# HireMe

{% embed url="<https://cyberdefenders.org/blueteam-ctf-challenges/62#nav-questions>" %}

## <mark style="color:blue;">Q1 What is the administrator's username?</mark> <a href="#q1-what-is-the-administrators-username" id="q1-what-is-the-administrators-username"></a>

open the file using FTK Imager and go to the path: root>Users

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2F66VrNXYfwXLMxpX7Y5NF%2Fimage.png?alt=media\&token=5196301f-3f38-4ed9-a7fd-6267082230db)

**Answer: Karen**

## <mark style="color:blue;">Q2 What is the OS's build number?</mark> <a href="#q2-what-is-the-oss-build-number" id="q2-what-is-the-oss-build-number"></a>

go to the path: root>windows>config, and scroll down till find SOFTWARE

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2FPZJx2F1wTteVBK6xSdJH%2Fimage.png?alt=media\&token=06c5b5d6-fc1f-4d9a-9458-822a741551a4)

Export the file then open it in the registry editor, file>load hive

then scroll down the path: SOFTWARE>Microsoft>Windows NT>CurrentVersion

the Build number would be on the right side

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2FiFv8VkJ1yrRMXdhkaczO%2Fimage.png?alt=media\&token=849a96a6-2e44-4e8c-b1bc-b01630018bbc)

**Answer:16299**

### <mark style="color:blue;">**Q3**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">What is the hostname of the computer?</mark> <a href="#q3-what-is-the-hostname-of-the-computer" id="q3-what-is-the-hostname-of-the-computer"></a>

go to the path: root>windows>config, and scroll down till find SYSTEM

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2FqQdTOC2eP0tu5WHGGj6m%2Fimage.png?alt=media\&token=c3f9cf01-0893-429c-9d23-90fce53d14fe)

Export the file then open it in the registry editor, file>load hive

then scroll down the path: SYSTEM>ControlSet001>Control>ComputerName>ComputerName

the hostname would be on the right side

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2FLw28BFewOlzFDlhNCkg1%2Fimage.png?alt=media\&token=4a090369-0ec0-4ca4-92c5-2e4de5bf4e68)

**Answer:TOTALLYNOTAHACK**

### <mark style="color:blue;">Q4 A messaging application was used to communicate with a fellow Alpaca enthusiest. What is the name of the software?</mark> <a href="#q4-a-messaging-application-was-used-to-communicate-with-a-fellow-alpaca-enthusiest.-what-is-the-name" id="q4-a-messaging-application-was-used-to-communicate-with-a-fellow-alpaca-enthusiest.-what-is-the-name"></a>

​

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2FxZpbc8gIxUHHEDQxi599%2Fimage.png?alt=media\&token=8bade0c4-e636-4734-a3ca-d88b26754f9b)

**Answer:skype​**

### <mark style="color:blue;">**Q5**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">What is the zip code of the administrator's post?</mark> <a href="#q5-what-is-the-zip-code-of-the-administrators-post" id="q5-what-is-the-zip-code-of-the-administrators-post"></a>

to find the Zip code it would be at the database so we need to read the web data, go to the path: root>Users>Karen>App Data>Local>Google>chrome>User Data>Default

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2FgVMHzn7aL809EWsFQzIg%2Fimage.png?alt=media\&token=6583a67d-78d5-4617-a1d8-e1df5310e3af)

Export the file and then open it by any SQL reader, I used DB browser(SQL Lite)

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2FsRqhgpzAG4p9j5GWOtx2%2Fimage.png?alt=media\&token=86f1c133-9ede-4d29-a375-d098a0bbbc50)

**Answer: 19709**

## <mark style="color:blue;">**Q6**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">What are the initials of the person who contacted the admin user from TAAUSAI?</mark>

now we need to find email files and read the messages.

​

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2FJcROGzRIFFqnyrjZv6eS%2Fimage.png?alt=media\&token=17cfd6a7-4dd4-46d0-b8d2-cf5e48965548)

Export the mail file and open it by any ost reader, I used vMail ost.

sort the messages from the earlier

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2FNyE7fIPjum0jvPESfmYp%2Fimage.png?alt=media\&token=85f7c1dc-a081-4150-818a-95d49d5953e1)

**Answer:MS**

## <mark style="color:blue;">**Q7**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">How much money was TAAUSAI willing to pay upfront?</mark> <a href="#q7-how-much-money-was-taausai-willing-to-pay-upfront" id="q7-how-much-money-was-taausai-willing-to-pay-upfront"></a>

from the previous mail screenshot reply

**Answer:150000**

## <mark style="color:blue;">**Q8**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">What country is the admin user meeting the hacker group in?</mark> <a href="#q8-what-country-is-the-admin-user-meeting-the-hacker-group-in" id="q8-what-country-is-the-admin-user-meeting-the-hacker-group-in"></a>

from the previous mail screenshot reply the destination is "27°22’50.10″N, 33°37’54.62″E"

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2FimZvjWlAz7M6Gd7fun8O%2Fimage.png?alt=media\&token=0c7852c9-1a98-401e-bb62-8c179d17189e)

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2Fd1Y17FOsRXPnlGYOiXOY%2Fimage.png?alt=media\&token=5848e0f7-2b30-46b8-9251-6b9bcb3345b1)

using Google Earth it is EGYPT!

