The Steam Tunnels
Hack that trail!
Instructions from the badge:
Gain access to the steam tunnels. Who took the turtle doves? Please tell us their first and last name. For hints on achieving this objective, please visit Minty’s dorm room and talk with Minty Candy Cane.
You are told you can find hints in the dorm, so you head there, but before you can enter, you need to solve the PIN at the entrance. Luckily there was an Elf who was ready to provide some hints for this:
Hey kid, it’s me, Tangle Coalbox. I’m sleuthing again, and I could use your help. Ya see, this here number lock’s been popped by someone. I think I know who, but it’d sure be great if you could open this up for me. I’ve got a few clues for you.
- One digit is repeated once.
- The code is a prime number.
- You can probably tell by looking at the keypad which buttons are used.
To find all the primes which adhere to these constraints, I wrote a small python script that produced the below candidates:
1307
1373
1733
3137
3371
3701
7013
7103
7331
Then I randomly tried the numbers from the bottom of the list, and the first one already opened the door. So finally you are in the dorm and you notice the same PIN is written on the wall… :D
Some hint from Minty:
Hi! I’m Minty Candycane! I just LOVE this old game! I found it on a 5 1/4” floppy in the attic. You should give it a go! If you get stuck at all, check out this year’s talks. One is about web application penetration testing. Good luck, and don’t get dysentery!
So if you click on the Terminal, it will open a browser frame with a game called The Holiday Hack Trail. You are tasked to solve it. There are 3 modes, Easy, Medium and Hard. As you increase difficulty, you need to solve the same problem with less and less resources (money). On Easy mode, it was rather trivial, on Medium it needed some effort, while on Hard I am not sure if it is possible to solve without some hacking. Instructions on the starting screen:
It's nearly time for Kringlecon.
You need to get there before the 25th day of December!
Hitch up your reindeer, gather your supplies, and do your best to make it to the North Pole on time.
Good luck!
If you select Easy mode, you will notice that the URL contains a bunch of parameters. Apparently, the game in this mode is controlled via URL parameters, which are easy to mess with
hhc://trail.hhc/store/?difficulty=0&distance=0&money=5000&pace=0&curmonth=7&curday=1&reindeer=2&runners=2&ammo=100&meds=20&food=400&name0=Ryan&health0=100&cond0=0&causeofdeath0=&deathday0=0&deathmonth0=0&name1=Vlad&health1=100&cond1=0&causeofdeath1=&deathday1=0&deathmonth1=0&name2=Jane&health2=100&cond2=0&causeofdeath2=&deathday2=0&deathmonth2=0&name3=Chris&health3=100&cond3=0&causeofdeath3=&deathday3=0&deathmonth3=0
Particularly interesting is the second parameter: distance. Turns out if you start the game, then modify this parameter, your position will suddenly jump to the position you entered for this param. The goal is to travel 8000 units of distance. If you modify it to be 7999 and then hit Go one more time, then you win straight away. On Medium and Hard modes, this hack is not available however, but for our purposes, this was enough, as solving it on Easy mode already gives you the hints necessary to progress to solving the main Objective.
You made it - congrats! Have you played with the key grinder in my room? Check it out! It turns out: if you have a good image of a key, you can physically copy it. Maybe you’ll see someone hopping around with a key here on campus. Sometimes you can find it in the Network tab of the browser console. Deviant has a great talk on it at this year’s Con. He even has a collection of key bitting templates for common vendors like Kwikset, Schlage, and Yale.
So the room which hides the entrance to the Steam Tunnels is at the end of the hallway where Minty is, and it seems you will need to do some key crafting. Also mentioned by Minty is a KringleCon talk by Deviant Ollam, about physical security around keys and how can one go about copying them.
Bitting those keys!
So once you enter the room, you will notice a small key bitting device on the table, which is useful for crafting keys. You will need it for opening the door to the Steam Tunnels, which hides in the next room, where that character is hopping into:
Before you start working on the challenge, be sure to spend a moment to appreciate the decoration. It is quite nicely done! So then when you are ready, it’s useful to consider the hint by Minty again. Minty mentioned previously, that sometimes it’s enough to have a good image of a key, in order to copy it, not necessary to have physical access. If you watched the youtube video from the hint, then you will definitely know what to do.
The last thing you need to realise is that the character hopping into the room, wears a key on his waist. If you open the Developer tools of your browser and check the source of that object you will discover that he is the Krampus and if you want to see his key properly, just visit:
https://2019.kringlecon.com/images/avatars/elves/krampus.png
Once you have the imge and get a good look at the key you can decipher it and find the correct bitting: 122520. If you enter this into the bitting machine at key.elfu.org then you will get a key which opens the entrance to the Steam Tunnels. Once you find your way to the end of the Steam Tunnel, you will meet again with Krampus Hollyfeld that is the answer to Objective 7.
Hello there! I’m Krampus Hollyfeld. I maintain the steam tunnels underneath Elf U, Keeping all the elves warm and jolly. Though I spend my time in the tunnels and smoke, In this whole wide world, there’s no happier bloke!