By Jeff White (karttoon)

This years SANS Holiday Hack was excellent! They absolutely killed it making a fun CTF this year! This years challenge included a Christmas themed jRPG, a custom soundtrack, 21 achievements, and 10 questions that you need to answer to complete it.

I laughed, I yelled, I got to hang out and meet some cool like-minded people over a few nights, and I'm not ashamed to say I even bopped my head a bit to Christmas music.

The gist of the story is that Santa was kidnapped while delivering presents while two children heard from their rooms. Throughout the game, you'll help investigate clues and solve puzzles to further progress the story and save Santa while figuring out who the nefarious villian was that took him.

This is a long post and covers answering every question in this years challenge, beating each terminal, hacking each server, piecing together the final audio, and finding all of the coins to complete all of the achievements. I've tried to break it down as logically as possible and detail my methodology, failures, and notes throughout the journey. Enjoy!

Here are some festive reading tunes as well.

Part 1: A Most Curious Business Card

• Question 01 - Santa's Tweets
• Question 02 - SantaGram ZIP

Part 2: Awesome Package Konveyance

• Question 03 - APK Embedded Credentials
• Question 04 - APK Embedded Audio File

Part 3: A Fresh-Baked Holiday Pi

• Question 05 - Password on the Cranbian System
• Question 06 - Terminal Hacking to Save Santa
• Terminal 1 - Elf House #2
• Terminal 2 - Workshop - Santa's Office
• Terminal 2 - Workshop - DFER
• Terminal 4 - Santa's Office
• Terminal 5 - Workshop - Train Station

Part 4: My Gosh... It's Full of Holes

• Question 07 - Will Hack for MP3's
• The Mobile Analytics Server
• The Dungeon Game
• The Debug Server
• The Banner Ad Server
• The Uncaught Exception Handler Server
• Question 08 - The Goods

Part 5: Discombobulated Audio

• Question 09 - Cyborgs Learning Chess
• Question 10 - Why?!

Item Locations

• Cranberry Pi Parts
• Coin Locations - Present Day
• Coin Locations - 1978

Question 01 - Santa's Tweets

There first thing we're provided with is Santa's business card, which includes his Twitter and Instragram handles.

Taking a look at his Twitter account, he has 350 tweets that all look encoded.

Initial thought was possibly XOR'd data with a key being some repeating pattern of Santa related text so I started copying it out, tweet by tweet, into a text file for better analysis. After maybe 15 or so tweets a definite pattern started to emerge, it just wasn't what I was expecting - a sideways "B" in ASCII art displayed. I went ahead and scrolled to the beginning of his Twitter timeline so that all 350 tweets were on my screen, then simply copy/pasta'd them out. Using a little grep-fu revealed the answer to Question 1.

The answer is "BUG BOUNTY".

Question 02 - SantaGram ZIP

Taking a look this time at Santa's Instragram, there are just three images. Only one is particularly interesting and I've put two red boxes over the details we need for this question.

It's pretty difficult to read but it's a file name and a FQDN that, when combined, allow us to download the ZIP file.

The ZIP is password protected but using the "bugbounty" password from Question 1, it successfully extracts an APK file for the SantaGram application.

Question 03 - APK Embedded Credentials

Opening the APK up in Bytecode Viewer and doing a search for the string "password" returns a number of hits. Quickly looking at each one, we find the embedded credentials in the "SantaGram_4.2/com/northpolewonderland/santagram/b.class" file, within the "a" function.

Below is the Java representation of the decompiled smali code, which makes it easier to read.

The username is "guest" and the password is "busyreindeer78".

Question 04 - APK Embedded Credentials

This time, searching didn't come up with any quick hits so I began to look at the Decoded Resources within Bytecode Viewer. Under "SantaGram_4.2/res/raw/" we find the MP3 file "discombobulatedaudio1.mp3"

Question 05 - Password on the Cranbian System

This is the first question that requires you interact with the jRPG game and where things start picking up! The first Elf NPC you encounter (Holly Evergreen) will give you a quest to find all five pieces of the Cranberry Pi system: heat sink, Cranberry Pi board, SD card, power cord, and a HDMI cable. These can be found around the map and are laid out to get you familiar with all parts of the game world. Once you've put them together and talked to Holly again, she'll give you a link to download the Cranbian image. The Cranberry Pi will also allow you to access terminals used in later parts of the game.

