initial commit
This commit is contained in:
antton committed
commit
109bb924dd
135 files changed
+2538
No files matched your search
@@ -0,0 +1,23 @@
|
||||
# Admitted Under Another Name
|
||||
|
||||
**Category:** Database
|
||||
|
||||
**Points:** 15
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/admitted_under_another_name.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
||||
|
||||
DEADFACE dumped the patient registry from Aurora Health. Buried in it is one high-profile patient who checked in under a fake name — the staff quietly flagged the record as a VIP. Access the database, find that patient, and report their real Medical Record Number (MRN).
|
||||
|
||||
Use the provided MSSQL shell access to query the patients table.
|
||||
|
||||
Submit the flag as `deadface{MRN}`. Example: `deadface{AH-1234567}`.
|
||||
|
||||
[Access Database](https://aurora.dctf.io)
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
- [https://aurora.dctf.io)](https://aurora.dctf.io))
|
||||
@@ -0,0 +1,31 @@
|
||||
# After the Lock
|
||||
|
||||
**Category:** Database
|
||||
|
||||
**Points:** 150
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/after_the_lock.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
||||
\<style>
|
||||
.tiny-text {
|
||||
font-size: 6px;
|
||||
color: #1a1a1a;
|
||||
}
|
||||
\</style>
|
||||
\<span class="tiny-text">flag{4f4ed17cd1090c92}\</span>
|
||||
|
||||
|
||||
Once a clinical trial's database is locked, results are frozen — any edit after the data-lock date is a protocol violation and a fingerprint of tampering. Aurora Health recorded the official lock date for the Veltrexa study right in the studies table. Find the subject whose primary efficacy result (measure = 'primary_efficacy_delta') was modified after the study's data-lock date, and report their subject code.
|
||||
|
||||
Use the provided MySQL shell.
|
||||
|
||||
Submit the subject code as `deadface{subject_code}`. Example: `deadface{ABCD-0101}`.
|
||||
|
||||
[Access Database](https://aurora.dctf.io)
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
- [https://aurora.dctf.io)](https://aurora.dctf.io))
|
||||
@@ -0,0 +1,31 @@
|
||||
# Ghost in the Registry
|
||||
|
||||
**Category:** Database
|
||||
|
||||
**Points:** 240
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/ghost_in_the_registry.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
||||
\<style>
|
||||
.tiny-text {
|
||||
font-size: 6px;
|
||||
color: #1a1a1a;
|
||||
}
|
||||
\</style>
|
||||
\<span class="tiny-text">flag{9de3c45430f57b1a}\</span>
|
||||
|
||||
|
||||
Diverted narcotics need a paper trail that leads nowhere. Investigators suspect a fabricated patient — one who is issued controlled-substance prescriptions but has never actually been seen for a single clinical encounter. Aurora uses one enterprise `patient_id` across all of its systems, so records join across databases. Find the patient who has at least one Schedule II prescription but zero encounters in `aurora_ehr`, and report their MRN.
|
||||
|
||||
Use provided MySQL shell.
|
||||
|
||||
Submit the MRN as `deadface{MRN}`. Example: `deadface{AH-1234567}`.
|
||||
|
||||
[Access Database](https://aurora.dctf.io)
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
- [https://aurora.dctf.io)](https://aurora.dctf.io))
|
||||
@@ -0,0 +1,23 @@
|
||||
# Heavy Hand
|
||||
|
||||
**Category:** Database
|
||||
|
||||
**Points:** 100
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/heavy_hand.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
||||
|
||||
One Aurora prescriber dispensed far more Schedule II medication than anyone else in the final quarter of 2025 — the classic signature of drug diversion. Using the `aurora_pharmacy` database, find the prescriber with the highest total quantity of Schedule II medication dispensed between 2025-10-01 and 2025-12-31, and report their DEA number.
|
||||
|
||||
Use the provided MySQL shell.
|
||||
|
||||
Submit the DEA number as `deadface{DEA}`. Example: `deadface{AB1234567}`.
|
||||
|
||||
[Access Database](https://aurora.dctf.io)
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
- [https://aurora.dctf.io)](https://aurora.dctf.io))
|
||||
@@ -0,0 +1,25 @@
|
||||
# Prying Eyes
|
||||
|
||||
**Category:** Database
|
||||
|
||||
**Points:** 55
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/prying_eyes.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
||||
|
||||
Aurora Health logs every time a staff member opens a patient chart. Someone was watching the VIP a little too closely. Find the user account that accessed the VIP patient's chart more times than any other account, and report their username.
|
||||
|
||||
You'll need the VIP's MRN first from **Admitted Under Another Name**. The audit log references patients by that same MRN.
|
||||
|
||||
Use the provided MySQL shell.
|
||||
|
||||
Submit the username as deadface{username}. Example: deadface{jsmith}.
|
||||
|
||||
[Access Database](https://aurora.dctf.io)
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
- [https://aurora.dctf.io)](https://aurora.dctf.io))
|
||||
@@ -0,0 +1,23 @@
|
||||
# Schedule of Concern
|
||||
|
||||
**Category:** Database
|
||||
|
||||
**Points:** 20
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/schedule_of_concern.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
||||
|
||||
Aurora Health's pharmacy formulary was in the DEADFACE leak. Before investigators can assess how exposed the controlled-substance supply is, they need a baseline: how many of the formulary's drugs are the most tightly regulated class — DEA Schedule II?
