24 lines
1.2 KiB
Markdown
24 lines
1.2 KiB
Markdown
# Two Places at Once
|
|
|
|
**Category:** Database
|
|
|
|
**Points:** 450
|
|
|
|
## Description
|
|
|
|
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/two_places_at_once.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
|
\<sup>Created By: \<code>@syyntax\</code>\</sup>
|
|
|
|
Aurora Health's incident-response team knows what DEADFACE did. They still don't know how they got in - until DEADFACE bragged about it. This post surfaced on the GhostTown forum. One legitimate account, used from two places at once. Find the compromised account - the one whose login shows up on two different workstations at the very same timestamp, over and over. Report that account's `username`.
|
|
|
|
Use the provided MySQL shell.
|
|
|
|
Submit the username as `deadface{username}`. Example: `deadface{jsmith}`.
|
|
|
|
[Access Database](https://aurora.dctf.io)
|
|
|
|
## Services
|
|
|
|
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
|
- [https://aurora.dctf.io)](https://aurora.dctf.io))
|