Since we know we need to get a password for an account, along with the obvious references to Raspberry Pi, we know we're going to likely be cracking some Linux hashes so let's get-to-mountin'! The Elf Wunorse Openslae offers up a few hints on how to do this.

The first thing we do is check the image for sector size and starting offset of the Linux partition.

Since the sector size is 512 bytes, we can multiply it by the "Start" offset (137216) and arrive at the starting location of the partition, which is 70254592 bytes in. With this information, we can mount the filesystem.

Taking a look at "/etc/shadow" we can see the salted hash for the "cranpi" account we need to crack.

Before cracking it, I'll combine the "passwd" and "shadow" files to get a nice format for John.

The Minty Candycane Elf hinted at using the "rockyou.txt" wordlist, which is standard on all Kali Linux distributions.

After 6 minutes, John successfully cracks the password.

Look at those abysmally slow cracking speeds...it's embarrassing! The answer for question 5 is "yummycookies".

Question 06 - Terminal Hacking to Save Santa

There are 5 terminals strewn throughout the game. Each one of them is a unique puzzle to be solved and I'll cover them in their own respective sections.

Terminal 1 - Elf House #2

Each terminal includes a banner when you logon that tells you what needs to be accomplished.

For the first terminal, we can see that the logged in username is "scratchy" and there is an "itchy" user as well - an obvious Simpsons reference (which later becomes important). We can also see that we don't have permission to look at the "/out.pcap" file as it's owned by the "itchy" account with 0400 permissions.

While trying to figure out how to access this file then, I checked my "sudo" access.

Ok, that seems pretty straight forward. We can run "tcpdump" and "strings" as user "itchy" with no password; this should be all we need to beat the challenge.

*NOTE* For whatever reason this terminal disconnected me constantly...whether it's because it was being bombarded by people or what, I don't know but it was really unstable.

We have two "GET" method requests for files, "firsthalf.html" and "secondhalf.bin". In the first file, you can quickly see "part1" of the passphrase we need, "santasli". The second file is a BIN so we'll need to see if we can extract this from the PCAP.

The first approach I took was to copy all of the packet data out of the PCAP itself since I was limited in the tools I could use when accessing the "out.pcap" file.

Once I had the contents of each packet inside of a file, I used a little Bash one-liner to parse out the only the hex bytes.

I then copied the hex and, using the 010 Editor, pasted it into a new file as hex data. Below I highlighted the same HTML data I showed above to illustrate.

Once I had the binary file of packets, I used CapLoader to carve out all of the valid packets, which should be everything that was in the PCAP on the terminal.

Saving the carved out packets and opening them in Wireshark shows the expected data...except you'll notice on the right a huge amount of errors. Pro-tip, that's not a good sign.

Looking at the stream for the BIN file, we can see tons of bytes are missing.

I have half of the passphrase, so I decided to try and guess the second-half by using my elite hacking skills Google.

Ah, "Santa's Little Hackers" sounds right up the alley of the SANS Holiday Hack! Unfortunately it's not the password.

Then it slowly dawned on me...Itchy...Scratchy...Santa's Little Helper...mother-SANTA!.

The password for terminal 1 is "santaslittlehelper".

*NOTE* While I couldn't get it to work in this context, I learned about a "tcpdump" flag that can potentially allow command execution, which is pretty rad.

Terminal 2 - Workshop - Santa's Office

Located in the bottom of the Workshop and leads to Santa's Office.

Taking a look at the files in our home directory show a hidden directory called ".doormat". This seemed like as good a place to start as any.

