Operate the Santavator⚓︎
Difficulty:
Direct link: elevator website
Terminal hint: Unscape Tmux and The Elf C0de
Objective⚓︎
Request
Talk to Pepper Minstix in the entryway to get some hints about the Santavator.
Sparkle Redberry
Hey hey, Sparkle Redberry here!
The Santavator is on the fritz. Something with the wiring is grinchy, but maybe you can rig something up?
Here's the key! Good luck!
With that key, you can look under the panel and see the Super Santavator Sparkle Stream (S4).
To get to different floors, you'll need to power the various colored receivers.
Hints⚓︎
Santavator Operations
It's really more art than science. The goal is to put the right colored light into the receivers on the left and top of the panel.
Santavator Bypass
There may be a way to bypass the Santavator S4 game with the browser console...
Solution⚓︎
Sparkle Redberry gives you a key to open up the Santavator panel which will reveal the Super Santavator Sparkle Stream (S4) and the yellow, red, and green receivers. There's 2 main ways to solve this challenge. Either find items and arrange them to color and direct the stream towards the receivers. Alternatively, you can use the app.js
JavaScript code to bypass the Santavator. This write-up focuses on the most basic solution to complete the challenge by using 2 items to activate a single floor.
Start by talking to Sparkle Redberry who will hand you a key to open the Santavator panel. You'll find a hex nut in front of the Santavator and a green light bulb in the top left corner of the Courtyard. Open the Santavator panel by clicking on the key and use the hex nut and green light bulb as shown in the image below.
Activating the green receiver will get you to the second floor where the talks are held. You can now find additional items like the red light bulb in the top right corner of the Talks Lobby. Since the hex nut already splits the stream towards the red and green receivers, adding the red light bulb in front of the red receiver will get you access to the Workshop and Roof. Below is an overview of where the different items are located.
Item | Floor | Room |
---|---|---|
Candycane | 1 | In front of the castle door on the Front Lawn |
Hex nut | 1 | In front of the Santavator in the Entryway |
Hex nut | 1 | Behind the table in the Dining Room (hidden from view) |
Santavator key | 1 | Received from Sparkle Redberry |
Green light bulb | 1 | Top left corner of the Courtyard |
Red light bulb | 2 | Top right corner of the Talks Lobby |
Yellow light bulb | R | Top left corner of the Netwars Room |
Large marble | 1.5 | Workshop Room |
Small marble | R | Bottom right corner of the Netwars Room (hidden from view) |
Proxmark | 1.5 | Wrapping Room |
Rubber ball | 1.5 | Wrapping Room |
Elevator 1.5 button | 2 | Speaker UNPreparedness Room |
Portals | 2 | Dropped by Release the Snacken |
Answer
Use the hex nut found in front of the Santavator and the green light bulb found in the Courtyard to power the green receiver.
Bypassing the Santavator
Another option to get to the other floors, except for Santa's office which also requires a fingerprint sensor bypass, is by analysing app.js
.
Once the proper particle amount for each stream color has been collected (line 3), the renderTraps()
function will turn on the LED by adding the on
CSS class to the LED HTML element (line 6) and change the value of the associated color LED in the powered
array to true (line 7). Vice versa, when the stream levels drop too low the LED is turned off by removing the on
CSS class (line 6) and the value in the powered
array changes back to false (line 7).
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
|
Based on which combination of LEDs are turned on at any given time, the associated buttons will be powered on as well. This is handled by the remainder of the renderTraps()
function which uses the state of the powered
array to add a powered
CSS class to the button elements (lines 10-16). Because the renderTraps()
function is continuously called as the scene is being rendered by the render()
function, any manual HTML edits to these buttons will be reverted by the renderTraps()
function as soon as the proper conditions aren't met anymore.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
|
There's a workaround though. The first thing the render()
function does is check the value of a stop
variable (lines 2-4). If stop
is true, we exit from the function and renderTraps()
isn't called at all (line 13). This freezes the stream and prevents any manual HTML changes from being reverted.
The way app.js
handles showing button 1.5 is by checking if the challenge URL contains a workshop-button
value as part of the tokens
GET request parameter. If that's the case a found
CSS class will be added to the image identified by the f15btn
CSS class (line 4), which adds the button to the panel.
1 2 3 4 5 |
|
We can now bypass the Super Santavator Sparkle Stream by taking the following actions:
- Open the web browser's developer tools
- Open the panel to expose the circuitry
- Enter
stop = true
in the JavaScript console to freeze the stream - Close the panel again
- Add a
found
CSS class to thef15btn
image so it appears - Add a
powered
CSS class to each of the button elements - Press the button for the desired floor