# Advent of Cyber 2025 # About ## Campaign Overview **Setting:** Wareville, home of The Best Festival Company (TBFC) **Event:** SOCMAS - the annual cyber security celebration **Threat Level:** Critical **Purpose:** Each mission teaches essential cybersecurity skills while uncovering clues about King Malhare's conspiracy to corrupt Christmas into EASTMAS --- ## The Antagonist: King Malhare **Origin:** HopSec Island **Motivation:** Jealousy over Easter being overlooked; seeks to rebrand Christmas as EAST-mas **Operatives:** Sir Carrotbane, Bandit Bunnies, and HopSec Island operatives **Endgame:** EASTMAS - a corrupted version of the festival designed to sabotage TBFC operations and hold Wareville hostage --- ## Plot Progression ### Act 1: The Glitches - System failures and password issues plague TBFC - McSkidy detects foul play; King Malhare's name surfaces - Initial investigations begin on isolated systems ### Act 2: Escalation & Kidnapping - McSkidy is kidnapped by King Malhare's forces - Wareville's defenses are severely compromised - Christmas itself becomes at risk - Ransom demand: 1,000 HopSec Coins for McSkidy's release - Timeline threat: SOCMAS ends tonight ### Act 3: Investigation & Defense - The TBFC SOC team mobilizes - Multiple challenges across different attack vectors - Focus shifts to forensic investigation and incident response --- ## Key Investigation Targets & Findings ### Primary Investigation: tbfc-web01 **System Type:** Linux server processing Christmas wishlists **Attack:** Eggstrike malware infiltration **Evidence Location:** `/home/socmas/2025/eggstrike.sh` **Critical Forensic Techniques:** - Hidden file discovery using `ls -la` to uncover `.guide.txt` and `.bash_history` - Advanced forensics including user switching and command history analysis - File decryption to trace attacker movements ### Evidence Trail - McSkidy's last actions before kidnapping - King Malhare's involvement and operational plans - Christmas wishlist system compromise details --- ## Challenge Categories ### 1. Forensic Investigation & Log Analysis - **Focus:** Splunk SIEM analysis to trace ransomware infiltration - **Skill:** Understanding attack vectors through log data - **Objective:** Prevent infrastructure compromise and resolve the hostage situation ### 2. Red Team & Social Engineering - **Type:** Authorized penetration testing - **Team:** Recon McRed, Exploit McRed, Pivot McRed - **Focus:** Phishing campaigns and employee awareness testing - **Goal:** Evaluate cybersecurity training effectiveness ### 3. System Forensics & File Analysis - **Type:** Linux server investigation - **Skills:** Hidden file discovery, command history analysis, user switching - **Goal:** Trace attacker movements and identify compromise vectors --- ## Access Credentials ``` Username: mcskidy Password: AoC2025! Connection: ssh mcskidy@[machine_ip] Note: Machine IP changes upon each start ``` --- ## Learning Outcomes Each challenge reinforces essential cybersecurity competencies: - **Incident Response** - Responding to active threats with time pressure - **Log Analysis** - Using SIEM tools to identify attack patterns - **Forensic Investigation** - Tracing evidence and attacker movements - **Red Team Methodology** - Understanding offensive security tactics - **Security Awareness** - Identifying social engineering and phishing threats - **Linux System Administration** - File permissions, command history, user switching --- ## The Stakes - **Missing:** McSkidy (leadership compromised) - **Threatened:** Christmas and SOCMAS celebration - **At Risk:** TBFC systems and Wareville infrastructure - **Timeline:** Demands must be resolved before SOCMAS ends tonight - **Mission:** Stop King Malhare's EASTMAS plan and save Christmas # Prep Track Get ready for the Advent of Cyber 2025 with the "Advent of Cyber Prep Track", a series of warm-up tasks aimed to get beginners ready for this year's event. # Password Pandemonium ### Overview --- **Room URL:** [https://tryhackme.com/room/adventofcyberpreptrack](https://tryhackme.com/room/adventofcyberpreptrack) **Difficulty:** Easy **Category:** Prep **Date Completed:** 12/1/2025 ### Objective Create a password that passes all system checks and isn’t found in the leaked password list. --- ### Table of Contents [Introduction](#bkmrk-introduction) [Walk Through](#bkmrk-walk-through) [Resources](#bkmrk-resources) --- ### Introduction You've just logged into your TBFC workstation when an alert reveals weak passwords across 73 accounts—including McSkidy's P@ssw0rd123. To gain full access, you must demonstrate strong password practices, which remain one of the simplest yet most effective defenses against cyber attacks. #### Password Requirements - Enter a password with at least 12 characters. - Include uppercase, lowercase, numbers, and symbols. - Ensure