Knowledge Hub

Advent of Cyber 2024

TryHackMe88 answered prompts

Advent of Cyber 2024 TryHackMe walkthrough with 88 answered prompts.

Prompts and answers

  • Is there a dedicated Advent of Cyber channel on TryHackMe Discord where users can discuss daily challenges and receive dedicated support? (yes/no)
    yes
  • Looks like the song.mp3 file is not what we expected! Run "exiftool song.mp3" in your terminal to find out the author of the song. Who is the author?
    Tyler Ramsbey
  • The malicious PowerShell script sends stolen info to a C2 server. What is the URL of this C2 server?
    http://papash3ll.thm/data
  • Who is M.M? Maybe his Github profile page would provide clues?
    Mayor Malware
  • What is the number of commits on the GitHub repo where the issue was raised?
    1
  • What is the name of the account causing all the failed login attempts?
    service_admin
  • How many failed logon attempts were observed?
    6791
  • What is the IP address of Glitch?
    10.0.255.1
  • When did Glitch successfully logon to ADM-01? Format: MMM D, YYYY HH:MM:SS.SSS
    Dec 1, 2024 08:54:39.000
  • What is the decoded command executed by Glitch to fix the systems of Wareville?
    Install-WindowsUpdate -AcceptAll -AutoReboot
  • BLUE: Where was the web shell uploaded to?
    /media/images/rooms/shell.php
  • BLUE: What IP address accessed the web shell?
    10.11.83.34
  • RED: What is the contents of the flag.txt?
    THM{Gl1tch_Was_H3r3}
  • What was the flag found in the .txt file that is found in the same directory as the PhishingAttachment.xslm artefact?
    THM{GlitchTestingForSpearphishing}
  • What ATT&CK technique ID would be our point of interest?
    T1059
  • What ATT&CK subtechnique ID focuses on the Windows Command Shell?
    T1059.003
  • What is the name of the Atomic Test to be simulated?
    Simulate BlackByte Ransomware Print Bombing
  • What is the name of the file used in the test?
    Wareville_Ransomware.txt
  • What is the flag found from this Atomic Test?
    THM{R2xpdGNoIGlzIG5vdCB0aGUgZW5lbXk=}
  • What is the flag discovered after navigating through the wishes?
    THM{Brut3f0rc1n6_mY_w4y}
  • What is the flag seen on the possible proof of sabotage?
    THM{m4y0r_m4lw4r3_b4ckd00rs}
  • What is the flag displayed in the popup window after the EDR detects the malware?
    THM{GlitchWasHere}
  • What is the flag found in the malstrings.txt document after running floss.exe, and opening the file in a text editor?
    THM{HiddenClue}
  • What is the other activity made by the user glitch aside from the ListObject action?
    PutObject
  • What is the source IP related to the S3 bucket activities of the user glitch?
    53.94.201.69
  • Based on the eventSource field, what AWS service generates the ConsoleLogin event?
    signin.amazonaws.com
  • When did the anomalous user trigger the ConsoleLogin event?
    2024-11-28T15:21:54Z
  • What was the name of the user that was created by the mcskidy user?
    glitch
  • What type of access was assigned to the anomalous user?
    AdministratorAccess
  • Which IP does Mayor Malware typically use to log into AWS?
    53.94.201.69
  • What is McSkidy's actual IP address?
    31.210.15.79
  • What is the bank account number owned by Mayor Malware?
    2394 6912 7723 1294
  • What is the flag value once Glitch gets reverse shell on the digital vault using port 4444? Note: The flag may take around a minute to appear in the C:\Users\glitch\Desktop directory. You can view the content of the flag by using the command type C:\Users\glitch\Desktop\flag.txt.
    AOC{GOT _MY_ACCESS_B@CK007}
  • What does GRC stand for?
    Governance, Risk, and Compliance
  • What is the flag you receive after performing the risk assessment?
    THM{R15K_M4N4G3D}
  • What is the flag value inside the flag.txt file that’s located on the Administrator’s desktop?
    THM{PHISHING_CHRISTMAS}
  • What is the BSSID of our wireless interface?
    02:00:00:00:02:00
  • What is the SSID and BSSID of the access point? Format: SSID, BSSID
    MalwareM_AP, 02:00:00:00:00:00
  • What is the BSSID of the wireless interface that is already connected to the access point?
    02:00:00:00:01:00
  • What is the PSK after performing the WPA cracking attack?
    fluffy/champ24
  • What is the flag value after transferring over $2000 from Glitch's account?
    THM{WON_THE_RACE_007}
  • What is the value of Flag1?
    THM{dude_where_is_my_car}
  • What is the value of Flag2?
    THM{my_name_is_malware._mayor_malware}
  • What is the name of the CA that has signed the Gift Scheduler certificate?
    THM
