https://tryhackme.com/room/yara-aoc2025-q9w1e3y5u7
Created by: tryhackme, krotovolb
https://www.youtube.com/watch?v=NAYtCSUHR8M is a great walkthrough video; he also gives a shoutout to regex 101: https://regex101.com/, something that helped me in this room, and I bookmarked as well for future use cases!
“When McSkidy went missing, there was chaos and uncertainty at The Best Festival Company (TBFC). However, even in her disappearance, McSkidy was trying to help the TBFC blue team. Taking a page out of the crisis communication process, McSkidy sent what looks like a bunch of images to the blue team from an anonymous location. These images looked like they were related to Easter preparations, but they contained a message sent by McSkidy. The crisis communication process outlines that a message might be sent through a folder of images containing hidden messages that can be decoded if you know the keyword. The blue team has to create a YARA rule that runs on the directory containing the images. The YARA rule must trigger on a keyword followed by a code word. After extracting all the code words in ascending order, the blue team will be able to decode the message.”
After reading the material, we are presented with our technical challenge: To make our own YARA rule. To the terminal we go! I made a file from nano called TBFC_Egg_Buster. The condition is this:
I added additional strings to what was already there. I’m not sure if this will mess with it, but we will find out. I was met with a syntax error! I ended up copying and pasting the rule without the ending bracket. Now that it’s fixed, I tried again.
“How many images contain the string TBFC?”
It will show duplicates, so if you count them with that in mind, it will be 5 images.
“What regex would you use to match a string that begins with TBFC: followed by one or more alphanumeric ASCII characters?”
“What is the message sent by McSkidy?” Copy and paste this into your Nano file and re-run it to obtain the message! It will be out of order, but we can figure that out!
Snippet highlights:
