26 lines
1.5 KiB
Markdown
26 lines
1.5 KiB
Markdown
# Who Goes There?
|
||
|
||
**Category:** De Monne Breach
|
||
|
||
**Points:** 25
|
||
|
||
## Description
|
||
|
||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
||
|
||
DEADFACE managed to slip a rogue Kali device onto De Monne Financial’s corporate network. Shortly afterward, someone used a legitimate employee account to access the company file share and steal sensitive documents.
|
||
|
||
One of those documents later surfaced in Ghost Town, confirming that the breach was more than just suspicious network activity.
|
||
|
||
ZeroTrace recovered a packet capture and a memory image from the affected environment. Your first task is to identify the De Monne Financial employee account that DEADFACE compromised.
|
||
|
||
What is the username of the compromised employee? Submit the flag as `deadface{username}`.
|
||
|
||
[Download memory.7z](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/for/dctf26-for/memory.7z)(~1.3GB zipped; 8.0GB unzipped)\<br>
|
||
\<sup>SHA256: `0eea0842a84240d0f2c9ce3564e250bd5367479b831f7be72247ae3dc43f8524`\</sup>
|
||
|
||
## Services
|
||
|
||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|