Welcome

Introduction

The SANS Holiday Hack Challenge 2025 dropped participants into a winter town taken by mischievous gnomes, breaking things across city hall, the hotel, the park, and the retro shop. The challenge spans 27 objectives across five difficulty tiers, covering offensive and defensive security topics.

I completed 21 of the 27 objectives, spanning cloud security (Azure RBAC, storage, and network misconfigurations), web application exploitation (IDOR, JWT/JWKS spoofing, Firebase leaks), core networking and firewalls, digital forensics and reverse engineering, and hardware signal analysis (1-Wire, SPI, I²C) and proposed prevention for exploitation objectives.

Map

Navigation tip

Even with less than 50 pages, there's still quite a bit of information to read through. To make things a little easier, you can use P or , to go to the previous section, N or . to navigate to the next section, and S, F, or / to open up the search dialog.

TL;DR if you keep pressing N or . from this point forward, you'll hit all the content in the right order!

Answers

Act I

1. Its All About Defang -

Phishing & IOC analysis : investigated a malicious email and defanged/reported its indicators of compromise.

2. Neighborhood Watch Bypass -

Linux privilege escalation : escalated from a restricted shell to admin access to restore the fire alarm system.

3. Santa's Gift-Tracking Service Port Mystery-

Network service enumeration : used ss to locate a relocated service's listening port and validated it with curl.

4. Visual Networking Thinger -

Core networking protocols : walked through DNS, TCP handshake, HTTP, TLS, and HTTPS flows in an interactive packet simulator.

5. Visual Firewall Thinger -

Firewall rule design : configured zone-based firewall rules to enforce least-privilege access between network segments.

6. Intro to Nmap -

Network scanning with Nmap : ran targeted and full-range scans to discover open ports and hidden services.

7. Blob Storage Challenge in the neighborhood -

Azure Storage auditing : used the Azure CLI to find a storage account with public blob access misconfigured.

8. Spare Key -

Azure least-privilege review : audited storage accounts via CLI to uncover an exposed website leaking a spare credential.

9. The Open Door -

Azure NSG auditing : enumerated Network Security Groups via CLI to find a rule exposing RDP/SSH to the internet.

10. Owner -

Azure RBAC auditing : queried subscriptions and role assignments via CLI to find identities with standing Owner access.

Act II

11. Retro Recovery -

Disk image forensics : mounted and analyzed a FAT12 floppy disk image to recover hidden files.

12. Mail Detective -

IMAP investigation : used curl to enumerate a mailbox over IMAP and trace a phishing lead to a pastebin URL.

13. IDORable Bistro -

IDOR exploitation : manipulated a receipt endpoint's object reference to enumerate records and identify a target customer.

14. Dosis Network Down -

Router RCE (CVE-2023-1389) : exploited an unauthenticated command injection flaw to recover the Wi-Fi password from a router's config.

15. Rogue Gnome Identity Provider -

JWT/JWKS spoofing : forged a JWKS-based JWT to escalate privileges and identify the malicious firmware being served.

16. Quantgnome Leap -

SSH key recon & crypto trail : traced SSH key comments and post-quantum key material across a server to recover the final flag.

17. Going in Reverse -

Reverse engineering : reverse engineered a Commodore 64 BASIC program's XOR obfuscation to recover the hidden flag.

Act III

18. Gnome Tea -

Firebase misconfiguration : exploited an exposed Firebase client config to query Firestore directly and leak a secret passphrase.

20. Snowcat RCE & Priv Esc -

Web RCE & privilege escalation : chained a deserialization RCE with privilege escalation to recover an unused API key.

21. Schrödinger's Scope -

Scoped web app pentest : conducted a scoped penetration test of a registration site while working around gnome interference.

23. On the Wire -

Signal protocol analysis : decoded 1-Wire, SPI, and I²C captures and XOR-decrypted the payload to extract sensor data.