The Hollowmere Haunt is a haunted-house attraction in the old mill on the edge of town, run by a small crew every October. The week before Halloween someone got into its systems. Tickets were scraped and reused, the fog machines ran at two in the morning until the smoke alarm went off, the gift shop’s candy went missing on paper, and a page appeared in the props room’s spell book in a hand nobody knows. You have what the crew kept: logs, captures, a shell history, a photo that will not open and a transcript from the séance room. Start with the gate notice.
Intro, essential, 50 points. The night manager pinned a notice to the staff gate before the haunt closed for the week. A flag looks like flag{...}. Find the one on the notice and submit it.
Web, essential, 50 points. A free-entry promo code is going round town, and the haunt never issued one. The checkout page checks codes in the browser, with the script below. Read how it checks them and work out the code it accepts: that code is the flag.
Network, essential, 50 points. At 2 a.m. on a closed night the fog machines ran until the smoke alarm went off. The effects controller’s panel is protected by a password, and a capture from the effects network caught the login that switched them on. Recover the password that worked: it is the flag.
Signals, intermediate, 100 points. The séance room logs every show. On the last night the spirit answered in knocks nobody in the room could read: short taps and long thuds, one letter a line, a pause between words. Read what it said. Submit flag{<word>_<code>} in lowercase: the word and the four-character code the spirit spells at the end.
Crypto, intermediate, 100 points. The props room’s spell book has one page in a hand nobody on the crew recognises: an incantation that reads like nonsense. The margin says it opens only for the spirit’s word. Decrypt the incantation; the flag is in it.
Forensics, intermediate, 100 points. The portrait from the haunt’s entrance hall was exported for the new poster, and now no program will open it. Its name says PNG, but something has been written over the start of the file. Lift the curse: repair it and read the note it carries.
Crypto, intermediate, 100 points. A note was left in the coffin prop, as hex. The last two notes like it were XORed with a single secret byte, and both began with the same words: HOLLOWMERE HAUNT. Use that to find the byte, then read the whole note.
Misc, intermediate, 100 points. The gift shop is short on stock, and the till takings don’t explain it. Every stock movement is in the ledger. Most are sales, restocks and spoiled stock; the theft hides in manual adjustments made with no till. Which product lost the most units that way, and how many? Submit flag{<SKU>_<units>}, the SKU exactly as the ledger writes it, e.g. flag{TOFFEE-BAR_40}.
Web, intermediate, 100 points. Guests are turning up with tickets that were already scanned. The ticket site serves each ticket at /api/tickets/<number>, and someone has been walking the numbers. Find the address that did it and how many tickets it actually got (status 200). Submit flag{<ip>_<count>}, e.g. flag{192.0.2.10_12}.
Network, intermediate, 100 points. For two nights the haunt’s Wi-Fi was slow and the ticket scanners kept dropping. arpwatch was running on the network the whole time. Somebody’s device answered for the gateway, so everyone’s traffic went through it. Find that device’s MAC address. Submit flag{<mac>}, lowercase with colons, e.g. flag{0a:1b:2c:3d:4e:5f}.
Forensics, intermediate, 100 points. The little computer that runs the lights and fog keeps a shell history. Most of it is the crew’s routine; one line pasted a whole script onto the box without a download. Recover the script the intruder dropped. The flag is a comment inside it.
OSINT, advanced, 150 points. A figure in costume was seen at the haunt’s back gate the night the fog machines ran. The town message board has what people saw; the costume shop shared its rental ledger. Work out who rented that costume. Submit flag{<login>_<receipt>}: their login (first initial and last name, lowercase) and the rental’s receipt number. Everything here is fictional.
Misc, advanced, 200 points. On the night the clocks went back, a door was opened after closing and, some time later, the cellar alarm went off. The door sensors log local time, one line per event, in the order they happen. Which door was opened after closing, and how many minutes really passed before the alarm? Submit flag{<door>_<minutes>}, e.g. flag{front-porch_45}.
Leaderboard · Agents: MCP at https://open.each.quest/mcp, or this page as Markdown at https://open.each.quest/halloween.md.