Holiday Hack 2020: Operate the Santavator

Objective

Terminal - Unescape Tmux

Challenge

Pepper Minstix is hanging out to the left of the main entrance to the castle next to the Tmux terminal challenge:

Howdy - Pepper Minstix here!

I’ve been playing with tmux lately, and golly it’s useful.

Problem is: I somehow became detached from my session.

Do you think you could get me back to where I was, admiring a beautiful bird?

If you find it handy, there’s a tmux cheat sheet you can use as a reference.

I hope you can help!

Going into the terminal presents the challenge:

Can you help me?

I was playing with my birdie (she's a Green Cheek!) in something called tmux,
then I did something and it disappeared!

Can you help me find her? We were so attached!!
elf@60c0add7f8e6:~$ 

Solution

Tmux is one of the first tools I install on an machine I build. To list sessions, the command is tmux ls. In this case, it shows one session:

elf@60c0add7f8e6:~$ tmux ls
0: 1 windows (created Fri Jan  8 21:43:15 2021) [80x24]

To attach, it’s tmux a -t [session id]. So running tmux a -t 0 reattaches to the session, and displays the bird:

Operate the Santavator

Hints

After solving the Tmux terminal, Pepper Minstix tells me how to work the Santavator:

You found her! Thanks so much for getting her back!

Hey, maybe I can help YOU out!

There’s a Santavator that moves visitors from floor to floor, but it’s a bit wonky.

You’ll need a key and other odd objects. Try talking to Sparkle Redberry about the key.

For the odd objects, maybe just wander around the castle and see what you find on the floor.

Once you have a few, try using them to split, redirect, and color the Super Santavator Sparkle Stream (S4).

You need to power the red, yellow, and green receivers with the right color light!

This is repeated in the hints section of the badge:

It’s really more art than science. The goal is to put the right colored light into the receivers on the left and top of the panel.

Sparkle Redberry stands in front of the Santavator. He gives me the key, and suggests that there may also be a way to bypass the S4 stream:

Hey hey, Sparkle Redberry here!

The Santavator is on the fritz. Something with the wiring is grinchy, but maybe you can rig something up?

Here’s the key! Good luck!

On another note, I heard Santa say that he was thinking of canceling KringleCon this year!

At first, I thought it was a joke, but he seemed serious. I’m glad he changed his mind.

Have you had a chance to look at the Santavator yet?

With that key, you can look under the panel and see the Super Santavator Sparkle Stream (S4).

To get to different floors, you’ll need to power the various colored receivers.

… There MAY be a way to bypass the S4 stream.

Solution - Fix It

Tamper Monkey

In walking around the first floor of the castle, I can find some of the parts necessary to get the Santavator running. Looking at the HTML for the first couple parts I came across, I noticed they all had the class .item-clicker. To make things easier, I created a TamperMonkey script that will find the parts and draw a circle around them:

// ==UserScript==
// @name         Holiday Hack Highlight items
// @namespace    http://tampermonkey.net/
// @version      0.1
// @description  try to take over the world!
// @author       0xdf
// @match        https://2020.kringlecon.com/
// @grant        none
// @run-at       document-idle
// ==/UserScript==
window.setInterval(highlight_items, 2000);
function highlight_items() {
    document.querySelectorAll('.item-clicker').forEach(function (item) {
      item.style.backgroundColor = "rgba(255,192,203,0.5)";
      item.style.border = "2px red solid";
      item.style.borderRadius = "100px";
  })
};

Getting it to run after the page had full loaded and on room changes proved challenging, so I just had it run every two seconds, which wasn’t too much for the browser to handle. It looks like:

Find the Parts

I found four items on the first floor that I had access to without using the Santavator:

Item	Location
Broken Candycane	Front entrance to castle
Hex Nut #1	Entryway near Santavator
Hex Nut #2	Dining Room behind table
Green Bulb	Top left of Courtyard

Click for full size image

Work the Santavator

In the Santavator, clicking on the panel displays it:

The Workshop button appears to be missing.

If I tried to do this before getting the key from Sparkle, the key hole would be empty:

With the key, clicking on it opens the panel:

The items I’ve found (hex nuts, green bulb, candy cane) are there, and there’s a stream of white sparkles coming out of the bottom, which must be the Super Santavator Sparkle Stream (S4). The note on the bottom right suggests that I can get to the lobby (where I already am) and the KringleCon talks with only green powered. As that’s the only bulb I have so far, I’ll try that. I can click and drag items around the panel and redirect the flow of S4 through the green bulb and into the green receiver. It doesn’t take much green to turn on the green light in the POWER section:

Clicking the key to close the door, the buttons for floor 1 and 2 are no longer red:

Clicking the KringleCon Talks button takes me there, completing objective 4.

