Drone Path

To locate the Drone Path terminal, head to no man's land, the center of The Front Yard. Chimney Scissorsticks will give you the information you need to get started. With the tensions beween Team Alabaster and Team Wombley rising, we need to get ahead of the drone activity happening on the Wombley side.

Chimney says we will be working with drone logs and KML files. If you open the terminal and click the menu, you will see there is a File Share page that contains a file "fritjolf-Path.kml".

The KML file is an XML based file format that contains geographic data. This file format can be viewed in many different tools, but I chose to open this one in https://maps.equatorstudios.com. This tool made it easy to open the KML file and seeing the path.

The flight path very clearly spells the word "GUMDROP1". If GUMDROP1 is a password, then the name of the file could be the username. I tried username "fritjolf" and password "GUMDROP1" and it let me in!

After login, there are a few more pages available. One of those pages is the profle page. If you view fritjolf's profile, there is a link to a file "/files/secret/Preparations-drone-name.csv".

The file Preparations-drone-name.csv hints that this file may reveal a drone name that can be searched for on the "Workshop" page. Looking at the contents of this file, I see it is indeed a csv file with each row a drone log entry. I am not familiar with this particular file format but I do see that there are GPS coordinates

I used Google Earth to put Placemarks on each coordinate and at first I wasn't seeing a pattern. I looked at each point carefully and I finally noticed that the 7th placemark kinda looked like a "W" if I zoomed in on the physical features of the ground at that point.

When I looked at all the placemarks, the letters started coming together. I drew the letters over the placemarks in red to show them better.

Back in the "Elf Drone Workshop" web app, I searched for a drone named "ELF-HAWK" and found some text about it plus a link to another csv file.

The phrase "I have hid the activation code in the dataset ELF-HAWK-dump.csv" indicates that the information we need for the next step is in that file somewhere. Looking at the contents of the file, it is in the same format as the previous CSV file. There are GPS coordinates toward the front of each row with some other columns after it. Disregarding the data other than the GPS coordinates, I wrote a python script to add each point to a KML file and display it on Google Earth. If you want my KML file I have uploaded it here: ELF_HAWK.kml

The path drawn on the Earth is very erratic but I do see the outline of letters in there if I look closely enough. I started to see more clearly when I hide all of the paths in the KML file, and start revealing them a few at a time.

Looking at the first 4 paths in the KML file, I can see the word "Drone" spelled out across the globe. I kept looking at the paths 3-5 at a time until I read out the whole phrase "DroneDataAnalystExpertMedal".

Back in the Elf Drone Workshop, I went to the Admin Console and entered "DroneDataAnalystExpertMedal" as the code.

After entering the code, I got the Silver trophy in my badge!

After getting the silver trophy, Chimney mentions that I needed to dig deeper, and that an injection flaw could hold more clues. Armed with this, it didn't take long to find a few SQL injection vulnerabilities.

Both the login API and the drone API are vulnerable to "' or 1=1;--" style SQL injections. On the login page, you could use this to login as other users, but the more useful injection is the drone API one, so that is where I will focus for now.

When the user searches for a drone name, a GET request is is made to "https://hhc24-dronepath.holidayhackchallenge.com/api/v1.0/drones?drone=dronename". The "drone" parameter is one vulnerable to injection. To see all of the drones, a simple injection attack can be issued that always returns true.

' or 1=1;--

Be sure to URL encode the query parameter.

https://hhc24-dronepath.holidayhackchallenge.com/api/v1.0/drones?drone='+or+1%3d1%3b--

This injection returns all of the drones.

[
    {
        "name": "ELF-HAWK",
        "quantity": "40",
        "weapons": "Snowball-launcher"
    },
    {
        "name": "Pigeon-Lookalike-v4",
        "quantity": "20",
        "weapons": "Surveillance Camera"
    },
    {
        "name": "FlyingZoomer",
        "quantity": "4",
        "weapons": "Snowball-Dropper"
    },
    {
        "name": "Zapper",
        "quantity": "5",
        "weapons": "CarrotSpike"
    }
]

Armed with valid drone names, I could just search for each of them and view the comments. I searched for each of the drone names to read the comments. I may add more of the data that I exfiltrated out of the database (e.g. users, passwords, comments, profile info, etc) to the Easter Eggs page.

One of the drone's had an interesting comment. I searched for "Pigeon-Lookalike-v4" and saw the comment "I heard a rumor that there is something fishing with some of the files. There was some talk about only TRUE carvers would find secrets and that FALSE ones would never find it.".

I recall the 2nd csv file containing many "TRUE" and "FALSE" values. Those columns were not needed to get the silver trophy, but they may be required to get the Gold trophy. The file "ELF-HAWK-dump.csv"

Since TRUE and FALSE are essentially binary data, I wrote a python script to go through all of the rows and convert the TRUE's and FALSE's into bit strings, ignore everything else. Note: be sure to include the first row, because the header row is missing a new line that causes data to be included in the header row. This caused me a bit of frustration.

data = ""
path = "ELF-HAWK-dump.csv"
with open(path) as f:
    for line in f:
        cols = line.split(",")
        num = ""
        for col in cols:
            if col == "TRUE":
                num += "1"
            if col == "FALSE":
                num += "0"
        data += num

The above snippet of the python script extracts the TRUE/FALSE data into long bit string. This bit string can then be converted to bytes and then printed as a UTF string.

for x in range(0, len(data), 8):
    print(int(data[x:x+8],2).to_bytes().decode(), end="")

The output of this code is some ascii art that displays the code word! It is "EXPERTTURKEYCARVERMEDAL".

Enter "EXPERTTURKEYCARVERMEDAL" in the Admin Console the Elf Drone Workshop to get the Gold trophy and be declared a Super Admin Drone Data Analyst Expert!