#huntressctf — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #huntressctf, aggregated by home.social.
-
This is a multipart challenge. All the flags can be found within the live Microsoft 365 instance that we’ll ssh into.
The clue is street address. I’m not too fluent in the capabilities of AADInternals, so the first thing I do is head over to the documentation.
If I do a search on ‘street’ I see that it’s part of an Output example for Get-AADintTenantDetails
Ok, let’s give that command a go.
And there’s the flag under the street value.
For the next one, It not so subtly says that Conditional Access Policies will be part of this, so again we reference the docs. Get-AADIntConditionalAccessPolicies seems like a good candidate.
Two for two.
Microsoft Teams will be our focus on the third one. There’s dozens of Teams commands available within AADInternals. If we focus on message, that will get us to Get-AADIntTeamsMessages.
Having the documentation for the syntax really helped on this one.
And for the last one, no there isn’t a Get-AADIntPresident command. That would be too easy. How about a command that will show us all the users?
Scrolling up through the output, we find that the President (PattiF), has a flag in the telephone number field.
4 out of 4.
Use the tag #HuntressCTF on BakerStreetForensics.com to see all related posts and solutions for the 2023 Huntress CTF.
https://bakerstreetforensics.com/2023/11/03/huntress-ctf-week-3-m-three-sixty-five/
-
Rock, Paper, Psychic
Do you want to play a game?
You can see the basic flow of the game above. You put in your choice, then after some calculation the game chooses, and what do you know – the game always makes the winning choice.
How about a nice game of Chess?
Having played the game a couple times to get familiar with the flow, I ran the program using x64dbg.
Hit F9 a few times until it the program gets to your input choice.
Once you’ve typed in your selection in the command window, back to x64dbg. From here we will step over (F8) the instructions 1 by one.
Continue to hit F8, observing as the rest of the game text appears.
Global Thermonuclear War
In x64dbg, we see that the program tests 2 values and then does a JNE (Jump if not Equal) command to another function 416C6A.
If we use the debugger and change this to JE (Jump if equal to):
Who you calling cheater?
Use the tag #HuntressCTF on BakerStreetForensics.com to see all related posts and solutions for the 2023 Huntress CTF.
https://bakerstreetforensics.com/2023/11/02/huntress-ctf-week-2-miscellaneous-rock-paper-psychic/