The Dutch Hacker
Advent of Cyber 3 on tryhackme

Advent of Cyber 3 (2021) on Tryhackme

This is the write up for the Room Advent of Cyber 3 (2021) on Tryhackme and it is part of the Yearly Christmas Cyber Security Event where you will learn the basics by doing 1 task every day for 25 Days

Make a connection with VPN or use the attack box on Tryhackme site to connect to the Tryhackme lab environment if needed.

Task 1 / Task 5

Read all that is in these tasks and press complete

Task 6 – Day 1 – Web Exploitation Save the Gifts

Read all that is in the task. This one is really simple we just need to adjust the ID

Advent of Cyber 3 day 1

1.1 After finding Santa’s account, what is their position in the company?

Change the ID to one. So the completer URL looks like

https://inventory-management.thm/activity?user_id=1

Advent of Cyber 3 day 1
Answer: The Boss!

1.2 After finding McStocker’s account, what is their position in the company?

Change the ID to 3

Advent of Cyber 3 day 1
Answer: Build Manager

1.3 After finding the account responsible for tampering, what is their position in the company?

Change the ID to 9

Advent of Cyber 3 day 1
Answer: Mischief Manager

1.4 What is the received flag when McSkidy fixes the Inventory Management System?

Click on every revert action of user_id 9 found in the previous question. The flag will reveal itself when all is clicked/reverted


If you want to learn more about IDOR vulnerabilities, we suggest trying out this room IDOR on Tryhackme

Task 7 – Day 2 – Web Exploitation Elf HR Problems

Open the following website with Firefox Best Festival Company (tryhackme.cloud) and register a new account.

7.1 What is the name of the new cookie that was created for your account?

Once you have registered a new account press F12 to open the developer console. Click on the Storage tab and select the cookie it just created

cookie manupilation tryhackme
Answer: user-auth

7.2 What encoding type was used for the cookie value?

Navigate to CyberChef then Copy the value of the string from the cookie in the input field and select HEX

json cyberchef to hex
Answer: hexadecimal

7.3 What object format is the data of the cookie stored in?

If we look at the output in Cyberchef we see that this is in JSON format

json cyberchef
Answer: JSON

7.3 What is the value of the administrator cookie? (username = admin)

We know the format is in JSON converted in HEX and we have a username admin.

Copy the output from previous question into the input field and change From HEX to To HEX with no space. The change your login name to admin

cyberchef json to hex

Answer is the output in cyberchef

7.3 What team environment is not responding?

Now back to your cookie in firefox. Change the value of the cookie to the HEX from the previous question

cookie manupilation

Navigate to the original site https://static-labs.tryhackme.cloud/sites/aoc-cookies/

login bypass

We now bypassed the login screen and are logged in as admin

Answer: HR

7.4 What team environment has a network warning?

Answer: Application

For more information about HTTP requests, methods, and headers, check out the Web Fundamentals room!

Task 8 – Day 3 – Christmas Blackout

Read all that is in this task. Start the Machine attached to this task. Wait until you see the IP address. If you are not connected with VPN then use the attack box. This is webbased

8.1 Using a common wordlist for discovering content, enumerate http://10.10.23.238 to find the location of the administrator dashboard. What is the name of the folder?

Navigating to the address http://MACHINE_IP
We see a website we need to enumerate with dirbuster to find the administrator dashboard

Open dirbuster ( I always open a terminal and type in dirbuster )
Fill in the target URL
Put the threads on MAX
Browse to a wordlist. In Kali, the wordlists are located in /usr/share/wordlist

Dirbuster Advent of Cyber 3 task 8

After pressing start click on the tab Result – Tree View and notice the admin directory

Dirbuster Advent of Cyber 3 task 8
Answer: admin

8.2 In your web browser, try some default credentials on the newly discovered login form for the “administrator” user. What is the password?

