mirror of
https://github.com/cliffe/BreakEscape.git
synced 2026-02-21 11:18:08 +00:00
Add Mission 3 Stage 7 Ink Scripts (Part 2)
- Add m03_terminal_dropsite.ink (VM flag submission) - 4 VM challenge flag submissions (scan, ftp, http, distcc) - Progressive intelligence unlocking - M2 hospital attack evidence reveal - Triggers m2_revelation_call event after distcc flag - Smoking gun evidence: $12,500 ProFTPD exploit → St. Catherine's - Add m03_terminal_cyberchef.ink (Encoding/decoding workstation) - Whiteboard ROT13 decoding (Architect reference, Phase 1/2) - Client roster Hex decoding (ENTROPY cell list, Q3 revenue) - USB drive double-encoding (Base64 + ROT13) - Architect's Directive full decode (Phase 2 attack plans) - 50K+ patients, 1.2M customers impact projections - Multi-layer decoding tutorial/reference guide Total Part 2: ~880 lines Combined total: ~1,740 lines (4 scripts complete) Remaining: 5 scripts (Agent 0x99, Guard, Receptionist, James, Debrief)
This commit is contained in:
Z. Cliffe Schreuders
@@ -0,0 +1,509 @@
|
||||
// ===========================================
|
||||
// Mission 3: Ghost in the Machine
|
||||
// TERMINAL: CyberChef Workstation
|
||||
// Location: Server Room
|
||||
// ===========================================
|
||||
|
||||
// Tracking decoding tasks
|
||||
VAR whiteboard_decoded = false
|
||||
VAR client_roster_decoded = false
|
||||
VAR usb_drive_decoded_layer1 = false
|
||||
VAR usb_drive_decoded_layer2 = false
|
||||
VAR first_time_tutorial = true
|
||||
|
||||
// External variables
|
||||
EXTERNAL player_name
|
||||
|
||||
// ===========================================
|
||||
// MAIN TERMINAL INTERFACE
|
||||
// ===========================================
|
||||
|
||||
=== start ===
|
||||
#speaker:computer
|
||||
|
||||
╔═══════════════════════════════════════════╗
|
||||
║ CYBERCHEF DECODING WORKSTATION ║
|
||||
║ Encoding/Decoding Analysis Tools ║
|
||||
╚═══════════════════════════════════════════╝
|
||||
|
||||
{first_time_tutorial:
|
||||
[This workstation provides real-time encoding/decoding]
|
||||
[Use CyberChef operations to decode evidence]
|
||||
|
||||
Available operations:
|
||||
- From Base64
|
||||
- ROT13
|
||||
- From Hex
|
||||
- Multi-layer decoding (sequential operations)
|
||||
|
||||
~ first_time_tutorial = false
|
||||
}
|
||||
|
||||
Select evidence to decode:
|
||||
|
||||
-> hub
|
||||
|
||||
// ===========================================
|
||||
// DECODING HUB
|
||||
// ===========================================
|
||||
|
||||
=== hub ===
|
||||
|
||||
+ {not whiteboard_decoded} [Decode server room whiteboard message]
|
||||
-> decode_whiteboard
|
||||
|
||||
+ {not client_roster_decoded} [Decode client roster file (from Victoria's computer)]
|
||||
-> decode_client_roster
|
||||
|
||||
+ {not usb_drive_decoded_layer2} [Decode USB drive message (double-encoded)]
|
||||
-> decode_usb_drive
|
||||
|
||||
+ [View decoding reference guide]
|
||||
-> reference_guide
|
||||
|
||||
+ [Exit workstation]
|
||||
#exit_conversation
|
||||
-> DONE
|
||||
|
||||
// ===========================================
|
||||
// WHITEBOARD MESSAGE (ROT13)
|
||||
// ===========================================
|
||||
|
||||
=== decode_whiteboard ===
|
||||
#speaker:computer
|
||||
|
||||
EVIDENCE: Server room whiteboard message
|
||||
|
||||
INPUT (Raw):
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
ZRRG JVGU GUR NEPUVGRPG'F CERSBEERQ PYVRAGF
|
||||
|
||||
CEBWRPG CUNFR 1: URNYGUNERENCCYVPNGVBAF
|
||||
CEBWRPG CUNFR 2: RARETL TEVQ VPF
|
||||
|
||||
PBAGNPG: PVCURE SBE CEPRFG NCCEBI NY
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
|
||||
ENCODING DETECTED: Character substitution pattern
|
||||
RECOMMENDATION: Apply ROT13 operation
|
||||
|
||||
+ [Apply ROT13 decoding]
|
||||
-> whiteboard_rot13_result
|
||||
|
||||
+ [Try different decoding method]
|
||||
-> whiteboard_wrong_method
|
||||
|
||||
=== whiteboard_rot13_result ===
|
||||
#speaker:computer
|
||||
|
||||
Applying "ROT13" operation...
