Cracking the 2023 SANS Holiday Hack Challenge

This write-up recaps solutions to SANS Holiday Hack Challenge 2023, covering AI hallucination detection in a pentest report; Linux SUID privilege escalation; Azure Function and managed identity abuse to obtain SSH certificates; AD CS abuse with Impacket/Certipy; voice deepfake passphrase bypass; CubeSat/NMF operations to retrieve camera imagery; and exploitation via SQL injection and Java deserialization—highlighting common misconfigurations and offensive TTPs in a CTF setting.