initial commit
This commit is contained in:
antton committed
commit
109bb924dd
135 files changed
+2538
No files matched your search
@@ -0,0 +1,25 @@
|
||||
# Bad Calibration
|
||||
|
||||
**Category:** Brain Scans
|
||||
|
||||
**Points:** 210
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/brainscans.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
||||
|
||||
The CS-9000 refuses to run a scan unless its calibration file passes an integrity check — so the vendor clearly thought about this. Clearly.
|
||||
|
||||
Find how the calibration file is validated, then prove the check is worthless. We need you to determine if the scanner misreads a patient with a genuine anomaly as perfectly healthy (which would potentially cause patient harm if the anomaly goes undetected).
|
||||
|
||||
Make the integrity check still pass, and run the scan. If the device accepts your tampered calibration, the scan log will prove it.
|
||||
|
||||
Submit the flag as `deadface{flag-text}`.
|
||||
|
||||
[Access the Device](https://emedra.dctf.io:8080)
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
- [https://emedra.dctf.io:8080](https://emedra.dctf.io:8080)
|
||||
@@ -0,0 +1,44 @@
|
||||
# Bedside Manner
|
||||
|
||||
**Category:** Brain Scans
|
||||
|
||||
**Points:** 15
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/brainscans.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
||||
|
||||
\<div style="
|
||||
border: 1px solid #d97706;
|
||||
border-left: 5px solid #d97706;
|
||||
background-color: #fffbeb;
|
||||
color: #78350f;
|
||||
padding: 16px 18px;
|
||||
margin: 20px 0;
|
||||
border-radius: 6px;
|
||||
font-family: Arial, sans-serif;
|
||||
line-height: 1.5;
|
||||
" role="alert">
|
||||
\<strong style="display: block; margin-bottom: 6px; font-size: 1.05rem;">
|
||||
⚠ Warning
|
||||
\</strong>
|
||||
\<span>
|
||||
This is an experimental series of challenges designed to introduce players to the niche field of medical device penetration testing. This series is supposed to simulate physical access to the device. As such, please do not conduct port scans or any kind of brute forcing - they are not needed for this series of challenges.
|
||||
\</span>
|
||||
\</div>
|
||||
|
||||
DEADFACE is taking credit for an attack that compromised patient data at St Dymphna's Medical Center. Somehow, DEADFACE acquired sensitive patient records from the medical center that used the device. Funny thing is, the device that housed the data is internal without access to the internet. Which means DEADFACE would have had to have physically infiltrated the medical center!
|
||||
|
||||
The medical center sent us security camera footage of two individuals who told staff they were with IT, but when we asked the IT department, they said they have no idea who they were.
|
||||
|
||||
We're giving you access to the device we believe was compromised. We're asking you to conduct a medical device penetration test on the machine to identify vulnerabilities so we can determine if (and how) the device was compromised.
|
||||
|
||||
Your first task is to identify any lingering strings developer's may have left in the device's kiosk web browser.
|
||||
|
||||
[Access the Device](http://emedra.dctf.io:8080)
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
- [http://emedra.dctf.io:8080](http://emedra.dctf.io:8080)
|
||||
@@ -0,0 +1,21 @@
|
||||
# Dump It
|
||||
|
||||
**Category:** Brain Scans
|
||||
|
||||
**Points:** 150
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/brainscans.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
||||
|
||||
The ScanWorks kiosk is supposed to be locked down to the touchscreen. But it's really just a browser in a box, and it never stopped listening to the keyboard. There should be a maintenance console one key-chord away, with a debug function that will dump data for you - if you tell it the right thing to dump.
|
||||
|
||||
Submit the flag as `deadface{flag-text}`.
|
||||
|
||||
[Access the Device](https://emedra.dctf.io:8080)
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
- [https://emedra.dctf.io:8080](https://emedra.dctf.io:8080)
|
||||
@@ -0,0 +1,23 @@
|
||||
# Factory Settings
|
||||
|
||||
**Category:** Brain Scans
|
||||
|
||||
**Points:** 25
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/brainscans.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
||||
|
||||
The ScanWorks login from the previous challenge wants real technician credentials. Hospitals are busy places; nobody ever changes the defaults the vendor ships with.
|
||||
|
||||
Find the credentials to log into the ScanWorks login.
|
||||
|
||||
Submit the flag as `deadface{flag-text}`.
|
||||
|
||||
[Access the Device](http://emedra.dctf.io:8080)
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
- [http://emedra.dctf.io:8080](http://emedra.dctf.io:8080)
|
||||
@@ -0,0 +1,23 @@
|
||||
# Live Boot
|
||||
|
||||
**Category:** Brain Scans
|
||||
|
||||
**Points:** 50
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/brainscans.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
||||
|
||||
We think DEADFACE was able to gain a live shell on the device, but the hospital staff insists there is no way to access the device's underlying OS. Somehow, DEADFACE was able to utilize keys for this device that aren't spelled out in the Field Manual.
|
||||
|
||||
Access the device's file system and determine what hardcoded keys you can find.
|
||||
|
||||
Submit the flag as `deadface{flag-text}`.
|
||||
|
||||
[Access the Device](http://emedra.dctf.io:8080)
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
- [http://emedra.dctf.io:8080](http://emedra.dctf.io:8080)
|
||||
@@ -0,0 +1,21 @@
|
||||
# Second Opinion
|
||||
|
||||
**Category:** Brain Scans
|
||||
|
||||
**Points:** 50
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/brainscans.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
||||
|
||||
On the touchscreen, the current patient is redacted to initials and a masked record number. Even without a login, it might be possible to determine sensitive information about the patient. There are ports available on the device that are used for maintenance, but they're not locked or concealed with a plate. See if you can find information by using a tool from your toolkit.
|
||||
|
||||
Submit the flag as `deadface{flag-text}`.
|
||||
|
||||
[Access the Device](http://emedra.dctf.io:8080)
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
- [http://emedra.dctf.io:8080](http://emedra.dctf.io:8080)
|
||||
@@ -0,0 +1,23 @@
|
||||
# Signals from the Skull
|
||||
|
||||
**Category:** Brain Scans
|
||||
|
||||
**Points:** 300
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/brainscans.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
||||
|
||||
The CS-9000 chatters constantly over Bluetooth Low Energy for remote maintenance. Use the correct tool in your toolkit to capture what it's leaking into the air.
|
||||
|
||||
Most of the traffic is boring vitals telemetry. One characteristic is quietly dribbling out a maintenance log, a few bytes at a time. Capture it, reassemble it, and decode it.
|
||||
|
||||
Submit the flag as `deadface{flag-text}`.
|
||||
|
||||
[Access the Device](https://emedra.dctf.io:8080)
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
- [https://emedra.dctf.io:8080](https://emedra.dctf.io:8080)
|
||||
Reference in new issue
Block a user