Past Challenges: 2012

The Year Without a Santa... Hack.

A Miser Brothers Weather Control System Challenge
By Ed Skoudis & Tim Medin

The world faced an unmitigated holiday disaster. Santa Claus, plagued by a bad head cold, felt unloved, unneeded, and, worst of all, unbelieved-in. He wearily announced that he was taking a year off, plunging children around the globe into deep despair. "Warn the people," Santa sighed, "Tell the papers. I'm much too tired... for Christmas capers."

To rescue the dire situation, Mrs. Claus hatched a plan, cunning in its details and stunning in its sheer audacity. She dispatched two kindly elves, Mr. Jingle Bells and Mr. Jangle Bells (no relation), to search the planet and find examples of Christmas spirit to shake Santa to his senses. "Scout up some good will, and show him some proof that somebody cares. Santa will change his mind and PRESTO! Christmas is on again." Flying on their trusty steed, the fledgling reindeer, Vixen, the Bells boys headed south.

In plotting their path, the inexperienced Vixen made a tragic miscalculation. She flew directly between the feuding Miser brothers! Snow Miser, who controls the weather in the cold regions of the world, was engaged in eternal battle with his stepbrother, Heat Miser, master of Earth's hot climates. Despite Vixen's valiant efforts to dodge the vicious battle, she and the elves were forced down over Southtown, collateral damage in a war both hot and cold.

In a series of missteps so contrived they appeared to come from a children's holiday television special, Vixen found herself imprisoned in Southtown's dog pound, with no hope of escape. Jingle and Jangle appealed to the highest authority in the land, Southtown's mustachioed mayor, to pardon Vixen. The mayor offered his mind-boggling terms, "You elves can work magic and all that. You conjure up a good, old-fashioned white Christmas for us right here in Southtown... and I'll spring your reindeer from the hoosegow!" The only problem? Southtown was located deep inside Heat Miser's territory, the crown jewel of his fiery empire, a location that hadn't seen snow in over a century.

With her plan in shambles, Mrs. Claus gathered the elves, regrouped, and undauntedly doubled down in her bold approach. She'd try to convince Snow Miser himself to conjure up a wintry blast for Southtown. When they arrived at his snow castle, Snow Miser and his gaggle of curiously identical minions regaled Mrs. Claus with his favorite autobiographical tune:

Although Snow Miser was cool with Mrs. Claus' proffered plan, he ultimately had to put her proposal on ice. "Hold it! Hold it! No can do, Mrs. C. The South is under the control of my step brother, Heat Miser." Unless they could chill out Snow Miser's kin, the plan would go nowhere. The next step in her twisted scheme became obvious: a quick trip down to the dreaded depths of Heat Miser's volcano, which triggered the old devil to perform his favorite song and dance number, a strangely familiar anthem:

When Mrs. Claus requested a snowy Southtown, Heat Miser burned with rage, rejecting the idea out of hand, his creepy hair glowing all ablaze. But, after stewing over the idea atop his hot seat, he eventually warmed to it, but only under one heated condition: he be allowed to melt the North Pole itself with sultry, tropical weather. They telephoned Snow Miser on the hotline to discuss the exchange. A predictable battle ensued, with neither side offering any ground in the negotiations.

Exasperated, Mrs. Claus had no choice but to appeal to a higher authority, Mother Nature herself. After considering Mrs. Claus' good-hearted plea and desire to save Christmas, Mother Nature insisted that her boys agree to the exchange. Heat Miser must allow it to snow in Southtown, while Snow Miser was obligated to allow a little warm weather at the North Pole. "We'll get right on it, Mother Dear," the Miser Brothers announced in sing-song unison.

And, that's where things start to get very interesting.

You see, Dear Reader, the naughty Miser Brothers did not EXACTLY follow Mother Nature's instructions. Instead, Snow Miser put his own unique spin on how to implement their mother's wishes.

"Hey, Hot Head, I've got an idea," Snow Miser taunted his brother.