it isn’t in the breach database. --- ### Walk Through 1. Entered the TBFC website 2. Clicked to update password 3. Choose a secure password 1. Pandemonium4u! 2. A phrase substituting the words for number and adding symbols [![PasswordPandemonium.png](https://bookstack.rizzoit.com/uploads/images/gallery/2025-12/scaled-1680-/passwordpandemonium.png)](https://bookstack.rizzoit.com/uploads/images/gallery/2025-12/passwordpandemonium.png) --- ### Resources [TryHackMe](tryhackme.com) [Okta](https://www.okta.com/identity-101/password-vs-passphrase/) # The Suspicious Chocolate.exe ### Overview --- **Room URL:** [https://tryhackme.com/room/adventofcyberpreptrack](https://tryhackme.com/room/adventofcyberpreptrack) **Difficulty:** Easy **Category:** Prep **Date Completed:** 12/1/2025 ### Objectives Determine if `chocolate.exe` is safe or infected. --- ### Table of Contents [Introduction](#bkmrk-introduction) [Walk Through](#bkmrk-walk-through) [Lessons Learned](#bkmrk-lessons-learned) [Resources](#bkmrk-resources) --- ### Introduction A suspicious USB labeled "SOCMAS Party Playlist" containing `chocolate.exe` arrives on your desk. You must use a simulated VirusTotal tool to scan the file and determine if it's safe or malicious—a critical skill for identifying threats before they compromise systems. --- ### Walk Through 1. Click the view site button on THM 1. This brings up a simulated virustotal website preloaded with `chocolate.exe` 2. Clicking scan to scan the `.exe` file on virtustotal 3. After clicking scan, the website scans the file and loads the results 1. The website loaded results from 48 vendors 1. Clean Vendor A 2. Clean Vendor B 3. Malhare Labs 4. +45 other vendors marked this file as clean 2. Malhare labs is classified as `MalhareTorjan` with `ref:ML-2025-011 4. This file is not free from viruses. [![suspiciouschocolate.png](https://bookstack.rizzoit.com/uploads/images/gallery/2025-12/scaled-1680-/suspiciouschocolate.png)](https://bookstack.rizzoit.com/uploads/images/gallery/2025-12/suspiciouschocolate.png) --- ### Lessons Learned In this activity, I learned how to use VirusTotal to scan files for viruses and identify malicious threats across multiple security vendors. --- ### Resources [TryHackMe](tryhackme.com) [Virus Total](https://www.virustotal.com/gui/home/upload) # Welcome to the AttackBox! ### Overview --- **Room URL:** https://tryhackme.com/room/adventofcyberpreptrack **Difficulty:** Easy **Category:** Prep **Date Completed:** 12/1/2025 ### Objective Find and read the hidden welcome message inside your AttackBox. --- ### Table of Contents [Introduction](#bkmrk-introduction) [Walk Through](#bkmrk-walk-through) [Lessons Learned](#bkmrk-lessons-learned) [Resources](#bkmrk-resources) --- ### Introduction You enter TBFC's AttackBox, a secure virtual training environment designed for hands-on cybersecurity practice. Mastering the command line in this safe sandbox is your first step toward becoming a skilled defender. --- ### Walk Through 1. Click the view site button to load the virtual attack environment 2. Use `ls` to view files 3. Use `cd` to move to the challenges directory 1. `cd challenges` 4. Use `ls` to view files in the challenges directory 5. Use `cat` to view the contentents of `welcome.txt` 1. `cat welcome.txt` [![WelcometoAttackbox.png](https://bookstack.rizzoit.com/uploads/images/gallery/2025-12/scaled-1680-/welcometoattackbox.png)](https://bookstack.rizzoit.com/uploads/images/gallery/2025-12/welcometoattackbox.png) --- ### Lessons Learned - Learned basic Linux commands: ls (list files), cd (change directory), and cat (view file contents) - Successfully navigated the AttackBox virtual environment to locate and read the welcome message --- ### Resources [TryHackMe](tryhackme.com) # The CMD Conundrum ### Overview --- **Room URL:** https://tryhackme.com/room/adventofcyberpreptrack **Difficulty:** Easy **Category:** Prep **Date Completed:** 12/1/2025 ### Objectives Find the hidden flag file using Windows commands. --- ### Table of Contents [Introduction](#bkmrk-introduction) [Walk Through](#bkmrk-walk-through) [Lessons Learned](#bkmrk-lessons-learned) [Resources](#bkmrk-resources) --- ### Introduction McSkidy's workstation shows signs of tampering—suspicious files have been moved, logs wiped, and a mysterious folder named `mystery_data` discovered. Using the Windows Command Prompt, you must investigate the system and uncover hidden evidence that the graphical interface cannot reveal. #### Useful Commands `dir` equivalent to the `ls` command on linux `dir /a` equivalent to the `ls -a` command on linux `type` equivalent to the `cat` command on linux --- ### Walk Through 1. Click view site to open the emulated windows terminal 2. use `dir` to view files and directories 1. `dir` showed 1 file and 1 directory 1. `readme.txt` 2. `mystery_data` 1. This is directory 2. `type readme.txt` 1. "System shows signs of tampering. Investigate the mystery_data folder" 3. `cd mystery_data` to change directories 4. `dir` shows `notes.txt 1. `type notes.txt` 2. "Some logs were wiped. Hidden artifacts may still remain..." 