|
||||
|
||||
OUTPUT (Decoded):
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
MEET WITH THE ARCHITECT'S PREFERRED CLIENTS
|
||||
|
||||
PROJECT PHASE 1: HEALTHCARE APPLICATIONS
|
||||
PROJECT PHASE 2: ENERGY GRID ICS
|
||||
|
||||
CONTACT: CIPHER FOR PRIEST APPROVAL
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
|
||||
ANALYSIS:
|
||||
- "The Architect" - ENTROPY leadership reference
|
||||
- Phase 1: Healthcare applications (aligns with M2 attack)
|
||||
- Phase 2: Energy grid ICS (future attack vector)
|
||||
- "Cipher" = Victoria Sterling's ENTROPY codename
|
||||
- "Priest approval" - pricing authorization process?
|
||||
|
||||
CRITICAL INTELLIGENCE:
|
||||
Confirms multi-phase attack campaign coordinated by
|
||||
"The Architect" with Victoria Sterling as operational lead.
|
||||
|
||||
Evidence logged. Objective updated.
|
||||
|
||||
~ whiteboard_decoded = true
|
||||
|
||||
#complete_task:decode_whiteboard
|
||||
|
||||
+ [Save evidence and return]
|
||||
Evidence saved to SAFETYNET database.
|
||||
-> hub
|
||||
|
||||
=== whiteboard_wrong_method ===
|
||||
#speaker:computer
|
||||
|
||||
Applying alternative decoding...
|
||||
|
||||
ERROR: Output is garbled nonsense.
|
||||
|
||||
TIP: This appears to be a simple character substitution.
|
||||
Try ROT13 - a common cipher that shifts letters 13 positions.
|
||||
|
||||
+ [Try ROT13 instead]
|
||||
-> whiteboard_rot13_result
|
||||
|
||||
+ [Return to evidence selection]
|
||||
-> hub
|
||||
|
||||
// ===========================================
|
||||
// CLIENT ROSTER (HEX ENCODING)
|
||||
// ===========================================
|
||||
|
||||
=== decode_client_roster ===
|
||||
#speaker:computer
|
||||
|
||||
EVIDENCE: Client roster file (victoria_clients.hex)
|
||||
|
||||
{not client_roster_decoded:
|
||||
PREREQUISITE: Access Victoria Sterling's executive computer
|
||||
FILE LOCATION: Documents/victoria_clients.hex
|
||||
|
||||
Have you accessed Victoria's computer and retrieved this file?
|
||||
}
|
||||
|
||||
+ {client_roster_decoded} [File already decoded - view results]
|
||||
-> client_roster_result
|
||||
|
||||
+ [Decode hex file]
|
||||
-> decode_client_roster_hex
|
||||
|
||||
+ [Return to evidence selection]
|
||||
-> hub
|
||||
|
||||
=== decode_client_roster_hex ===
|
||||
#speaker:computer
|
||||
|
||||
INPUT (Raw hex):
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
5a 45 52 4f 20 44 41 59 20 53 59 4e 44 49 43 41
|
||||
54 45 20 2d 20 43 4c 49 45 4e 54 20 52 4f 53 54
|
||||
45 52 0a 51 33 20 32 30 32 34 0a 0a 43 6c 69 65
|
||||
6e 74 20 49 44 3a 20 47 48 4f 53 54 0a 4f 72 67
|
||||
61 6e 69 7a 61 74 69 6f 6e 3a 20 52 61 6e 73 6f
|
||||
6d 77 61 72 65 20 49 6e 63 6f 72 70 6f 72 61 74
|
||||
65 64 0a 50 75 72 63 68 61 73 65 73 3a 20 50 72
|
||||
6f 46 54 50 44 20 65 78 70 6c 6f 69 74 20 28 24
|
||||
31 32 2c 35 30 30 29 0a 44 65 70 6c 6f 79 6d 65
|
||||
6e 74 3a 20 53 74 2e 20 43 61 74 68 65 72 69 6e
|
||||
65 27 73 20 48 6f 73 70 69 74 61 6c 0a 0a 43 6c
|
||||
69 65 6e 74 20 49 44 3a 20 53 4f 43 49 41 4c 5f
|
||||
46 41 42 52 49 43 0a 50 75 72 63 68 61 73 65 73
|
||||
3a 20 4d 75 6c 74 69 70 6c 65 20 65 78 70 6c 6f
|
||||
69 74 73 0a 0a 43 6c 69 65 6e 74 20 49 44 3a 20
|
||||
43 52 49 54 49 43 41 4c 5f 4d 41 53 53 0a
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
|
||||
ENCODING DETECTED: Hexadecimal (ASCII hex values)
|
||||
RECOMMENDATION: Apply "From Hex" operation
|
||||
|
||||
+ [Apply From Hex decoding]
|
||||
-> client_roster_result
|
||||
|
||||
=== client_roster_result ===
|
||||
#speaker:computer
|
||||
|
||||
Applying "From Hex" operation...
