I Went To DEFCON!

look at me LARPing as a hacker at Defcon 32 which also is my first Defcon if you're not familiar with Defcon it's just one giant playground of puzzle solving and I decided to join Prim engen's team the psychoholic and after 72 hours of difficult Cipher cracking we got first place in the gold bug challenge the psychoholic chose the gold bug crypto village challenge which includes 13 puzzles and one meta puzzle in which there was 250 teams that competed 40 that even got a single puzzle correct 10th Place got three puzzles correct and first place that's this guy right here uh we got 12 problems correct so let's go over a few of these challenges and I'll show you kind of how the solution was derived some of them were much easier than others but they are all a ton of fun to do all right so let's first talk about etiquette ah gosh today is the day you say excitedly looking into your closet you already picked out your best outfit days ago in eager anticipation of this evening you'll be joining your friends for a lovely evening of parlor games you hear a soft knock on the door come in you say impatiently mildly annoyed at the interruption hey sweetie it's Granny I heard you're going to a party tonight and I wanted to give you this to help you make sure you're all ready she hands you an old book it looks nearly 150 years old with a Dusty red cover and Yellow doged Pages the ladies and gentlemen etiquette book of the best Society what do I need this for granny Smiles warmly it is important to know how to behave at the party she tells you before long granny has gone off on a tangent from the anecdote she was telling about someone in the story from one time when her granny told her something about a party she had been to and something about proper communication with a fan and the importance of chandelier versus lamp placement and you realize granny has asked you a question and you snap back to the present well you promise to take a look at it won't you it's really not that sort of party you tell Granny starting to roll your eyes before you catch yourself granny size and you feel bad for disappointing her she had been so excited to give you this book that clearly meant a lot to her but I'll look through it she perks right back up her face glowing you never know when it will come in handy so obviously first observation you must make is this the grandson's kind of a dick I don't know what his deal is like this sweet dear Grand came there and gave him a book for a nice fine evening with the ladies and gentlemen of the best society yet he got mildly annoyed at being interrupted like what kind of grandson is this I think we need to have a whole situation on this grandson debacle so when you scroll down to the bottom there will be this picture of a book and if you click it you get a PDF now when the PDF opens up and you kind of scroll down you'll start seeing these lines inside the PDF and right away somebody from the group noticed something interesting about the text on the prior page it looks nearly 150 years old with a Dusty red cover and yellow Doge eared Pages you know those cuts that you can see right here in the PDF that looks like kind of dog ear folds so as you scroll through the PDF you can see that every single page has some sort of folding mark on it so this is probably the answer we just need to figure out what do we fold why and what answer does it give us now at this point is pretty much where I become the Alex Jones of Cipher solving I just start to suspect everything every possible clue so I start just trying to grab information from the page and if I take come on which is quoted and then I search for it in the book you'll notice that come on actually intersects one of the dog gears and if you notice that come on is actually the third sentence down inside of this little clue it's also the third from the last occurrence so therefore there's only one possible answer I got to fold those pages and look at what words the corners point to discover the secret passcode all right as you can see I got the clear answer of never at and that was incorrect the actual answer was both simpler and more complicated it wasn't until teammate G suggested that maybe we should take every last place that the folds don't match and then draw those across as if there was a message from all the remaining unfolded parts of the dog ears which makes sense cuz as you can see here part of the page wasn't folded and as you can see right here this random page also wasn't folded and same with this one so they all do seem to have some sort of middle section so I created this lovely python script to grab out every single line and group them by Pages then take out the middle two points and then draw them one at a time moving over one pixel every single time I draw one of the lines and that is the answer that kind of looks like the answer the silly essay what are the chances that the pages actually made words I could read let's go points on the board that's 100 points next up is the masquerade problem I literally can't

