🎅🎄 SANS 2021 Holiday Hack Challenge (HHC) - KringleCon 4

Introduction

Every year the SANS Institute and the Counter Hack Team hosts a ‘Holiday Hack Challenge’ also commonly referred to as HHC.

The SANS HHC contains a number of unique infosec related challenges designed to test and improve the technical skills of those interested or working within Information/Cyber Security.

The 2021 Holiday Hack Challenge can be found below:

SANS 2021 HHC - KringleCon 4: Calling Birds

Quick Statistics for HHC 2021

• Approximately 15,000 players
• 12,496 opened the starting gate
• 3,519 thawed the door on Frost Tower
• 304 made it to the credits on the roof of Frost Tower
• 282 completed all objectives
• Average completion time of 17.87 days to complete challenge
• First person to finish was ‘rnu’
• Second person to finish was ‘k1ngpr4wn’
• Third person to finish was ‘lukash’
• 2,292 made it to Jack’s Restroom
• 243 flushed the toilet and found Jason
• 76 made it to the Shenanigans room
• 0 Avatar NFTs Minted
• 25,571 chat messages between the in-game and on Discord
• 4,727,463 Redis Keys generated
• 87.13% of players completed the Orientation
• 24.22% of players completed Where in the World is Caramel Santaigo
• 24.54% of players thawed Frost Tower’s Entrance
• 13.75% of players completed Slot Machine Investigation
• 14.41% of players completed Strange USB Device
• 9.57% of players completed Shellcode Primer
• 4.31% of players completed Printer Exploitation
• 2.77% of players completed Kerberoasting on an Open Fire
• 10.32% of players completed Splunk!
• 5.09% of players completed Now Hiring!
• 7.73% of players completed Customer Complaint Analysis
• 2.56% of players completed Frost Tower Website Checkup
• 2.81% of players completed FPGA Programming
• 27.64% of players completed exif
• 24.54% of players completed wifi
• 24.22% of players completed osint
• 21.21% of players completed gnmap
• 20.56% of players completed frostavator
• 20.05% of players completed logicmunchers
• 14.41% of players completed ducky
• 12.77% of players completed ipv6
• 10.33% of players completed imds
• 9.64% of players completed yara
• 8.94% of players completed ltrace
• 6.96% of players completed elfcode
• 6.64% of players completed hero
• 5.35% of players completed log4jblue
• 4.94% of players completed log4jred
• 4.59% of players completed hohono
• 2.81% of players completed fpga
• 2.55% of players completed speakandspell
• 1.70% of players completed elfcode-bonus
• There’s generally between 2% and 3% who fully complete
• 222 Reports submitted
• 50 Honorable Mentions
• 53 Super Honorable Mentions

SANS keeps a number of past challenges (including HHC 2021) available all year long for those who still want to take part after the challenge has concluded which can be found below:

SANS Past HHC Challenges

Write-up

For those looking to learn or expand on their technical abilities these types of challenges can often be a good starting point with many participants choosing to document and publish their write-ups for every challenge completed.

Included as part of the SANS HHC is the option to submit your write-up for each challenge (prior to the deadline) to enter into the SANS Contest.

In January 2022, I successfully completed all of the challenges and submitted my write-up to the Counter Hack Team for the fourth year in a row.

This year I recreated the world of KringleCon IV as a playable JRPG game to deliver my write-up in a creative way, in addition to creating an ‘Edutainment’ series on YouTube.

I have chosen to do this to both challenge myself in creating this in such a short space of time, but also to highlight my challenge failures in an entertaining way.

Imposter Syndrome is fairly prevalent in this industry, so to highlight the time taken to solve challenges and some of the failures along the way, in my opinion, is a much needed addition which is rarely included in these write-ups.

My submitted entry was one of the 3 major prize winners of 2021, securing the “Most Creative” prize which was a welcomed change to the Super Honorable and Honorable mention achieved in previous years. Creating this did take a considerable amount of time to create, but it was well worth it.

The Winners and the relevant entries have been linked below:

• Grand Prize Winner: Thomas Bouve
• Most Creative Answer: Jai Minton (Mine! See below)
• Runner-Up Most Creative Answer: Joel Tan
• Best Technical Answer: David Forsythe
• Runner-Up Best Technical Answer: Roger Johnsen

SANS HHC 2021 - Winners and Answers

JRPG Playable Write-up:

YouTube Playlist:

Final Notes

I’d like to close by giving my thanks to this year’s speakers, HHC Team, challenge developers, and the concierge team, in addition to giving my congratulations to the rest of the Honorable and Super Honorable Entries, send my congratulations to all 222 people/teams who took the time to document and submit their reports, and also to all the players who participated in the SANS 2021 HHC.