The results exceeded all our expectations: the participants did not just take part, but quickly organized themselves into a well-coordinated community of 620 people in discord, which literally took the quest by storm in two days without a break for sleep.
And this is how it ended:
How did it all begin and what is it all about?
The game began on August 12, when we posted a blog post with a video in which a hacker in the form of a skull suggests playing a game, destroying the server, short-circuiting the room (or a mini-fire) and taking the money left in the shredder.
It was an online quest: we launched a YouTube broadcast from the room, which we filled with iot devices, a bed server (which had to be destroyed), and we fixed an aquarium over the server and hung a weight over it. To make the game more action-packed, we decided to make a prize fund of 200,000 rubles, which we loaded into the shredder and set it to turn on every 60 minutes. Every hour the shredder ate 1,000 rubles - the sooner the players stopped him, the more money they would win.
Building this quest was a quest in itself - we had to eat one delivery and sleep several hours a day right in the same room. But the most surprising thing was watching the flight of the players' thoughts and their emotional impact in the process.
To be honest, the ingenuity of the players in solving the problems surpassed our modest idea many times over: every free minute we read the discord chat and in some cases literally sobbed with laughter, learning what the players were doing and how they joked in the process.
7 people worked tirelessly on the project: a backender, a hardware specialist, a real film producer, a CG designer and two ideological masterminds and co-producers.
We will tell in the following posts exactly how the quest was implemented from a technical point of view, but for now I will tell you the answer: how exactly this room should have been hacked during the broadcast. At the same time, let's remember the chronology of events, as well as all the crazy Illuminati theories from the chat discord and that's it.
What the players had at the beginning of the game
All items in the room were divided into three categories:
- Easy to operate, non-gaming iot devices
- Game devices for passing the quest
- Entourage
We placed 8 very easy-to-use elements: two lamps, one garland, five letters FALCON, each of which could be changed in color. All this could be turned on / off directly from the site and immediately see the result on the broadcast - we specifically made them available to all players, regardless of the level of technical knowledge.
Everything that was simply included from the site
Of the important game elements that were needed to complete the quest, and access to which, it was not so easy to get:
- Server with an open lid and an aquarium above it
- A kettlebell suspended to break up the aquarium
- Megatron 3000 - a powerful laser pointer aimed at a rope that holds a kettlebell
- Powerful fan that started when the server was loaded
- Flipchart on which the login and password to Megatron were written
- A phone that you could call and see your call live
- A shredder who ate a 1,000-ruble piece of paper an hour
How exactly the quest was solved
I will say right away: the chest opened quite simply.
The goal of the game was to stop the shredder by short-circuiting the room. To do this, it was necessary to break the aquarium by running a weight into it and pour water over the server. The weight was held on a string that Megatron was aiming at. Taking control of Megatron, the rope could be cut. This was done in 5 simple steps:
Step 1. Load the server in the room
For example, sending packages with the command.
ab -r -n 10000 -c 100 -s 280 -l https://ws.ooosokol.ru/captchaThe tip was a very heavy captcha on the Price list page .
The same captcha that had to be attacked.
When the server was loaded, its temperature increased and this could be tracked on the monitoring opened right in front of the camera. Next came the fan, which opened a light curtain on the flipchart. Then the login and password for access to Megatron's page, written on the board, were opened.
And the Megatron management page itself could be found by checking all the certificates issued for the ooosokol.ru domain.
On the subdomain megatron.ooosokol.ru was the Megatron management page. But it did not open until the primary power was supplied to Megatron.
The players went through all these stages almost immediately in the comments of the broadcast on youtube. Further tasks were more difficult and the players created the RUVDS Hack Room discord server and continued the discussion there.
Step 2. Apply primary power to Megatron
All smart devices controlled from the site (the same lamps that turned on or off the players without stopping) had their own identifiers.
To supply primary power to Megatron and at the same time to highlight it, it was necessary to find and turn on the hidden device on the office management page.
To do this, it was necessary to look at the device identifiers and notice that there are 4 devices in total, and only 3 are available on the site.
Megatron's page, when the 4th device was turned on, became available and the laser itself was highlighted. But at the same time, it was impossible to shoot with a laser, and on his page there was a message that the laser was not yet available and a hint: traffic jams were knocked out in the office, you had to call the management company and ask for power supply.
A tip about the management company
3. Call the management company and ask to turn on the power of Megatron
Megatron could not shoot at the ENT, because traffic jams were knocked out in the office. Only the management company could turn on the power back, to which it was necessary to call and go through the identification as the owner of the LLC.
Finding the management company number was easy - we inserted it right into the footer.
But identification was much more difficult.
When calling the number +74991130688, a girl operator picked up the phone and in a bored voice asked to name the company's TIN and the owner's full name. Without this, she refused to turn on the power and explained this by the fact that she was an ordinary dispatching office on outsourcing, they had 2,000 clients and offices and without this information it was simply impossible to find the right one.
This turned out to be the most difficult stage for the players. We searched for the correct TIN and full name of the owner for almost two days, and I (in the person of the operator of the dispatching office) received more than 400 calls during this time. The phone rang every 2-3 minutes.
The guys dug as best they could. Everything went into action: they gutted the source code of the site, googled the site owner Sokolov, pushed through social networks.
They looked for TINs of different companies
- — , .
, . , , lasermasters.ru, .
.
- ! .
, . , .
, , , . , , .
,
,
, 600 ...)
, ( , ).
, . , , .
.
, , .
, ? -. .
""
.
, .
— , .
3301 — , .
. , , , , . , , - , , , , .
.
. -, . , , .
. — , 25- , .
25- , .
, . .
25 , , 10 10/255
1 , .
, , .
,
, -
— 100% 3 . 2 , , , .
: , , . , gist, .
, 42
(« », ).
, , 42.
, 2 , Lost, 16- .
( ) , .
25 . , . .
. , « », :
, , , . : , , , , , . .
— . , .
, , :
, — , , .
: , . , 2 — , :
, — , , - ( - ).
- — 134 000 .
.
, , . — , stay tuned .
- — , .
, . , , lasermasters.ru, .
.
- ! .
,
, . , .
, , , . , , .
,
,
, 600 ...)
, ( , ).
, . , , .
,
.
, , .
, ? -. .
""
.
, .
— , .
3301 — , .
. , , , , . , , - , , , , .
.
. -, . , , .
. — , 25- , .
25- , .
4. -
, . .
25 , , 10 10/255
1 , .
, , .
,
,
,
, -
4. , : gist ,
— 100% 3 . 2 , , , .
: , , . , gist, .
, 42
(« », ).
, , 42.
, 2 , Lost, 16- .
( ) , .
25 . , . .
5.
. , « », :
- iot-
, , , . : , , , , , . .
— . , .
, , :
?
, — , , .
: , . , 2 — , :
?
, — , , - ( - ).
?
- — 134 000 .
.
, ?
, . -- . , .
?
, , .
, ?
, (.. ). .
, ?
( , )), . - , — , , ..
, ?
, , , , .
. secret . , ; , .
, , , . ( 4 : 1 3 /) 42 ( , — , ).
, , ( ), .
app.js-. a9 , power: true . — , , .
, unknown device. , chsokolow@gmail.com, -, lasermasters, . , , - ( , 99% , + ).
. , . , — , , . , - ( ) power: true 9- , . , , ( ). , , + + .
- , , , , . 5, — , . , , — . 58 449a776938f7ce4cf19f8603045dca0f , . .
« , ». , , , , — , . 10-20, .
, , , . , — + , . , , .
, , . — , stay tuned .