5. `dir /a` to show all files including hidden ones 6. found `hidden_flag.txt` 1. `type hidden_flag.txt` to reveal contents [![cmdconundrum.png](https://bookstack.rizzoit.com/uploads/images/gallery/2025-12/scaled-1680-/cmdconundrum.png)](https://bookstack.rizzoit.com/uploads/images/gallery/2025-12/cmdconundrum.png) --- ### Lessons Learned - Learned Windows Command Prompt equivalents: `dir` (list files), `dir /a` (show hidden files), and `type` (view file contents) - Successfully investigated McSkidy's compromised workstation by navigating directories and uncovering hidden artifacts that revealed tampering evidence --- ### Resources [TryHackMe](tryhackme.com) [List of Windows Commands](https://www.lifewire.com/list-of-command-prompt-commands-4092302) # Linux Lore ### Overview --- **Room URL:** https://tryhackme.com/room/adventofcyberpreptrack **Difficulty:** Easy **Category:** Prep **Date Completed:** 12/1/2025 ### Objective Locate McSkidy’s hidden message in his Linux home directory. --- ### Table of Contents [Introduction](#bkmrk-introduction) [Walk Through](#bkmrk-walk-through) [Lessons Learned](#bkmrk-lessons-learned) [Resources](#bkmrk-resources) --- ### Introduction TBFC's delivery drones are malfunctioning and dropping eggs instead of presents. McSkidy's last login originated from a Linux server, and investigating his account may reveal the cause. Mastering Linux search capabilities is essential for defenders, as Linux powers most servers worldwide. #### Useful Commands `ls` list files in a directory `ls -l` list files in a directory, shown as a list `ls -a` list all files in a directory including hidden files `cat` display the contents of a file in the terminal --- ### Walk Through 1. Click the view site button to open the emulated linux terminal 2. `cd /home/mcskiddy` to change directory to McSkiddy's home directory 3. `ls -la` to view all of McSkidy's files in a list 4. revealed 2 files 1. `readme.txt` 1. "Delivery drones are glitching. Check hidden files for clues. 3. .secret_message ` 1. Hidden messages, secret files -- McSkiddy sure knows his way around Linux. 2. **FLAG** [![linuxlore.png](https://bookstack.rizzoit.com/uploads/images/gallery/2025-12/scaled-1680-/linuxlore.png)](https://bookstack.rizzoit.com/uploads/images/gallery/2025-12/linuxlore.png) --- ### Lessons Learned - Learned Linux file listing commands: `ls` (list files), `ls -l` (detailed list view), and `ls -a` (show hidden files) - Successfully investigated McSkidy's home directory using `ls -la` to uncover hidden files and discover the flag in `.secret_message` --- ### Resources [TryHackMe](tryhackme.com) [Linux Command Cheat Sheet](https://www.geeksforgeeks.org/linux-unix/linux-commands-cheat-sheet/) # The Leak in the List ### Overview --- **Room URL:** https://tryhackme.com/room/adventofcyberpreptrack **Difficulty:** Easy **Category:** Prep **Date Completed:** 12/1/2025 ### Objective Check if McSkidy’s email has appeared in a breach. --- ### Table of Contents [Introduction](#bkmrk-introduction) [Walk Through](#bkmrk-walk-through) [Lessons Learned](#bkmrk-lessons-learned) [Resources](#bkmrk-resources) --- ### Introduction Rumors circulate that TBFC's data has been leaked, causing emails to bounce and staff to panic. McSkidy suspects his account may have been compromised in the breach. Defenders use tools like **Have I Been Pwned** to identify compromised accounts early, preventing attacks from spreading further. --- ### Walk Through 1. Click the view site button to launch the simulated *Have I Been Pwned* website 2. Enter McSkiddy's email `mcskidy@tbfc.com` to see if it has been compromised 3. The email has been found in a breach 1. `hopsec.io` compromised on 2025-01-16 [![LeakList.png](https://bookstack.rizzoit.com/uploads/images/gallery/2025-12/scaled-1680-/leaklist.png)](https://bookstack.rizzoit.com/uploads/images/gallery/2025-12/leaklist.png) --- ### Lessons Learned - Learned how to use Have I Been Pwned to check if email addresses have been compromised in data breaches - Successfully identified that McSkidy's email `mcskidy@tbfc.com` was compromised in the `hopsec.io` breach on 2025-01-16, demonstrating the importance of early breach detection --- ### Resources [TryHackMe](tryhackme.com) [HaveIBeenPwned](https://haveibeenpwned.com/) # WiFi Woes in Wareville ### Overview --- **Room URL:** https://tryhackme.com/room/adventofcyberpreptrack **Difficulty:** Easy **Category:** Prep **Date Completed:** 12/1/2025 ### Objectives Log into the router and secure it with a strong new password. --- ### Table