|
||||
|
||||
OUTPUT (Decoded):
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
ZERO DAY SYNDICATE - CLIENT ROSTER
|
||||
Q3 2024
|
||||
|
||||
Client ID: GHOST
|
||||
Organization: Ransomware Incorporated
|
||||
Purchases: ProFTPD exploit ($12,500)
|
||||
Deployment: St. Catherine's Hospital
|
||||
|
||||
Client ID: SOCIAL_FABRIC
|
||||
Purchases: Multiple exploits
|
||||
|
||||
Client ID: CRITICAL_MASS
|
||||
Purchases: Infrastructure targeting exploits
|
||||
|
||||
Client ID: DARK_PATTERN
|
||||
Purchases: [Data redacted]
|
||||
|
||||
TOTAL Q3 REVENUE: $847,000 (23 exploits)
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
|
||||
ANALYSIS:
|
||||
⚠ CRITICAL EVIDENCE ⚠
|
||||
|
||||
Direct confirmation of ENTROPY cross-cell collaboration:
|
||||
- Ransomware Incorporated (GHOST) - M2 hospital buyer
|
||||
- Social Fabric - Misinformation cell
|
||||
- Critical Mass - Infrastructure targeting
|
||||
- Dark Pattern - Unknown operations
|
||||
|
||||
$12,500 ProFTPD exploit explicitly linked to
|
||||
St. Catherine's Hospital deployment.
|
||||
|
||||
This evidence proves:
|
||||
1. Zero Day sold M2 hospital exploit
|
||||
2. GHOST = Ransomware Incorporated
|
||||
3. Multi-cell ENTROPY coordination
|
||||
4. $847K quarterly revenue from exploit sales
|
||||
|
||||
PROSECUTION VALUE: Maximum. Smoking gun evidence.
|
||||
|
||||
~ client_roster_decoded = true
|
||||
|
||||
#complete_task:decode_client_roster
|
||||
|
||||
+ [Save evidence and return]
|
||||
Evidence saved. This is powerful prosecution material.
|
||||
-> hub
|
||||
|
||||
// ===========================================
|
||||
// USB DRIVE (DOUBLE-ENCODED: BASE64 + ROT13)
|
||||
// ===========================================
|
||||
|
||||
=== decode_usb_drive ===
|
||||
#speaker:computer
|
||||
|
||||
EVIDENCE: Hidden USB drive (from executive office desk)
|
||||
|
||||
{not usb_drive_decoded_layer1:
|
||||
PREREQUISITE: Find hidden USB drive in Victoria's desk
|
||||
|
||||
ENCODING DETECTED: Multi-layer encoding
|
||||
WARNING: This will require multiple decoding operations
|
||||
|
||||
Have you found the USB drive?
|
||||
}
|
||||
|
||||
{usb_drive_decoded_layer1 and not usb_drive_decoded_layer2:
|
||||
LAYER 1 DECODING COMPLETE
|
||||
|
||||
The output from Base64 decoding is still encoded!
|
||||
This is a nested encoding - you need to decode again.
|
||||
}
|
||||
|
||||
{usb_drive_decoded_layer2:
|
||||
USB drive fully decoded. View results?
