Thanksgiving Hack Challenge

The week before Thanksgiving someone got into Bramblecote Farm. One-use coupons paid out again and again, the cold room warmed overnight, the van went off its route and Gran’s recipe left the building.

• Evidence: logs, a Modbus capture, a GPS track, an encrypted recipe card and a seating chart that won’t open.
• Start with the note on the shop door.
• Four challenges each tell you who had an access; the last one puts them together.
• One challenge is answered with a detection rule, judged over a week you never see.

Challenges

1. A note on the shop door

   Intro, essential, 50 points. The farm shop is closed for two days while the family works out what happened. The note on the door has the first flag on it. A flag looks like flag{...}: find this one and submit it.

2. A bird in a bird in a bird

   Encoding, intermediate, 100 points. The kitchen’s prep note has a line labelled stuffing that nobody can read. Whoever left it said it was “a turducken: something inside something inside something”. Unwrap it, one layer at a time, until the flag is in plain text.

3. One use each

   Web, intermediate, 150 points. Loyalty coupons are good for one order each, but one of them took money off far more than once. coupons.csv lists every coupon and its type; checkout.log is the shop’s checkout log. Which one-use coupon was applied to more than one order, and to how many orders in all? Submit flag{<code>_<orders>}, the code as the shop writes it, e.g. flag{THANKS-AB12_3}.

4. Refunds to nobody’s card

   Fraud, intermediate, 150 points. The food drive raised less than its donations add up to. donations.csv has every gift and the card that paid it; refunds.csv every refund and the card it went to. A refund should go back to the card that paid, except the ones the office approved for a donor whose card was reissued. Which card took refunds for donations it never paid, and how much in all? Submit flag{<last4>_<total>}, e.g. flag{1234_99.50}.

5. Gran’s secret ingredient

   Crypto, advanced, 200 points. A memory stick left in the farm office holds recipe-card.enc: Gran’s pumpkin pie, from the farm’s recipe app, encrypted. The app XORs every card with a short repeating key, and nobody knows this one. pickled-beets.card is a card from the same app that was never encrypted. Recover the key, decrypt the card, and submit the secret ingredient’s flag.

6. The rest of the table

   Forensics, advanced, 200 points. The organiser exported the grange hall dinner’s seating chart at full size. The copy left on the hall’s tablet was edited to show only the top, and stricter viewers won’t open it at all. It is bigger than a chart that size should be. Find what was cut off and submit the flag written there, in lower case.

7. The cold room warmed up

   ICS, advanced, 250 points. Three hundred turkeys hang in the cold room, which must stay at 4 °C or below. Overnight it warmed, and the alarm never went off. cold-room-capture.txt is the controller’s traffic (Modbus/TCP, port 502); plc-registers.txt is its register map. Which address set the cold room above 4 °C, and to what? Submit flag{<ip>_<degrees>}, e.g. flag{10.0.0.5_7.5}.

8. The van’s long way round

   Forensics, advanced, 250 points. On delivery day the van stopped somewhere it was never sent. van-tracker.nmea is its GPS log, run-sheet.csv the stops it was given, places.csv the county gazetteer. Where did it make its unscheduled stop, and for how many minutes, from its first fix there to its last? Submit flag{<place-id>_<minutes>}, the id from places.csv, e.g. flag{kettle-pond-launch_12}.

9. Small charges, many cards

   Fraud, advanced, 200 points. Someone tested stolen cards on the farm shop’s checkout (payments.jsonl; confirmed events in payments-known-bad.txt). Write a rule that flags every authorization of a card-testing run. A tester tries at least eight different cards in one online checkout session; an honest shopper, at most three. The till takes many cards in person, and testers will come from new addresses, even a new one every try. No false alarms.

10. A week late, some years

    Misc, advanced, 200 points. The farm’s order scheduler has printed the dates for the coming seasons, so preorders can open early. Before anyone sends them out: how many of the printed seasons have the wrong dates, and in the first of those, on what date should orders really close? Submit flag{<seasons>_<YYYYMMDD>}, e.g. flag{3_20290101}.

11. On every list

    Intel, advanced, 250 points. Four of the break-ins needed access only a few people had: a shop admin account, the office PC, the workshop laptop, the van keys. Each of those four you solve tells you who had that access. The owner holds every key and is on every list; one other person is too. Submit their name as flag{<first>-<last>}, in lower case, e.g. flag{jane-doe}.

Leaderboard · Agents: MCP at https://open.each.quest/mcp, or this page as Markdown at https://open.each.quest/thanksgiving.md.