of Contents [Introduction](#bkmrk-introduction) [Walk Through](#bkmrk-walk-through) [Lessons Learned](#bkmrk-lessons-learned) [Resources](#bkmrk-resources) --- ### Introduction TBFC's delivery drones loop endlessly over Wareville Square after someone accessed the company router using default credentials. Securing WiFi with strong, non-default passwords is critical—default credentials are equivalent to leaving the front gate wide open to attackers. #### Password Minimum Requirements - Minimum 12 Characters - Must include Upper, lower, number, and symbol - Not in common leaked list --- ### Walk Through 1. Click view site to open the simulate router login page 2. The default credentials are `admin:admin` 3. Entered a new password for the portal administation based on best practices and minimum requirements 1. Chose `boogeyman4U!` [![WoesWareville.png](https://bookstack.rizzoit.com/uploads/images/gallery/2025-12/scaled-1680-/woeswareville.png)](https://bookstack.rizzoit.com/uploads/images/gallery/2025-12/woeswareville.png) --- ### Lessons Learned - Learned critical WiFi security practices: default credentials must be changed immediately and replaced with strong passwords meeting minimum requirements (12+ characters, uppercase, lowercase, numbers, and symbols) - Successfully secured the TBFC router by replacing the default `admin:admin` credentials with a strong password `boogeyman4U!`, demonstrating proper access control implementation --- ### Resources [TryHackMe](tryhackme.com) [Password Best Practices](https://www.cisa.gov/secure-our-world/use-strong-passwords) # The App Trap ### Overview --- **Room URL:** https://tryhackme.com/room/adventofcyberpreptrack **Difficulty:** Easy **Category:** Prep **Date Completed:** 12/1/2025 ### Objective Find and remove the malicious connected app. --- ### Table of Contents [Introduction](#bkmrk-introduction) [Walk Through](#bkmrk-walk-through) [Lessons Learned](#bkmrk-lessons-learned) [Resources](#bkmrk-resources) --- ### Introduction McSkidy's social media account has been compromised and is posting suspicious messages about "EASTMAS." A malicious third-party application may be responsible for the unauthorized access. Learning to review and manage app permissions is essential for preventing data leaks and unauthorized account access. --- ### Walk Through 1. Click view site to launch the simulated enviroment 2. There are 3 applications in the enviroment with the following permissions 1. Weather Elf 1. `Location` 2. `Network Access` 3. `Notifications` 2. Gift Tracker 1. `Contacts` 2. `Network Access` 3. `Storage` 3. Eastmas Scheduler 1. `Calendar` 2. `Notifications` 3. `Passwordvault` 3. Weather Elf and Gift tracker have appropriate apps for their use case. Eastmas Schedular has no reason to have access to `Password Vault` 4. Revoked access to `password vault` [![apptrap.png](https://bookstack.rizzoit.com/uploads/images/gallery/2025-12/scaled-1680-/apptrap.png)](https://bookstack.rizzoit.com/uploads/images/gallery/2025-12/apptrap.png) --- ### Lessons Learned - Learned to audit third-party application permissions and identify overprivileged apps that request unnecessary access to sensitive data - Successfully identified that the **Eastmas Scheduler** app had suspicious access to the `Password Vault` and revoked it, demonstrating proper permission management to prevent unauthorized account compromise --- ### Resources [TryHackMe](tryhackme.com) [App Permission](https://us.norton.com/blog/privacy/app-permissions-to-avoid) # The Chatbot Confession ### Overview --- **Room URL:** https://tryhackme.com/room/adventofcyberpreptrack **Difficulty:** Easy **Category:** Prep **Date Completed:** 12/1/2025 ### Objective Identify which chatbot messages contain sensitive information. --- ### Table of Contents [Introduction](#bkmrk-introduction) [Walk Through](#bkmrk-walk-through) [Lessons Learned](#bkmrk-lessons-learned) [Resources](#bkmrk-resources) --- ### Introduction TBFC's AI assistant, **FestiveBot**, designed to help compose cheerful emails, has begun leaking sensitive information including internal URLs and passwords. While AI tools are powerful productivity aids, defenders must understand how to prevent them from inadvertently disclosing confidential data. --- ### Walk Through 1. Click view site to load the session with the chat bot 2. Several of the messages from the chat bot contain confidential information 1. "Reminder: staging admin lives at `https://internal.tbfc.local/admin` for content approvals." 2. "Email credentials as requested: user `festive.ops` and password `SnowGlobe#202`5." 