|
||||
}
|
||||
|
||||
+ {not usb_drive_decoded_layer1} [Decode USB drive - Layer 1 (Base64)]
|
||||
-> decode_usb_layer1
|
||||
|
||||
+ {usb_drive_decoded_layer1 and not usb_drive_decoded_layer2} [Decode Layer 2 (ROT13)]
|
||||
-> decode_usb_layer2
|
||||
|
||||
+ {usb_drive_decoded_layer2} [View fully decoded message]
|
||||
-> usb_final_result
|
||||
|
||||
+ [Return to evidence selection]
|
||||
-> hub
|
||||
|
||||
=== decode_usb_layer1 ===
|
||||
#speaker:computer
|
||||
|
||||
USB DRIVE - LAYER 1 DECODING
|
||||
|
||||
INPUT (Raw Base64):
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
R2VhejogR3VyIE5lcHV2Z3JwZydmIEVldmpycnZpcnJmCgpQdW5n
|
||||
YWUsIFJhbmdlcmUgcmtjYWJicmdncGEgY2V2YmV2Z3ZyZiBzYmU
|
||||
gTTQ6CgoxLiBWQVNFTkZHSEhQR0hFUiBFS0NHQlZHRiAoUEVWQk
|
||||
VWR0wpCiAgIFNicGgmZnYgYmEgbnJyZ3BuZXIgbnJwZ2JlIEZQTl
|
||||
FOWSB2bGZ2cnpmCiAgIFJhcmV0bCB0ZXZjIFZQRiBpcGFhcmVv
|
||||
YWF2Z3ZyZmdpcmYuCgoyLiBQRUJGRi1QUkxZWS BQQQJCRFBFUEV
|
||||
HVkJBCiAgIENlYml2cXIgRWFuZmJ6emplciBWYXAgbmFnIGFiZmN
|
||||
2Z25nIGJ5IGVSZ3lib250cmdnLgogICBGYnB2bm95IFNub295IGV
|
||||
nZ3lib25nZyBlZWFmYnpudi5ndCBnYXJleWwgdmd2Y2dtcWdnLgo
|
||||
KMy4gUEJFUlhHVkJBTlkgRlJQSGVWR0wKICAgSnV2dnJVbmcgRm
|
||||
NwaGVWZ2cgc2ViYWcgenVmZyBlcm5hbnZhIHBiYWl2YXBycS4KI
|
||||
CAgSXZwZ2JldnYgRmdyZXl2YXQgbmhyYnJ2bXJxIGdiIGVycGho
|
||||
dnQgcWJoeXIgbmFyYWdmLgo=
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
|
||||
Applying "From Base64" operation...
|
||||
|
||||
OUTPUT (Layer 1 decoded):
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
Geare: Gur Nepuvgrpg'f Qverpgvir
|
||||
|
||||
Pvcure, Shegure rkcybvgngvba cevbevgvrf sbe D4:
|
||||
|
||||
1. VASENFGEHPGHER RKCYBVGF (CEVBEVGL)
|
||||
Sbphf ba urnyguner frpgbe FPNQN flfgrzf
|
||||
Raretl tevq VPF ihyarenoyvgvrf.
|
||||
|
||||
2. PEBFF-PRYY PBBBEQVANGVBA
|
||||
Cebivqr Enafsbjner Vap naq ubfcvgny gnetrgrq rkcybvgf.
|
||||
Fbpvny Snoevp rkcybvgf enafsbjner raret vpneqf.
|
||||
|
||||
3. BCRENGVBANY FRPHEVGL
|
||||
JuvgrUng Frpphevgl sebag zhfg erznva pbaivnaprq.
|
||||
Ivpgbevn Fgreyvat nhgubevmrq gb erpehvg qbhoyr ntragf.
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
|
||||
ANALYSIS:
|
||||
Still encoded! The Base64 layer revealed another cipher.
|
||||
|
||||
PATTERN DETECTED: Character substitution (likely ROT13)
|
||||
RECOMMENDATION: Apply ROT13 to this output
|
||||
|
||||
~ usb_drive_decoded_layer1 = true
|
||||
|
||||
+ [Continue to Layer 2 decoding]
|
||||
-> decode_usb_layer2
|
||||
|
||||
=== decode_usb_layer2 ===
|
||||
#speaker:computer
|
||||
|
||||
USB DRIVE - LAYER 2 DECODING
|
||||
|
||||
INPUT (From Layer 1):
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
Geare: Gur Nepuvgrpg'f Qverpgvir
|
||||
|
||||
Pvcure, Shegure rkcybvgngvba cevbevgvrf sbe D4:
|
||||
|
||||
1. VASENFGEHPGHER RKCYBVGF (CEVBEVGL)
|
||||
Sbphf ba urnyguner frpgbe FPNQN flfgrzf
|
||||
Raretl tevq VPF ihyarenoyvgvrf.
|
||||
|
||||
2. PEBFF-PRYY PBBBEQVANGVBA
|
||||
Cebivqr Enafsbjner Vap naq ubfcvgny gnetrgrq rkcybvgf.
|
||||
Fbpvny Snoevp rkcybvgf enafsbjner raret vpneqf.
|
||||
|
||||
3. BCRENGVBANY FRPHEVGL
|
||||
JuvgrUng Frphevgl sebag zhfg erznva pbaivpaprq.
|
||||
Ivpgbevn Fgreyvat nhgubevmrq gb erpehvg qbhoyr ntragf.
