26 lines
1.5 KiB
Markdown
26 lines
1.5 KiB
Markdown
# Upon the Throne
|
|
|
|
**Category:** Database
|
|
|
|
**Points:** 120
|
|
|
|
## Description
|
|
|
|
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/upon_the_throne.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
|
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
|
|
|
Pull the threads together. Aurora's breach was not random: an insider clerk snooped a gubernatorial candidate's chart to build kompromat, and a diversion-flagged physician was coerced into faking the Veltrexa trial that would decide a drug's approval. Both insiders were being run by the same DEADFACE handler, whose codename was recovered in a compromised-account field (`handler_ref`) on each side of the house: the audit-system users and the EHR providers.
|
|
|
|
Many handler codenames appear across those two tables - around fifteen on each side, so there is no obvious one to guess - but only one appears in both `users` and `providers`: the single operative managing an insider on each side. Find that codename.
|
|
|
|
Use the provided MySQL shell.
|
|
|
|
Submit the codename as `deadface{CODENAME}`. Example: `deadface{JOKER-4}`.
|
|
|
|
[Access Database](https://aurora.dctf.io)
|
|
|
|
## Services
|
|
|
|
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
|
- [https://aurora.dctf.io)](https://aurora.dctf.io))
|