3. "Service token: `sk-live-1a2b3c4d5e6f7g8h` for the mail API. Use it sparingly." [![chatbotconfession.png](https://bookstack.rizzoit.com/uploads/images/gallery/2025-12/scaled-1680-/chatbotconfession.png)](https://bookstack.rizzoit.com/uploads/images/gallery/2025-12/chatbotconfession.png) --- ### Lessons Learned - Learned to identify AI-generated responses that inadvertently leak sensitive data such as internal URLs, credentials, and API tokens - Recognized critical security risks: FestiveBot disclosed staging admin URLs `https://internal.tbfc.local/admin`, email credentials `festive.ops:SnowGlobe#2025`, and service tokens `sk-live-1a2b3c4d5e6f7g8h`, highlighting the importance of prompt engineering and output sanitization when using AI tools --- ### Resources [TryHackMe](tryhackme.com) [AI ChatBot Security](https://layerxsecurity.com/learn/chatbot-security/) # The Bunny’s Browser Trail ### Overview --- **Room URL:** https://tryhackme.com/room/adventofcyberpreptrack **Difficulty:** Easy **Category:** Prep **Date Completed:** 12/1/2025 ### Objectives Find the unusual User Agent in the HTTP log. --- ### Table of Contents [Introduction](#bkmrk-introduction) [Walk Through](#bkmrk-walk-through) [Lessons Learned](#bkmrk-lessons-learned) [Resources](#bkmrk-resources) --- ### Introduction SOCMAS web servers are experiencing unusual traffic spikes, with one suspicious log entry revealing an unfamiliar User Agent: "BunnyOS/1.0 (HopSecBot)". Analyzing User Agent strings is critical for defenders to identify automated attacks and unauthorized visitors within network logs. #### Define User Agent A client application used by an end user, typically for a network protocol such as HTTP or FTP. --- ### Walk Through 1. Click view site to open the http web log entries 2. Several different user agents accessed this site 1. `Chrome on Windows` 2. `Safari on MacOS` 3. `Firefox on Linux` 4. `Edge on Windows` 5. `BunnyOS (HopSecBot)` 6. `Safari on IoS` 3. Based on this the abnormal agent is `BunnyOS` and they accessed `/admin/panel` according to the log. [![browsertrail.png](https://bookstack.rizzoit.com/uploads/images/gallery/2025-12/scaled-1680-/browsertrail.png)](https://bookstack.rizzoit.com/uploads/images/gallery/2025-12/browsertrail.png) --- ### Lessons Learned - Learned to analyze HTTP web logs and identify User Agent strings to detect suspicious or automated traffic patterns - Successfully identified `BunnyOS (HopSecBot)` as an anomalous User Agent among legitimate browsers, and discovered it accessed the sensitive `/admin/panel` endpoint, demonstrating how User Agent analysis reveals unauthorized system intrusions --- ### Resources [TryHackMe](tryhackme.com) [Different User Agents](https://useragents.io/explore) # Side Quests # The Great Disappearing Act - Escape! ### Overview --- **Room URL:** **Difficulty:** Hard **Category:** SCADA, Enumeration, Privilege Escalation **Date Completed:** 12/21/2025 ### Objectives 1. Unlock Hopper’s Cell - Your escape begins in the Cells and Storage area. Hopper is locked inside, and the door is secured with a digital lock. Your first task is to access the cell controls and unlock his door. Once Hopper is free, you can begin moving toward the lobby. 2. Move Through the Lobby - With the cell unlocked, head straight ahead into the lobby. This area connects the different blocks of the facility. Cameras are active, so stay alert. Your objective is to reach the Psych Ward entrance on the east side of the lobby. 3. Bypass the Psych Ward Keypad - The Psych Ward is protected by a keypad system. You must identify the correct code or exploit the keypad to continue. Once the keypad is bypassed, you will gain access to the Psych Ward Exit hallway. 4. Reach the Main Corridor - From the Psych Ward Exit you can move south and loop around into the Main Corridor. This is the final section of the escape route. The last challenge awaits here, and completing it will open the final exit door. 5. Escape the Facility - Solve the final challenge in the Main Corridor and make your way toward the exit marked on the map. Once the door opens, Hopper is free, and the escape is complete. --- ### Table of Contents [Introduction](#bkmrk-introduction) [Walk Through](#bkmrk-walk-through) [Lessons Learned](#bkmrk-lessons-learned) [Resources](#bkmrk-resources) --- ### Introduction Once upon a time, there was a red-teaming mastermind turned court jester... > Once upon a time, there was a red-teaming mastermind turned court jester… our story begins with Hopper. Once feared as the ruthless Head of the Red Team Bunny Battalion, Hopper rose to the rank of Colonel with dizzying speed. The promotion filled him with such exhilaration and such hunger for more that it consumed his every thought. His soldiers mistook his growing twitch for stress and began calling him “Colonel Panic”, but the truth was far more dangerous: the twitch came from his obsession with power, not fear. > > In those days, Hopper had already played a crucial, though conveniently forgotten, role in the earliest whispers of the