Knowledge Hub

Advent of Cyber 2023

TryHackMe109 answered prompts

Advent of Cyber 2023 TryHackMe walkthrough with 109 answered prompts.

Prompts and answers

Is there a dedicated Advent of Cyber channel on TryHackMe Discord where users can discuss daily challenges and receive dedicated support? (yes/no)
yes
What is McGreedy's personal email address?
t.mcgreedy@antarcticrafts.thm
What is the password for the IT server room door?
BtY2S02
What is the name of McGreedy's secret project?
Purple Snow
How many packets were captured (looking at the PacketNumber)?
100
What IP address sent the most amount of traffic during the packet capture?
10.10.1.4
What was the most frequent protocol?
ICMP
Using crunch and hydra, find the PIN code to access the control system and unlock the door. What is the flag?
THM{pin-code-brute-force}
What is the correct username and password combination? Format username:password
isaias:Happiness
What is the flag?
THM{m3rrY4nt4rct1crAft$}
How large (in bytes) is the AC2023.BAK file?
12,704
What is the name of the backup program?
BackupMaster3000
What should the correct bytes be in the backup's file signature to restore the backup properly?
41 43
What is the flag after restoring the backup successfully?
THM{0LD_5CH00L_C00L_d00D}
If the coins variable had the in-memory value in the image below, how many coins would you have in the game?
1397772111
What is the value of the final flag?
THM{mchoneybell_is_the_real_star}
How many unique IP addresses are connected to the proxy server?
9
How many unique domains were accessed by all workstations?
111
What status code is generated by the HTTP requests to the least accessed domain?
503
Based on the high count of connection attempts, what is the name of the suspicious domain?
frostlings.bigbadstash.thm
What is the source IP of the workstation that accessed the malicious domain?
10.10.185.225
How many requests were made on the malicious domain in total?
1581
Having retrieved the exfiltrated data, what is the hidden flag?
THM{a_gift_for_you_awesome_analyst!}
What is the malware C2 server?
mcgreedysecretc2.thm
What is the file inside the deleted zip archive?
JuicyTomaTOY.exe
What flag is hidden in one of the deleted PNG files?
THM{byt3-L3vel_@n4Lys15}
What is the SHA1 hash of the physical drive and forensic image?
39f2dea6ffb43bf80d80f19d122076b3682773c2
What HTTP User-Agent was used by the malware for its connection requests to the C2 server?
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15
What is the HTTP method used to submit the command execution output?
POST
What key is used by the malware to encrypt or decrypt the C2 data?
youcanthackthissupersecurec2keys
What is the first HTTP URL used by the malware?
http://mcgreedysecretc2.thm/reg
How many seconds is the hardcoded value used by the sleep function?
15
What is the C2 command the attacker uses to execute commands via cmd.exe?
shell
What is the domain used by the malware to download another binary?
stash.mcgreedy.thm
Manually navigate the defaced website to find the vulnerable search form. What is the first webpage you come across that contains the gift-finding feature?
/giftsearch.php
Analyze the SQL error message that is returned. What ODBC Driver is being used in the back end of the website?
ODBC Driver 17 for SQL Server
Inject the 1=1 condition into the Gift Search form. What is the last result returned in the database?
THM{a4ffc901c27fb89efe3c31642ece4447}
What flag is in the note file Gr33dstr left behind on the system?
THM{b06674fedd8dfc28ca75176d3d51409e}
What is the flag you receive on the homepage after restoring the website?
THM{4cbc043631e322450bc55b42c}
What is the hash of the vulnerable user?
03E805D8A8C5AA435FB48832DAD620E3
What is the content of flag.txt on the Administrator Desktop?
THM{XMAS_IS_SAFE}
What is the default port for Jenkins?
8080
What is the password of the user tracy?
13_1n_33
What's the root flag?
ezRo0tW1thoutDiD
What's the SSH flag?
Ne3d2SecureTh1sSecureSh31l
What's the Jenkins flag?
FullTrust_has_n0_Place1nS3cur1ty
Which security model is being used to analyse the breach and defence strategies?
Diamond Model
Which defence capability is used to actively search for signs of malicious activity?
Threat hunting
What are our main two infrastructure focuses? (Answer format: answer1 and answer2)
Firewall and Honeypot
Which firewall command is used to block traffic?
Deny
There is a flag in one of the stories. Can you find it?
THM{P0T$_W@11S_4_S@N7@}
What is the other term given for Artificial Intelligence or the subset of AI meant to teach computers how humans think or nature works?
Machine Learning
What ML structure aims to mimic the process of natural selection and evolution?
Genetic Algorithm
What is the name of the learning style that makes use of labelled data to train an ML structure?
Supervised Learning
