> For the complete documentation index, see [llms.txt](https://thmflags.gitbook.io/thm-walkthroughs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://thmflags.gitbook.io/thm-walkthroughs/difficulty-easy/advent-of-cyber-4-2022.md).

# Advent of Cyber 4 (2022)

Get started with Cyber Security in 24 Days - learn the basics by doing a new, beginner-friendly security challenge every day leading up to Christmas.

| Room Attributes       | Value                                                                  |
| --------------------- | ---------------------------------------------------------------------- |
| Subscription Required | <mark style="color:green;background-color:green;">False</mark> \[Free] |
| Type                  | Walkthroughs                                                           |
| Difficulty            | <mark style="color:green;background-color:green;">Easy</mark>          |
| Tags                  | beginner, christmas, challenge, advent                                 |

## Task 6 \[Day 1] <mark style="color:blue;background-color:blue;">Frameworks</mark> Someone's coming to town!

<figure><img src="https://969802554-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuhNyf6qCYVqCOnFlkxNz%2Fuploads%2FaOqUD4VDjtFP527QMaxA%2Fimage.png?alt=media&amp;token=ac688d6f-2c0a-4f66-a6f8-de030b484df7" alt=""><figcaption></figcaption></figure>

Your task is to help the Elves solve a puzzle left for them to identify who is trying to stop Christmas. Click the View Site button at the top of the task to launch the static site in split view. You may have to open the static site on a new window and zoom in for a clearer view of the puzzle pieces.

<details>

<summary>Puzzle  Solutions</summary>

Puzzle 1/3

![](https://969802554-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuhNyf6qCYVqCOnFlkxNz%2Fuploads%2FdJUsjJySKbsmOaZ8nzDE%2Fimage.png?alt=media\&token=272cc68f-a2cd-4f09-b03e-db0add5e5605)

Puzzle 2/3

![](https://969802554-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuhNyf6qCYVqCOnFlkxNz%2Fuploads%2FOfop3PER7LuOf0d12Zvf%2Fimage.png?alt=media\&token=7e26512e-f795-4873-86f7-feac059a1d79)

Puzzle 3/3

![](https://969802554-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuhNyf6qCYVqCOnFlkxNz%2Fuploads%2FbdVvFZG9tdnkJryK51Dg%2Fimage.png?alt=media\&token=31615294-7b84-4b9c-b2b9-d1318720f94a)

</details>

Once you complete the puzzles you'll be presented with defaced site containing the flag and a calling card from the malicious actor:

![](https://969802554-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuhNyf6qCYVqCOnFlkxNz%2Fuploads%2FQEOvJV7BNuZTEfjvoXab%2Fimage.png?alt=media\&token=1f2156db-3acd-4675-8f5a-10b7a6375595)

### Who is the adversary that attacked Santa's network this year?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`The Bandit Yeti`

</details>

### What's the flag that they left behind?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`THM{IT'S A Y3T1 CHR1$TMA$}`

</details>

### Looking to learn more? Check out the rooms on [Unified Kill Chain](https://tryhackme.com/room/unifiedkillchain), [Cyber Kill Chain](https://tryhackme.com/room/cyberkillchainzmt), [MITRE](https://tryhackme.com/room/mitre), or the whole [Cyber Defence Frameworks](https://tryhackme.com/module/cyber-defence-frameworks) module!

{% hint style="success" %}
No answer needed
{% endhint %}

## Task 7 \[Day 2] <mark style="color:blue;background-color:blue;">Log Analysis</mark> Santa's Naughty & Nice Log!

<figure><img src="https://969802554-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuhNyf6qCYVqCOnFlkxNz%2Fuploads%2F3uzje65YTUEIwAwilSTa%2Fimage.png?alt=media&amp;token=6e764d81-1777-4ca7-8a3d-e671228fc4b4" alt=""><figcaption></figcaption></figure>

### Ensure you are connected to the deployable machine in this task.

{% hint style="success" %}
No answer needed
{% endhint %}

### Use the `ls` command to list the files present in the current directory. How many log files are present?

{% hint style="warning" %}
**HINT:** The directory needs to be `/home/elfmcblue`. You can use `cd` to change to this `cd /home/elfmcblue`
{% endhint %}

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`2`

</details>

### Elf McSkidy managed to capture the logs generated by the web server. What is the name of this log file?

{% hint style="warning" %}
**HINT:** You can use the `ls`command to list the files present in the directory.
{% endhint %}

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`webserver.log`

</details>

### Begin investigating the log file from question #3 to answer the following questions.

{% hint style="success" %}
No answer needed
{% endhint %}

### On what day was Santa's naughty and nice list stolen?

{% hint style="warning" %}
**HINT:** This answer is looking for a day in the week.
{% endhint %}

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`Friday`

</details>

### What is the IP address of the attacker?

{% hint style="warning" %}
**HINT:** The attacker only made one request to the web server.
{% endhint %}