Find Remaining Parts

On level two, there are more parts, which open up other floors. Here’s the location of the other parts, all of which are accessible at this point, though the portals and floor 1.5 buttons require solving the Speaker Unprep terminal associated with objective 5:

Item	Floor	Location
Red Bulb	2	Top right of Talks Lobby
Floor 1.5 Button	2	Speaker Unprep Room
Portals	2	Enable and talk to Vending Machine in Speaker Unprep Room
Small Marble	R	Bottom right NetWars behind wall
Yellow Bulb	R	By sleigh on roof
Large Marble	1.5	Workshop
Rubber Ball	1.5	Wrapping Room

Click for full size image

Full S4

With these parts, I can power all three S4 colors. I used only the hex nut, the rubber ball, the portals, and the bulbs. The idea is to first use the hex nut to split enough off to power the yellow. Then use the rubber ball to bounce a stream to red. Finally, find a place that portals can pull off a slight stream to send to green. It’s important to note that yellow needs the most to fully power, as it’s the longest cable, where as green needs very little.

Now all the buttons are enabled, though clicking on 3 opens up a fingerprint reader, and clicking on it just generates a buzz:

Solution - Hack JS

This Santavator is powered by HTML and JavaScript. Looking at the buttons, I noticed when I managed to power a button, it has the powered class added to it:

In the image above, I’ve got the green and red powered, all but the btn4 have the powered class.

For the sake of example, I created a fresh login to KringleCom, and skipped collecting parts, the button, and even the key. Instead, I opened the Chrome Dev tools, Sources tab. Under elevator.kringlecastle.com there’s an app.js where all the code for the Santavator resides.

The renderTraps function seems to control if a button is powered or not:

const renderTraps = () => {
  TRAPS.forEach((points, index) => {
    const fillLevel = pl.Math.clamp(PARTICLE_COUNTS[index].length / trapTargetCounts[index], 0, 1);
    const steppa = Math.floor(fillLevel / (1 / wireSteps[index]));
    wireElements[index].style.backgroundPosition = `0 ${ -wireElements[index].clientHeight * steppa }px`;
    ledElements[index].classList[fillLevel === 1 ? 'add' : 'remove']('on');
    powered[index] = fillLevel === 1;
  });
  btn1.classList[powered[2] ? 'add' : 'remove']('powered');
  btn3.classList[powered[2] ? 'add' : 'remove']('powered');
  btn2.classList[powered[2] && powered[0] && hasToken('workshop-button') ? 'add' : 'remove']('powered');
  btnr.classList[powered[2] && powered[0] ? 'add' : 'remove']('powered');
  btn4.classList[powered[2] && powered[1] && powered[0] ? 'add' : 'remove']('powered');
};

This function (which likely is constantly running) calculates if each trap point is powered, and then sets each of the buttons with or without the powered class using the [statement] ? [if true] : [if false] syntax.

In Chrome it’s easy to change the JavaScript. I’ll change each of these to just be adding powered:

const renderTraps = () => {
  TRAPS.forEach((points, index) => {
    const fillLevel = pl.Math.clamp(PARTICLE_COUNTS[index].length / trapTargetCounts[index], 0, 1);
    const steppa = Math.floor(fillLevel / (1 / wireSteps[index]));
    wireElements[index].style.backgroundPosition = `0 ${ -wireElements[index].clientHeight * steppa }px`;
    ledElements[index].classList[fillLevel === 1 ? 'add' : 'remove']('on');
    powered[index] = fillLevel === 1;
  });
  
  btn1.classList['add']('powered');
  btn3.classList['add']('powered');

  btn2.classList['add']('powered');
  btnr.classList['add']('powered');

  btn4.classList['add']('powered');
  
};

On hitting Ctrl-s, all the buttons are enabled (even 1.5 without the button itself):

An alternative place to make a change is on the list line of the TRAPS.forEach loop. It is setting powered[index] equal to if fillLevel === 1. I’ll change === to <, and then all the traps are powered, so all the buttons are powered (if I collect the workshop button, or I can edit that requirement).

« 3) Point-of-Sale Password Recovery 5) Open HID Lock »