Since the banner says "deep in the directories", I decided to just recursively list all of the directories under ".doormat". Below is an excerpt from the command, showing a "key_for_the_door.txt".

Last, a quick "cat" of the file.

The password for terminal 2 is "open_sesame".

Terminal 3 - Workshop - DFER

Located at the top of the Workshop.

In the home directory for the user, we find a binary called "wumpus" which turns out is an old text-based game called "Hunt the Wumpus" created in 1972. You essentially need to locate the Wumpus monster inside this labyrinth while avoiding bats and pitfalls.

I spent a fair amount of time trying to map the labyrinth out, as they let you play the same one every time you die. I'm not sure if the original is like this or if it's a modified version, but room connections and dangers continued to shift after each death and made mapping fairly impossible.

Peering at the strings revealed some interesting data.

Notice how when I originally started the game it said "the instruction file seems to have disappeared"? Creating a "wump.info" file in the same directory changed the output of the application. It's clear that the application is trying to call "less" on it.

I didn't find a way to hijack "less" and possibly get command-execution, but it turned out to be unnecessary. While researching the game, I stumbled upon this website which lets you play the original game online. For whatever reason, being able to visualize the game in boxes let me understand the core mechanic of the game and I was able to beat it within a few turns.

Basically, try to imagine a box of 9 squares with the Wumpus in the center. If you get the message that he's around, then move into another room - if you get the same message, then you know you're on the outside of the 9 and he's *potentially* in a room on either side of you. Let your arrows rain down death upon the Wumpus!

The password for terminal 3 is "WUMPUS IS MISUNDERSTOOD".

Terminal 4 - Santa's Office

Located directly past the Terminal 2 door. The password panel is hidden in the bookshelf.

I'll be honest and say that this one didn't immediately jump out at me. *turns in hacker-card* A quick Google of that phrase shows that it's a quote from the AI in WarGames...D'oh!

As soon as I knew it was WarGames I knew exactly what scene this was from. After some time on YouTube trying to find the full thing, I located this bad boy.

The terminal follows the dialogue of the movie verbatim.

Even to the point of only allowing you to play as the Ruskies...lame! :)_

I always hated going to security cons in Vegas anyway!

The password for terminal 4 is "LOOK AT THE PRETTY LIGHTS".

Terminal 5 - Workshop - Train Station

Located at the train station in the Workshop.

This one is slightly different as it doesn't necessarily tell you what you need to do. Based on the menu, it seems pretty clear you need to start the train.

Starting with the "HELP" command I noticed something right off the bat. It's the same recipe I use for my cranberry pie!

Oh, and that it looks like LESS!

I attempted to break out of this by using the "!" command to pass through an external command for execution, specifically "!/bin/bash".

Success!

Activating the program "ActivateTrain" starts the train and takes us back in time.

This warps us back to the year 1978, where most of the Elves are children, SD cards haven't been invented, and you can't escape "We Will Rock You" on the radio.

When you enter the DFER (Santa's Dungeon For Errant Reindeer) in 1978, the jolly man appears, answering the last part of this question.

Santa appears to have come down with amnesia and doesn't remember who kidnapped him - back to sleuthing!

Question 07 - Will Hack for MP3's

Alright, we need to grab 6 MP3's spread across 5 servers. Going back to the APK, if we look in Bytecode Viewer at file "SantaGram_4.2/res/values/strings.xml", we can identify all of the URLs for the servers above.

Below is my compiled list of URLs and whether they are in-scope or not, along with a quick DNS lookup.

The Mobile Analytics Server

First things first, a quick Nmap scan to see what's open to us.

Always brings a smile to my face when I find a Git repo!

A quick "wget" of the website pulls down all of the files within the "/.git/" directory and then we can use the below one-liner to decompress the object files in "/.git/objects" with openssl's zlib module and get access to the source code of the website.

Looking at the strings of the "index.html" file reveals a number of directories and files, which gives us a good idea of the layout of the site.

Since we can only see the "login.php" page, I decide to start there and recursively grep the object files for a string on the page and then review the code.