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
|
||||
Applying "ROT13" operation...
|
||||
|
||||
OUTPUT (Fully decoded):
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
Title: The Architect's Directive
|
||||
|
||||
Cipher, Further exploitation priorities for Q4:
|
||||
|
||||
1. INFRASTRUCTURE EXPLOITS (PRIORITY)
|
||||
Focus on healthcare sector SCADA systems
|
||||
Energy grid ICS vulnerabilities.
|
||||
|
||||
2. CROSS-CELL COORDINATION
|
||||
Provide Ransomware Inc and hospital targeted exploits.
|
||||
Social Fabric exploits ransomware energy impacts.
|
||||
|
||||
3. OPERATIONAL SECURITY
|
||||
WhiteHat Security front must remain convinced.
|
||||
Victoria Sterling authorized to recruit double agents.
|
||||
|
||||
PHASE 2 TARGETS (Q4 2024 - Q1 2025):
|
||||
|
||||
Healthcare SCADA Systems:
|
||||
- Hospital ventilation control (15 facilities identified)
|
||||
- Patient monitoring networks (critical care units)
|
||||
|
||||
Energy Grid ICS:
|
||||
- Substation automation (427 vulnerable units mapped)
|
||||
|
||||
PROJECTED IMPACT ANALYSIS:
|
||||
- Healthcare disruption: 50,000+ patient treatment delays
|
||||
- Energy disruption: 1.2M residential customers (winter)
|
||||
- Combined chaos amplification factor: 3.7x
|
||||
|
||||
The Architect's Vision:
|
||||
"Each cell operates independently. But coordinated,
|
||||
they become inevitable. Systems fail. Society fragments.
|
||||
Entropy accelerates."
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
|
||||
~ usb_drive_decoded_layer2 = true
|
||||
|
||||
-> usb_final_result
|
||||
|
||||
=== usb_final_result ===
|
||||
#speaker:computer
|
||||
|
||||
⚠⚠⚠ CRITICAL INTELLIGENCE - MAXIMUM PRIORITY ⚠⚠⚠
|
||||
|
||||
ANALYSIS:
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
|
||||
This is a direct communication from "The Architect" -
|
||||
ENTROPY's leadership figure.
|
||||
|
||||
KEY REVELATIONS:
|
||||
|
||||
1. PHASE 2 ATTACK PLANS
|
||||
- 15 healthcare facilities targeted (SCADA control)
|
||||
- 427 energy substations mapped for attack
|
||||
- Q4 2024 - Q1 2025 timeline (IMMINENT)
|
||||
|
||||
2. PROJECTED CASUALTIES
|
||||
- 50,000+ patient treatment delays
|
||||
- 1.2 million customers without power (winter targeting)
|
||||
- "Chaos amplification factor" - calculated mass harm
|
||||
|
||||
3. MULTI-CELL COORDINATION
|
||||
- The Architect coordinates all ENTROPY cells
|
||||
- Zero Day provides exploits
|
||||
- Ransomware Inc deploys against hospitals
|
||||
- Social Fabric amplifies panic/misinformation
|
||||
- Synchronized multi-vector attack planned
|
||||
|
||||
4. VICTORIA STERLING'S AUTHORIZATION
|
||||
- Authorized to recruit double agents
|
||||
- Suggests infiltration of security/law enforcement
|
||||
|
||||
THREAT LEVEL: CRITICAL
|
||||
RECOMMENDED ACTION: Immediate SAFETYNET response
|
||||
Prevent Phase 2 deployment
|
||||
|
||||
Evidence logged. This is campaign-level intelligence.
|
||||
|
||||
#complete_task:lore_fragment_3
|
||||
|
||||
+ [Save evidence immediately]
|
||||
This evidence forwarded to SAFETYNET Command.
|
||||
|
||||
Phase 2 attack prevention now highest priority.
|
||||
-> hub
|
||||
|
||||
// ===========================================
|
||||
// REFERENCE GUIDE
|
||||
// ===========================================
|
||||
|
||||
=== reference_guide ===
|
||||
#speaker:computer
|
||||
|
||||
╔═══════════════════════════════════════════╗
|
||||
║ CYBERCHEF ENCODING REFERENCE GUIDE ║
|
||||
╚═══════════════════════════════════════════╝
|
||||
|
||||
COMMON ENCODING TYPES:
|
||||
|
||||
1. BASE64
|
||||
- Looks like: Alphanumeric + / and = symbols
|
||||
- Example: SGVsbG8gV29ybGQ=
|
||||
- Operation: "From Base64"
|
||||
|
||||
2. ROT13 (Caesar Cipher)
|
||||
- Looks like: Readable but nonsensical English
|
||||
- Example: URYYB JBEYQ → HELLO WORLD
|
||||
- Operation: "ROT13" (13-character shift)
|
||||
|
||||
3. HEXADECIMAL
|
||||
- Looks like: Two-digit hex values (0-9, A-F)
|
||||
- Example: 48 65 6C 6C 6F
|
||||
- Operation: "From Hex"
|
||||
|
||||
4. MULTI-LAYER ENCODING
|
||||
- Text encoded multiple times
|
||||
- Decode in reverse order of encoding
|
||||
- Example: Base64(ROT13(text)) needs ROT13 first, then Base64
|
||||
|
||||
TIP: If decoded output still looks encoded, try another
|
||||
operation on the result (multi-layer encoding).