read this text as you see it's impossible so there's only one thing to do much better like the previous one there's this big wall of text and then some link off to another web page maybe it's a PDF let's find out a curious history ha the coded Ballroom I recall a text detailing in meticulous detail the dance that is traditional within its Halls a dance of such curious Precision that only a Madman could decipher its meaning but alas I find myself only pondering deeper its hidden secrets just the other day fate drew me to observe an extreme Fortune but a small portion of the ceremony while coming near the building I heard the distinct voice of the ceremony Master call out such a curious phrase the baron doth gaze sour toward steamed pudding cold why what's wrong with this Baron huh why is he looking at steamed pudding and why is the steamed putting cold okay lots of questions again needing to be answered with this these Little Riddles okay riddle me this crypto master and then not 10 minutes later a steady stream of masked guests exited the building upon their fronts I observed the following letters in order o t i r a t WF y r RX K what could it mean I must know pray tell me obviously the baron and the cold pudding part is very important it was all capitalized and had the quotes and the second part talking about this steady stream coming back out that also must be important so let's just Mark those two in our head and come back to it now obviously this giant file clearly has the answer either the entire thing or within it if you start reading the instructions you'll notice it's actually literally laying out the algorithm but it's laying it out in order how to create it now the trick here is that you only see the leaving guess so you actually have to kind of do a bit of an inverse lookup at the end of the algorithm to be able to see what letters did they originally spell this just simply involves putting a bunch of guests around in a circle 26 positions huh kind of odd right and then making sure that everybody has a number and then switching positions doing a little dance it's like a really simple kind of basic hashing type algorithm now what made this really simple to solve is that if you look at any of the spots you can actually see repetitive phrases notice this right here the master announces letter F the guest holding letter F takes their place at marker zero the master announces letter O the guest holding placard o takes their place at number 01 and you can slowly see the circle kind of forming and it just keeps doing the same thing over and over again and any duplicates are obviously dropped so what I did is I actually made the two different ways in which you can print out the circle printed the heading then would actually print the master announces this and then the guest holding this placard moves into this position and did that for the entire setup the next section the dance I did the exact same thing again I just made sure I printed exactly what the page had and then the last part with the inversion of the algorithm I again just printed every last bit of information that was had ran the program and just piped it all out to a single file then I took this file right here and just simply compared the original instruction set to the one that I generated and if I had a perfectly exact matching one I knew I've created the algorithm correctly which then it gave me the output which the output of the test version was U YX s b p g a FV so then I could then feed that into the program instead of the original phrase that's a part of the cipher and program it such that I could get the original phrase mysterious to be printed back out therefore I was able to actually go both ways with this algorithm and since the file contained no differences I knew I pretty much had the correct answer lo and behold I did have the correct answer so I just simply run the problem with the new input in the very end is history accuse which happens to be 13 letters long the same length of all the other problems answers that we're running into so huh let's go and when we entered it in problem was correct that's two so the next two I did not fully solve but instead just played a small part if any part in solving these but they were completely Bonkers so I thought it'd be fun to show you the solution through this so first let's go to charades so now when you click on raid all you're presented with is this image now this obviously doesn't feel like there's a lot of information here but if you look at each one of the positions of these guys they're dancing guys right they're each in these fun positions it turns out that's from Sherlock Holmes called a dancing man Cipher that means all I have to do is go to each picture and decipher each letter which of course spells out Arco LC and you can tell right away that's not 13 letters and that's not even English so that's probably not the solution to the problem but if you look above each one of their heads there are

13 speech bubbles so probably The Ordering of the speech bubbles will become very important now this where're going to have to get pretty deep on the Alex Jones level conspiracy so follow me along here okay so if you look at each one of the words they all happen to have Roman numerals in them and if you calculate out all their Roman numeric values you will see that they're all distinct and their values 1 through 13 sorting and ordering each one of the words that came into the list and then associating its dancing man value with its ordering we get rail crash hero 13 letters and it makes sense English so guess what that's the answer yes it is by the way fun fact I actually was originally kind of working on this problem so I actually started translating out the dancing man putting all this information in I actually