{"id":45,"date":"2022-08-23T12:57:00","date_gmt":"2022-08-23T12:57:00","guid":{"rendered":"https:\/\/themeger.shop\/wordpress\/katen\/personal-alt\/?p=45"},"modified":"2023-02-03T20:30:34","modified_gmt":"2023-02-03T19:30:34","slug":"facts-about-business-that-will-help-you-success","status":"publish","type":"post","link":"https:\/\/www.mutlu.ch\/?p=45","title":{"rendered":"Kusto Detective Agency: Chall #5"},"content":{"rendered":"\n

Hello. It’s going to happen soon: a big heist. You can stop it if you are quick enough. Find the exact place and time it\u2019s going to happen.
Do it right, and you will be rewarded, do it wrong, and you will miss your chance.<\/em><\/p>\n\n\n\n

Here are some pieces of the information:
The heist team has 4 members. They are very careful, hide well with minimal interaction with the external world. Yet, they use public chat-server for their syncs. The data below was captured from the chat-server: it doesn’t include messages, but still it may be useful. See what you can do to find the IPs the gang uses to communicate.
Once you have their IPs, use my small utility to sneak into their machine\u2019s and find more hints:
https:\/\/sneakinto.z13.web.core.windows.net\/<ip><\/em><\/p>\n\n\n\n

Cheers
El Puente<\/em><\/p>\n\n\n\n

PS:
Feeling uncomfortable and wondering about an elephant in the room: why would I help you?
Nothing escapes you, ha?
Let\u2019s put it this way: we live in a circus full of competition. I can use some of your help, and nothing breaks if you use mine… You see, everything is about symbiosis.
Anyway, what do you have to lose? Look on an illustrated past, fast forward N days and realize the future is here.<\/em><\/p>\n\n\n\n