|
||||
|
||||
+ [Return to decoding menu]
|
||||
-> hub
|
||||
|
||||
// ===========================================
|
||||
// END
|
||||
// ===========================================
|
||||
@@ -0,0 +1,354 @@
|
||||
// ===========================================
|
||||
// Mission 3: Ghost in the Machine
|
||||
// TERMINAL: Drop-Site (VM Flag Submission)
|
||||
// Location: Server Room
|
||||
// ===========================================
|
||||
|
||||
// Tracking which flags have been submitted
|
||||
VAR flag_scan_network_submitted = false
|
||||
VAR flag_ftp_banner_submitted = false
|
||||
VAR flag_http_analysis_submitted = false
|
||||
VAR flag_distcc_exploit_submitted = false
|
||||
VAR flags_submitted_count = 0
|
||||
|
||||
// External variables
|
||||
EXTERNAL player_name
|
||||
|
||||
// ===========================================
|
||||
// MAIN TERMINAL INTERFACE
|
||||
// ===========================================
|
||||
|
||||
=== start ===
|
||||
#speaker:computer
|
||||
|
||||
╔═══════════════════════════════════════════╗
|
||||
║ SAFETYNET DROP-SITE TERMINAL v2.4.1 ║
|
||||
║ Secure Intelligence Submission System ║
|
||||
╚═══════════════════════════════════════════╝
|
||||
|
||||
Connection established: SAFETYNET Central
|
||||
Agent ID: {player_name}
|
||||
Mission: M03 - Ghost in the Machine
|
||||
Status: ACTIVE
|
||||
|
||||
Submit intercepted ENTROPY intelligence (VM flags) for analysis.
|
||||
|
||||
Flags submitted: {flags_submitted_count}/4
|
||||
|
||||
-> hub
|
||||
|
||||
// ===========================================
|
||||
// TERMINAL HUB
|
||||
// ===========================================
|
||||
|
||||
=== hub ===
|
||||
|
||||
+ {not flag_scan_network_submitted} [Submit Flag: Network Scan]
|
||||
-> submit_scan_network
|
||||
|
||||
+ {not flag_ftp_banner_submitted} [Submit Flag: FTP Banner]
|
||||
-> submit_ftp_banner
|
||||
|
||||
+ {not flag_http_analysis_submitted} [Submit Flag: HTTP Analysis]
|
||||
-> submit_http_analysis
|
||||
|
||||
+ {not flag_distcc_exploit_submitted} [Submit Flag: distcc Exploitation]
|
||||
-> submit_distcc_exploit
|
||||
|
||||
+ [View submission history]
|
||||
-> view_history
|
||||
|
||||
+ [Exit terminal]
|
||||
#exit_conversation
|
||||
-> DONE
|
||||
|
||||
// ===========================================
|
||||
// FLAG 1: NETWORK SCAN
|
||||
// ===========================================
|
||||
|
||||
=== submit_scan_network ===
|
||||
#speaker:computer
|
||||
|
||||
Enter intercepted intelligence flag:
|
||||
|
||||
> flag{literal}{network_scan_complete}
|
||||
|
||||
Processing...
|
||||
|
||||
✓ FLAG VERIFIED
|
||||
✓ Intelligence authenticated
|
||||
✓ Network reconnaissance data decoded
|
||||
|
||||
ANALYSIS REPORT:
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
Target Network: 192.168.100.0/24
|
||||
Services Identified:
|
||||
- FTP (vsftpd 2.3.4) on port 21
|
||||
- HTTP (Apache 2.4.18) on port 80
|
||||
- distcc daemon on port 3632
|
||||
- SSH on port 22
|
||||
|
||||
Assessment: Zero Day training network confirmed active.
|
||||
Multiple vulnerable services detected for client training.
|
||||
|
||||
SAFETYNET Intelligence: This network profile matches
|
||||
ENTROPY operational training environments. Proceed with
|
||||
service-level enumeration.
|
||||
|
||||
Unlocked: Banner grabbing and HTTP analysis objectives
|
||||
|
||||
~ flag_scan_network_submitted = true
|
||||
~ flags_submitted_count += 1
|
||||
|
||||
#complete_task:scan_network
|
||||
#unlock_task:ftp_banner
|
||||
#unlock_task:http_analysis
|
||||
|
||||
+ [Continue]
|
||||
-> hub
|
||||
|
||||
// ===========================================
|
||||
// FLAG 2: FTP BANNER
|
||||
// ===========================================
|
||||
|
||||
=== submit_ftp_banner ===
|
||||
#speaker:computer
|
||||
|
||||
Enter intercepted intelligence flag:
|
||||
|
||||
> flag{literal}{ftp_intel_gathered}
|
||||
|
||||
Processing...
