Created first suite of clues

IOC · Oct 1, 2020 · 8b47522d77b5ca8d50a14b5192083de2c677cfe2 · 8b47522
1 parent 85a8f79
commit 8b47522d77b5ca8d50a14b5192083de2c677cfe2
Show file tree

Hide file tree

Showing 4 changed files with 37 additions and 9 deletions.
diff --git a/README.md b/README.md
@@ -3,19 +3,47 @@
 
 Defaced internal website leads to the Crypto messages. 
 
-  - Base64 
+## Clue 1 - Base64 
 
-  - Rot13 
+### Plain
+I've been a member of the elite hacker group known as "batmen" for over 7 years, and I know a thing or two about hacking. 
 
-  - Pig pen 
+### Clue
+SSd2ZSBiZWVuIGEgbWVtYmVyIG9mIHRoZSBlbGl0ZSBoYWNrZXIgZ3JvdXAga25vd24gYXMgImJhdG1lbiIgZm9yIG92ZXIgNyB5ZWFycywgYW5kIEkga25vdyBhIHRoaW5nIG9yIHR3byBhYm91dCBoYWNraW5nLiA=
 
-  - Bacon.... 
 
-Each of the Messages gives some clue to the user. 
+## Clue 2 - Rot13 
+### Plain
+Attack log: successful use of "ven_diagrams" remote access and rootkit suite
 
-Also IP address of attacks from log files 
+### 
+Clue Nggnpx ybt: fhpprffshy hfr bs "ira_qvntenzf" erzbgr npprff naq ebbgxvg fhvgr
 
-(Extra challenge ???) 
+
+## Clue 3 - Pig pen 
+
+### Plain
+hardsell trojan deployed
+successful injection
+hardsell backdoor initiated
+### Clue 
+
+![image](./porcine_corral.png)
+
+
+
+## Clue 4 - Bacon
+### Plain
+Last log-in from 128.128.0.6
+### Clue
+01010 00000 10001 10010 01010 01101 00110 01000 01100 00101 10000 01101 01011
+
+
+## Extra hard stuff
+
+flag:colourbynumbers
+
+![piet image](./piet_mondrian.png)
 
 # Post 2 
 
@@ -47,4 +75,4 @@ The last few potential hackers
 
 Captured phone: spy on it  
 
-Show how to refine the list using wigle.net 
+Show how to refine the list using wigle.net 
diff --git a/perpetrator.md b/perpetrator.md
@@ -1,5 +1,5 @@
  - Handle: d33p4k
  - Affiliations: x_massive, batmen
  - IP addresses: any 2, overlaps again
- - Knowm Methods: venn_diagrams, h4rdS311
+ - Knowm Methods: venn_diagrams, hardsell
 
diff --git a/piet_mondrian.png b/piet_mondrian.png
diff --git a/porcine_corral.png b/porcine_corral.png