|
9. Would you be able to identify the exact name of the malware on the previous question?
(Level 3: Web Server)
|
#7,
6 years after release (2025-12-03 16:04:49)
|
425 |
|
8. This computer is a webserver (hence, a juicy target). The attackers have left an extra backdoor. Locate it.
(Level 3: Web Server)
|
#8,
6 years after release (2025-12-03 15:44:43)
|
400 |
|
7. How many times the attackers connected to ADMINPC1 computer?
(Level 3: Web Server)
|
#6,
6 years after release (2025-12-03 15:25:32)
|
400 |
|
6. How many times the attackers connected to this server?
(Level 3: Web Server)
|
#5,
6 years after release (2025-12-03 12:52:04)
|
375 |
|
4. The attackers have dropped an executable on a system folder. What's its name?
(Level 3: Web Server)
|
#7,
6 years after release (2025-12-03 12:19:26)
|
350 |
|
2.Which user first connected successfully to the server?
(Level 3: Web Server)
|
#7,
6 years after release (2025-12-03 11:57:24)
|
325 |
|
1. When was the server rebooted on 03/Nov/2019? Name the system start time.
(Level 3: Web Server)
|
#5,
6 years after release (2025-12-03 11:48:12)
|
325 |
|
10. Which IP has connected to this computer using RDP?
(Level 2: Admin PC)
|
#8,
6 years after release (2025-12-03 11:26:42)
|
300 |
|
9. How many computers has accessed salvador.bendito through RDP?
(Level 2: Admin PC)
|
#6,
6 years after release (2025-12-03 11:17:29)
|
300 |
|
8. There has been a recon action on this computer. When did this recon started?
(Level 2: Admin PC)
|
#8,
6 years after release (2025-12-03 11:10:00)
|
275 |
|
7. Could you find the name of a program that can help exonerate Salvador?
(Level 2: Admin PC)
|
#9,
6 years after release (2025-12-03 10:32:52)
|
275 |
|
6. When was the service used by the exfiltration software installed?
(Level 2: Admin PC)
|
#9,
6 years after release (2025-12-03 10:04:56)
|
250 |
|
5.When was the last file successfully exfiltrated?
(Level 2: Admin PC)
|
#7,
6 years after release (2025-12-03 09:55:32)
|
250 |
|
4. To which remote computer was the data exfiltrated to?
(Level 2: Admin PC)
|
#7,
6 years after release (2025-12-03 09:39:50)
|
225 |
|
3. Which program has transmitted most data on 05/Nov/2019 ?
(Level 2: Admin PC)
|
#8,
6 years after release (2025-12-02 17:37:54)
|
225 |
|
2.Which song is going to be used for the EHP project?
(Level 2: Admin PC)
|
#8,
6 years after release (2025-12-02 17:27:14)
|
200 |
|
1.Where in the system is hidden the folder "Secreto" (Secret)
(Level 2: Admin PC)
|
#9,
6 years after release (2025-12-02 17:12:38)
|
200 |
|
11.Which executable do you think was used to exfiltrate data
(Level 1: File Server)
|
#8,
6 years after release (2025-12-02 16:11:53)
|
175 |
|
10. Which registry key is the responsible for the non-matching timestamps in the previous challenge?
(Level 1: File Server)
|
#10,
6 years after release (2025-12-02 15:49:29)
|
150 |
|
9. According to MFT, which time was last accessed the file README.txt.txt? And what time was REALLY opened this file with notepad.exe
(Level 1: File Server)
|
#11,
6 years after release (2025-12-02 15:34:51)
|
150 |
|
8. Which user tried to mount \\*\C$
(Level 1: File Server)
|
#15,
6 years after release (2025-12-02 14:59:12)
|
125 |
|
7. Which user was online when the file lista_candidatos.xlsx was modified the last time?
(Level 1: File Server)
|
#11,
6 years after release (2025-12-02 13:13:50)
|
125 |
|
6. Which users have connected (using any kind of protocol) to the system in last month?
(Level 1: File Server)
|
#13,
6 years after release (2025-12-02 13:05:37)
|
100 |
|
5.How many accounts have successfully logged in on the last month?
(Level 1: File Server)
|
#11,
6 years after release (2025-12-02 13:04:07)
|
100 |
|
4.EHP Project has a candidate list (the shortlist that was leaked). When was this list last accessed?
(Level 1: File Server)
|
#15,
6 years after release (2025-12-02 12:46:20)
|
75 |
|
3.The EHP database is encrypted using PGP. What's the database name?
(Level 1: File Server)
|
#20,
6 years after release (2025-12-02 12:40:28)
|
75 |
|
2.How many subfolders are in this shared folder
(Level 1: File Server)
|
#19,
6 years after release (2025-12-02 12:37:14)
|
50 |
|
1.CHITONSRV has a shared folder. What's its name?
(Level 1: File Server)
|
#25,
6 years after release (2025-12-02 12:36:29)
|
50 |
