Mein Weg zur IT Sicherheit
https://tryhackme.com/room/adventofcyber4
Task 20 [Day 15] Secure Coding Santa is looking for a Sidekick
Frage 1:
What is the name given to file uploads that allow threat actors to upload any files that they want?
Antwort 1:
unrestricted
Frage 2:
What is the title of the web application developed by Santa’s freelancer?
Antwort 2:
SantaSideKick2
https://tryhackme.com/room/adventofcyber4
Task 18 [Day 13] Packet Analysis Simply having a wonderful pcap time
Frage 1:
View the „Protocol Hierarchy“ menu.
What is the „Percent Packets“ value of the „Hypertext Transfer Protocol“?
Wir öffnen die bereitgestellte Datei und Navigieren zu Statistics -> Protocol Hierarchy.
Antwort 1:
0.3
https://tryhackme.com/room/adventofcyber4
Task 15 [Day 10] Hack a game You’re a mean one, Mr. Yeti
Frage 1:
What is the Guard’s flag?
Wir folgen der Anleitung im Task und nachdem sich die Tür geöffnet hat sprechen wir mit der Wache.
Antwort 1:
THM{5_star_Fl4gzzz}
https://tryhackme.com/room/adventofcyber4
Task 14 [Day 9] Pivoting Dock the halls
Frage 1:
Deploy the attached VM, and wait a few minutes. What ports are open?
Hier hilft uns ein nmap Scan:
└─$ nmap 10.10.109.8
Starting Nmap 7.93 ( https://nmap.org ) at 2022-12-14 18:47 CET
Nmap scan report for 10.10.109.8
Host is up (0.047s latency).
Not shown: 999 closed tcp ports (conn-refused)
PORT STATE SERVICE
80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 0.83 secondsAntwort 1:
80
Frage 2:
What framework is the web application developed with?
Port 80 ist offen, dieser zeigt eine http Seite an. Wir öffnen die SEite in unserem Browser (http://MACHINE_IP:80).
Hier sehen wir, dass Laravel benutzt wird.
Antwort 2:
Laravel
https://tryhackme.com/room/adventofcyber4
Task 12 [Day 7] CyberChef Maldocs roasting on an open fire
Frage 1:
What is the version of CyberChef found in the attached VM?
Die Version steht in der Adresszeile des Browsers.
Antwort 1:
9.49.0
https://tryhackme.com/room/adventofcyber4
Task 11 [Day 6] Email Analysis It’s beginning to look a lot like phishing
Frage 1:
What is the email address of the sender?
Wir machen einen Rechtsklick auf den Desktop und wählen „Open Terminal“, dann geben wir unseren Befehl ein:
ubuntu@ip-10-10-136-88:~/Desktop$ emlAnalyzer -i Urgent:.eml --header --html -u --text --extract-all
==============
|| Header ||
==============
X-Pm-Content-Encryption.....end-to-end
X-Pm-Origin.................internal
Subject.....................Urgent: Blue section is down. Switch to the load share plan!
