Skip to content


Close Encounters of the Frostian Kind


OMG! Let's go!!! Hello there and welcome to my 2021 SANS Holiday Hack Challenge write-up. Had you asked me at the beginning of 2021 if I'd be submitting a write-up, I might've hesitated. But each year, as the KringleCon chatter starts to build, so does my excitement, and it just reels me right back in. So, once again, I packed a suitcase, booked a flight, and headed to the North Pole to meet up with Santa, the Elves, and all my KringleCon friends! 🤗

Similar to last year, there's 3 main sections. This page which contains the introduction, answers, the overall narrative, and final conclusion. Objectives contains the write-ups for the main objectives for which an answer had to be submitted and Terminal Hints has the write-ups for the additional side challenges which provide you with hints to help solve the main objectives.

As always, there's a few things worth highlighting like getting root on the IMDS Exploration terminal, bruteforcing the Frostavator, the minor mistake in Prof. Petabyte's FPGA presentation, a bit of cheating here and there, solving terminals with one-liners, the behind the scenes of the WiFi dongle, the very incomplete list of Easter eggs, and all of the custom scripts used throughout the game.

50-page submission limit

Each year there's a huge number of write-ups that need to be reviewed by the SANS and Counter Hack teams. To find a good middle ground between preventing information overload and creating a write-up that can stand on its own as a learning resource, some parts, like the navigation tip below, are collapsed by default. Skipping over these will not take away from understanding the overall solution, but feel free to expand them to get some additional information.

Navigation tip

Even with less than 50 pages, there's still quite a bit of information to read through. To make things a little easier, you can use P or , to go to the previous section, N or . to navigate to the next section, and S, F, or / to open up the search dialog.

TL;DR if you keep pressing N or . from this point forward, you'll hit all the content in the right order! 😄


1. KringleCon Orientation -

Follow Jingle Ringford's instructions to open the gate.

2. Where in the World is Caramel Santaigo? -

Play the game or decode the Cookiepella cookie.

3. Thaw Frost Tower's Entrance -

Connect to the FROST-Nidus-Setup SSID and use the /api/cooler endpoint to turn up the heat.

5. Strange USB Device -


6. Shellcode Primer -

cyber security knowledge

7. Printer Exploitation -


8. Kerberoasting on an Open Fire -


9. Splunk! -


11. Customer Complaint Analysis -

Flud Hagg Yaqh

12. Frost Tower Website Checkup -


13. FPGA Programming -

Write an FPGA program which can generate any requested output frequency.

NPC locations⚓︎

Name Event Floor Area Challenge Type
Jingle Ringford NP - Orientation KringleCon Orientation O
Tangle Coalbox KC 1 Courtyard Where is Caramel Santaigo? O
Piney Sappington KC 1 Courtyard Document Analysis T
Grimy McTrollkins NP - The North Pole Thaw Frost Tower's Entrance O
Greasy GopherGuts NP - The North Pole Grepping for Gold T
Hubris Selfington FF 1 Frost Tower Lobby Slot Machine Investigation O
Noel Boetie NP - The North Pole Logic Munchers T
Morcel Nougat KC 2 Speaker UNprep. Room Strange USB Device O
Jewel Loggins KC 2 Talks Lobby IPv6 Sandbox T
Ruby Cyster FF 16 Jack's Office Shellcode Primer, Printer Exploitation O
Chimney Scissorsticks KC R NetWars Holiday Hero T
Eve Snowshoes KC 3 Santa's office HoHo... No, Kerberoasting on an Open Fire T, O
Angel Candysalt KC 1 Great Room Splunk! O
Fitzy Shortstack KC 1 Entry Yara Analysis T
Noxious O’Dor FF 16 Jack's Restroom IMDS Exploration, Now Hiring! T, O
Pat Tronizer FF 2 Talks Lobby Customer Complaint Analysis O
Tinsel Upatree KC 1 Kitchen Strace Ltrace Retrace T
Ingreta Tude FF 16 Jack's Studio Frost Tower Website Checkup O
Ribb Bonbowford KC 1 Dining Room The Elf C0de T
Crunchy Squishter FF R Frost Tower Rooftop FPGA Programming O
Grody Goiterson FF R Frost tower Lobby Frostavator T



Listen children to a story that was written in the cold

'Bout a Kringle and his castle hosting hackers, meek and bold

Then from somewhere came another, built his tower tall and proud

Surely he, our Frosty villain hides intentions 'neath a shroud

So begins Jack's reckless mission: gather trolls to win a war

Build a con that's fresh and shiny, has this yet been done before?

Is his Fest more feint than folly? Some have noticed subtle clues

Running 'round and raiding repos, stealing Santa's Don'ts and Do's

Misdirected, scheming, grasping, Frost intends to seize the day

Funding research with a gift shop, can Frost build the better sleigh?

Lo, we find unlikely allies: trolls within Jack's own command

Doubting Frost and searching motive, questioning his dark demand

Is our Jack just lost and rotten - one more outlaw stomping toes?

Why then must we piece together cludgy, wacky radios?

With this object from the heavens, Frost must know his cover's blown

Hearkening from distant planet! We the heroes should have known

Go ahead and hack your neighbor, go ahead and phish a friend

Do it in the name of holidays, you can justify it at year's end

There won't be any retweets praising you, come disclosure day

But on the snowy evening after? Still Kris Kringle rides the sleigh


Icy Sickles

We come in peace! I am Icy Sickles from ice Planet Frost.
Many centuries ago, we Frostian trolls sent an expedition to study your planet and peoples.
Jack Frost, scion of Planet Frost’s ruling family, captained that long-ago mission, which carried many hundreds of our people to your planet to conduct our research.

Erin Fection

I am Erin Fection, the pilot of this interstellar spaceship.
Our first expedition established a base in the land of Oz, where our researchers became known as “Munchkins.”
We received a message from them long ago about a Great Schism, where the Frostian expedition split into two warring factions: Munchkins and Elves.
Thankfully, they managed to establish an uneasy peace by relocating the Elves to the North Pole.
Since then, we have heard nothing from the expedition. They went interstellar radio silent. Until NOW.


I am Buttercup, Princess of ice Planet Frost.
Thanks to your help, we received the message from the device summoning us back to Earth to address the recent unpleasantness.
We had no idea that Jack Frost would cause such trouble! We sincerely apologize.
We will take Jack back home to Planet Frost, along with all the other trolls.
The Elves and Munchkins, of course, can remain if they opt to do so.
Fear not, we WILL bring Jack and any guilty trolls to justice for their infractions. They will not bother your planet any longer.
Again, we apologize for all the troubles he has caused, and we sincerely THANK YOU for your help!
And, now that you've helped us solve everything, feel free to show off your skills with some swag - only for our victors!

Jack Frost

I was just having a little fun. C’mon, man!
And, I was just getting started! I had such big plans!
I don’t want to go home!!!


The Frostians have reached out to me via video link. They’ve explained to me all that has happened.
I’d like to thank you for your truly excellent work in foiling Jack’s plans and ensuring that he is finally brought to justice.
On behalf of all of us here at the North Pole, we wish you and yours a happy and healthy Holiday Season.
Thank you and HAPPY HOLIDAYS from me and all of the elves. Ho Ho Ho!