MAIN
DAY 01
Which CLI command would you use to list a directory?
mcskidy@tbfc-web01:~$ apropos "list directory"
dir (1) - list directory contents
ls (1) - list directory contents
ntfsls (8) - list directory contents on an NTFS filesystem
vdir (1) - list directory contents
For those who consider themself intermediate and want another challenge, check McSkidy's hidden note in /home/mcskidy/Documents/ to get access to the key for Side Quest 1! HINT: Once you have the final flag, use it to unlock the hidden png. Where is it? That's a .secret
DAY 02
Browse to http://10.65.164.171 from within the AttackBox and try to access the mailbox of the factory user to see if the previously harvested admin password has been reused on the email portal. What is the total number of toys expected for delivery?
DAY 03
Examine the firewall logs. How many bytes were transferred to the C2 server IP from the compromised web server?
DAY 04
Complete the AI showcase by progressing through all of the stages. What is the flag presented to you?
Execute the exploit provided by the red team agent against the vulnerable web application hosted at MACHINE_IP:5000. What flag is provided in the script's output after it? Remember, you will need to update the IP address placeholder in the script with the IP of your vulnerable machine (MACHINE_IP:5000)
DAY 05
Exploiting the IDOR found in the view_accounts parameter, what is the user_id of the parent that has 10 children?
Bonus Task: If you want to dive even deeper, use either the base64 or md5 child endpoint and try to find the id_number of the child born on 2019-04-17? To make the iteration faster, consider using something like Burp's Intruder. If you want to check your answer, click the hint on the question.
Bonus Task: Want to go even further? Using the /parents/vouchers/claim endpoint, find the voucher that is valid on 20 November 2025. Insider information tells you that the voucher was generated exactly on the minute somewhere between 20:00 - 24:00 UTC that day. What is the voucher code? If you want to check your answer, click the hint on the question.
DAY 06
Static analysis: Within the strings of HopHelper.exe, a flag with the format THM{XXXXX} exists. What is that flag value? Note, this can be found towards the bottom of the strings output.
Dynamic analysis: Filter the output of ProcMon for "TCP" operations. What network protocol is HopHelper.exe using to communicate? Make sure to have executed HopHelper.exe while ProcMon was open and capturing events.
DAY 07
DAY 08
DAY 09
For those who want another challenge, have a look around the VM to get access to the key for Side Quest 2! Accessible through our Side Quest Hub!
DAY 10
How many accounts were added to the sudoers group in the Linux PrivEsc - User Added to Sudo Group alert?
DAY 11
DAY 12
DAY 13
What regex would you use to match a string that begins with TBFC: followed by one or more alphanumeric ASCII characters?
DAY 14
Bonus Question: There is a secret code contained within the news site running on port 5002; this code also happens to be the password for the deployer user! They should definitely change their password. Can you find it?
DAY 15
DAY 16
DAY 17
Looking for the key to Side Quest 3? Hopper has left us this cyberchef link as a lead. See if you can recover the key and access the corresponding challenge in our Side Quest Hub!
DAY 18
DAY 19
Now that you understand how the system works, the mission is yours, hack it back and save Christmas! What's the flag?
DAY 20
Repeat the same steps as were done for ordering the SleighToy Limited Edition. What is the flag value once the stocks are negative for Bunny Plush (Blue)?
DAY 21
Malhare seems to be using typosquatting, domains that look the same as the real one, in an attempt to hide the fact that the domain is not the intended one, what character in the domain gives this away?
Malicious HTAs often include real-looking data, like survey questions, to make the file seem authentic. How many questions does the survey have?
Notice how even in code, social engineering persists, fake incentives like contests or trips hide in plain sight to build trust. The survey entices participation by promising a chance to win a trip to where?
The HTA is enumerating information from the local host executing the application. What two pieces of information about the computer it is running on are being exfiltrated? You should provide the two object names separated by commas.
After reviewing the function intended to get the survey questions, it seems that the data from the download of the questions is actually being executed. What is the line of code that executes the contents of the download?
It seems as if the malware site has been taken down, so we cannot download the contents that the malware was executing. Fortunately, one of the elves created a copy when the site was still active. Download the contents from here. What popular encoding scheme was used in an attempt to obfuscate the download?
Decode the payload. It seems as if additional steps where taken to hide the malware! What common encryption scheme was used in the script?
Either run the script or decrypt the flag value using online tools such as CyberChef. What is the flag value?
For those who want another challenge, download the HTA file from here to get the key for Side Quest 4, accessible through our Side Quest Hub. The password for the file is CanYouREM3?.
DAY 22
Which search filter would you use to search for all entries that communicate to rabbithole.malhare.net with a beacon score greater than 70% and sorted by connection duration (descending)?
DAY 23
Apart from GetObject and ListBucket, what other action can be taken by assuming the bucketmaster role?
DAY 24
Make a POST request to the /post.php endpoint with the username admin and the password admin. What is the flag you receive?
Make a request to the /cookie.php endpoint with the username admin and the password admin and save the cookie. Reuse that saved cookie at the same endpoint. What is the flag your receive?
After doing the brute force on the /bruteforce.php endpoint, what is the password of the admin user?
Last updated