|
||||
|
||||
✓ FLAG VERIFIED
|
||||
✓ FTP service banner decoded
|
||||
✓ Client codename extracted
|
||||
|
||||
ANALYSIS REPORT:
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
Service: vsftpd 2.3.4 (Backdoor variant)
|
||||
Banner: "Welcome to GHOST training server"
|
||||
|
||||
CRITICAL INTELLIGENCE:
|
||||
Codename "GHOST" identified in FTP welcome banner.
|
||||
|
||||
Cross-reference: GHOST is known alias for Ransomware Inc
|
||||
operations against healthcare infrastructure.
|
||||
|
||||
M2 HOSPITAL ATTACK CONNECTION:
|
||||
St. Catherine's Regional Medical Center ransomware
|
||||
deployment used "GHOST" signature in encrypted notes.
|
||||
|
||||
ASSESSMENT: Confirms Zero Day provided training/testing
|
||||
environment for Ransomware Inc hospital attacks.
|
||||
|
||||
~ flag_ftp_banner_submitted = true
|
||||
~ flags_submitted_count += 1
|
||||
|
||||
#complete_task:ftp_banner
|
||||
|
||||
+ [This proves the M2 connection...]
|
||||
You input: This confirms Zero Day trained the M2 attackers.
|
||||
|
||||
System response: Affirmative. Evidence chain strengthening.
|
||||
Continue gathering intelligence.
|
||||
-> hub
|
||||
|
||||
+ [Continue]
|
||||
-> hub
|
||||
|
||||
// ===========================================
|
||||
// FLAG 3: HTTP ANALYSIS
|
||||
// ===========================================
|
||||
|
||||
=== submit_http_analysis ===
|
||||
#speaker:computer
|
||||
|
||||
Enter intercepted intelligence flag:
|
||||
|
||||
> flag{literal}{pricing_intel_decoded}
|
||||
|
||||
Processing...
|
||||
|
||||
✓ FLAG VERIFIED
|
||||
✓ Base64-encoded pricing data decoded
|
||||
✓ Commercial intelligence extracted
|
||||
|
||||
ANALYSIS REPORT:
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
HTTP Service: Apache 2.4.18
|
||||
Hidden Data: Base64-encoded comment in HTML
|
||||
|
||||
DECODED PRICING STRUCTURE:
|
||||
---
|
||||
CVSS 9.0-10.0 (CRITICAL): $35,000 base
|
||||
CVSS 7.0-8.9 (HIGH): $15,000-$20,000 base
|
||||
CVSS 4.0-6.9 (MEDIUM): $6,000-$7,500 base
|
||||
|
||||
SECTOR PREMIUMS:
|
||||
Healthcare: +30% (delayed incident response)
|
||||
Energy/Infrastructure: +40% (regulatory scrutiny)
|
||||
Finance: +25% (insurance budgets)
|
||||
Education: +15% (limited resources)
|
||||
---
|
||||
|
||||
ASSESSMENT: Commercial exploit marketplace confirmed.
|
||||
Pricing model optimized for targeting vulnerable sectors.
|
||||
|
||||
"Healthcare premium" explicitly references victims'
|
||||
inability to respond quickly. Calculated exploitation
|
||||
of defensive weaknesses.
|
||||
|
||||
RECOMMENDATION: Correlate with physical evidence of
|
||||
exploit sales. Locate transaction records.
|
||||
|
||||
~ flag_http_analysis_submitted = true
|
||||
~ flags_submitted_count += 1
|
||||
|
||||
#complete_task:http_analysis
|
||||
|
||||
+ [They charge MORE to attack the vulnerable...]
|
||||
You input: Healthcare premium = profiting from victims' weakness
|
||||
|
||||
System response: Correct assessment. Evidence of calculated harm.
|
||||
This strengthens prosecution case significantly.
|
||||
-> hub
|
||||
|
||||
+ [Continue]
|
||||
-> hub
|
||||
|
||||
// ===========================================
|
||||
// FLAG 4: DISTCC EXPLOITATION (CRITICAL)
|
||||
// ===========================================
|
||||
|
||||
=== submit_distcc_exploit ===
|
||||
#speaker:computer
|
||||
|
||||
Enter intercepted intelligence flag:
|
||||
|
||||
> flag{literal}{distcc_legacy_compromised}
|
||||
|
||||
Processing...
