joergschwarzwaelder/hhc2022

Submission for HHC2022

SANS Holiday Hack Challenge 2022

Write-up submitted by Joerg Schwarzwaelder

In-game character: joergen

WalletAddress: 0xe5d7FcfF7ab197Dd9359ED3De8b2C7Fa42200b7B

Disclaimer: All information and code in this repository is provided as-is, probably not without errors and not ready for production use.

KringleCon V: Golden Rings

Background information:

Online Game

Map of the Game

Location of the NPC Characters

KTM Locations

Main Objectives

• Objective 1: KringleCon Orientation

Recover the Tolkien Ring

• Objective 2: Wireshark Practice
• Objective 3: Windows Event Logs
• Objective 4: Suricata Regatta

Recover the Elfen Ring

• Objective 5: Clone with a Difference
• Objective 6: Prison Escape
• Objective 7: Jolly CI/CD

Recover the Web Ring

Boria PCAP Mining

• Objective 8.1: Naughty IP
• Objective 8.2: Credential Mining
• Objective 8.3: 404 FTW
• Objective 8.4: IMDS, XXE, and Other Abbreviations
• Objective 9: Open Boria Mine Door
• Objective 10: Glamtariel's Fountain

Recover the Cloud Ring

• Objective 11: AWS CLI Intro
• Objective 12: Trufflehog Search
• Objective 13: Exploitation via AWS CLI

Recover the Burning Ring of Fire

• Objective 14: Buy a Hat
• Objective 15: Blockchain Divination
• Objective 16: Exploit a Smart Contract

Holiday Eggs

Some Holiday Eggs were discovered.

Additional

Marie helped to develop a frontend for Santa's Data Lake. Using that a detailed analysis of player's progress and HHC2022's success is possible. Santa is able to see for each individual wallet, which Rings were secured and how many KringleCoins it holds.