Navigate to http://MACHINE_IP/admin

Now we are going to guess this password. If you read the task correctly especially the default credentials part they more or less have given you the password

Login: Administrator
PWD: administrator

Found login credentials
Answer: administrator

8.3 Access the admin panel. What is the value of the flag?

The flag is located on the bottom and starts with THM{

Welcome to the admin page

Task 9 – Day 4 – Santa’s Running Behind

Read all that is in the task. IF you are connected with VPN and not use the attack box Please the following guide Configure Burpsuite with Firefox

Access the login form at http://MACHINE_IP
Open Burpsuite
Make sure FoxyProxy is on Burp

Foxy Proxy


Submit some dummy credentials and intercept the request.

All traffic is going to burp now also the firefox traffic hit the forward button until you see the password page in burpsuite.

Burp suite proxy

Once you see this in burpsuite hit the action button and send to intruder

Burp suite send to intruder

9.1 What valid password can you use to access the “santa” account?

We know the login is Santa and we now want to find the password through brute force with burp suite

In Burpsuite click on the intruder tab and within intruder click on Position. We first need to tell Burpsuite what position we need to Fuzz.

Click on the Clear button
Select attack type -> Cluster Bomb
Select username and click on ADD
Select password and click on ADD

Burp suite cluster bomb attack

The password list we are going to use can be found here. We will also use this list for login names https://assets.tryhackme.com/additional/aoc2021/day4/passwords.txt

We will configure Burp to use this list for the password and for the login name. Position 1 is now username and position 2 is password. Normally if you already know the login name you do not select the username in burp when adding it to the intruder for the payload we just did. For now, I’m doing this to show you that you can also rotate usernames with passwords by loading different lists

This list is very small so you can copy the list and then paste it in. normally lists are bigger and you need to load it. For now, copy the list and press on paste

Intruder position 1

Once position payload is set. Select position 2 and do the same

Intruder position 2

Once the lists are loaded press the Start attack button

burp suite start attack button

Below you see the progress bar. Once finished take a look at the Lenght field. You will notice a different value for when the login is correct

Found credentials woth burp suite
Answer: cookie

9.2 What is the flag in Santa’s itinerary?

Turn off Burpsuite in firefox. Reload the page and use the credentials we just found

turn off foxy proxy
Login found

The flag is on this page and starts with THM{

Task 10 – Day 5 – Pesky Elf Forum

This is a really easy task just follow all that is in this task and you will find the flag

Task 11 – Day 6 – Patch management is Hard

Deploy the machine attached to this task and read all that is in this task

11.1 Deploy the attached VM and look around. What is the entry point for our web application?

Open Firefox and navigate to the page as provided in the task HTTP://MACHINE_IP.p.thmlabs.com/

Now we see in the URL err=error.txt. So this PHP file is reading from local files

Answer: err

11.2 Use the entry point to perform LFI to read the /etc/flag file. What is the flag?

Type /etc/flag after err= and press enter

The flag will show itself on the page

11.3 Use the PHP filter technique to read the source code of the index.php. What is the $flag variable’s value?

in order to read the file, we need to convert it to a base64 code first. Type in the following after err=

php://filter/convert.base64-encode/resource=index.php

Now copy the base64 code and go to cyberchef to convert is back

the flag is on the second line of the PHP code

11.4 Now that you read the index.php, there is a login credential PHP file’s path. Use the PHP filter technique to read its content. What are the username and password?

Now that we have the code of the index.php. look at the 3rd line. it includes a creds.php. Let’s get it by typing in the following after err=

php://filter/convert.base64-encode/resource=./includes/creds.php

Do not forget the dot before the /includes. This means root and then the subfolder

Now we have another base64 code. Decode it with cyberchef and you will get the credentials

The answer is in format username:password

11.5 Use the credentials to login into the web application. Help McSkidy to recover the server’s password. What is the password of the flag.thm.aoc server? 

