Knappast lätt

Platform: undutmaning | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Windows | Author: XESXOR | Date: 2026-03-21 | Status: Solved Techniques: strings_extraction, t9_keyboard_conversion, hash_verification, registry_analysis

Summary

English summary: The person responsible for CASCADA's emergency plan, Berit Beredd, is missing. Harriet finds an external hard drive on Berit's desk with a sticker on the back containing potential passwords. The goal is to access the drive's contents by finding the correct PIN.

Knappast lätt — Undutmaning

Description

Den ansvarige för CASCADAs beredskapsplan, Berit Beredd, står inte att finna. Förhoppningsvis har hon inte blivit hajmat.

När Harriet, med lite lätt dåligt samvete, rotar igenom Berits skrivbord för att se om det finns något användbart, hittar hon en extern hårddisk. Men hur ska hon komma åt innehållet?

Hon vänder och vrider på disken och på baksidan hittar hon ett litet klistermärke med text på. Du kanske ska titta närmare på disken.

English summary: The person responsible for CASCADA's emergency plan, Berit Beredd, is missing. Harriet finds an external hard drive on Berit's desk with a sticker on the back containing potential passwords. The goal is to access the drive's contents by finding the correct PIN. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Analysis

The challenge name "Knappast lätt" is a Swedish wordplay:

• "Knappast" = "hardly" but sounds like "knappar" = "buttons/keys"
• "lätt" = "easy"

This hints at a keyboard/keypad-based solution.

Files Provided

• 030426-4281-01.dmp - Windows 64-bit kernel crash dump (PAGEDU64 format, 557KB)

Memory Dump Analysis

Strings extraction from the dump revealed registry data at offset 0x4ba00:

• Registry path: \Registry\Machine\Software\fonster
• Values: flag, another, year, pajat fönster (Swedish for "broken window") ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Web Interface Discovery

The challenge URL revealed a PIN pad interface with T9 keyboard layout (like old mobile phones). A sticker showed potential passwords:

• sharkysharky1988
• greatwhite88
• sharkattack88
• bullshark1988
• greatwhite1988
• cascadashark88
• whalesharkcascada1988
• hammercascada1988
• cascada1988

JavaScript Analysis

The PIN pad JavaScript code showed:

• Input is hashed with SHA-512
• Target hash: e0b5adcce88acc0582d89467ba3ea45c78a9338ce7316e7ef70076455f2df856a58685a7e286ac5b8b5594c9b26c71dbaeb7a0482b9ab503c68aaf57d1927eb9
• If hash matches, flag = undut{SHA1(input)} ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Understand T9 Encoding

The PIN pad uses T9 keyboard mapping (like old mobile phones):

• 2 = ABC, 3 = DEF, 4 = GHI, 5 = JKL
• 6 = MNO, 7 = PQRS, 8 = TUV, 9 = WXYZ

Step 2: Convert Passwords to T9 and Check SHA-512

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import hashlib

# T9 keyboard mapping
t9_map = {
    'a': '2', 'b': '2', 'c': '2',
    'd': '3', 'e': '3', 'f': '3',
    'g': '4', 'h': '4', 'i': '4',
    'j': '5', 'k': '5', 'l': '5',
    'm': '6', 'n': '6', 'o': '6',
    'p': '7', 'q': '7', 'r': '7', 's': '7',
    't': '8', 'u': '8', 'v': '8',
    'w': '9', 'x': '9', 'y': '9', 'z': '9',
}
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

def to_t9(s):
    return ''.join(t9_map.get(c.lower(), c) for c in s)

passwords = [
    "sharkysharky1988", "greatwhite88", "sharkattack88",
    "bullshark1988", "greatwhite1988", "cascadashark88",
    "whalesharkcascada1988", "hammercascada1988", "cascada1988"
]

target_hash = "e0b5adcce88acc0582d89467ba3ea45c78a9338ce7316e7ef70076455f2df856a58685a7e286ac5b8b5594c9b26c71dbaeb7a0482b9ab503c68aaf57d1927eb9"

for pwd in passwords:
    t9 = to_t9(pwd)
    sha512 = hashlib.sha512(t9.encode()).hexdigest()
    if sha512 == target_hash:
        sha1 = hashlib.sha1(t9.encode()).hexdigest()
        print(f"MATCH: {pwd} -> {t9}")
        print(f"SHA-1: {sha1}")
        print(f"Flag: undut{{{sha1}}}")

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Result

• Password: hammercascada1988
• T9 PIN: 42663722722321988
• SHA-512 matches target hash
• SHA-1 of PIN: REDACTED ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