What is the name of the layer between the Input and Output layers of a Neural Network?
Hidden Layer
What is the name of the process used to provide feedback to the Neural Network on how close its prediction was?
Back-Propagation
What is the value of the flag you received after achieving more than 90% accuracy on your submitted predictions?
THM{Neural.Networks.are.Neat!}
What is the key first step in the Machine Learning pipeline?
data collection
Which data preprocessing feature is used to create new features or modify existing ones to improve model performance?
feature engineering
During the data splitting step, 20% of the dataset was split for testing. What is the percentage weightage avg of precision of spam detection?
0.98
How many of the test emails are marked as spam?
3
One of the emails that is detected as spam contains a secret code. What is the code?
I_Hate_Best_FestiVal
What key process of training a neural network is taken care of by using a CNN?
Feature Extraction
What is the name of the process used in the CNN to extract the features?
Convolution
What is the name of the process used to reduce the features down?
Pooling
What off-the-shelf CNN did we use to train a CAPTCHA-cracking OCR model?
Attention OCR
What is the password that McGreedy set on the HQ Admin portal?
ReallyNotGonnaGuessThis
What is the value of the flag that you receive when you successfully authenticate to the HQ Admin portal?
THM{Captcha.Can't.Hold.Me.Back}
Which version of SiLK is installed on the VM?
3.19.1
What is the size of the flows in the count records?
11774
What is the start time (sTime) of the sixth record in the file?
2023/12/05T09:33:07.755
What is the destination port of the sixth UDP record?
49950
What is the record value (%) of the dport 53?
35.332088
What is the number of bytes transmitted by the top talker on the network?
735229
What is the sTime value of the first DNS record going to port 53?
2023/12/08T04:28:44.825
What is the IP address of the host that the C2 potentially controls? (In defanged format: 123[.]456[.]789[.]0 )
175[.]175[.]173[.]221
Which IP address is suspected to be the flood attacker? (In defanged format: 123[.]456[.]789[.]0 )
175[.]215[.]236[.]223
What is the sent SYN packet's number of records?
1658
What is the name of the service that respawns the process after killing it?
a-unkillable.service
What is the path from where the process and service were running?
/etc/systemd/system
The malware prints a taunting message. When is the message shown? Choose from the options below.
4
What is the exposed password that we find from the bash history output?
NEhX4VSrN7sV
What is the PID of the miner process that we find?
10280
What is the MD5 hash of the miner process?
153a5c8efe4aa3be240e5dc645480dee
What is the MD5 hash of the mysqlserver process?
c586e774bb2aa17819d7faae18dad7d1
Use the command strings extracted/miner. .0x400000 | grep http://. What is the suspicious URL? (Fully defang the URL using CyberChef)
hxxp[://]mcgreedysecretc2[.]thm
After reading the elfie file, what location is the mysqlserver process dropped in on the file system?
/var/tmp/.system-python3.8-Updates/mysqlserver
What is the handle of the developer responsible for the merge changes?
@badsecops
What port is the defaced calendar site server running on?
9081
What server is the malicious server running on?
Apache
What message did the Frostlings leave on the defaced site?
FROSTLINGS RULE
What is the commit ID of the original code for the Advent Calendar site?
986b7407
What Linux kernel version is the Jenkins node?
5.4.0-1029-aws
What value is found from /var/lib/jenkins/secret.key?
90e748eafdd2af4746a5ef7941e63272f24f1e33a2882f614ebfa6742e772ba7
Is SSRF the process in which the attacker tricks the server into loading only external resources (yea/nay)?
nay
What is the C2 version?
1.1
What is the username for accessing the C2 panel?
mcgreedy
What is the flag value after accessing the C2 panel?
THM{EXPLOITED_31001}
What is the flag value after stopping the data exfiltration from the McSkidy computer?
THM{AGENT_REMOVED_1001}
What is the name of the AD authentication protocol that makes use of tickets?
Kerberos
What is the name of the AD authentication protocol that makes use of the NTLM hash?
NetNTLM
What is the name of the tool that can intercept these authentication challenges?
Responder
What is the password that McGreedy set for the Administrator account?
GreedyGrabber1@
What is the value of the flag that is placed on the Administrator’s desktop?
THM{Greedy.Greedy.McNot.So.Great.Stealy}
One of the photos contains a flag. What is it?
THM{DIGITAL_FORENSICS}
What name does Tracy use to save Detective Frost-eau’s phone number?
Detective Carrot-Nose
One SMS exchanged with Van Sprinkles contains a password. What is it?
chee7AQu
What is the final flag?
THM{YouMeddlingKids}
What flag did you get after completing the survey?
THM{SurveyComplete_and_HolidaysSaved}