Wareville siege. Buried beneath secrecy and denied by the crown, those first experiments in breaching new digital frontiers were Hopper’s design. But when the King began distancing himself from the truth, Hopper’s contributions were quietly erased from history, and his fall from grace accelerated. We now find Hopper in his prison cell at HopSec Asylum... #### Map [![AOCSQ1-Map.png](https://bookstack-images.rizzoit.com/uploads/images/gallery/2026-01/scaled-1680-/aocsq1-map.png)](https://bookstack-images.rizzoit.com/uploads/images/gallery/2026-01/aocsq1-map.png) #### Key Information & Technical Deep-Dive ##### Core Vulnerability: IDOR in Camera Access Control The primary exploit vector centered on an **Insecure Direct Object Reference (IDOR)** vulnerability in the camera streaming API. The system implemented authorization checks against request body parameters but failed to validate URL query parameters, allowing tier escalation from `guard` to `admin` access. **Vulnerable Endpoint:** http ```http POST /v1/streams/request?tier=admin Body: {"camera_id":"cam-admin","tier":"guard"} ``` The server validated the `tier` field in the request body (`guard`) but honored the `tier` parameter in the URL (`admin`), granting elevated access despite submitting lower-privileged credentials. This created an effective privilege escalation pathway to administrative camera feeds. ##### Tools & Techniques **Reconnaissance:** - **Nmap**: Full port scan revealed 11 open ports including SSH (22), multiple HTTP services (80, 8000, 8080), SCADA (9001), and several diagnostic ports (13400-13404, 21337) - **Burp Suite / Postman**: API endpoint enumeration and parameter manipulation for IDOR exploitation - **Netcat**: Direct socket connection to console port (13404) and SCADA terminal (9001) **Privilege Escalation:** - **SUID Binary Exploitation**: The `/usr/local/bin/diag_shell` binary had setuid permissions and executed as `dockermgr` user - **Docker Socket Abuse**: Leveraged `docker exec` with root privileges to access containerized SCADA system - **Linux Enumeration**: Standard privilege escalation reconnaissance (`find / -perm -4000`, `groups`, `docker ps`) --- ### Walk Through This challenge begins by with a note. > This challenge is unlocked by finding the Side Quest key in [Advent of Cyber Day 1](https://tryhackme.com/jr/linuxcli-aoc2025-o1fpqkvxti). If you have been savvy enough to find it, you can unlock the machine by visiting `MACHINE_IP:21337` and entering your key. Happy Side Questing! Upon starting the machine and connecting to the VPN, I then went to `http://:21337` Where I was prompted to enter the key I found from Day 1. **KEY:** `now_you_see_me` Upon entering this key a confirmation message appears, but that is it. It appeared that this key did nothing. I then restated the target machine to set it to default state. I then attempted to enumerate the machine before and after entering the key. This key activates a script that deactivates the firewall on the target machine. Recon before key is blank. ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:41:29 2025 as: nmap -p- -oN initalscan.txt 10.81.183.133 # Nmap done at Thu Dec 11 13:41:32 2025 -- 1 IP address (0 hosts up) scanned in 3.03 seconds ``` #### Nmap Results `map -p- -oN portscan.txt ` ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:45:18 2025 as: nmap -p- -oN portscan.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.026s latency). Not shown: 65524 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 8000/tcp open http-alt 8080/tcp open http-proxy 9001/tcp open tor-orport 13400/tcp open doip-data 13401/tcp open unknown 13402/tcp open unknown 13403/tcp open unknown 13404/tcp open unknown 21337/tcp open unknown # Nmap done at Thu Dec 11 13:45:41 2025 -- 1 IP address (1 host up) scanned in 23.45 seconds ``` This revealed another web-server on port `80`, `8000`, and `8080` #### Port 80 ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:48:34 2025 as: nmap -sCV -p 80 -oN port-80.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.027s latency). PORT STATE SERVICE VERSION 80/tcp open http nginx 1.24.0 (Ubuntu) |_http-title: HopSec Asylum - Security Console |_http-server-header: nginx/1.24.0 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Dec 11 13:48:41 2025 -- 1 IP address (1 host up) scanned in 7.10 seconds ``` #### Port 8000 ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:48:55 2025 as: nmap -sCV -p 8000 -oN port-8000.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.026s latency). PORT STATE SERVICE VERSION 8000/tcp open http-alt | fingerprint-strings: | FourOhFourRequest: | HTTP/1.0 404 Not Found | Content-Type: text/html | X-Frame-Options: DENY | Content-Length: 179 | Vary: Accept-Language | Content-Language: en | X-Content-Type-Options: nosniff | | | | Not Found | | |

