Objective 7: Solve the Sleigh's CAN-D-BUS Problem
Jack Frost is somehow inserting malicious messages onto the sleigh's CAN-D bus. We need you to exclude the malicious messages and no others to fix the sleigh. Visit the NetWars room on the roof and talk to Wunorse Openslae for hints.
The first challenge here that I'm presented with is a bit unorthodox:
Can't even access the challenge unless I'm Santa or an Official Technician Elf. Since I'm neither, I was forced to poke around the castle a bit.
I do recall there being a scary dark room that I used the HID repeater attack against...might as well check it out!
A locked door on the 1 1/2'th floor with a dark room...
Looking through those eye-holes turns me into...
Malkovich malkovich mal....uh...Santa santa santa santa.
Sorry. But now that I'm Santa, I can probably access things I couldn't access before. Like say, the CAN-D-Bus challenge.
That's more like it!
What I'm presented with here is a quickly-scrolling set of numbers, each column representing something different. The first two columns on the left showed the epoch time, followed by the ID of the message sent to the CAN-D bus, a hashtag as a delimiter, and the message regarding the ID. I can modify various effects by moving the slider for the accelerator, the brake, and the steering, I can start and stop the engine, and finally lock and unlock the doors. Each modifier I introduce displays a new message that scrolls by quickly. I can create a filter that stops receiving messages based on specific criteria, and ultimately my goal is to filter out the bad data spammed by whatever Jack Frost added and allow the sleigh to operate normally.
Based on this, my next step is to map out what each ID is and the potential values I can achieve for each based on what the log file tells me.
- 244 = Engine status and RPMs
- 080 = Brake status and how much pressure, min is 00 0000, max is 00 0064. Has a crazy high value of FF FFFF periodically, that seems a bit excessive if my max value seems to be 64.
- 188 = Not sure, I can't change this value. Always displays as 00
- 019 = Steering, max left is > ffff ffff ffc0, at 0 it's 0000, at max right it's < 0040
- 19B = 0000 000f 2057, weird message can't map. Malicious?
- 19B = 0000 0000 0000 0000 => lock
- 19B = 0000 000F 0000 0000 => unlock
- 02A = 0000 FF => Stop Engine
- 02A = 00FF 00 => Start Engine
Based on the above I see two weird messages I can try to filter out. First is a strange value from 19B which I mapped to the lock/unlock function, and the second is a crazy high value for the brakes. Ultimately, those two aberrant values were the malicious ones, and the following is what got the sleigh started and working normally again:
A christmas miracle!