From........................Chief Elf <chief.elf@santaclaus.thm>
Date........................Tue, 6 Dec 2022 00:00:01 +0000
Mime-Version................1.0
Content-Type................multipart/mixed;boundary=---------------------03edd9c682a0c8f60d54b9e4bb86659f
To..........................elves.all@santaclaus.thm <elves.all@santaclaus.thm>
X-Attached..................Division_of_labour-Load_share_plan.doc
Message-Id..................<QW9DMjAyMl9FbWFpbF9BbmFseXNpcw==>
X-Pm-Spamscore..............3
Received....................from mail.santaclaus.thm by mail.santaclaus.thm; Tue, 6 Dec 2022 00:00:01 +0000
X-Original-To...............elves.all@santaclaus.thm
Return-Path.................<murphy.evident@bandityeti.thm>
Delivered-To................elves.all@santaclaus.thm
=========================
|| URLs in HTML part ||
=========================
[+] No URLs found in the html
=================
|| Plaintext ||
=================
[+] Email contains no plaintext
============
|| HTML ||
============
<span>Dear Elves,</span><div><br></div><div><span>Due to technical problems in the blue section of our toy factory, we are having difficulties preparing some toys. </span></div><div><br></div><div><span>There
are a few days left to Christmas, so we need to use time efficiently to
prepare every wishlist we receive. Due to that, the blue section's
workload is shared with the rest to avoid any toy production delay.</span></div><div><br></div><div><span>The detailed division of labour is included in the attached document.</span></div><div><br></div><div><span>Good luck to you all.</span></div><div><br></div><div><b><span>Chief Elf</span></b></div><div><br></div>
=============================
|| Attachment Extracting ||
=============================
[+] Attachment [1] "Division_of_labour-Load_share_plan.doc" extracted to eml_attachments/Division_of_labour-Load_share_plan.doc
Antwort 1:
chief.elf@santaclaus.thm
https://tryhackme.com/room/adventofcyber4
Task 1-5
Diese Tasks enthalten keine Fragen.
Task 6 [Day 1] Frameworks Someone’s coming to town!
Frage 1:
Who is the adversary that attacked Santa’s network this year?
Wir klicken auf „View Site“ und bekommen ein paar Rätsel und Puzzel vorgesetzt. Diese müssen wir lösen und erhalten unsere Antwort:
Antwort 1:
The Bandit Yeti!
https://tryhackme.com/room/skynet
Task 1 Deploy and compromise the vulnerable machine!
Frage 1:
What is Miles password for his emails?
Wir starten mit einem einfachen nmap Scan:
└─$ nmap 10.10.68.67
Starting Nmap 7.93 ( https://nmap.org ) at 2022-11-17 17:59 CET
Nmap scan report for 10.10.68.67
Host is up (0.068s latency).
Not shown: 994 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
110/tcp open pop3
139/tcp open netbios-ssn
143/tcp open imap
445/tcp open microsoft-ds
Nmap done: 1 IP address (1 host up) scanned in 2.92 secondsWer hätte es gedacht, ein Emailservice ist vorhanden! Weiter geht es mit der Enumeration und SMBMap:
└─$ smbmap -H 10.10.68.67
[+] Guest session IP: 10.10.68.67:445 Name: 10.10.68.67
Disk Permissions Comment
---- ----------- -------
print$ NO ACCESS Printer Drivers
anonymous READ ONLY Skynet Anonymous Share
milesdyson NO ACCESS Miles Dyson Personal Share
IPC$ NO ACCESS IPC Service (skynet server (Samba, Ubuntu))https://tryhackme.com/room/gamezone
Task 1 Deploy the vulnerable machine
Frage 1:
What is the name of the large cartoon avatar holding a sniper on the forum?
Der Protagonist aus der Spiele-Serie Hitman!
Antwort 1:
Agent 47
Task 2 Obtain access via SQLi
Frage 1:
When you’ve logged in, what page do you get redirected to?
Wir öffnen die IP der Machine in unserem Browser und geben ‚ or 1=1 — – in das „Log in“ Feld ein und klicken auf „Enter“:
https://tryhackme.com/room/alfred
Task 1 Initial Access
Frage 1:
How many ports are open? (TCP only)
Erster Schritt: nmap:
└─$ nmap 10.10.37.194
Starting Nmap 7.93 ( https://nmap.org ) at 2022-11-06 14:42 CET
Nmap scan report for 10.10.37.194
Host is up (0.048s latency).
Not shown: 997 filtered tcp ports (no-response)
PORT STATE SERVICE
80/tcp open http
3389/tcp open ms-wbt-server
8080/tcp open http-proxy
Nmap done: 1 IP address (1 host up) scanned in 4.85 secondsAntwort 1:
3
© 2025 René und IT-Sec
Theme von Anders Norén — Hoch ↑