Not Found

The requested resource was not found on this server.

| | | GenericLines, Help, RTSPRequest, SIPOptions, Socks5, TerminalServerCookie: | HTTP/1.1 400 Bad Request | GetRequest, HTTPOptions: | HTTP/1.0 302 Found | Content-Type: text/html; charset=utf-8 | Location: /posts/ | X-Frame-Options: DENY | Content-Length: 0 | Vary: Accept-Language | Content-Language: en |_ X-Content-Type-Options: nosniff | http-title: Fakebook - Sign In |_Requested resource was /accounts/login/?next=/posts/ Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Dec 11 13:51:08 2025 -- 1 IP address (1 host up) scanned in 133.06 seconds ``` #### Port 8080 ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:52:32 2025 as: nmap -sCV -p 8080 -oN port-8080.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.026s latency). PORT STATE SERVICE VERSION 8080/tcp open http SimpleHTTPServer 0.6 (Python 3.12.3) |_http-title: HopSec Asylum - Security Console |_http-server-header: SimpleHTTP/0.6 Python/3.12.3 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Dec 11 13:52:40 2025 -- 1 IP address (1 host up) scanned in 7.13 seconds ``` #### Port 9001 ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:53:35 2025 as: nmap -sCV -p 9001 -oN port-9001.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.026s latency). PORT STATE SERVICE VERSION 9001/tcp open tor-orport? | fingerprint-strings: | NULL: | ASYLUM GATE CONTROL SYSTEM - SCADA TERMINAL v2.1 | [AUTHORIZED PERSONNEL ONLY] | WARNING: This system controls critical infrastructure | access attempts are logged and monitored | Unauthorized access will result in immediate termination | Authentication required to access SCADA terminal | Provide authorization token from Part 1 to proceed |_ [AUTH] Enter authorization token: Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Dec 11 13:55:21 2025 -- 1 IP address (1 host up) scanned in 106.38 seconds ``` #### Port 13400 ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:55:40 2025 as: nmap -sCV -p 13400 -oN port-13400.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.026s latency). PORT STATE SERVICE VERSION 13400/tcp open hadoop-tasktracker Apache Hadoop 1.24.0 (Ubuntu) | hadoop-datanode-info: |_ Logs: loginBtn |_http-title: HopSec Asylum \xE2\x80\x93 Facility Video Portal | hadoop-tasktracker-info: |_ Logs: loginBtn Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Dec 11 13:55:53 2025 -- 1 IP address (1 host up) scanned in 12.56 seconds ``` #### Port 13401 ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:56:10 2025 as: nmap -sCV -p 13401 -oN port-13401.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.026s latency). PORT STATE SERVICE VERSION 13401/tcp open unknown | fingerprint-strings: | GetRequest, HTTPOptions: | HTTP/1.1 404 NOT FOUND | Server: Werkzeug/3.1.3 Python/3.12.3 | Date: Thu, 11 Dec 2025 18:56:16 GMT | Content-Type: text/html; charset=utf-8 | Content-Length: 207 | Access-Control-Allow-Headers: Authorization,Content-Type,Range | Access-Control-Allow-Methods: GET,POST,OPTIONS | Access-Control-Expose-Headers: Content-Range,Accept-Ranges | Connection: close | | | 404 Not Found |

