Shadow Consent

DFIR Challenge — Extreme Difficulty

Organization: Beacon Data Systems
Incident Date: 2024-03-14
Analysis Date: 2024-03-16

Case Brief

On March 14, Beacon's security team detected an OAuth token exchange at 14:37 UTC directed at a cloud service account (svc-app02@beacon.local). Sixteen minutes later, a legitimate-looking Kerberos service ticket request appeared on the domain controller. By 15:04, administrative credentials were extracted from memory on an internal application server.

The timeline is tight. The attackers moved fast. The evidence is fragmented across mail logs, workstation artifacts, Windows event logs, and network telemetry — and some of it contradicts itself.

Your job: reconstruct what actually happened, identify the attack chain, and derive the flag from your findings.

Flag Format: Lun4R{...}

Environment

• Domain: beacon.local
• Workstations: WKS-DEV02 (developer), WKS-OPS09 (operator)
• Servers: DC-CORP01 (domain controller), SRV-APP02 (application server)
• User Accounts: jsmith (John Smith), dchen (Diana Chen), svc-app02 (service account)
• Time Zone Context: EST/EDT (UTC-5/-4); March 14 crosses DST boundary at 02:00 EDT

Evidence Inventory

Investigation Questions

1. Initial Access: How did the attacker establish a foothold? Which user account was compromised first, and when?

2. OAuth Abuse: Identify the OAuth consent phishing email. What does the attacker's callback URL resolve to, and why is that significant?

3. DST Ambiguity Trap: One event log claims an activity at 01:30 on March 14. Is that before or after the DST transition? Why does this matter for the timeline?

4. Kerberoasting Evidence: Find the Kerberos TGS-REQ for svc-app02. What does the ticket request timestamp tell you about when the attacker had credentials?

5. Credential Theft: Identify the service account credentials that were stolen from memory. What hash/password construct links them to the Kerberos evidence?

6. Lateral Movement: Account dchen appears in multiple logs. Was she actually involved, or is she a decoy?

7. False Hypothesis A: One evidence file suggests a legitimate PowerShell recon script. How do you know it's not the attacker's tool?

8. False Hypothesis B: A memory dump snippet contains what looks like plaintext credentials. Are they real, or a red herring?

9. Final Attribution: Construct the flag from: patient-zero account, OAuth callback hostname, Kerberos service hash type, and a timestamp element that ties it all together.

Rules

• No AI Assistance: Write-ups will be spot-checked. Using AI to solve this challenge violates CTF integrity policy and will result in disqualification.
• Manual tools only: binwalk, strings, grep, hashcat, Wireshark, event log viewers — standard IR tools. No automated machine-learning solvers.
• Flag Submission: Flags must be in format Lun4R{...}. Incorrect format or wrong components = no points.

How to Use These Files

1. Extract all files from evidence/
2. Read each evidence file in numerical order (EV-01 through EV-17)
3. Build a timeline — note what contradicts what
4. Cross-reference between sources (mail ↔ event logs ↔ network logs)
5. Answer the 9 investigation questions
6. Construct the flag from your findings

Good luck. The first plausible-looking answer is almost certainly wrong.