{"id":11,"date":"2012-02-01T04:17:00","date_gmt":"2012-02-01T04:17:00","guid":{"rendered":"http:\/\/www.somethingsomethingsecurity.com\/?p=11"},"modified":"2012-02-01T04:17:00","modified_gmt":"2012-02-01T04:17:00","slug":"christmas-challenge-2011","status":"publish","type":"post","link":"http:\/\/www.somethingsomethingsecurity.com\/?p=11","title":{"rendered":"Christmas Challenge 2011"},"content":{"rendered":"<p>Well&#8230;.I didn&#8217;t win the annual Ed Skoudis and friends Christmas Challenge (<a href=\"http:\/\/pen-testing.sans.org\/blog\/2012\/01\/26\/holiday-challenge-2011-winners-answers\">http:\/\/pen-testing.sans.org\/blog\/2012\/01\/26\/holiday-challenge-2011-winners-answers<\/a>) but thought I would share my solution anyway.<br \/>Please fell free to sing along&#8230;&#8230;&#8230;&#8230;&#8230;.<\/p>\n<p>Well now Rudolph was frantic<br \/>cause Grandma was missing<br \/>The police thought he did it<br \/>His iPhone confirmed it.<br \/>The GPS on the phone<br \/>Matched a jpg showing Grandma&#8217;s coat alone.<\/p>\n<p>Rudolph heard little Timothy<br \/>interrupt and tell the court.<br \/>He had found some evidence<br \/>but did not know how to parse it out.<\/p>\n<p>Cupid had mad Wireshark skills<br \/>and went right to work.<br \/>The first thing that he noticed<br \/>was an email and a doc in Word.<\/p>\n<p>The email revealed a secret plan<br \/>that Grandma had cooked up.<br \/>She planned to frame Rudolph<br \/>and topped her insurance up.<\/p>\n<p>The capture showed a fatal flaw<br \/>with Santaslist PHP.<br \/>Grandma took over MyDNS,<br \/>by hacking her some Apache.<\/p>\n<p>Then with trojaned updates<br \/>and the DNS manipulation,<br \/>SQLite was used to add<br \/>the damning CellLocation.<br \/>Rudolph was proven innocent.<br \/>The Plaza was where they knew,<br \/>the police could find Grandma<br \/>wearing one red shoe.<\/p>\n<p>BONUS: Extended special live only verse<br \/>And so little Timmy Tweeted,<br \/>&#8220;Network Miner is &#8216;freein&#8217;<br \/>Rudolph\u2019s not a flea bitten beast<br \/>and for Grandma there&#8217;ll be no Caribbean&#8221;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Well&#8230;.I didn&#8217;t win the annual Ed Skoudis and friends Christmas Challenge (http:\/\/pen-testing.sans.org\/blog\/2012\/01\/26\/holiday-challenge-2011-winners-answers) but thought I would share my solution anyway.Please fell free to sing along&#8230;&#8230;&#8230;&#8230;&#8230;. Well now Rudolph was franticcause Grandma was missingThe police thought he did itHis iPhone confirmed it.The GPS on the phoneMatched a jpg showing Grandma&#8217;s coat alone. Rudolph heard little Timothyinterrupt [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-11","post","type-post","status-publish","format-standard","hentry","category-random-thoughts"],"_links":{"self":[{"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/11","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=11"}],"version-history":[{"count":0,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/11\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}