Reviewing the object file ".git/objects/25/92098ead7ae87e50b561a95a9e51e4195ef140.out" we find the below section of code.

It looks like a cookie is created by taking the JSON structure of username and date and passing it to the "encrypt" function.

Searching for the encryption function, I find it in ".git/objects/7a/b24db36e53d8aeb6943729e83b5f6f530a73f7.out".

Now we have everything we need to generate our own authentication cookie, the only thing we need now is an account name.

In the object file ".git/objects/0a/d23f39b6572ebd114071c801e2140f7092e8a8.out" I find code that refers to the "guest" account.

The below is a PHP script that will generate authentication cookies that we can apply to the "AUTH" value.

Our auth token for the "guest" account.

Setting our cookie in Cookies Manager+ we successfully gain access to the "guest" account.

At the top of the page is a button labeled "MP3" which lets us download "discombobulatedaudio2.mp3".

Since we know there are two MP3 files on this server, we'll continue on.

Taking a look at the "index.php" page in object file "./git/objects/63/e494c4654066d2ee8f28135b1855dda23d88f7.out", we see that the MP3 button only appears if we're logged in as "guest", but we also learn there is an "administrator" account with an "Edit" button instead.

We find the code for the "mp3_web_path" function in object file "./git/objects/10/d46fe7c496411ff18f9177d6f99c25f2d0400a.out" and shows that our user-ID is passed as a parameter to the "getaudio.php" file.

Let's go ahead and generate the "administrator" account cookie and see if we can get the user-ID to pass to the "getaudio.php" file.

After logging in as the "administrator" account I reviewed "getaudio.php" found in object file ".git/objects/0a/d23f39b6572ebd114071c801e2140f7092e8a8.out". Unfortunately, my hopes of just passing an ID were quickly dashed with the below code.

The ID is gathered by unpacking the "AUTH" cookie and getting the username and then looking it up within the database. All hopes of SQLi through these functions get crushed by parameterized values and the mysqli_real_escape_string function.

I found that I was able to inject reports into the database through the "report.php" page that was found in the APK resources, but ultimately could not get it to render any PHP due to the mysql_real_escape_string and htmlentities functions. Along with this, since there were so many object files, I quite frequently found older versions of a pages which contained vulnerabilities that weren't actually exploitable in the currently deployed iteration so I chased a lot of red herrings.

Taking a step back, the "administrator" account is given access to a new page so it makes sense to think that page will be crucial is completing this attack. The "Edit" page lets you edit saved queries from the "Query Engine". The queries allow you to lookup reported information, presumably from the SantaGram application.

Reviewing the code in object file ".git/objects/b7/5048eda4700268b38de8aff1dfec5a8f023ab5.out" shows how the queries are built for the "report" table; specifically there is a "id", "name", "description", and "query" value.

When I reviewed "edit.php" in the object file ".git/objects/c0/8beb21bd744a41d784eb9b1e9e90d2b3a884cc.out", I noticed it checks if if the "id" value is passed as a parameter with "$_GET['id']". If that parameter exists, it checks the rest of the parameters in the URI and subsequently updates each field in the database with the provided value, if it doesn't then it uses the values passed through the webpage.

Notice what's missing?

The "query" value isn't available via the website but should be available via the URI! A quick sanity check of "view.php" to make sure it doesn't filter out the query in any way.

Now we're onto something if we can craft a SQL query that lets us dump the MP3 file from the database.

In the object file ".git/objects/49/76b1415ee55aa3a757db375d0f24a826e1c85f.out" we find a SQL dump and see how our "audio" table is constructed.

A quick validation by sumbitting the below URL...

Then browsing to it via "view.php"...

Now that we validated injection, it's time to dump that MP3!

As "MEDIUMBLOB" is a byte string, I opted to convert it to hex and extract it that way via the website.

The result.

A quick copy and paste again into the 010 Editor and we now have "discombobulatedaudio7.mp3".