Heat Miser retorted, "Let's just get this over with, you old blizzard. Give me access to your Cold Weather Control System, the Chiller, and I'll give you access to the controls of my heat machine, the Heater."

"Chill out for a minute, you flaming fool. I've got a more elegant idea. Instead of just exchanging access over our weather control systems, why don't we sweeten this whole endeavor with a little friendly hacking competition, a cool challenge, if you will," Snow miser proposed with a big toothy smile.

Heat Miser liked what he was hearing, "Sounds interesting. We could do a hot little capture the flag contest!"

"Exactly," exclaimed Snow Miser, "I'll try to hack into your Warm Weather Control System and shut it down, while powering up my Cold Weather Control System over Southtown, resulting in an icily beautiful snow storm in Southtown. At the same time, you can try to hack my Cold Weather Control System to shut it down as you activate your Warmer to create a miserably warm day at the North Pole."

"What a sizzling idea! I'm in," said Heat Miser. "We'll start with our current state, full blast warm on Southtown and super cold on the North Pole. Call it Zone 0 in our competition. Each of us will try to hack through five levels of challenges, gradually shutting down the other's machine as we ramp up our own. You'll have your Zone 1 challenge, which will deactivate the first part of the Chiller, and I'll have my Zone 1 challenge, which will deactivate the first part of the Heater. When either of us completes Level 5, we'll have achieved our goal, and win!" Snow Miser loved the idea, responding shiningly, "May the best Miser win!"

The brothers agreed to the following rules of engagement and scope, which anyone participating in this challenge is obligated to follow:

• No denial of service attacks against the targets or other users
• No brute force attacks
• Application-level attacks only; no attacks against the underlying operating system
• Attack only the individual web applications located at heatmiser.counterhack.com and snowmiser.counterhack.com

The two Miser brothers decided to take their discussions onto Twitter as they taunted each other while trying to gain control of their stepbrother's machine. Snow Miser's Twitter handle is @sn0w_m1s3r, Heat Miser's is @h34t_m1s3r, and Mother Nature's handle is @m0th3r_n4tur3.

After several hours of failing to reach Zone 5 in their respective target systems, the brothers were faced with yet another unexpected turn of events. Mother Nature had gotten wind of their proposed competition, and was quite unsettled that they hadn't simply followed the request of Mrs. Claus.

"Boys, boys, boys, I am so very disappointed with you," Mother Nature sighed. "I banish each of you to your lairs for a whole weekend! You're grounded." The Misers sulked off to their castles in disappointment, their contest left unfinished.

And, that's where you get involved, Dear Reader. You see, in her rush to punish her boys, Mother Nature forgot about Mrs. Claus' overall goal, namely to save Christmas by causing it to snow in Southtown, while balancing the force by bringing along a little warm weather to the North Pole. You'll have to pick up where the Miser Brothers left off, gaining control over Snow Miser's Chiller machine and Heat Miser's Heater machine, advancing each from Zone 0 through Zone 5. If you cannot achieve this goal, Santa will stay home, Christmas will be cancelled, and it may truly be the Year without a Santa Hack!

Work your way through the five challenges at snowmiser.counterhack.com and the five challenges at heatmiser.counterhack.com, answering the following six questions:

1. Where did you find the remainder of Snow Miser's Zone 1 URL?
2. What is the key you used with steghide to extract Snow Miser's Zone 2 URL? Where did you find the key?
3. On Snow Miser's Zone 3 page, why is using the same key multiple times a bad idea?
4. What was the coding error in Zone 4 of Heat Miser's site that allowed you to find the URL for Zone 5?
5. How did you manipulate the cookie to get to Zone 5 of Heat Miser's Control System?
6. Please briefly describe the process, steps, and tools you used to conquer each zone, including all of the flags hidden in the comments of each zone page.

Please submit your answers to holidayhack@counterhack.com.

- Ed Skoudis & Tim Medin