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`10.10.249.191`

</details>

### What is the name of the important list that the attacker stole from Santa?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`santaslist.txt`

</details>

### Look through the log files for the flag. The format of the flag is: THM{}

{% hint style="warning" %}
**HINT:** Using grep recursively allows you to quickly look through a bunch of log files for a value.
{% endhint %}

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`THM{STOLENSANTASLIST}`

</details>

### Interested in log analysis? We recommend the [Windows Event Logs](https://tryhackme.com/room/windowseventlogs) room or the [Endpoint Security Monitoring Module](https://tryhackme.com/module/endpoint-security-monitoring).&#x20;

{% hint style="success" %}
No answer needed
{% endhint %}

## Task 8 \[Day 3] <mark style="color:red;background-color:red;">OSINT</mark> Nothing escapes detective McRed

<figure><img src="https://969802554-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuhNyf6qCYVqCOnFlkxNz%2Fuploads%2FsfQ14EBuQyiJTDhQiIrm%2Fimage.png?alt=media&amp;token=e69e72d5-2282-4e9b-8fac-5beec901d084" alt=""><figcaption></figcaption></figure>

### What is the name of the Registrar for the domain `santagift.shop`?

{% hint style="warning" %}
**HINT:** Check the who.is/whois website to find WHOIS information.
{% endhint %}

All the information you need can be found on <https://who.is/whois/santagift.shop>

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`NAMECHEAP INC`

</details>

### Find the website's source code (repository) on [github.com](https://github.com/) and open the file containing sensitive credentials. Can you find the flag?

{% hint style="warning" %}
**HINT:** Use the same search terms that Recon McRed used on github.com to find the leaked source code.
{% endhint %}

All the information you need can be found on <https://github.com/muhammadthm/SantaGiftShop>

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`{THM_OSINT_WORKS}`

</details>

### What is the name of the file containing passwords?

{% hint style="warning" %}
**HINT:** Check the file containing sensitive credentials.
{% endhint %}

[config.php](https://github.com/muhammadthm/SantaGiftShop/blob/main/config.php) contains several secrets in code that are publicly readable in source code:

<table data-view="cards"><thead><tr><th></th><th></th><th></th></tr></thead><tbody><tr><td></td><td></td><td><img src="https://969802554-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuhNyf6qCYVqCOnFlkxNz%2Fuploads%2F0qUz4PO8o3TVTHMHJda3%2Fimage.png?alt=media&amp;token=3c736975-f854-4004-8fd5-4bf0afb294d9" alt=""></td></tr><tr><td></td><td><img src="https://969802554-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuhNyf6qCYVqCOnFlkxNz%2Fuploads%2FbKanzpnrRfi7BjMcAycO%2Fimage.png?alt=media&amp;token=52778bda-9851-4009-ace6-8c77d0e0c4f1" alt="" data-size="original"></td><td></td></tr><tr><td><p></p><p><img src="https://969802554-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuhNyf6qCYVqCOnFlkxNz%2Fuploads%2FJ3Bye9GAfbOExn3pX4QJ%2Fimage.png?alt=media&amp;token=2e05f88f-8ae9-4ec8-aaec-a4f4c1c0d529" alt=""></p></td><td></td><td></td></tr></tbody></table>

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`config.php`

</details>

### What is the name of the QA server associated with the website?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`qa.santagift.shop`

</details>

### What is the DB\_PASSWORD that is being reused between the QA and PROD environments?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`S@nta2022`

</details>

### Check out this [room](https://tryhackme.com/room/googledorking) if you'd like to learn more about Google Dorking!&#x20;

{% hint style="success" %}
No answer needed
{% endhint %}

## Task 9 \[Day 4] <mark style="color:red;background-color:red;">Scanning</mark> Scanning through the snow

<figure><img src="https://969802554-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuhNyf6qCYVqCOnFlkxNz%2Fuploads%2FygNNwQPga8C5LebZu0bC%2Fimage.png?alt=media&amp;token=d54a912d-70e6-4ded-a2e9-c8f5b1f8d631" alt=""><figcaption></figcaption></figure>

### What is the name of the HTTP server running on the remote host?

{% hint style="warning" %}
**HINT:** Try nmap -sV MACHINE\_IP in the AttackBox.
{% endhint %}

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`Apache`

</details>

### What is the name of the service running on port 22 on the QA server?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`ssh`

</details>

### What flag can you find after successfully accessing the Samba service?

{% hint style="warning" %}
**HINT:** It is located in the admins folder.
{% endhint %}

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`{THM_SANTA_SMB_SERVER}`

</details>

### What is the password for the username santahr?

<details>

<summary>Reveal Flag <span data-gb-custom-inline data-tag="emoji" data-code="1f6a9">🚩</span></summary>

:triangular\_flag\_on\_post:`santa25`

</details>

### If you want to learn more scanning techniques, we have a module dedicated to [Nmap](https://tryhackme.com/module/nmap)!

{% hint style="success" %}
No answer needed
{% endhint %}

<br>