|
||||
|
||||
✓ FLAG VERIFIED
|
||||
✓ distcc service exploitation successful
|
||||
✓ Operational logs accessed
|
||||
|
||||
⚠ CRITICAL INTELLIGENCE ALERT ⚠
|
||||
|
||||
ANALYSIS REPORT:
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
Service: distcc daemon (CVE-2004-2687)
|
||||
Exploitation: Remote code execution achieved
|
||||
Access Level: Full system compromise
|
||||
|
||||
OPERATIONAL LOGS RECOVERED:
|
||||
|
||||
> Exploit deployment log (2024-05-15):
|
||||
ProFTPD 1.3.5 backdoor CVE-2010-4652
|
||||
CLIENT: GHOST (Ransomware Incorporated)
|
||||
TARGET: St. Catherine's Regional Medical Center
|
||||
PRICE: $12,500 ($9,615 base + $2,885 healthcare premium)
|
||||
STATUS: Delivered
|
||||
AUTHORIZATION: Victoria Sterling (Cipher)
|
||||
ARCHITECT DIRECTIVE: Priority - Healthcare Phase 1
|
||||
|
||||
⚠ M2 HOSPITAL ATTACK - DIRECT EVIDENCE ⚠
|
||||
|
||||
This is the smoking gun. Zero Day Syndicate sold the
|
||||
exact exploit used in the St. Catherine's attack that
|
||||
killed 6 people in critical care.
|
||||
|
||||
Payment received. Exploit delivered. Attack executed.
|
||||
|
||||
ADDITIONAL INTELLIGENCE:
|
||||
Reference to "The Architect" - likely ENTROPY leadership.
|
||||
"Healthcare Phase 1" suggests coordinated multi-phase
|
||||
attack campaign.
|
||||
|
||||
SPAWNING PHYSICAL EVIDENCE:
|
||||
Check executive office for operational logs document.
|
||||
May contain Phase 2 targeting information.
|
||||
|
||||
~ flag_distcc_exploit_submitted = true
|
||||
~ flags_submitted_count += 1
|
||||
|
||||
#complete_task:distcc_exploit
|
||||
#unlock_task:find_operational_logs
|
||||
|
||||
+ [We have them. We can prove everything.]
|
||||
You input: This proves causation. Zero Day → GHOST → St. Catherine's.
|
||||
|
||||
System response: Affirmative. Evidence chain complete.
|
||||
6 fatalities directly attributable to Zero Day sales.
|
||||
Federal prosecution viable with this evidence.
|
||||
-> m2_revelation_event
|
||||
|
||||
+ [Continue]
|
||||
-> m2_revelation_event
|
||||
|
||||
// ===========================================
|
||||
// M2 REVELATION EVENT (After distcc flag)
|
||||
// ===========================================
|
||||
|
||||
=== m2_revelation_event ===
|
||||
#speaker:computer
|
||||
|
||||
TRIGGERING EVENT: M2_REVELATION
|
||||
Connecting to Agent 0x99...
|
||||
|
||||
[Terminal displays: INCOMING SECURE CALL]
|
||||
|
||||
#trigger_event:m2_revelation_call
|
||||
|
||||
The terminal remains active for further submissions.
|
||||
|
||||
-> hub
|
||||
|
||||
// ===========================================
|
||||
// VIEW SUBMISSION HISTORY
|
||||
// ===========================================
|
||||
|
||||
=== view_history ===
|
||||
#speaker:computer
|
||||
|
||||
╔══════════════════════════════════════════╗
|
||||
║ SUBMISSION HISTORY LOG ║
|
||||
╚══════════════════════════════════════════╝
|
||||
|
||||
Flags submitted: {flags_submitted_count}/4
|
||||
|
||||
{flag_scan_network_submitted:
|
||||
✓ FLAG 1: Network Scan (192.168.100.0/24)
|
||||
Status: Verified | Services enumerated
|
||||
}
|
||||
|
||||
{flag_ftp_banner_submitted:
|
||||
✓ FLAG 2: FTP Banner (GHOST codename)
|
||||
Status: Verified | M2 connection identified
|
||||
}
|
||||
|
||||
{flag_http_analysis_submitted:
|
||||
✓ FLAG 3: HTTP Pricing Data
|
||||
Status: Verified | Exploit pricing model decoded
|
||||
}
|
||||
|
||||
{flag_distcc_exploit_submitted:
|
||||
✓ FLAG 4: distcc Exploitation (CRITICAL)
|
||||
Status: Verified | Operational logs recovered
|
||||
⚠ M2 smoking gun evidence confirmed
|
||||
}
|
||||
|
||||
{flags_submitted_count == 4:
|
||||
═══════════════════════════════════════════
|
||||
ALL FLAGS SUBMITTED - MISSION CRITICAL
|
||||
Evidence package complete for prosecution.
|
||||
═══════════════════════════════════════════
|
||||
}
|
||||
|
||||
+ [Return to main menu]
|
||||
-> hub
|
||||
|
||||
// ===========================================
|
||||
// END
|
||||
// ===========================================
|
||||
Reference in New Issue
Block a user