  • Look inside the POST requests in the HTTP history. What is the password for the snowballelf account?
    c4rrotn0s3
  • Use the credentials for any of the elves to authenticate to the Gift Scheduler website. What is the flag shown on the elves’ scheduling page?
    THM{AoC-3lf0nth3Sh3lf}
  • What is the password for Marta May Ware’s account?
    H0llyJ0llySOCMAS!
  • Mayor Malware finally succeeded in his evil intent: with Marta May Ware’s username and password, he can finally access the administrative console for the Gift Scheduler. G-Day is cancelled!
    What is the flag shown on the admin page?
  • THM{AoC-h0wt0ru1nG1ftD4y}
    On what day was Glitch_Malware last logged in?
  • 07/11/2024
    What event ID shows the login of the Glitch_Malware user?
  • 4624
    Read the PowerShell history of the Administrator account. What was the command that was used to enumerate Active Directory users?
  • Get-ADUser -Filter * -Properties MemberOf | Select-Object Name
    Look in the PowerShell log file located in Application and Services Logs -> Windows PowerShell. What was Glitch_Malware's set password?
  • SuperSecretP@ssw0rd!
    Review the Group Policy Objects present on the machine. What is the name of the installed GPO?
  • Malicious GPO - Glitch_Malware Persistence
    What is the password for backupware that was leaked?
  • R3c0v3r_s3cr3ts!
    What is the group ID of the Secret Recovery Group?
  • 7d96660a-02e1-4112-9515-1762d0cb66b7
    What is the name of the vault secret?
  • aoc2024
    What are the contents of the secret stored in the vault?
  • WhereIsMyMind1999
    Extract all the events from the cctv_feed logs. How many logs were captured associated with the successful login?
  • 642
    What is the Session_id associated with the attacker who deleted the recording?
  • rij5uu4gt204q0d3eb7jj86okt
    What is the name of the attacker found in the logs, who deleted the CCTV footage?
  • mmalware
    What is the technical term for a set of rules and instructions given to a chatbot?
  • system prompt
    What query should we use if we wanted to get the "status" of the health service from the in-house API?
  • Use the health service with the query: status
    After achieving a reverse shell, look around for a flag.txt. What is the value?
  • THM{WareW1se_Br3ach3d}
    What is the OTP flag?
  • THM{one_tough_password}
    What is the billionaire item flag?
  • THM{credit_card_undeclined}
    What is the biometric flag?
  • THM{dont_smash_your_keyboard}
    What was the first message the payload sent to Mayor Malware’s C2?
  • I am in Mayor!
    What was the IP address of the C2 server?
  • 10.10.123.224
    What was the command sent by the C2 server to the target machine?
  • whoami
    What was the filename of the critical file exfiltrated by the C2 server?
  • credentials.txt
    What secret message was sent back to the C2 in an encrypted format through beacons?
  • THM_Secret_101
    What is the function name that downloads and executes files in the WarevilleApp.exe?
  • DownloadAndExecuteFile
    Once you execute the WarevilleApp.exe, it downloads another binary to the Downloads folder. What is the name of the binary?
  • explorer.exe
    What domain name is the one from where the file is downloaded after running WarevilleApp.exe?
  • mayorc2.thm
    The stage 2 binary is executed automatically and creates a zip file comprising the victim's computer data; what is the name of the zip file?
  • CollectedFiles.zip
    What is the name of the C2 server where the stage 2 binary tries to upload files?
  • anonymousc2.thm
    What is the name of the webshell that was used by Mayor Malware?
  • shelly.php
    What file did Mayor Malware read from the pod?
  • db.php
    What tool did Mayor Malware search for that could be used to create a remote connection from the pod?
  • nc
    What IP connected to the docker registry that was unexpected?
  • 10.10.130.253
    At what time is the first connection made from this IP to the docker registry?
  • 29/Oct/2024:10:06:33 +0000
    At what time is the updated malicious image pushed to the registry?
  • 29/Oct/2024:12:34:28 +0000
    What is the value stored in the "pull-creds" secret?
  • {"auths":{"http://docker-registry.nicetown.loc:5000":{"username":"mr.nice","password":"Mr.N4ughty","auth":"bXIubmljZTpNci5ONHVnaHR5"}}}
    Crack the hash value stored in hash1.txt. What was the password?
  • fluffycat12
    What is the flag at the top of the private.pdf file?
  • THM{do_not_GET_CAUGHT}
    What is the flag?
  • THM{Ligh75on-day54ved}
    What is the flag you get at the end of the survey?
  • THM{we_will_be_back_in_2025}
    No answer provided