initial commit

2026-10-19 14:59:45 +02:00
commit 109bb924dd
@@ -0,0 +1,20 @@
+# Borrowed Script
+
+**Category:** De Monne Breach
+
+**Points:** 100
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@syyntax\</code>\</sup>
+
+The workstation obtained `telemetry.ps1` from another machine before scheduling it. What internal IPv4 address supplied the script? Submit the source username and the IP address.
+
+Submit the flag as `deadface{username@IP}`.
+
+Use the memory dump evidence from **Who Goes There?**
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
+# Cache Money
+
+**Category:** De Monne Breach
+
+**Points:** 150
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@syyntax\</code>\</sup>
+
+We know a suspicious task launches a PowerShell script from an unusual directory. What is the script's full Windows path?
+
+Submit the flag as `deadface{absolute\file\path}`.
+
+Use the memory dump evidence from **Who Goes There?**
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
+# Challenge Accepted
+
+**Category:** De Monne Breach
+
+**Points:** 100
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@syyntax\</code>\</sup>
+
+Find Nathan's first SMB NTLMv2 authentication after the poisoned name response. What is its 16-byte `NTProofStr`?
+
+Submit the flag as `deadface{16-byte string}`.
+
+Use the PCAP from \**Uninvited Guest*.
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
+# Crown Jewels
+
+**Category:** De Monne Breach
+
+**Points:** 75
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@syyntax\</code>\</sup>
+
+The attacker copied several documents from the executive share. What was the first PDF read from that share? Submit its full filename, including the extension.
+
+Submit the flag as `deadface{file.txt}`.
+
+Use the PCAP from \**Uninvited Guest*.
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
+# False Telemetry
+
+**Category:** De Monne Breach
+
+**Points:** 250
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@syyntax\</code>\</sup>
+
+`WindowsTelemetryCheck` runs a PowerShell script that repeatedly tests a connection. Identify the destination IPv4 address, TCP port, and delay between attempts.
+
+Submit the flag as `deadface{IP_PORT_SECONDS}`.
+
+Use the memory dump evidence from **Who Goes There?**
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
+# Hidden in Plain Task
+
+**Category:** De Monne Breach
+
+**Points:** 75
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@syyntax\</code>\</sup>
+
+An attacker registered a task to keep activity going after leaving the workstation. What is the task's exact name? Submit the name as it appears in memory.
+
+Submit the flag as `deadface{TaskName}`.
+
+Use the memory dump evidence from **Who Goes There?**
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
+# Name to a Face
+
+**Category:** De Monne Breach
+
+**Points:** 10
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@syyntax\</code>\</sup>
+
+A poisoned name answer prompted an SMB authentication attempt. Which username did the workstation send?
+
+Submit the flag as `deadface{username}`.
+
+Use the PCAP from \**Uninvited Guest*.
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
+# Public Offering
+
+**Category:** De Monne Breach
+
+**Points:** 75
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@syyntax\</code>\</sup>
+
+Kali sent a ZIP archive outside the corporate network. What public IPv4 address and TCP destination port received the archive?
+
+Submit the flag as `deadface{IP_PORT}`.
+
+Use the PCAP from \**Uninvited Guest*.
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
+# The Typo That Bit
+
+**Category:** De Monne Breach
+
+**Points:** 75
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@syyntax\</code>\</sup>
+
+Nathan's workstation tried to reach an executive share through a misspelled server name. Identify one mistyped server hostname visible in memory. Submit the hostname, without slashes or the share name.
+
+Submit the flag as `deadface{share-name}`.
+
+Use the memory dump evidence from **Who Goes There?**
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
+# The Workstation in the Middle
+
+**Category:** De Monne Breach
+
+**Points:** 40
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@syyntax\</code>\</sup>
+
+The compromised De Monne employee was working at a Windows device. What is that device's hostname? Preserve the capitalization shown in memory.
+
+Submit the flag as `deadface{COMPUTER-NAME}`.
+
+Use the memory dump evidence from **Who Goes There?**
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,21 @@
+# Uninvited Guest
+
+**Category:** De Monne Breach
+
+**Points:** 25
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@syyntax\</code>\</sup>
+
+Nathan's workstation asked the local network to resolve a file-server name. Which corporate IPv4 address supplied the suspicious answer?
+
+Submit the flag as `deadface{IP}`.
+
+[Download PCAP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/for/dctf26-for/demonne.pcap)(7.5MB)\<br>
+\<sup>SHA256: `a717623237abefb2fc061d6df8f6e9d1391f066f5ac448042b5eb72d41a8ddb3`\</sup>
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,25 @@
+# Who Goes There?
+
+**Category:** De Monne Breach
+
+**Points:** 25
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@syyntax\</code>\</sup>
+
+DEADFACE managed to slip a rogue Kali device onto De Monne Financial’s corporate network. Shortly afterward, someone used a legitimate employee account to access the company file share and steal sensitive documents.
+
+One of those documents later surfaced in Ghost Town, confirming that the breach was more than just suspicious network activity.
+
+ZeroTrace recovered a packet capture and a memory image from the affected environment. Your first task is to identify the De Monne Financial employee account that DEADFACE compromised.
+
+What is the username of the compromised employee? Submit the flag as `deadface{username}`.
+
+[Download memory.7z](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/for/dctf26-for/memory.7z)(~1.3GB zipped; 8.0GB unzipped)\<br>
+\<sup>SHA256: `0eea0842a84240d0f2c9ce3564e250bd5367479b831f7be72247ae3dc43f8524`\</sup>
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)