*NOTE* The below was also found in the database file. The "administrator" credentials are valid but the "guest" one does not work. It was a moot point due to the cookie generator I wrote.

The Dungeon Game

Nmap reveals a socket listening on TCP/111111 and a webserver which has instructions for a game called "Dungeon".

If you're not familiar with this game, it's a variant of Zork which is another old-school text-based adventure game. You enter commands and navigate the game world to collect treasure. I hate Zork. I hated it in the 80's, I hated in the 90's, and I've continued to hate it for each decade since. I'd almost forgotten how much I disliked this game until I had to play it again here.

We're also given quite a few hints from our friendly Elves.

And...

I decided to try and play the game, which directly correlates to my hate of the game. Many hours went into using the maps found here to try and navigate the game.

Since the Elf hinted at beating the Cyclops, I hoped that I would find the new Elf NPC in that area...I was wrong. But I still grabbed the egg, killed a troll, and made it all the way past the Cyclops to fight the Thief! I was actually pretty pleased with that but I kept getting killed by the Thief, presumably because I didn't have a high enough score yet.

I decided to take a look at the binary and approach this problem differently since I didn't seem to make headway playing legit.

So we have a 64-bit ELF binary (elf...heh) that hasn't been stripped. Checking out the strings revealed some interesting entries as well. Below is a snippit containing the juicy parts.

No deaths? Sign me up!

Googling a few of those strings led me to this Github page for the file "zork/gdt.c".

Typing "gdt" in the game gives us access to the menu I found in the binary strings output.

The "nd" command flips on god-mode and I finally put the Thief to rest! But...I still couldn't find the Elf anywhere around that area. Argh!

After a breather and some Zork research online, I found just one website which mentioned this incantation you can cast within the game to automatically warp to the endgame! Surely, the Elf will be at the endgame!

Pro-tip: He's not. SANTA ZORK! Since I had god-mode enabled, I also got stuck in this location since you're not supposed to actually be able to survive the attack by the Guardians once you step through the Pine Wall into the open field...

Going back to the drawing-board I decided to take another look at the GDT menu and noticed this gem "TK", or "Take", and had the bright idea that maybe I could just take all of the 20 treasures I needed and beat the game "legitimately" since so much seems to be based on your score (it kept telling me my score rank was "Hacker".

Playing around with the command, it effectively just takes a number as an argument and puts the corresponding object into your inventory. There didn't appear to be any rhyme or reason as to the layout of objects in the array and it even held non-inventory based items, such-as glaciers, a large tree, and a cliff.

I determined I'd need to enumerate all of the objects to find the indexes of the treasure and wrote a quick script to take a set of objects and then check my inventory. Below is an example of the first few objects, along with my notation for object number of the treasures needed to win the game.

Around object 200 something magical happened...

We hit the end...let's see what the last few items are so we can grab our treasure.

An Elf!

Since I know I need to give the Elf some treasure, I give him the only thing in my inventory that might be treasure-ish, a bird that I dubbed "Puffington" to align with the spirit of the North Pole theme.

PUFFINGTON!!! SANTA YOU ELF!

A quick visit to treasure/index list and I grab a treasure I know he'll like.

I send a quick e-mail off to Peppermint and get the next audio file, "discombobulatedaudio3.mp3", for our trouble.

The Debug Server

Taking a look at the Nmap results doesn't reveal much detail about this server.

It does indicate "application/json" content-type but using the POST method to send JSON objects to the "index.php" file we found in the APK didn't return any error messages or clues.

To understand the function of the webserver better, I started rooting around in the APK looking for hints.

In the "SantaGram_4.2/res/values/strings.xml" file, the below stood out.

That's interesting. It appears that debug data is sent to the URL but by default debug is disabled.

Digging into this further, looking at the decompiled code as Java in the "SantaGram_4.2/com/northpolewonderland/santagram/EditProfile.class" file shows strings that indicate "Remote debug logging" and a JSON object structure.

Looking up each of those functions and creating values for them didn't get me anywhere.

