https://www.andrew.cmu.edu/user/msadeghi/tags/walkthrough/Recent content in Walkthrough on Matin SadeghianHugoen-usWed, 31 Jan 2024 00:00:00 +0000https://www.andrew.cmu.edu/user/msadeghi/posts/baldis-basics-answer-key/Wed, 31 Jan 2024 00:00:00 +0000https://www.andrew.cmu.edu/user/msadeghi/posts/baldis-basics-answer-key/<h2 id="forensics">Forensics</h2> <h3 id="forensics-1">Forensics 1</h3> <p>For forensics 1, you had to decrypt the packets in the given pcap file using the ssl keys on the desktop. Through that, you would notice a <code>mdns poisoning</code> (2nd answer) attack that began with the url <code>http://youtube/</code> (1st answer). Searching through the packets for YouTube video links, you would come across <code>https://www.youtube.com/watch?v=IFERaX0EwDU</code> and <code>https://www.youtube.com/watch?v=f6hmHgenVQg</code> (3rd answer).</p> <h3 id="forensics-2">Forensics 2</h3> <p>Searching the system for common auto-run areas, you would find a visual basic script at <code>C:\Windows\SYSVOL\domain\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Scripts\Startup\startup.vbs</code> (1st answer), which added the <code>Administrator</code> user with the password <code>Sup3rS3cu4eP@ssw0rd!</code> (2nd answer).</p>https://www.andrew.cmu.edu/user/msadeghi/posts/my-little-pony-walkthrough/Wed, 15 Nov 2023 00:00:00 +0000https://www.andrew.cmu.edu/user/msadeghi/posts/my-little-pony-walkthrough/<h2 id="forensics">Forensics</h2> <h3 id="forensics-1">Forensics 1</h3> <p>Question:</p> <p>They are at it again. The users keep on sending each other these stupid secret notes. This goes against our policies so please figure out what their secret notes say and report them here.</p> <p>For this report please figure out the full plain-text and key used in the “xor” file. We also know that part of the plaintext is &ldquo;For honesty no pony can deny&rdquo;.</p> <p>EXAMPLE KEY: Il0v3P0n1es</p>