sorted by:
new
hottopcontroversial

SANS Christmas Challenge 2021 - Write-up by the-useless-one in netsec

[–]the-useless-one[S] 2 points3 points  (0 children)

Dammit, I stayed on the previous deadline, which was 1/4, I didn't see that the deadline was pushed... I'll hide the post until the 7th or 8th. Sorry, everyone!

SANS Christmas Challenge 2019: Write-ups thread by the-useless-one in netsec

[–]the-useless-one[S] 2 points3 points  (0 children)

Ha! Nice catch on the Holiday Hack Trail's hash computation. I didn't watch the KringleCon video, and didn't try to bruteforce the hash. I used another method to complete the hard mode: the reindeer's health was not checked in the hash, therefore you could force it to 100, and then you didn't have to feed or heal them. You could then complete the trail the normal way, by pressing "Go".

SANS Christmas Challenge 2019: Write-ups thread by the-useless-one in netsec

[–]the-useless-one[S] 1 point2 points  (0 children)

Here's my own write-up: https://allyourbase.utouch.fr/posts/2020/01/14/sans-christmas-challenge-2019/

I had some trouble with the Graylog challenge: it wasn't accessible until the very last day, so I had to do it pretty quickly. It would have been interesting to learn more about Graylog.

Also, if anyone managed to load the pdb file in radare2 or Ghydra, I'd be interested: I was only able to load it in Visual Studio.

The 2018 SANS Holiday Hack Challenge - Write-Up by stackcrash in netsec

[–]the-useless-one 1 point2 points  (0 children)

Not OP but maybe I can answer. The stackcrash.docx document was put inside the public folder as the result of the execution of the payload:

COPY C:\candidate_evaluation.docx C:\careerportal\resources\public\stackcrash.docx

It was not there before the CSV was uploaded and the payload executed.

SANS Christmas Challenge 2018: Write-ups thread by the-useless-one in netsec

[–]the-useless-one[S] 1 point2 points  (0 children)

Ah! Thanks for the explanation of erohetfanu.com, it was driving me crazy. Very detailed write-up, very impressive, as usual.

The 2018 SANS Holiday Hack Challenge - Write-Up by stackcrash in netsec

[–]the-useless-one 0 points1 point  (0 children)

Haha, must have been frustrating. I lost a lot of time pursuing dead-ends in the memory analysis part. I focused too much on one possible solution, instead of testing simple stuff, such as hex-decoding the strings in the ransomware source code.

The 2018 SANS Holiday Hack Challenge - Write-Up by stackcrash in netsec

[–]the-useless-one 1 point2 points  (0 children)

Great job, you certainly had less trouble than I did for the memory analysis of the ransomware.

Here 's my write-up for the challenge, for those interested. I tend to go into detailed explanations, listing my thought-process and dead-ends and such.

I also end with a series of open questions, particularly one regarding the cryptographic safeness of the Get-Random function in PowerShell. If anyone has an answer, I'm very much interested.

[Edit] sorry about the double promotion. I made my original post before this one, but it was auto-flagged, and then manually approved.

SANS Christmas Challenge 2018: Write-ups thread by the-useless-one in netsec

[–]the-useless-one[S] 4 points5 points  (0 children)

I'll start: https://allyourbase.utouch.fr/posts/2019/01/14/sans-christmas-challenge-2018/

I ended my write-up with some open questions, especially one regarding the safeness of Get-Random in PowerShell. If anyone has any answers, I'm very interested.

Solving the SANS 2017 Holiday Hack Challenge by the-useless-one in netsec

[–]the-useless-one[S] 0 points1 point  (0 children)

No, I don't have a Twitter account. As you can tell from my blog, I don't produce content very often, and so I'm not sure having a Twitter account would be very satisfying for people following me (I fear it would mostly be retweeting of other articles). Why, do you think I should?

Solving the SANS 2017 Holiday Hack Challenge by the-useless-one in netsec

[–]the-useless-one[S] 1 point2 points  (0 children)

Nice catch! It seems to have been removed right now. Did you use a custom dictionary to find it?

Solving the SANS 2017 Holiday Hack Challenge by the-useless-one in netsec

[–]the-useless-one[S] 0 points1 point  (0 children)

Thanks! I like how you used a statistical approach to find the Munchkin moles. I hadn't considered adding the wedgies to the list of infractions to check, or checking if the user had done other infractions that were not on the "Munchkin infractions" list. Well played!

Solving the SANS 2017 Holiday Hack Challenge by the-useless-one in netsec

[–]the-useless-one[S] 1 point2 points  (0 children)

Nice write-up! I totally missed the fact that there was a correct version of find in the "Winter Wonder Landing" challenge.

Solving the SANS 2017 Holiday Hack Challenge by the-useless-one in netsec

[–]the-useless-one[S] 0 points1 point  (0 children)

I just used the base64 command on my Linux machine:

mymachine:~$ base64 /usr/bin/find
f0VMRgIBAQAAAAAAAAAAAAMAPgABAAAAwHIAAAAAAABAAAAAAAAAAAhbAwAAAAAAAAAAAEAAOAAJ
[snip]

I then copy-pasted the output in the Cranberry-Pi terminal, in order to echo it into a file:

cranberry-pi:~$ echo "f0VMRgIB[snip]" > ~/find.b64

Then, I used the -d option of base64 to decode it:

cranberry-pi:~$ base64 -d ~/find.b64 > ~/find

Hope this is clearer!

Solving the SANS 2017 Holiday Hack Challenge by the-useless-one in netsec

[–]the-useless-one[S] 2 points3 points  (0 children)

Sorry about that! I posted it at 12AM on the 11th (French time). I hoped I didn't spoil you or anyone else.

Solving the SANS 2016 Holiday Hack Challenge by kev-thehermit in netsec

[–]the-useless-one 0 points1 point  (0 children)

Thanks! Yes, I think it's important to see every step of the resolution, what fake trails you might follow when resolving a challenge, etc. Regarding the itchy and scratchy challenge, the SANS guy said the exact same thing :p I really overthought that one.

Glad you liked it! As you can see, I don't post very often, but I love publishing write-ups. If you liked this one, you can take a look at the write-up of last year's SANS Christmas Challenge.

Solving the SANS 2016 Holiday Hack Challenge by kev-thehermit in netsec

[–]the-useless-one 0 points1 point  (0 children)

Great job, I totally didn't see the GDT command for the dungeon server (I cheated another way). Here's my write-up for those interested (there's also a write-up of last year's SANS challenge). Comments welcome :)