2023 SANS Holiday Hack Challenge: A Holiday Odyssey | Featuring 6: Geese A-Lei'ing!⚓︎
Hello and welcome to my 2023 SANS Holiday Hack Challenge write-up!
This year, Santa and his team relocated to Geese Islands, an island archipelago near the equator in the Pacific Ocean. They're utilizing a new Artificial Intelligence tool called ChatNPT to prepare for the annual gift-giving extravaganza, and the elves seek our assistance in ensuring the appropriate application of ChatNPT.
The challenges are distributed across six geese-themed islands, inspired by the Six Geese A Laying Bell from the 12 Days of Christmas series/song. These challenges cover a wide range of topics, including AI-assisted cybersecurity, AI voice synthesis, cloud security, web application security, threat hunting in Windows Cloud, identifying vulnerabilities in space mission software packages, lock picking, phishing analysis, and Cyber Defense Azure AD configurations.
Let's embark on our journey to Geese Islands!
Table of Contents⚓︎
Solutions for each of the 24 objectives can be found on their respective islands at the links below. Alternatively, you can use the navigation links at the bottom of each page to move to the previous or next objective.
- Welcome
- Christmas Island
- Island of Misfit Toys
- Pixel Island
- Steampunk Island
- Film Noir Island
- Space Island
- Conclusion
- Appx A - Easter Eggs
- Appx B - NPC
- Appx C - Fish
- Appx D - Sailing Races
Objectives⚓︎
Holiday Hack Orientation (Christmas Island)
Talk to Jingle Ringford on Christmas Island and get your bearings at Geese Islands
Snowball Fight (Christmas Island)
Visit Christmas Island and talk to Morcel Nougat about this great new game. Team up with another player and show Morcel how to win against Santa!
Visit Ginger Breddie in Santa's Shack on Christmas Island to help him with some basic Linux tasks. It's in the southwest corner of Frosty's Beach.
Reportinator (Christmas Island)
Noel Boetie used ChatNPT to write a pentest report. Go to Christmas Island and help him clean it up.
Help Sparkle Redberry with some Azure command line skills. Find the elf and the terminal on Christmas Island.
Luggage Lock (Island of Misfit Toys)
Help Garland Candlesticks on the Island of Misfit Toys get back into his luggage by finding the correct position for all four dials
Linux PrivEsc (Island of Misfit Toys)
Rosemold is in Ostrich Saloon on the Island of Misfit Toys. Give her a hand with escalation for a tip about hidden islands.
Faster Lock Combination (Steampunk Island)
Over on Steampunk Island, Bow Ninecandle is having trouble opening a padlock. Do some research and see if you can help open it!
Game Cartridges: Vol 1 (Island of Misfit Toys)
Find the first Gamegosling cartridge and beat the game
Game Cartridges: Vol 2 (Pixel Island)
Find the second Gamegosling cartridge and beat the game
Game Cartridges: Vol 3 (Steampunk Island)
Find the third Gamegosling cartridge and beat the game
Shifty McShuffles is hustling cards on Film Noir Island. Outwit that meddling elf and win!
KQL Kraken Hunt (Film Noir Island)
Use Azure Data Explorer to uncover misdeeds in Santa's IT enterprise. Go to Film Noir Island and talk to Tangle Coalbox for more information.
Phish Detection Agency (Film Noir Island)
Fitzy Shortstack on Film Noir Island needs help battling dastardly phishers. Help sort the good from the bad!
Hashcat (Island of Misfit Toys)
Eve Snowshoes is trying to recover a password. Head to the Island of Misfit Toys and take a crack at it!
Piney Sappington needs a lesson in JSON web tokens. Hack Elf Hunt and score 75 points.
Certificate SSHenanigans (Pixel Island)
Go to Pixel Island and review Alabaster Snowball's new SSH certificate configuration and Azure Function App. What type of cookie cache is Alabaster planning to implement?
The Captain's Comms (Steampunk Island)
Speak with Chimney Scissorsticks on Steampunk Island about the interesting things the captain is hearing on his new Software Defined Radio. You'll need to assume the GeeseIslandsSuperChiefCommunicationsOfficer role.
Active Directory (Steampunk Island)
Go to Steampunk Island and help Ribb Bonbowford audit the Azure AD environment. What's the name of the secret file in the inaccessible folder on the FileShare?
Space Island Door Access Speaker (Space Island)
There's a door that needs opening on Space Island! Talk to Jewel Loggins there for more information.
Gain access to Jack's camera. What's the third item on Jack's TODO list?
Missile Diversion (Space Island)
Thwart Jack's evil plan by re-aiming his missile at the Sun.
Catch twenty different species of fish that live around Geese Islands. When you're done, report your findings to Poinsettia McMittens on the Island of Misfit Toys.
Catch at least one of each species of fish that live around Geese islands. When you're done, report your findings to Poinsettia McMittens.