*NOTE* I later realize my mistake here - a lack of understanding of the getCanonicalName and getSimpleName. It was worth it in the end since I learned more.

At this point, I came to the conclusion that the only way I was going to get the correct syntax for the JSON object the server expects was to run the APK.

For whatever reason I could not get the Android SDK emulator to work and resorted to downloading "free" Android emulators. I'm lucky I have a malware analysis VM as I have no doubt in my mind that this thing got compromised from all the shady Android emulators out there. Suffice to say, I found that the Chinese KOPLAYER worked well enough (it's designed to play Android games).

Once again, some helpful Elf hints gives us the tools and knowledge we need to beat the challenge.

And...

I went ahead and decompiled the APK to get access to the smali files.

We saw in the "EditProfile.class" that there is a logical if-then statement that checks to see whether debugging is enabled. Since we know that it's not, we can change the Smali to proceed when debbing is disabled.

In the "SantaGram_4.2/smali/com/northpolewonderland/santagram/EditProfile.smali" file, we see the if-then statement.

To get what we want, we'll change "If equal" comparison.

To "If not equal".

Next, we need to recompile the APK with our changes.

After that, we'll need to sign the APK so that we can load it into our emulator.

The APK successfully installs on KOPLAYER.

I'm continually impressed with the level of detail they put into this years challenges!

Finally, going to edit our profile we capture the requests that we need.

We were so close the first time! I just didn't properly list the full path...

You can see that it returns us a JSON object which includes a filename. One thing to note is that it also returns the original request we sent...but there is something additional in it that we didn't specify.

Let's flip that to "true" and see what happens.

We are provided with a list of files on the server and find the locaion for our MP3 file, "debug-20161224235959-0.mp3".

The Banner Ad Server

Starting off with Nmap shows that we'll be dealing with another website.

Looking at the site shows some scrolling ads and in the top right is a "Login" button.

Peering under the hood at the source code reveals this snippit.

Decoding that gives us the JSON object below; however, the really important thing is the indication of the "meteor_runtime_config" telling us that it's a Meteor-built application.

I'm not familiar with the Meteor Framework but luckily the Elf Pepper Minstix has us covered with a few useful hints!

Grabbing Meteor Miner and checking out the site shows a "Collection" called "HomeQuotes".

Note the "audio" field for the single record.

Throwing the below command into the Java Console gives us the output for the records.

Looking at the 5th element in the array gives us the information we're after, the URL for the next MP3 - "discombobulatedaudio5.mp3".

The Uncaught Exception Handler Server

For the exception server, we know based on the URL in the APK that there is an "exception.php" file. Browsing to that file gives us a message that we must use the HTTP POST method. Upon each "correct" request, I kept receiving error messages that divulged what the next expected piece was.

Playing around with the two operations, "WriteCrashDump" showed that I could pass data and access it through the website at the file name it provides me.

Validating...

I tried various forms of injection to get the PHP to interpet on the website but it looked like the htmlentities and/or additional filtering was in play and preventing this. I did find a way to bypass these for XSS, but since that doesn't progress us, it was a bit pointless.

I did find that the ReadCrashDump operation would also allow me to look at the data submitted through WriteCrashDump.

My cheeky PHP injection didn't work here either.

You'll note that the full filename isn't listed here so it's safe to assume that ".php" is being appended. This is further confirmed by just submitting it with the extension.

It makes sense then that this is some sort of file inclusion and opens up a number of potential attack possibilities. This is further confirmed with the below test.

I wasn't able to get any directory traversal attacks working but I was reminded of another Elf hint.

Using this technique allows us to quickly get the sourcecode for the "exception.php" file and find the location of our next audio file, discombobulated-audio-6-XyzE3N9YqKNH.mp3.

Question 08 - The Goods

The 7 audio files are below.

