$s is the salt and $p is the password, and checking Hashcat for this type of hash, we come up dry. the_ is encrypted and locked down, but the problems_in_the_north.txt gives us some information to work with.Īlright, so we have a hash and a clue as to how the hash was created. Nice! Our first kingdom flag! And there are two files to check out here. Now we are armed with a bunch of clues, and our scouting has also uncovered the credentials for the FTP server (oberynmartell:A_verySmallManCanCastAVeryLargeShad0w), so it's time to head to Dorne! Thanks for letting us know, Jorah! Scoping out the code we get some hints. It was a good idea, because running exiftool on the mp3 file uncovered a flag! One of the secret flags.įinally, just to be sure, let's run Dirb with the common.txt wordlist to see if there is anything else hiding.Īnd there is! Heading to this URL we get some more info. I even downloaded everything possible, which includes the audio files, and I took a look at all of them. So, checking out everything we can we find the following: But before we move on to Dorne (FTP), let's really scour this port for everything possible to gather as many clues as possible. The final entry in the robots.txt did not have much in terms of clues. Just as stated in the goals/rules text, it looks like we have our set path ahead of us and can see what we need to do for each challenge/flag. I don't really want to be your friend, but I will take your map.

Let's tuck this info away and get exploring the rest of the directories. Inspecting the source, we get another hint. Now that we added a user agent and swapped to it, reloading the page yields a different result. We need to change our user-agent to be the three-eyed raven as indicated by robots.txt. Look at those capital letters spelling it out for us. We are stopped by Jon Snow, who seems to be telling us that we know nothing, but looking at the source code for this page we get another hint. Taking a look at the source, we get a full scoop on the rules, goals, and some hints. We've got a lot to sort through, but let's hit port 80 first by accessing it with a browser.

So let's get to it.Īrp-scan and Nmap first as usual to find out the target IP and ports/services enumeration. This was a refreshing challenge after doing a bunch of boot-to-root VMs, and I had a lot of fun-especially with the theme being Game of Thrones.

Game of thrones game walkthrough