Welcome#
Introduction#
Hi there! Welcome to my 2019 SANS Holiday Hack Challenge write-up.
The menu at the top gets you to all the goodies. This page provides the answers to the main objectives, Elf University map, full narrative, and some thoughts on what might be coming next. Objectives and terminal hint write-ups can be found in their respective menu sections. Some odds and ends like interesting UI elements, user accounts, and a few notes about tokens are stored under Miscellaneous. If you prefer keyboard shortcuts you can use n and p to navigate or s to search the site.
Each objective and terminal hint also comes with its own video version of the write-up. If you're more of a visual learner and prefer watching just the videos then feel free to check out this playlist on YouTube to watch all 11 episodes in the correct order.
If you have any feedback or questions please feel free to reach out to me on Twitter.
Answers#
- Talk to Santa & Find the Turtle Doves:
Student Union fireplace - Unredact Threatening Document:
DEMAND - Evaluate Attack Outcome:
supatree - Determine Attacker Technique:
ntdsutil - Determine Compromised System:
192.168.134.130 - Splunk:
Kent you are so unfair. And we were going to make you the king of the Winter Carnival. - Get Access to the Steam Tunnels:
Krampus Hollyfeld - Bypassing the Frido Sleigh CAPTEHA:
8Ia8LiZEwvyZr2WO - Retrieve Scraps of Paper from Server:
Super Sled-o-matic - Recover Cleartext Document:
Machine Learning Sleigh Route Finder - Open the Sleigh Shop Door:
The Tooth Fairy - Filter Out Poisoned Data Sources:
0807198508261964
Note
Talk to Santa in the Quad and Find the Turtle Doves do not require any answers to be submitted as these objectives are mainly there to set the stage, point you in the right direction, and ensure you visit all areas of Elf University. The write-up for both these objectives has been consolidated under a single entry titled Talk to Santa & Find the Turtle Doves.
Elf University Map#
Narrative#
Arrive
Whose grounds these are, I think I know
His home is in the North Pole though
He will not mind me traipsing here
To watch his students learn and growMeet Santa
Some other folk might stop and sneer
"Two turtle doves, this man did rear?"
I'll find the birds, come push or shove
Objectives given: I'll soon clearDoves Found
Upon discov'ring each white dove,
The subject of much campus love,
I find the challenges are more
Than one can count on woolen glove.Strange Man
Who wandered thus through closet door?
Ho ho, what's this? What strange boudoir!
Things here cannot be what they seem
That portal's more than clothing store.Meet Krampus
Who enters contests by the ream
And lives in tunnels meant for steam?
This Krampus bloke seems rather strange
And yet I must now join his team...CAPTEHA
Despite this fellow's funk and mange
My fate, I think, he's bound to change.
What is this contest all about?
His victory I shall arrange!Decrypt Router HW Paper
To arms, my friends! Do scream and shout!
Some villain targets Santa's route!
What scum - what filth would seek to end
Kris Kringle's journey while he's out?TF Plot Reveal
Surprised, I am, but "shock" may tend
To overstate and condescend.
'Tis little more than plot reveal
That fairies often do extendProblem Solver
And yet, despite her jealous zeal,
My skills did win, my hacking heal!
No dental dealer can so keep
Our red-clad hero in ordeal!Cliff Hanger
This Christmas must now fall asleep,
But next year comes, and troubles creep.
And Jack Frost hasn't made a peep,
And Jack Frost hasn't made a peep...
KringleCon 3#
The final piece of the narrative, its CSS class, as well as the letter of wintry magic you find in the top left corner of the Elf University Bell Tower all hint at what might be in store for next year's KringleCon event. It appears that the Tooth Fairy wasn't working alone and all this time Jack Frost had apparently been helping her out!
