Advent of Cyber 2024 Day 24: You can’t hurt SOC-mas, Mayor Malware!
Lab link. Questions 1. What is the flag? mosquitto_pub -h localhost -t “d2FyZXZpbGxl/Y2hyaXN0bWFzbGlnaHRz” -m “on”
Category Advent of Cyber 2024
Dive into the wonderful world of cyber security by engaging in festive beginner-friendly exercises every day in the lead-up to Christmas!
Advent of Cyber 2024 Day 23: You wanna know what happens to your hashes?
Lab link. Questions 1. Crack the hash value stored in hash1.txt. What was the password? To crack a hash, the first step is to identify its type. For this, we use the hash-id tool. This tool analyzes the provided hash and…
Advent of Cyber 2024 Day 22: It’s because I’m kubed, isn’t it?
Lab link. Questions 1. What is the name of the webshell that was used by Mayor Malware? The Kubernetes cluster is started using Minikube. The output shows that the cluster has been successfully started and configured by default. We check…
Advent of Cyber 2024 Day 21: HELP ME…I’m REVERSE ENGINEERING!
Lab link. Questions 1. What is the function name that downloads and executes files in the WarevilleApp.exe? DownloadAndExecuteFile 2. Once you execute the WarevilleApp.exe, it downloads another binary to the Downloads folder. What is the name of the binary? explorer.exe…
Advent of Cyber 2024 Day 20: If you utter so much as one packet…
Lab link. Questions 1. What was the first message the payload sent to Mayor Malware’s C2? ip.src == 10.10.229.217 system prompt 2. What was the IP address of the C2 server? 10.10.123.224 3. What was the command sent by the…
Advent of Cyber 2024 Day 19: I merely noticed that you’re improperly stored, my dear secret!
Lab link. Questions 1. What is the OTP flag? If we run the command <strong>frida-trace ./TryUnlockMe -i 'libaocgame.so!*'</strong>, it will automatically start tracing all the functions. The penguin is requesting a PIN code, which is handled by the <strong>_Z7set_otpi</strong> function.…
Advent of Cyber 2024 Day 18: I could use a little AI interaction!
Lab link. Questions 1. What is the technical term for a set of rules and instructions given to a chatbot? system prompt 2. What query should we use if we wanted to get the “status” of the health service from…
Advent of Cyber 2024 Day 17: He analyzed and analyzed till his analyzer was sore!
Lab link. Questions 1. Extract all the events from the cctv_feed logs. How many logs were captured associated with the successful login? 642 2. What is the Session_id associated with the attacker who deleted the recording? rij5uu4gt204q0d3eb7jj86okt 3. What is…
Advent of Cyber 2024 Day 16: The Wareville’s Key Vault grew three sizes that day.
Lab link. Questions 1. What is the password for backupware that was leaked? az ad user list –filter “startsWith(‘wvusr-‘, displayName)” R3c0v3r_s3cr3ts! 2. What is the group ID of the Secret Recovery Group? 7d96660a-02e1-4112-9515-1762d0cb66b7 3. What is the name of the…
Advent of Cyber 2024 Day 15: Be it ever so heinous, there’s no place like Domain Controller.
Lab link. Questions 1. On what day was Glitch_Malware last logged in? Answer format: DD/MM/YYYY 07/11/2024 2. What event ID shows the login of the Glitch_Malware user? 4624 3. Read the PowerShell history of the Administrator account. What was the…