Hello there and welcome to my 2021 SANS Holiday Hack Challenge write-up. Had you asked me at the beginning of 2021 if I'd be submitting a write-up, I might've hesitated. But each year, as the KringleCon chatter starts to build, so does my excitement, and it just reels me right back in. So, once again, I packed a suitcase, booked a flight, and headed to the North Pole to meet up with Santa, the Elves, and all my KringleCon friends!
Similar to last year, there's 3 main sections. This page which contains the introduction, answers, the overall narrative, and final conclusion. Objectives contains the write-ups for the main objectives for which an answer had to be submitted and Terminal Hints has the write-ups for the additional side challenges which provide you with hints to help solve the main objectives.
As always, there's a few things worth highlighting like getting root on the IMDS Exploration terminal, bruteforcing the Frostavator, the minor mistake in Prof. Petabyte's FPGA presentation, a bit of cheating here and there, solving terminals with one-liners, the behind the scenes of the WiFi dongle, the very incomplete list of Easter eggs, and all of the custom scripts used throughout the game.
50-page submission limit
Each year there's a huge number of write-ups that need to be reviewed by the SANS and Counter Hack teams. To find a good middle ground between preventing information overload and creating a write-up that can stand on its own as a learning resource, some parts, like the navigation tip below, are collapsed by default. Skipping over these will not take away from understanding the overall solution, but feel free to expand them to get some additional information.
Even with less than 50 pages, there's still quite a bit of information to read through. To make things a little easier, you can use P or , to go to the previous section, N or . to navigate to the next section, and S, F, or / to open up the search dialog.
TL;DR if you keep pressing N or . from this point forward, you'll hit all the content in the right order!
1. KringleCon Orientation -
Follow Jingle Ringford's instructions to open the gate.
3. Thaw Frost Tower's Entrance -
Connect to the FROST-Nidus-Setup SSID and use the
/api/cooler endpoint to turn up the heat.
4. Slot Machine Investigation -
5. Strange USB Device -
6. Shellcode Primer -
7. Printer Exploitation -
8. Kerberoasting on an Open Fire -
9. Splunk! -
10. Now Hiring! -
11. Customer Complaint Analysis -
12. Frost Tower Website Checkup -
13. FPGA Programming -
Write an FPGA program which can generate any requested output frequency.
|Jingle Ringford||NP||-||Orientation||KringleCon Orientation||O|
|Tangle Coalbox||KC||1||Courtyard||Where is Caramel Santaigo?||O|
|Piney Sappington||KC||1||Courtyard||Document Analysis||T|
|Grimy McTrollkins||NP||-||The North Pole||Thaw Frost Tower's Entrance||O|
|Greasy GopherGuts||NP||-||The North Pole||Grepping for Gold||T|
|Hubris Selfington||FF||1||Frost Tower Lobby||Slot Machine Investigation||O|
|Noel Boetie||NP||-||The North Pole||Logic Munchers||T|
|Morcel Nougat||KC||2||Speaker UNprep. Room||Strange USB Device||O|
|Jewel Loggins||KC||2||Talks Lobby||IPv6 Sandbox||T|
|Ruby Cyster||FF||16||Jack's Office||Shellcode Primer, Printer Exploitation||O|
|Chimney Scissorsticks||KC||R||NetWars||Holiday Hero||T|
|Eve Snowshoes||KC||3||Santa's office||HoHo... No, Kerberoasting on an Open Fire||T, O|
|Angel Candysalt||KC||1||Great Room||Splunk!||O|
|Fitzy Shortstack||KC||1||Entry||Yara Analysis||T|
|Noxious O’Dor||FF||16||Jack's Restroom||IMDS Exploration, Now Hiring!||T, O|
|Pat Tronizer||FF||2||Talks Lobby||Customer Complaint Analysis||O|
|Tinsel Upatree||KC||1||Kitchen||Strace Ltrace Retrace||T|
|Ingreta Tude||FF||16||Jack's Studio||Frost Tower Website Checkup||O|
|Ribb Bonbowford||KC||1||Dining Room||The Elf C0de||T|
|Crunchy Squishter||FF||R||Frost Tower Rooftop||FPGA Programming||O|
|Grody Goiterson||FF||R||Frost tower Lobby||Frostavator||T|
Listen children to a story that was written in the cold
'Bout a Kringle and his castle hosting hackers, meek and bold
Then from somewhere came another, built his tower tall and proud
Surely he, our Frosty villain hides intentions 'neath a shroud
So begins Jack's reckless mission: gather trolls to win a war
Build a con that's fresh and shiny, has this yet been done before?
Is his Fest more feint than folly? Some have noticed subtle clues
Running 'round and raiding repos, stealing Santa's Don'ts and Do's
Misdirected, scheming, grasping, Frost intends to seize the day
Funding research with a gift shop, can Frost build the better sleigh?
Lo, we find unlikely allies: trolls within Jack's own command
Doubting Frost and searching motive, questioning his dark demand
Is our Jack just lost and rotten - one more outlaw stomping toes?
Why then must we piece together cludgy, wacky radios?
With this object from the heavens, Frost must know his cover's blown
Hearkening from distant planet! We the heroes should have known
Go ahead and hack your neighbor, go ahead and phish a friend
Do it in the name of holidays, you can justify it at year's end
There won't be any retweets praising you, come disclosure day
But on the snowy evening after? Still Kris Kringle rides the sleigh
We come in peace! I am Icy Sickles from ice Planet Frost.
Many centuries ago, we Frostian trolls sent an expedition to study your planet and peoples.
Jack Frost, scion of Planet Frost’s ruling family, captained that long-ago mission, which carried many hundreds of our people to your planet to conduct our research.
I am Erin Fection, the pilot of this interstellar spaceship.
Our first expedition established a base in the land of Oz, where our researchers became known as “Munchkins.”
We received a message from them long ago about a Great Schism, where the Frostian expedition split into two warring factions: Munchkins and Elves.
Thankfully, they managed to establish an uneasy peace by relocating the Elves to the North Pole.
Since then, we have heard nothing from the expedition. They went interstellar radio silent. Until NOW.
I am Buttercup, Princess of ice Planet Frost.
Thanks to your help, we received the message from the device summoning us back to Earth to address the recent unpleasantness.
We had no idea that Jack Frost would cause such trouble! We sincerely apologize.
We will take Jack back home to Planet Frost, along with all the other trolls.
The Elves and Munchkins, of course, can remain if they opt to do so.
Fear not, we WILL bring Jack and any guilty trolls to justice for their infractions. They will not bother your planet any longer.
Again, we apologize for all the troubles he has caused, and we sincerely THANK YOU for your help!
And, now that you've helped us solve everything, feel free to show off your skills with some swag - only for our victors!
I was just having a little fun. C’mon, man!
And, I was just getting started! I had such big plans!
I don’t want to go home!!!
The Frostians have reached out to me via video link. They’ve explained to me all that has happened.
I’d like to thank you for your truly excellent work in foiling Jack’s plans and ensuring that he is finally brought to justice.
On behalf of all of us here at the North Pole, we wish you and yours a happy and healthy Holiday Season.
Thank you and HAPPY HOLIDAYS from me and all of the elves. Ho Ho Ho!