The Return of the Yeti

I had the Advent of Cyber '23 on my calendar for Dec 1, and I wasn't sure what I was in for, this would be my first AOC, so, while I had some free time I logged the day before only to see there's another room released on my dashboard

ooh a Side Quest, I wonder if I can do something there while I wait for the main event

QR code social media, finding the room

So in the try hack me Advent of Cyber '23 Side Quest room it says the first of four challenges will be a hidden room that you can get access to via QR code parts hidden in there social pages between Tuesday, 28th November and Thursday, 30th November, hey! today is the 30th, so I can go looking for them ahead of time and be prepared.

so lets get looking

first I try there linked-in, scroll to find what was posted on the dates provided in the clue (between Tuesday, 28th November and Thursday, 30th November)

huh 🥚👀 lets see what that link gets us

ahh, so its a bisected qr-code, I thought it would be multiple QR codes with data in them that you had to read, but this is interesting because if theres only one QR code maybe I can use the parts of it to figure out the rest, but first I should find what else is available

well thay gave us a list, so lets follow it in order.

There discord is up next, im already there so lets see whats up

a text channel made just for this room, lets see, pinned mesages

ooh nice, now there's only one more part relaced, socal media on the list no 3

Instagram, oh well time to make a fake account so I can access the posts

![note] instagram is being horrid, and while writeing this I wasnt able to get a screenshot never the less:

ah ha here it is

hmm ok so I have most of the qrcode, but not that top left section,

lets see what each part dose and see if we can still get the data

repairing the qr code early

So, what is a qr code made of ?

a quick google brought me here: https://www.maketecheasier.com/how-qr-codes-work/

mmhm mhmm, lots of reading, probably important,

looks like im missing one of those positioning markers, the timeing data, format info, and "content" cool

what is that though?

ok so, im missing error correction information and maybe some data too, or atleast part of it will be missing

lest smooch what I have already together, and add in a marker and some timing pattens

k then, I cant decode that from my phone, there might be a tool to recover it maybe?

google led me to this site https://merri.cx/qrazybox/ a qr code Analysis and Recovery Toolkit, noice

what happens when I upload my art project to it?

detected nice, OOH tools, I like those

yes yes yes give me the data

wooo I did it yayyy

aww 302, redirect, shucks, wrong link. or at least its not entirely garbage, just something isnt right

Lets sanity check first, is the room even there?

dms :

later in the main chat

alright then, lets see whats wrong with my qrcode

lets look at that tool list and try something else, data sequence analysis, sounds good, I know some of the data is corrupt because it was split in 4 parts and I don't think an open bracket can be part of a URL

aah yeah, that message data is being read wrong because the missing data was just replaced with white or 0 values

well the edit tool lets us paint each bit as either black 1, white 0, or Gray ?

lets pain the missing bits and try to get the data again

yep missing data, lets see what we can use to help us, back in that tools section there was something called Reed-Soloman Decoder, used for "errors and erasures correction"

now that sounds like a wikipedia rabbithole waiting to happen so ima ignore that and just press buttons and see what happens :3

well thats good, theres some reed-soloman blocks detected, lets try it

HA, pure skill, biggest brain ez no luck needed

Into the room

and I'm the first person in the room 0w0

![note] hi I'm currently writing this post bursting though this room, and didn't actually take any screen shots, but here's a time line from the room showing the 4 people to get into the room before the final part of the QR code is released I got in at about 14:44 on the 30th, but I wasn't alone for long

I have to make use of this head start and get onto the tasks

OK SO DONT PANIC, YOU MIGHT BE ABLE TO FINISH THIS ROOM BEFORE ANYONE ELSE

what do we have (clue vision active)

and the questions

ooh a packet dump from a wifi connection, wireshark time :3

Wireshark

well thats question 1 done :3

"What's the password to access the WiFi network?"

well we have alot of data here, and first thing I always do in Wireshark is get a higher level view of what's going on with its statistics tools, first thing first, what kind of data do we have, lets look at the protocol hierarchy

ok lots of wifi stuff, lots of data, but most interestingly a little slither of 802.1x authentication stuff, lets filter for that useing the right click menus

ooh nice, 2 4-way-handshake authentications, and its wep/wp2 ?

4-way Handshake

google time and today we get : https://securitytutorials.co.uk/how-to-capture-crack-wpa-wpa2-wireless-passwords/

nice. so we can use aircrack-ng to crack this, if I save it as a pcap format, and this is a ctf so its probably in the rockyou.txt wordlist

aircrack-ng Downloads/van.pcap -w /usr/share/wordlists/rockyou.txt

heh nice, so lets put that into Wireshark to decrypt the traffic and go back to the protocol hierarchy to see what we have now

ok so some TCP data, alot is TLS encrypted, some is RDP, and some is just unencrypted data.

lets look at this another way, now we have decrypted the 802.1x data, we should see addresses, so lets go to another one of the fue tools in Wireshark I know, the Conversations view

ok 3 devices, 8.8.8.8 is just googles dns so we can ignore that, whats going on in TCP land? and lets sort by packets so we see whats most chatty

ok so; lots of small packet examples that only last a tiny amount of time, from the same device, across alot of ports, so thats a packet scanner

but the other two very chatty ports are 3389 and 4444 3389 is RDP so we were kind of expecting that, but whats 4444?

cant find anything on google, lets look at the traffic

oh hello is that the word power shell I see !

lets follow the TCP stream

oh someone has been very naughty this year

but thay did leave me a gift

RDP Certificate

looks to be the local Remote Desktop certificate in base64 so lets reverse that with a tool provided to us by GCHQ! everyone's favourite CyberChef!

and hey presto, we get a certificate! and its got a password... less nice,

I tried Christmas the wifi password, I tried BFC123, the password in the introtext, but no luck

its at this point dear reader, that I realise someone else has joined the room and has answered all the questions I have, spooked, I want to get that first place!

so I try cracking that certificate to try and read the RDP data and see what it could hold a bit of googling tells me that you can use john the ripper to crack a pkcs12

so off I go crackin again, this is just a ctf so it should be relatively easy, just throw rockyou.txt at it, right?

well after a long LONG time (1h)

GAAAH, I waited on all of rockyou and an hour of john brute-forceing just to get the word I already filled in for question 3

fine, we have the certificate, lets see what we get when we now decrypt the RDP traffic

RDP Clipbord

google powers fire up again i found this from unit42-palo altone tworks

so lets get the key, then add it into wireshark

great, more layers of readable data, so lets look at the updated protocol hierarchy to see what we can read

ooh clipbord plaintext :3 lets sort this by length to try and find big chunks of text

ooh

anks for looking into this 
Having Frost-eau in the case is for sure great!
ps I'll copy the weird file I found and send
 it to you through a more secure channel
 Regards
 Elf McSkidy

so something is getting sent and we can try to figure out whats happening though the clipbord text

ill go though all of the 53 packets and try and pull out all the text in timeline order

https://mail.google.com/mail/u/0/?tab=rm&ogbl#inbox

1337-0

hanks for looking into this 
Having Frost-eau in the case is for sure great!
ps I'll copy the weird file I found and send
 it to you through a more secure channel
 Regards
 Elf McSkidy

yetikey1.txt

dpxSet-Clipboard -value (Get-Content \Desktop\secret.txt.txt)

1-1f9548f
[REDACTED - you will have to do the room yourself to get this one]
154ef2834

well that looks like the rest of our questions anscered