mistranslated one of them as an L instead of an S I mean look at that that does look like that's a potentially an L okay I thought it was kind of kinked with the arm but that apparently was a straight up arm I got it wrong I got the dancing man wrong not only that but you'll notice that there's these little numbers right here 10 4 3 6 03 I actually thought these little buttons right here were something okay Thor okay maybe Thor might have missed lley he's like hey man those buttons are important so I was going through and I was trying to figure out stuff and I kid you not there's even a time where a group of people were looking through counting the little circles in each one of these words man I mean we were deep in the possible conspiracy theories for how to decode this thing this one was actually really hard to do but it was a ton of fun so the last challenge I want to go over is number three cir Mystique but I want to go over only one section of it because I kid you not it took us like 12 hours and at one point G and I were just giggling trying to figure out why this is not English we're like smth trying to like create words out of just a jumble of letters we were sleep deprived it was like 2: in the morning and the problem was staring Us in the face this really is like going to be the highlight the pain of trying to solve these Cipher challenges so after some time solving these challenges you land on this particular page it's like a page Discovery one if you looked up here you could see a bunch of these different URLs but it doesn't really matter but it says Roy G Biv Roy's amazing Apothecary and right away you're like is that an H in there you literally at 2 in the morning when you're sleep to private you start seeing everything as a possible clue Step Closer dear patrons to encounter the Steed and Ematic Roy G Biv Alchemist extraordinary a concoction of colors a cauldron of Curves a compendium of captivating compounds await your curious Cravings quench your thirst for the extraordinary and become bewildered by beguiling bruise then you're presented with this huge Board of potions and then you're presented with math a lot of quick math going on here so obviously we need to do some conversions so if red plus red equals red I would assume that means red equal 0 orange plus orange equal yellow we can imagine 1 + 1 = 2 so that should work out orange plus yellow equal green well that could be three yellow plus yellow equals blue all right this is starting to make sense green plus green equals what appears to be purple six obviously as you can see there's quite a few of these little problems so once you work it all out which Thor did all of that thank you Thor you end up discovering like what red means what yellow means and then of course the shape of the bottle also means something as well therefore every single bottle with its color and its shape you could derive an exact decimal value so now onto the actual shelf we need to actually apply all those values across the shelf and there you go we have all the values for every single bottle now they're coming in sets of three so I bet if we add all those numbers together modulo into this little piece of clue at the bottom of the page we'll probably get the answer out here's the modulo summed values for each one of the shelves and when I convert it into an asky value zero being a I get the following string rot left drop last well that sounds pretty easy I assume that means I need to shift every single bottle over by one and then drop the last column so there we go I simply drop the first one and then push it on to the end and since they come in sets of three just simply add the three values together in modulo by 28 and then print out the value which gives us now this is the part where maybe there was a lot of laughter we couldn't figure things out the brain was probably dead from staying up too much I tried to rotate every last way I could think of tried rotating entire sets tried rotating this way tried ro oh my gosh we tried everything I tried dropping individually the last bottle out of each one of the sets of three and then rotating it that way I tried rotating each row and then dropping the end of the row man tried all of them now remember I said the

answer is staring me in the face see thisam it is actually the answer let me show you all right when I paint him onto each one of these locations it is actually staring you in the face it's not CV bang dropping the bang it's not CV a u i c it's c u r e k v i l e vile a c TS axe that means when I go up into here I go here vile ax and there we go we've made it to the next page obviously there's still quite a few other puzzles left but those are the ones I was most familiar with and this was what Defcon was like for me I got to go through all of that I got to meet a lot of cool people I even participated in Crash and compile where you had to drink and solve coding problems unfortunately my internet wouldn't work and I actually had to I kid you not I had to take my solution I had to commit it to GitHub I had to push it up via my phone's internet then low-level learning had to bring it back down test it take the output commit it push it back up me bring it back down look at the output there was no chance we were going to win that one but it was a ton of fun Defcon 32 I had an absolute blast at and I highly recommend trying out the Devcon hacking experience the name is the primagen