initial commit

database/upon-the-throne/README.md

@@ -0,0 +1,25 @@
+# Upon the Throne
+
+**Category:** Database
+
+**Points:** 120
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/upon_the_throne.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@syyntax\</code>\</sup>
+
+Pull the threads together. Aurora's breach was not random: an insider clerk snooped a gubernatorial candidate's chart to build kompromat, and a diversion-flagged physician was coerced into faking the Veltrexa trial that would decide a drug's approval. Both insiders were being run by the same DEADFACE handler, whose codename was recovered in a compromised-account field (`handler_ref`) on each side of the house: the audit-system users and the EHR providers.
+
+Many handler codenames appear across those two tables - around fifteen on each side, so there is no obvious one to guess - but only one appears in both `users` and `providers`: the single operative managing an insider on each side. Find that codename.
+
+Use the provided MySQL shell.
+
+Submit the codename as `deadface{CODENAME}`. Example: `deadface{JOKER-4}`.
+
+[Access Database](https://aurora.dctf.io)
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
+- [https://aurora.dctf.io)](https://aurora.dctf.io))