• discombobulatedaudio1.mp3
• discombobulatedaudio2.mp3
• discombobulatedaudio3.mp3
• debug-20161224235959-0.mp3
• discombobulatedaudio5.mp3
• discombobulated-audio-6-XyzE3N9YqKNH.mp3
• discombobulatedaudio7.mp3

Question 09 - Cyborgs Learning Chess

I struggled with the audio quite a bit and realized I know absolutely nothing about audio forensics or mixing in general. Given that, I still managed to figure it out after hours of listening to this thing on loop and reversing, speeding up, speeding down, noise canceling, etc. I'd highly recommend Audacity for A) being free and B) having tons of capabilities in a user-friendly interface.

In the end, speeding it up 500%, changing the pitch to D#3, along with a few guesses, led me to the answer. The combined audio can be played below or downloaded here.

The first part of the audio made sense..."Father Christmas, Santa Claus". Ok, I get it. Santa, Father Christmas. Holiday Challenge. Roger that.

The second part though...it made no sense at all - "Father Christmas, Santa Claus, as Cyborgs learning Chess".

I spent the next two nights on the audio and honestly had a blast just hanging out in the final room ("The Corridor") with a bunch of other players. We'd shoot the breeze, talk to each other, give hints, and had a lot of laughs at each others frustrations. The social aspect of the game this year was fantastic and sorely lacking in any other CTFs.

Googling around for what I believe the phrase to be, I stumbled upon this link.

I began reading a lot of the Doctor Who stuff and noted the TARDIS on Santa's office desk.

I still couldn't figure out what the password was and tried lots of episode names, character names, and other Doctor Who/Christmas references to no avail. It wasn't until someone told me they thought the last audio file sounded like "chess" too, but it wasn't.

Knowing I had the audio wrong, I began trying to disect the last few words. The 4th audio file I just couldn't place. It sounded like "as" or "and" and I started typing in variations in Google.

Cha-ching!

When I saw the TARDIS Data Core website's profile for Santa, I thought it was odd that they listed "Jeff" as an alias but now it all made sense.

Trying the password "father christmas santa claus or as ive always known him jeff" opens the last door and pulls back the curtain on this mystery.

The answer to Question 9 is "Doctor Who", of course!

Question 10 - Why?!

Doctor Who looked into a time vortex and saw a universe where the Star Wars Holiday Special never happened, thus the world was better off not having suffered through the misery of seeing it. Basically, he's a mad man. Star Wars Holiday Special was awesome and Itchy, Malla, and Lumpy would agree!

Aarrr wgh ggwaaah!

Cranberry Pi Parts

Heat Sink - Elf House #2 - Upstairs

Cranberry Pi Board - Elf House #1 -> Secret Fireplace Room

Power Cord - The North Pole

SD Card - The North Pole

HDMI Cable - Workshop

Once you have all of the parts, head back to Holly Evergreen at the start of the game and tell her the password extracted in Question 5 ("yummycookies").

Coin Locations - Present Day

Coin 01 - The North Pole (behind roof)

Coin 02 - Elf House #2 (in Kitchen)

Coin 03 - Elf House #2 (under couch)

Coin 04 - Elf House #2 - Upstairs (in trough)

Coin 05 - Elf House #2 - Room 2

Coin 06 - Elf House #1 -> Secret Fireplace Room

Coin 07 - NetWars Experience Treehouse (left side)

Coin 08 - The North Pole (on top of NetWars roof)

Coin 09 - Small Tree House

Coin 10 - The North Pole (front of Santa's Workshop)

Coin 11 - Workshop (conveyor belt)

Coin 12 - DFER

Coin 13 - The Corridor

Coin Locations - 1978

Coin 14 - The North Pole (beyond Holly Evergreen)

Coin 15 - The North Pole (behind two houses on left)

Coin 16 - The Big Tree (upstairs)

Coin 17 - NetWars Experience Treehouse (right side)

Coin 18 - Santa's Office (in knights hand)

Coin 19 - Workshop (behind boxes)

Coin 20 - Workshop - Train Station

With that, we wrap up the last of the in-game achievements and fully complete this years challenge!

Props again to the SANs team for another great Holiday Hack Challenge!

Until next year...

Older posts...