baud rate that is negotiated between the microprocessor and ESP32 chip?
    9600
  • What is the flag that is transmitted once the new baud rate was accepted?
    THM{Hacking.Hardware.Is.Fun}
  • What is the flag value after reversing the file firmwarev2.2-encrypted.gpg?
    THM{WE_GOT_THE_FIRMWARE_CODE}
  • What is the Paraphrase value for the binary firmwarev1.0_unsigned?
    Santa@2022
  • After reversing the encrypted firmware, can you find the build number for rootfs?
    2.6.31
  • What port is Mosquitto running on?
    1883
  • Is the device/init topic enumerated by Nmap during a script scan of all ports? (y/n)
    y
  • What Mosquitto version is the device using?
    1.6.9
  • What flag is obtained from viewing the RTSP stream?
    THM{UR_CAMERA_IS_MINE}
  • Follow the instructions in the attached static site to help McSkidy reduce her attack surface against attacks from the Yeti. Use the flag as an answer to complete the task.
    THM{4TT4CK SURF4C3 R3DUC3D}
  • Case 1: What is the password for Santa’s Vault?
    S3cr3tV@ultPW
  • Case 1: What is the Flag?
    THM{EZ_fl@6!}
  • Case 2: What is Santa’s favourite thing?
    MilkAndCookies
  • Case 2: What is the password for Santa’s Vault?
    3XtrR@_S3cr3tV@ultPW
  • Case 2: What is the Flag?
    THM{m0@r_5t3pS_n0w!}
  • Case 3: What is the Executive Assistant’s favourite thing?
    BanoffeePie
  • Case 3: What is Santa’s previous password?
    H0tCh0coL@t3_01
  • Case 3: What is Santa’s current password?
    H0tCh0coL@t3_02
  • Case 3: What is the 1st part of the vault’s password?
    N3w4nd1m
  • Case 3: What is the 2nd part of the vault’s password?
    Pr0v3dV@ultPW
  • Case 3: What is the password for Santa’s Vault?
    N3w4nd1mPr0v3dV@ultPW
  • Case 3: What is the Flag?
    THM{B@d_Y3t1_1s_n@u6hty}
  • What is Santa's Code?
    2845
  • Mission ELFPossible: What is the Abominable for a Day Flag?
    THM{D3f3n5e_1n_D3pth_1s_k00L!!}
  • Please help us improve by answering this 5-minute survey. Make sure to grab the flag before you click "Submit"!
    THM{AoC2022!thank_you!}
  • Are you ready to continue your learning journey on TryHackMe? (Yea,Yea)
    Yea