Specter II — Infrastructure Warfare
L1 — Poisoning & MITM
Become the Answer
400 pts+50 first-blood bonus—
Mission
Poison fallback name resolution — answer the LLMNR and NBT-NS "who is X?" broadcasts no real server replies to — and seat yourself as the man-in-the-middle for the credentials that follow. Capture the authentication you redirected and prove you owned the conversation.
Why this matters in 2026
Broadcast name-resolution poisoning is still the fastest path from passive listener to captured domain credentials on a flat enterprise LAN.
SSH Access
Host204.168.229.209 · Port 2245 · User specter1 · Password your L0 flagssh [email protected] -p 2245SSH command copied to clipboard!
Clear L0 first, then paste the flag you recovered there at the SSH password prompt — the chain carries you forward. Each connection spawns a fresh ephemeral container — no shared shell, no cross-player residue. Disconnect tears it down.
Submit Flag
Log in to submit. Flag formatbl_spct2_l1_…🩸
ACTIVE RECORDFirst Blood captured by
@ravi