On the webpage press home and then on the login text. Or just put the login.php

https://MACHINE_IP.p.thmlabs.com/login.php

Login with the found credentials and click on password recovery

11.6 The web application logs all users’ requests, and only authorized users can read the log file. Use the LFI to gain RCE via the log file page. What is the hostname of the webserver? The log file location is at ./includes/logs/app_access.log.

We are still logged in. Click on log access and click on reset logs. You do not have to but I did to find it faster what I’m looking for

Now log out

Got o login page and type in the login field

Press sing in and it will tell you invalid user. But in the background it wrote the info to the log

Now we use the LFI to get the log file

https://10-10-122-135.p.thmlabs.com/index.php?err=./includes/logs/app_access.log

Answer: lfi-aoc-awesome-59aedca683fff9261263bb084880c965

Task 12 – Day 7 – Web Exploitation – Migration Without Security

Read all that is in this task and start the machine attached to it

12. Interact with the MongoDB server to find the flag. What is the flag?

If you followed along with the instruction you already connected with ssh to the machine

Type in the following command to retrieve to flag ( Capital sensitive )

  • show databases
  • use flagdb
  • db.getCollectionNames();
  • db.flagColl.find()

The flag will reveal itself after the last command

12.2 Can you log into the application that Grinch Enterprise controls as admin and retrieve the flag?

Open the webpage http://MACHINE_IP in firefox
Open burp suite and turn on the proxy in firefox. If you do not know how then follow this guide

Configure Burpsuite with Firefox – The Dutch Hacker

We know the username is admin. Fill this in at username and password field

Press forward in burp until you see the request then add [$ne] after the word password and press forward

Turn of burp in firefox and click on the flag link

12.3 Once you are logged in, use the gift search page to list all usernames that have guest roles. What is the flag?

Navigate to dashboard then click on search

Just type a search string press enter and look at the URL

type in the following after username [$ne]=guest&role=guest

The flag is on this page

12.4 Use the gift search page to perform NoSQL injection and retrieve the mcskidy record. What is the details record?

this user is probably probably has got an other role.

type in the following after username =mcskidy&role[$ne]=user

Answer: ID:6184f516ef6da50433f100f4:mcskidy:admin

Task 13 – Day 8 – Santa’s bag of Toys

Start the machine attached to this task and use the terminal to setup a remote connection to the windows machine

xfreerdp /u:Administrator /p:grinch123! /v:10.10.175.187

13.1 What operating system is Santa’s laptop running (“OS Name”)?

Open the folder names SntasLaptopLogs on the desktop
Open the file called PowerShell_transcript.LAPTOP._s3k_jad.20211128153510

Scroll down and you see the name of the OS

Answer: Microsoft Windows 11 Pro

13.2 What was the password set for the new “backdoor” account?

Open the log with the name PowerShell_transcript.LAPTOP.k_dg27us.20211128153538
Scroll down a little to see the command net user s4nta grinchstolechristmas /add

Answer:  grinchstolechristmas  

13.3 In one of the transcription logs,  the bad actor interacts with the target under the new backdoor user account, and copies a unique file to the Desktop. Before it is copied to the Desktop, what is the full path of the original file? 

Open the file called PowerShell_transcript.LAPTOP.Zw6PA+c4.20211128153734
We see the command copy is being used

Answer: C:\Users\santa\AppData\Local\Microsoft\Windows\UsrClass.dat

13.4 The actor uses a Living Off The Land binary (LOLbin) to encode this file, and then verifies it succeeded by viewing the output file. What is the name of this LOLbin?

Opening the URL provided in the question we see that is has to do with certutil
When you look in the log it is being used to encode a file

Answer: certutil.exe

Now copy all in the log between the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- markers. Open the cyberchef which is n the desktop

Download the file

Now follow the rest of the task and open the file you just downloaded with the program provided in the task

13.5 Drill down into the folders and see if you can find anything that might indicate how we could better track down what this SantaRat really is. What specific folder name clues us in that this might be publicly accessible software hosted on a code-sharing platform?