**Answer: EGYPT**

## <mark style="color:blue;">Q9 What is the machine's timezone? (Use the three-letter abbreviation)</mark> <a href="#q9-what-is-the-machines-timezone-use-the-three-letter-abbreviation" id="q9-what-is-the-machines-timezone-use-the-three-letter-abbreviation"></a>

from the Q3 file, go to the path: SYSTEM>ControlSet001>Control>TimeZoneInformation

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2FvoUZ5TZr8GNUDOA7W3ly%2Fimage.png?alt=media\&token=3ffc59cb-74b8-43e2-a694-f78ae6fddb5f)

**Answer: UTC**

## <mark style="color:blue;">Q10 When was AlpacaCare.docx last accessed?</mark> <a href="#q10-when-was-alpacacare.docx-last-accessed" id="q10-when-was-alpacacare.docx-last-accessed"></a>

Search for AlpacaCare.docx and look at the time modified.

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2FTXmSi0PdAL5GUqBhLaFq%2Fimage.png?alt=media\&token=c47bc23f-8e2a-4bfc-a5a2-660a16d0819e)

**Answer: 03/17/2019 09:52 pm**

## <mark style="color:blue;">Q11 There was a second partition on the drive. What is the letter assigned to it?</mark> <a href="#q11-there-was-a-second-partition-on-the-drive.-what-is-the-letter-assigned-to-it" id="q11-there-was-a-second-partition-on-the-drive.-what-is-the-letter-assigned-to-it"></a>

from the Previous file at Q3 search for system>mountedDevices

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2Fi6vUXc9meBcdlc5qGBg6%2Fimage.png?alt=media\&token=f8032863-846e-419f-9ff4-5292a6c22aac)

there is A , C , D try it

**Answer: A**

## <mark style="color:blue;">Q12 What is the answer to the question Company's manager asked Karen?</mark> <a href="#q12-what-is-the-answer-to-the-question-companys-manager-asked-karen" id="q12-what-is-the-answer-to-the-question-companys-manager-asked-karen"></a>

again from the email file at Q

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2FeDodJU3bhdi1nojbgjpJ%2Fimage.png?alt=media\&token=03d4cb77-63a3-41cb-bbc9-3085ec29a79a)

**Answer: TheCardCriesNoMore**

## <mark style="color:blue;">**Q13**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">What is the job position offered to Karen? (3 words, 2 spaces in between)</mark> <a href="#q13-what-is-the-job-position-offered-to-karen-3-words-2-spaces-in-between" id="q13-what-is-the-job-position-offered-to-karen-3-words-2-spaces-in-between"></a>

again from the email file at Q6

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2FXe1MOsDnPhbpLAxl439O%2Fimage.png?alt=media\&token=3d2e3ce3-1400-4d6a-aa80-a0a292a2ac5d)

**Answer: cyber security analyst**

## <mark style="color:blue;">Q14 When was the admin user password last changed?</mark> <a href="#q14-when-was-the-admin-user-password-last-changed" id="q14-when-was-the-admin-user-password-last-changed"></a>

go to the same path as at Q2: root>windows>config

but this time we would open the file by RegRipper 3.0

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2FbRZ78GPFY17EUrEgiJti%2Fimage.png?alt=media\&token=5dc03b6d-2cab-4444-a453-244af74ab63b)

search for Karen as he is the admin and look Pwd Reset Date

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2F2R0fxZZy9tEa6W4LRH05%2Fimage.png?alt=media\&token=2407646a-ee42-466c-a2d7-e78bb010279d)

**Answer: 03/21/2019 19:13:09**

## <mark style="color:blue;">Q15 What version of Chrome is installed on the machine?</mark> <a href="#q15-what-version-of-chrome-is-installed-on-the-machine" id="q15-what-version-of-chrome-is-installed-on-the-machine"></a>

we would use SOFTWARE file from Q2

then open it by Registry editor, then go to the path: WOW6432Node>Microsoft>Windows >CurrentVersion>Uninstall>Google Chrome

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2FvjaoykQMDIr8amddNb1i%2Fimage.png?alt=media\&token=9809ffa8-1905-419c-a807-1156c25e4c3a)

**Answer: 72.0.3626.121**

## <mark style="color:blue;">**Q16**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">What is the HostUrl of Skype?</mark> <a href="#q16-what-is-the-hosturl-of-skype" id="q16-what-is-the-hosturl-of-skype"></a>

to know the host url we have to search in the web history file

so go to the path: root>Users>Karen>App Data>Local>Google>chrome>User Data>Default ,

and export the HISTORY file

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2FSBlwPR43rhp1RRY9q6Zq%2Fimage.png?alt=media\&token=b118c601-d468-4883-b0ed-309e4cede619)

then open it by SQL lite and search for the link that hosts Skype program file

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2FP0MwkR6mtJZXz13OmtLt%2Fimage.png?alt=media\&token=5b52b2c6-3d7a-40db-aaaf-8141676cfdbd)

**Answer:** [**https://download.skype.com/s4l/download/win/Skype-8.41.0.54.exe**](https://download.skype.com/s4l/download/win/Skype-8.41.0.54.exe)

## <mark style="color:blue;">Q17 What is the domain name of the website Karen browsed on Alpaca care that the file AlpacaCare.docx is based on?</mark> <a href="#q17-what-is-the-domain-name-of-the-website-karen-browsed-on-alpaca-care-that-the-file-alpacacare.doc" id="q17-what-is-the-domain-name-of-the-website-karen-browsed-on-alpaca-care-that-the-file-alpacacare.doc"></a>

Mmmmm, let us open the mentioned file and look what would we find <mark style="color:red;">(Careful and open it in an isolation machine or VM)</mark>

![](https://324540987-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fr5hQfrvbdTKlV3abaxvg%2Fuploads%2FxPwQJFtgUO8CChDRmMyb%2Fimage.png?alt=media\&token=1f8a4ea8-8b53-4e36-bf5a-c1a0aa890a9b)

I open it at the ANYRUN site and searched for any hyperlink and that is the answer.

**Answer:** [**palominoalpacafarm.com**](http://palominoalpacafarm.com)