<\/p>\n\n\n\n

To execute in your cluster:<\/p>\n\n\n\n

.execute database script <|\r\n.create-merge table ChatLogs (Timestamp:datetime, Message:string)  \r\n.ingest into table ChatLogs ('https:\/\/kustodetectiveagency.blob.core.windows.net\/digitown-chat\/log_00000.csv.gz')\r\n.ingest into table ChatLogs ('https:\/\/kustodetectiveagency.blob.core.windows.net\/digitown-chat\/log_00001.csv.gz')<\/code><\/pre>\n\n\n\n
Chall #5 Solution<\/h3>\n\n\n\n
let Joined = ChatLogs\r\n| where Message has \"joined the channel\"\r\n| extend User = extract(\"User \\\\'(.+)\\\\' joined\", 1, Message), Channel = extract(\"joined the channel \\\\'(.+)\\\\'\", 1, Message)\r\n| summarize Count=count() by bin(Timestamp, 1m), Channel\r\n| where Count == 4\r\n| summarize by Channel, Count;\r\nlet Left = ChatLogs\r\n| where Message has \"left the channel\"\r\n| extend User = extract(\"User \\\\'(.+)\\\\' left\", 1, Message), Channel = extract(\"left the channel \\\\'(.+)\\\\'\", 1, Message)\r\n| summarize Count=count() by bin(Timestamp, 1d), Channel\r\n| where Count == 4\r\n| summarize by Channel, Count;\r\nJoined \r\n| join kind=innerunique Left on Channel\r\n| project Channel;\r\n\r\nlet Users= ChatLogs\r\n| where Message has \"joined the channel\"\r\n| extend User = extract(\"User \\\\'(.+)\\\\' joined\", 1, Message), Channel = extract(\"joined the channel \\\\'(.+)\\\\'\", 1, Message)\r\n| where Channel == \"cf053de3c7b\"\r\n| summarize by User;\r\nlet Ips = ChatLogs\r\n| where Message has \"logged in from\"\r\n| extend User = extract(\"User \\\\'(.+)\\\\' logged\", 1, Message), Ip = extract(\"logged in from \\\\'(\\\\d+\\\\.\\\\d+\\\\.\\\\d+\\\\.\\\\d+)\\\\'\", 1, Message)\r\n| summarize by User, Ip;\r\nUsers\r\n| join kind=innerunique Ips on User\r\n| project User, Ip<\/code><\/pre>\n\n\n\n
at this step you need to investigate the 4 users:<\/p>\n\n\n\n
u8819ece9b0\u2003https:\/\/sneakinto.z13.web.core.windows.net\/119.10.30.154<\/a>
uab8088061c\u2003https:\/\/sneakinto.z13.web.core.windows.net\/194.243.69.176<\/a>
uaf9f4fef17\u2003https:\/\/sneakinto.z13.web.core.windows.net\/236.48.237.42<\/a>
uf034c98df3\u2003https:\/\/sneakinto.z13.web.core.windows.net\/146.49.19.37<\/a><\/p>\n\n\n\n
The image below has a date info :<\/p>\n\n\n\n
https:\/\/sneakinto.z13.web.core.windows.net\/119.10.30.154\/message-project-x.png<\/p>\n\n\n\n
\n
\"\"<\/figure>\n<\/figure>\n\n\n\n
The txt file <\/p>\n\n\n\n
\nhttps:\/\/sneakinto.z13.web.core.windows.net\/194.243.69.176\/utils.txt\n<\/div><\/figure>\n\n\n\n
\/\/ Handy utils\r\n\r\n\/\/ 1) Utility to discover secondary messages.\r\n\/\/ Usage: ReadMessage(Message, Key)\r\nlet ReadMessage = (Message:string, Key:string) \r\n{\r\n    let m = Message; let K = Key; let l = toscalar(print s = split(split(K,':')[1], ',') | mv-expand s | summarize make_list(tolong(s)));\r\n    let ma = (i1:long, i2:long) { make_string(repeat(tolong(l[i1])-tolong(l[i2]), 1))}; \r\n    let ms = (d:dynamic, s:long, e:long) { make_string(array_slice(d, s, e)) };   \r\n    let mc = m has '...';\r\n    print s=split(split(replace_regex(m, @'[\\s\\?]+', ' '),substring(K,9,3))[1], ' ')\r\n    | mv-expand with_itemindex=r s to typeof(string) | serialize \r\n    | where r in (l)\r\n    | extend s = iif(r-1 == prev(r), replace_string(strcat(prev(s), s),'o','ou'), s)\r\n    | where (r+1 != next(r))\r\n    | summarize s=strcat_array(make_list(s), iff(mc, '+%2B', ' '))\r\n    | extend k = series_subtract(series_add(to_utf8(K), l), repeat(23, 10))\r\n    | project result=iif(mc, strcat(ms(k,0,3), ma(8,2), ms(k,4,6), ms(l,8,8), ms(k,7,7), ma(8,0), s), s)\r\n};\r\nReadMessage(\r\n```\r\nHi there! How are you?\r\n\r\nPS: \r\nThis is a nice utility that reveals what hidden messages the text may have.\r\nWe may read the message and think: is there anything beyond words?\r\nCan we find it without the utility, or it will become too much of a headache?\r\n```,\r\nh@'dhkl4fva!that:2,9,15,22,31'\r\n)\r\n\r\n\r\n\/\/ 2) Get GEO location from images:\r\n\/\/ Use https:\/\/tool.geoimgr.com\/<\/code><\/pre>\n\n\n\n
ReadMessage(\r\n```\r\nPS:\r\nFeeling uncomfortable and wondering about an elephant in the room: why would I help you?\r\nNothing escapes you, ha?\r\nLet\u2019s put it this way: we live in a circus full of competition. I can use some of your help, and nothing breaks if you use mine... You see, everything is about symbiosis.\r\nAnyway, what do you have to lose? Look on an illustrated past, fast forward N days and realize the future is here.\r\n```,\r\nh@'wytaPUJM!PS:2,7,17,29,42,49,58,59,63'<\/code><\/pre>\n\n\n\n
Search the decoded URL<\/p>\n\n\n\n
https://bing.com?q=uncomfortable+%2Belephant+%2Bescapes+%2Bcircus+%2Bbreaks+%2Beverything+%2Btoulouse+%2Billustrated<\/code><\/pre>\n\n\n\n
We get below URL, which has year info “1891”<\/strong><\/p>\n\n\n\n
\nhttps:\/\/www.bridgemanimages.com\/en\/meaulle\/an-uncomfortable-elephant-the-pachyderm-escapes-from-a-circus-menagerie-breaks-everything-in-the\/nomedium\/asset\/5980623\n<\/div><\/figure>\n\n\n\n
The last piece is picture project x’s taken day and geo location, which can be retrieved from this this picture<\/p>\n\n\n\n
\nhttps:\/\/sneakinto.z13.web.core.windows.net\/146.49.19.37\/image3.jpg\n<\/div><\/figure>\n\n\n\n
Conclusion<\/h3>\n\n\n\n