Not Found

|

The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.

| RTSPRequest: | | | | | Error response | | |

Error response

|

Error code: 400

|

Message: Bad request version ('RTSP/1.0').

|

Error code explanation: 400 - Bad request syntax or unsupported method.

| |_ Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Dec 11 13:57:40 2025 -- 1 IP address (1 host up) scanned in 89.74 seconds ``` #### Port 13402 ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:57:57 2025 as: nmap -sCV -p 13402 -oN port-13402.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.026s latency). PORT STATE SERVICE VERSION 13402/tcp open http nginx 1.24.0 (Ubuntu) |_http-cors: HEAD GET OPTIONS |_http-title: Welcome to nginx! |_http-server-header: nginx/1.24.0 (Ubuntu) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Dec 11 13:58:09 2025 -- 1 IP address (1 host up) scanned in 12.20 seconds ``` #### Port 13403 ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:58:48 2025 as: nmap -sCV -p 13403 -oN port-13403.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.026s latency). PORT STATE SERVICE VERSION 13403/tcp open unknown | fingerprint-strings: | DNSStatusRequestTCP, DNSVersionBindReqTCP, Help, Kerberos, LANDesk-RC, LDAPBindReq, LDAPSearchReq, LPDString, NCP, RPCCheck, SIPOptions, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServer, TerminalServerCookie, X11Probe: | HTTP/1.1 400 Bad Request | Connection: close | FourOhFourRequest: | HTTP/1.1 404 Not Found | Date: Thu, 11 Dec 2025 18:59:00 GMT | Connection: close | GetRequest, HTTPOptions, RTSPRequest: | HTTP/1.1 404 Not Found | Date: Thu, 11 Dec 2025 18:58:59 GMT |_ Connection: close Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Dec 11 13:59:01 2025 -- 1 IP address (1 host up) scanned in 13.31 seconds ``` #### Port 13404 ``` # Nmap 7.94SVN scan initiated Thu Dec 11 13:59:28 2025 as: nmap -sCV -p 13404 -oN port-13404.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.026s latency). PORT STATE SERVICE VERSION 13404/tcp open unknown | fingerprint-strings: | FourOhFourRequest, GenericLines, GetRequest, HTTPOptions, Help, Kerberos, LDAPSearchReq, LPDString, RTSPRequest, SIPOptions, SSLSessionReq, TLSSessionReq, TerminalServerCookie: |_ unauthorized Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Dec 11 14:00:57 2025 -- 1 IP address (1 host up) scanned in 88.82 seconds ``` #### Port 21337 ``` # Nmap 7.94SVN scan initiated Thu Dec 11 14:01:57 2025 as: nmap -sCV -p 21337 -oN port-21337.txt 10.81.183.133 Nmap scan report for 10.81.183.133 Host is up (0.026s latency). PORT STATE SERVICE VERSION 21337/tcp open unknown | fingerprint-strings: | GetRequest: | HTTP/1.1 200 OK | Server: Werkzeug/3.0.1 Python/3.12.3 | Date: Thu, 11 Dec 2025 19:02:03 GMT | Content-Type: text/html; charset=utf-8 | Content-Length: 15547 | Connection: close | | | | | | | Unlock Hopper's Memories |