We see the santarat as folder on the desktop. Opening it we see .github

Answer:  .github

13.6 Additionally, there is a unique folder named “Bag of Toys” on the Desktop! This must be where Santa prepares his collection of toys, and this is certainly sensitive data that the actor could have compromised. What is the name of the file found in this folder? 

Navigate to the folder. There is only one file in it

Answer: bag_of_toys.zip

13.7 What is the name of the user that owns the SantaRat repository?

Here is the github I found GitHub – Grinchiest/SantaRat: A remote access trojan to use against Santa’s laptop!

Answer Grinchiest

13.8 Explore the other repositories that this user owns. What is the name of the repository that seems especially pertinent to our investigation?

Answer: operation-bag-of-toys

13.9 What is the name of the executable that installed a unique utility the actor used to collect the bag of toys?

Back to the log files. Open the log with the name PowerShell_transcript.LAPTOP.b+XfnW7t.20211128154858

In the log we see it downloaded a file

Answer: uharc-cmd-install.exe

13.10 What are the contents of these “malicious” files (coal, mold, and all the others)?

The easiest way is to Download the zip file from the github and open one file with notepad that is in this zip file

If you want to find the password the in the github open the commit

Answer: GRINCHMAS

13.11 What is the password to the original bag_of_toys.uha archive?

13.12 How many original files were present in Santa’s Bag of Toys?

Answer: 228

Task 14 – Day 9 – Networking – Where is all this data going

Read all that is in this task. Download the pcap file attached to this task. If you do not have Wireshark installed on your machine then you can download it here Download Wireshark

Open Wireshark
Go to file and open -> Select the PCAP file you just downloaded

Follow the task before you go into the questions

14.1 In the HTTP #1 – GET requests section, which directory is found on the web server?

Filter on HTTP then click on the first package. Make sure you open the Hypertext Transfer Protocol

Answer: Login

14.2 What is the username and password used in the login page in the HTTP #2 – POST section? 

Filter: http.request.method == POST
Click First package
Answer is under HTML Form URL encoded

Answer: McSkidy:Christmas2021!

14.3 What is the User-Agent’s name that has been sent in HTTP #2 – POST section?

Stay in the same package and look under Hypertext Transfer Protocol

Answer: User-Agent: TryHackMe-UserAgent-THM{d8ab1be969825f2c5c937aec23d55bc9}

14.4 n the DNS section, there is a TXT DNS query. What is the flag in the message of that DNS query?

Filter on dns
scroll down until you see a TXT query

14.5 In the FTP section, what is the FTP login password?

filer on FTP

14.6 In the FTP section, what is the FTP command used to upload the secret.txt  file?

filer on ftp-data

Answer: STOR

14.7 In the FTP section, what is the content of the secret.txt file?

Same package

Answer: 123^-^32

Task 15 – Day 10 – Offensive is the Best Defence

Start the machine attached to this task and open up a terminal

If you want all questions answered in one scan use nmap -T4 -A -p- MACHINEIP

15.5 Help McSkidy and run nmap -sT 10.10.72.99. How many ports are open between 1 and 100?

Answer: 2

15.6 What is the smallest port number that is open?

Answer: 22

15.7 Now run nmap -sS 10.10.72.99. Did you get the same results? (Y/N)

Answer: Y

15.8 If you want Nmap to detect the version info of the services installed, you can use nmap -sV 10.10.72.99. What is the version number of the web server?

Answer: Apache httpd 2.4.49

15.9 What is the CVE number of the vulnerability that was solved in version 2.4.51?

Answer: CVE-2021-42013

15.10 What is the port number that appeared in the results now?

use command nmap -T4 -A -p- MACHINEIP

Answer: 20212

15.11 What is the name of the program listening on the newly discovered port?

Answer: telnetd

Most Popular Post

Sign Up

Signup today for free and be the first to get notified on new updates.
* indicates required

Follow Me

Most Popular Post

Contact Us