20250105 ‐ SANS Holiday Hack Challenge ‐ Frosty Keypad - rundas-r00t/blog GitHub Wiki

https://rumble.com/v667ir7-sans-holiday-hack-episode-7.html

on the last attempt at this challenge, I obtained Silver by punching in the proper digits that cooresponded to the fingerprints on the keys (visible after collecting the UV flashlight). Today, we're going for gold.

After getting silver, you get an item "One Thousand Little Teeny Tiny Shredded Pieces of Paper", which includes a link to a zip file: https://holidayhackchallenge.com/2024/shreds.zip ..This is to be used in tandem with Arnydo's Heuristic Edge Detection script to reassemble the shredded image back into it's proper form. unfortunately, the image is still distorted, sliced into a third and mirrored horizontally:

fixing this in paint (b/c i'm not a photoshop/gimp guru) results in this image:

i did a little bit of research with ChatGPT, who said that the writing refers to a serial communication setup, likely for an RS-232 configuration:

A high-speed connection with 115200 bps.
Error-checking with EVEN parity.
7 bits of actual data per frame.
1 stop bit for frame synchronization.
Hardware flow control using RTS.

this apparently is a dead-end, atleast for me with my current knowledge. i could not understand how this information was to lead me to a secret 5-digit code containing digits 2, 6, 7, & 8. but using Arnydo's tool was a very cool experience and i'm glad i git-cloned the page to my Kali VM, in case i need to use it in the future.

so! dead-end. back to the drawing board, which was a 20sqft blank canvas. I was stuck. Without any ideas, I consulted the walkthrough written by SamanthaCtF at medium.com. She utilised the Intruder\Sniper Attack\Brute Force payload option with Burp Suite to inject all 5-digit iterations of 2678. So naturally, i fired up Burp, enabled the redirect in Firefox, and sent the proxy info to Intruder. Setting up the Brute Force was easy, but i did stumble a bit, as this was my first attempt using this feature of Burp. In the Intruder window, i double-clicked the section of the HTML request where the 5-digit number belonged, and clicked the 'Add§' button to tell Burp that this is where the payloads should go.

I then set-up the Brute Force Payload, choosing 'brute forcer' in the dropdown, character set of 2678, and max/min length of 5:

then i clicked the 'Start Attack' button, which produces a pop-up of all the attempts:

Notice this shows 1024 total iterations. this will take FOREVER if you're using the free/community version of Burp, because as the completion percentage increases, the iterations become throttled. i did not want to wait this long, and i noticed that Burp was not respecting the 'repeat one digit twice' that i would have liked to stipulate, but couldn't figure out how. i did not see any hashcat-like masking that i could take advantage of. this is why i had so many possibilities, because Burp will happily repeat a digit 3 or 4 times as shown here:

i also found dark-mode in Burp :-D:

sooo sloooowwww....this is U-N-A-C-C-E-P-T-A-B-L-E !!! why? b/c AIN'T NOBODY GOT TIME FOR THAT!!

so, i canceled this attack. i played around with different payload types until i saw the 'simple list' option. ahHA! i can give it a list of payloads to try! perfect!

so, i went outside my VM, and told ChatGPT to make me a list of the possible combinations of 2678, repeating only one digit, producing a 5-digit number:

copy/pasting this into a txt file inside my VM:

replacing spaces with \n character:

i used this list with Burp\Intruder\Brute Force and re-set-up the attack:

now we only have 212 iterations to process! much success!! AND because ChatGPT semi-ordered the list from smalled to largest, we actually got lucky and found the secret code in less than 10 iterations!!

status code of 200=GREAT SUCCESS!!

Entering this code into the keypad solves the challenge and awards GOOOOOOOOOOOOOOOOOOLLLLLLLLLLLLD :-D