[Day 11] Networking Where Are The Reindeers? | Advent of Cyber 3 (2021)

Febi Mudiyanto
3 min readDec 12, 2021


Today is about network again and a little bit of a database query. I am very interested in learning database, because I rarely touch with the database.

Let’s expose the database..

# There is an open port related to MS SQL Server accessible over the network. What is the port number?


I use -sS for stealth scan, and -sV to see the version and -Pn for break the ping blocking.

# If the connection is successful, you will get a prompt. What is the prompt that you have received?


# We can see four columns in the table displayed above: id, first (name), last (name), and nickname. What is the first name of the reindeer of id 9?


I use SELECT * FROM reindeer.dbo.names; but you can also use SELECT * FROM reindeer.dbo.names WHERE id=9;

# Check the table schedule. What is the destination of the trip scheduled on December 7?


With the same way.

# Check the table presents. What is the quantity available for the present “Power Bank”?


# There is a flag hidden in the grinch user's home directory. What are its contents?


Check for the command xp_cmdshell first.

And as you can see, the flag.txt hide in the Grinch’s Documents folder.

# Congratulations, the flag you have recovered contains the password of McDatabaseAdmin! In this task, we learned how to use sqsh to interact with a MS SQL Server. We learned that if xp_cmdshell is enabled, we can execute system commands and read the output using sqsh.

just click Question Done


I learn some new knowledge today, it’s about MS SQL Server Vulnerabilities, xp_cmdshell and sqsh command. I am very happy, and thanks.



Febi Mudiyanto

Just a Learner and CTFs Player on a quite night.