Walk Through 2021 Kākācon Badge Challenge

20 Nov 2021 - karit

So 2021 saw the first Badge Challenge for Kākācon, this will walk you through the challenge. Don’t read this post if you don’t want spoilers. The Entry Point section contains the entry point, the sections after that are a walk through.

Entry Point

Some people may have been enjoying Pepper Raccoon’s on the front of the sticker, but others would have also noticed there was something printed on the backing paper: Front and back of the 2021 Kākācon sticker. The details of what is on the back is discussed just below.

Challenge 1

The back of the sticker above was the entry to the challenge. I would image people would have done something like:

  1. Transcribe what was on the back: 
      w==
  UEQs   ==https://
   oQHwsUEQsEAw==https
   HhgFOwoQHwsUEQsEAw==
  nz/PxIZHhgFOwoQHwsUE
  kācon.nz/PxIZHhgFOwo
tps://kākācon.nz/Px
  EAw==https://kākāco
QHwsUEQsEAw==https:
 gFOwoQHwsUEQsEAw
  n.nz/PxIZH  FO
  kākācon.nz
 s://kāk
  2. Then align them: 
                               w==
                     UEQs   ==https://
                oQHwsUEQsEAw==https
          HhgFOwoQHwsUEQsEAw==
   nz/PxIZHhgFOwoQHwsUE
kācon.nz/PxIZHhgFOwo
                               tps://kākācon.nz/Px
                        EAw==https://kākāco
                QHwsUEQsEAw==https:
           gFOwoQHwsUEQsEAw
n.nz/PxIZH  FO
                                     kākācon.nz
                                 s://kāk
  3. Which collapses to 
    kācon.nz/PxIZHhgFOwoQHwsUEQsEAw==https://kākācon.nz/Px
  4. Notice the pattern and overlap 
    https://kākācon.nz/PxIZHhgFOwoQHwsUEQsEAw==
  5. Go to that URL, no dice.
  6. Does give a hint that need to do some more with the string.
  7. It looks like a base64 string, just base64 decode it and well that isn’t too helpful: 
    ?.....;
........
  8. Have a look at the source for the page and there are some more hints: 
    <!-- Badge challenge notes:
* There is no need to scan any boxes
* There is no need to brute force/dir buster directories/files, the clues should give you all the information you need
* Karit's word is final, rules can be as he sees fit, etc
* Cyberchef is your friend
-->
<!-- Is this the 𝘦𝘹𝘤𝘭𝘶𝘴𝘪𝘷𝘦 thing you are looking for? 𝘖𝘳 is it something else? -->
<!-- Nestor_meridionalis -->
  9. So there is a few things to take away:
  10. Cyberchef is your friend, so chances are this and other challenges will need Cyberchef
  11. The word exclusive and or are in an italicised font, leading towards the need of an XOR
  12. There the latin word for kākā included Nestor meridionalis.
  13. Plug it into CyberChef and get: Screenshot of the above CyberChef URL
  14. Now what to do with the output qwjjwwdgumbpxdjb
  15. Perviously put it in a URL so why not again? 
    https://www.kākācon.nz/qwjjwwdgumbpxdjb

Challenge 2

The landing page for Challenge 1 has a link to an audio file of the Dawn Chorus. If you have a listen about 30 seconds there are some Kākā and Pīwakawaka calls which sound like Morse Code.

I envision it would have been solved something like:

  1. Listen to the audio Audio.
  2. Figure out the Pīwakawaka is a dot and the Kākā is the dash.
  3. Could transcribe it by ear or look at a visual representation in something like audacity. Screenshot of the audio in Audacity
  4. Will get: 
    .. . --. .... .- . -- ..- -- . .. -- . .. --. ....
  5. Which becomes ieghaemumeimeigh
  6. Perviously put it in a URL so why not again? 
    https://www.kākācon.nz/ieghaemumeimeigh

Challenge 3

The landing page for Challenge 2 has four images on it all of which have some EXIF data in them:

I envision it would have been solved something like:

  1. Download all the images.
  2. Pipe them through something (CyberChef will do the trick) which will extract the EXIF data.
  3. Get:
    • nohleRoh
    • beeNae0A
    • op9aeCai
    • Tee6eghe
  4. Combine them together (based on image name) to get nohleRohbeeNae0Aop9aeCaiTee6eghe
  5. Perviously put it in a URL so why not again? 
    https://www.kākācon.nz/nohleRohbeeNae0Aop9aeCaiTee6eghe

Challenge 4

The landing page for Challenge 3 has the following message:

T OVJF NVL PEXF TG GV AEAEHVZ, OVJFRLIIN NVL FZKVNFX GOF HVZ. GOTY TY GOF RTWYG GTPF GOFWF OEY QFFZ E QEXUF HOEIIFZUF EG AEAEHVZ, WFEIIN OVJF TG TY SVWATZU EZX JFVJIF OECF PEXF TG GOTY REW. WPTVGUYJKRSFUPCX

I envision it would have been solved something like:

  1. This is a substitution cipher.
  2. Plug it into CyberChef once have figured out the substitution letters. Screenshot of the above CyberChef URL
  3. One part of the message is English RMIOTGSPJFWEGMVD
  4. Perviously put it in a URL so why not again? 
    https://www.kākācon.nz/RMIOTGSPJFWEGMVD
  5. And the that is the completion page.