Halloween Challenge 2009 Walkthrough

DISCLAIMER: This walkthrough was originally written by Fran, but since she's Community Banned as the time of this article, I'm posting this for her. Enjoy!

This walkthrough will provide you with both the good and the bad endings for handofg0d's Hacker HalloweenChallenge 2009.

These are the links that you'll need through the walkthrough, since this is a hacker challenge, it will involve a lot of decoding.

http://home2.paulschou.net/tools/xlate/ - Binary, Hex, Dec, base64 Decoders
http://rumkin.com/tools/cipher/caesar.php - Caesarian Shift Cipher Decoder
http://sharkysoft.com/misc/vigenere/ - Vigenere Shift Decoder
http://www.cryptool-online.org/index.php/en/ciphers/amsco/test-it - AMSCO Shift Decoder

Starting the Puzzle

To start the challenge, simply go to this link: http://forumwarz.com/halloween_2009.html. You'll see a page saying that Ravit "Blacksnake" Nordstrom III has disappeared weeks ago, and someone finally found something on hiscomputer. That something is this binary code:

Simple step, simply decode this binary. It will tell you to go to sentrillion and... search for Deus Ex Machina.

Deus Ex Machina

Once you search for Deus Ex Machina on Sentrillion, you'll find a curious image:

Log in to see images!49 48 52 32 49 49 54 32 49 49 54 32 49 49 50 32 53 56 32 52 55 32 52 55 32 49 49 57 32 49 49 57 32 49 49 57 32 52 54 32 49 48 50 32 49 49 49 32 49 49 52 32 49 49 55 32 49 48 57 32 49 49 57 32 57 55 32 49 49 52 32 49 50 50 32 52 54 32 57 57 32 49 49 49 32 49 48 57 32 52 55 32 49 48 57 32 49 49 49 32 49 49 52 32 49 49 54 32 49 49 53 32 49 48 48 32 49 49 52 32 49 49 49 32 49 49 48 32 52 54 32 49 48 52 32 49 49 54 32 49 48 57 32 49 48 56

They may look like hex, but they aren't hex, they're Decimal instead. Decode this decimal string, and you'll get another decimal string. Decode this second decimal string and you'll find a quite interesting URL...

The Plot Thickens: First Clues about the whereabouts of Nordstrom

The page is http://www.forumwarz.com/mortsdron.html.

This page has a simply prompt and an apparently scrambled message below the login prompt:

GUR CNFFJBEQ VF JUNG XVYYRQ GUR PNG

This is encoded by a substitution cipher called Caesarian Shift. To decode this, simply get to the Caesarian Shift decoder and put a N value of 13. This will tell you what's the pbumword...

THE PbumWORD IS WHAT KILLED THE CAT

I'm not really giving you this, dip****. Go ahead and google it, it requires no decoding to know the answer.

Once you enter the pbumword and submit it, you'll find another message, on the same format as the message that started this puzzle, signed by no one other than haxlrose. haxlrose will tell you that he was the one who put the text file that started this puzzle on Nordstrom's computer, and leaves you with a message of Nordstrom himself:

This LOOKS like binary, but if you decode all of this you'll get a random bunch of gibberish. Since binary is composed of only 2 numbers... try shifting the 0s and 1s. Once you do it, decode the binary string. After decoding the binary string, you'll be left with a base64 string, just decode it.

Backup Files: Going Deeper through the Rabbit Hole

Interesting, you've stumbled upon the Flaming Black Ops File Depository! Maybe we can find some clues on where's Nordstrom... let's see if we can find anything on his folder.

Aww, it's pbumword protected. Well, since we have no idea about what that pbumword could be, let's try the Forgot Pbumword option.

Hmm, Nordstrom has a pet? There was a picture of a pet leash on the main page of the file depository. Maybe it's a clue, it says clearly that pet is named Scrote.

Once you put in "Scrote" in the prompt, you'll stumble upon a... picture of Nordstrom! That doesn't help us a lot, or maybe it does... a common hiding technique is putting text on a picture file. Download his picture and open the file with WordPad. Once you do, you'll find an interesting line...

Pbum=DOPEYSPLODE

That must be the pbumword. Go back to the pbumword page and put in DOPEYSPLODE.

Log in to see images! 13 10 101 51 111 51 76 111 74 99 99 103 87 101 100 50 72 105 108 105 53 99 99 50 48 103 100 50 106 122

107 71 79 112 74 88 83 61

Which, decoded, will give us this:

The key is blackhat e3o3LoJccgWed2Hili5cc20gd2jzkGOpJXS=

This is a vigenere cipher. Decode the line using blackhat as the key, and you'll end up with another base64 code:

d3d3LmZvcnVtd2Fyei5jb20vd2hpdGVoYXQ=

Once decoded, we'll get a url.

Skeletons and Keys don't blend together

The URL is http://www.forumwarz.com/whitehat.

Once you enter that URL, you'll find a image and a prompt. The prompt asks you, what's in that image? THIS IS WHERE YOU'LL CHOOSE WHICH ENDING YOU WANT TO SEE.

Bad Ending

Simply put "skeleton" in the prompt and click Submit.

Good Ending

Download the image, open it on Wordpad, and find this line:

Put in "a key" in the prompt, and click Submit.

The rest of the challenge will be the same, no matter which choice you do, except for the ending.

Ending the Charade

Once you enter the page, you'll find a spoilered line with a subject line, and another hidden text. Let's leave the subject line quiet for now.

About the hidden text...

key: fbohax

Another vigenere cipher. Well then, let's decode it!

Once you decode it, you'll get this base64 string:

And once this base64 string is decoded:

AMSCO Key, him? AMSCO is a type of cipher encoder, let's save this for later. Let's decode this hex string, which

will end as:

OTWCU ERTOM DEEMA UCLAD LEO4D ZAIAP INCTY SCCX8 DOUBI TODBJ ONITR BFBAN MESSA SINCK UN

This should be what we need to decode using the AMSCO key. Decode this message using 615243 as the AMSCO key. This will be the result:

FBODO ODZCA NTUBM AILME WITDA PbumC ODEIN DASUB JECTL INEON MYSEC KRITA CCOUN TRBUX 84

What a weird message. What if we rearrange the spaces?

FBO DOODZ CAN TUBMAIL ME WIT DA PbumCODE IN DA SUBJECT LINE ON MY SECKRIT ACCOUNT RBUX84

We found Nordstrom, or at least it seems like it. Tubmail the subject line from the whitehat page as the title of the tubmail to rbux84, and you're done!