Skip to content

Speaker UNPrep⚓︎

Elf: Bushy Evergreen
Direct link: speaker terminal
Objective: Open HID Lock


Bushy Evergreen

Ohai! Bushy Evergreen, just trying to get this door open.
It's running some Rust code written by Alabaster Snowball.
I'm pretty sure the password I need for ./door is right in the executable itself.
Isn't there a way to view the human-readable strings in a binary file?


Strings in Binary Files

The strings command is common in Linux and available in Windows as part of SysInternals.

Lookup Table

For polyalphabetic ciphers, if you have control over inputs and visibilty of outputs, lookup tables can save the day.

Letting a Program Decrypt for You

While you have to use the lights program in /home/elf/ to turn the lights on, you can delete parts in /home/elf/lab/.


Welcome message
Help us get into the Speaker Unpreparedness Room!

The door is controlled by ./door, but it needs a password! If you can figure
out the password, it'll open the door right up!

Oh, and if you have extra time, maybe you can turn on the lights with ./lights
activate the vending machines with ./vending-machines? Those are a little
trickier, they have configuration files, but it'd help us a lot!

(You can do one now and come back to do the others later if you want)

We copied edit-able versions of everything into the ./lab/ folder, in case you
want to try EDITING or REMOVING the configuration files to see how the binaries

Note: These don't require low-level reverse engineering, so you can put away IDA
and Ghidra (unless you WANT to use them!)


The password is stored in plaintext in the door binary and can be extracted using strings door | grep pass.

Door unlocked



Bushy Evergreen

That's it! What a great password...
Oh, this might be a good time to mention another lock in the castle.
Santa asked me to ask you to evaluate the security of our new HID lock.
If ever you find yourself in posession of a Proxmark3, click it in your badge to interact with it.
It's a slick device that can read others' badges!


Bushy Evergreen

Hey, you want to help me figure out the light switch too? Those come in handy sometimes.
The password we need is in the lights.conf file, but it seems to be encrypted.
There's another instance of the program and configuration in ~/lab/ you can play around with.
What if we set the user name to an encrypted value?

The username and password for the light application are read from the lights.conf configuration file. Any configuration value starting with E$ is considered encrypted and automatically decrypted. To retrieve the password, edit /home/elf/lab/lights.conf and copy the encrypted password into the username field. Running /home/elf/lab/light will now cause the application to decrypt the encrypted username value so it can be shown as part of the welcome message.

Lights on

To turn the lights on, use the recovered password with the production version of the app, located at /home/elf/light.



Bushy Evergreen

Wow - that worked? I mean, it worked! Hooray for opportunistic decryption, I guess!
Oh, did I mention that the Proxmark can simulate badges? Cool, huh?
There are lots of references online to help.
In fact, there's a talk going on right now!

Vending machine

Bushy Evergreen

So hey, if you want, there's one more challenge.
You see, there's a vending machine in there that the speakers like to use sometimes.
Play around with ./vending_machines in the lab folder.
You know what might be worth trying? Delete or rename the config file and run it.
Then you could set the password yourself to AAAAAAAA or BBBBBBBB.
If the encryption is simple code book or rotation ciphers, you'll be able to roll back the original password.

Deleting the configuration file at /home/elf/lab/vending-machines.json and running /home/elf/lab/vending-machines automatically creates a new configuration containing an encrypted password based on input from the user.

Create config

Trial and error tells us that the encrypted value of a character depends on the character's position in the string. The encryption pattern also repeats itself every 8 positions and only letters and numbers are supported. Using we can create a string covering all 8 possible positions for each characters and use it as the password when generating a new vending machines configuration. /home/elf/lab/vending-machines.json will contain the encrypted version.





Both strings can now be used to decrypt the password by taking each character from the password, finding the 8-character block in Encrypted where this character is located at the same position as in the password, and using the character's overall position in the Encrypted string to retrieve the character at the same location in the Plaintext string. helps to automate this process and decrypts the password stored in /home/elf/vending-machines.json to CandyCane1.

Vending machines on

Release the Snacken! 🍿




Bushy Evergreen

Your lookup table worked - great job! That's one way to defeat a polyalphabetic cipher!
Good luck navigating the rest of the castle.
And that Proxmark thing? Some people scan other people's badges and try those codes at locked doors.
Other people scan one or two and just try to vary room numbers.
Do whatever works best for you!