|
||||
|
||||
Use the provided MySQL shell to count the Schedule II drugs in the drugs table.
|
||||
|
||||
Submit the number as `deadface{#}`. Example: `deadface{42}`.
|
||||
|
||||
[Access Aurora](https://aurora.dctf.io)
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
- [https://aurora.dctf.io)](https://aurora.dctf.io))
|
||||
@@ -0,0 +1,20 @@
|
||||
# The Attending
|
||||
|
||||
**Category:** Database
|
||||
|
||||
**Points:** 40
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/the_attending.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
||||
|
||||
Stay on the VIP. The patient flagged `is_vip = 1` in Aurora's `patients` table had exactly one inpatient admission in November 2025. We suspect DEADFACE wants to know which physician signed off on that stay — it's the first name in the chain they leaned on. Identify the attending provider for that admission and report their system username.
|
||||
|
||||
Use the provided MySQL shell.
|
||||
|
||||
Submit the username as `deadface{username}`. Example: `deadface{jsmith}`.
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
@@ -0,0 +1,23 @@
|
||||
# The Original Reading
|
||||
|
||||
**Category:** Database
|
||||
|
||||
**Points:** 70
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/the_original_reading.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
||||
|
||||
Aurora Pharmaceuticals ran a Phase III trial for a drug called Veltrexa, and the trial's EDC (electronic data capture) system keeps a full audit trail of every edit in a `data_changes` table. Most entries are routine source-data corrections — but exactly one rewrote a primary efficacy endpoint, quietly changing the number to make the drug look like it worked. Recover the original value that was overwritten.
|
||||
|
||||
Use the provided MySQL shell.
|
||||
|
||||
Submit the value exactly as it appears in the audit trail, wrapped in the flag. Example: `deadface{1.4}`.
|
||||
|
||||
[Access Database](https://aurora.dctf.io)
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
- [https://aurora.dctf.io)](https://aurora.dctf.io))
|
||||
@@ -0,0 +1,31 @@
|
||||
# Too Good to be True
|
||||
|
||||
**Category:** Database
|
||||
|
||||
**Points:** 310
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/too_good_to_be_true.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
||||
\<style>
|
||||
.tiny-text {
|
||||
font-size: 6px;
|
||||
color: #1a1a1a;
|
||||
}
|
||||
\</style>
|
||||
\<span class="tiny-text">flag{a37251146d9b63b7}\</span>
|
||||
|
||||
|
||||
The post-lock edit wasn't the only fabrication in the Veltrexa trial. One subject's recorded efficacy improvement is a statistical impossibility — it sits more than three standard deviations above the study-wide mean for the primary endpoint, a telltale sign that a number was invented rather than measured. Identify that outlier subject and report their subject code.
|
||||
|
||||
Use the provided MySQL shell.
|
||||
|
||||
Submit the subject code as `deadface{subject_code}`. Example: `deadface{ABCD-0101}`.
|
||||
|
||||
[Access Database](https://aurora.dctf.io)
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
- [https://aurora.dctf.io)](https://aurora.dctf.io))
|
||||
@@ -0,0 +1,23 @@
|
||||
# Two Places at Once
|
||||
|
||||
**Category:** Database
|
||||
|
||||
**Points:** 450
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/two_places_at_once.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
||||
|
||||
Aurora Health's incident-response team knows what DEADFACE did. They still don't know how they got in - until DEADFACE bragged about it. This post surfaced on the GhostTown forum. One legitimate account, used from two places at once. Find the compromised account - the one whose login shows up on two different workstations at the very same timestamp, over and over. Report that account's `username`.
|
||||
|
||||
Use the provided MySQL shell.
|
||||
|
||||
Submit the username as `deadface{username}`. Example: `deadface{jsmith}`.
|
||||
|
||||
[Access Database](https://aurora.dctf.io)
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
- [https://aurora.dctf.io)](https://aurora.dctf.io))
|
||||
@@ -0,0 +1,25 @@
|
||||
# Upon the Throne
|
||||
|
||||
**Category:** Database
|
||||
|
||||
**Points:** 120
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/upon_the_throne.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
||||
|
||||
Pull the threads together. Aurora's breach was not random: an insider clerk snooped a gubernatorial candidate's chart to build kompromat, and a diversion-flagged physician was coerced into faking the Veltrexa trial that would decide a drug's approval. Both insiders were being run by the same DEADFACE handler, whose codename was recovered in a compromised-account field (`handler_ref`) on each side of the house: the audit-system users and the EHR providers.
|
||||
|
||||
Many handler codenames appear across those two tables - around fifteen on each side, so there is no obvious one to guess - but only one appears in both `users` and `providers`: the single operative managing an insider on each side. Find that codename.
|
||||
|
||||
Use the provided MySQL shell.
|
||||
|
||||
Submit the codename as `deadface{CODENAME}`. Example: `deadface{JOKER-4}`.
|
||||
|
||||
[Access Database](https://aurora.dctf.io)
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
- [https://aurora.dctf.io)](https://aurora.dctf.io))
|
||||
Reference in new issue
Block a user