Alyx 3.0

First Step https://pastebin.com/u/Alyxx

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’

A new note appeared on Alyxx's pastebin

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’

"Sometimes, the deepest secrets can only be found in my eyes."
Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’

Take the pixel hex color.

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’
Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’
Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’

Password: hidden

Second Step pastebin.com/7eLz3bQE

Acces with the password "hidden"

The text says that even when you are blind, space keep existing so you have to select the text to see the spaces.

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’

We have 3 different space sizes.
Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’
5 Spaces
Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’
1 Space
Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’
0 Spaces

5 acts as a separator "/" (since its longer)
1 acts as a dash "-"
0 acts as a dot "."

Note: I used separators at the beginning and the end because there is an inconsistency on how pastebin shows empty spaces after a newline and it was making the riddle unsolvable.

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’

Password: chosen

Third Step - https://pastebin.com/iF5Th4pK

It's a base64 encoded text, but the hint tells us that its scrambled.

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’

Decoding from Base64 shows some plaintext at the end

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’

Some numbers are showing up.
We separate those 3 lines.

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’

Something looks broken, that's because the line order is scrambled. We reorder them accordingly
(Note that the line with a "=" must be the last one since the character is used for padding)

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’

We end up with a list of 17 numbers.
The base64 has 17 lines.
The list shows the correct order of the lines (Makes sense because line 3 (the last) has an "=" sign)

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’

It can be done manually but I wrote a quick python script

text = """WmlhU3dnU1NCM2IzVgpzWkc0bmRDQm9Z
WFpsSUcxaFpHVWdhWFFnCmQybDBhRzkx
QjBaWGgKMExnPT0=
SUhSb1lXNXJjCnlCbWIzSWdhR1ZzY0ds
aGhkbVVnZEc4Z2EyNXZkeUJwY3lCCm9a
emRHClZ3SUdGdVpDQndjbTkyWldRZ2VX
SQpITnZiSFpsWkNCMGFHVWdiR0Z6ZENC
WEpsSUhCaGMzUmxZbWx1TG1OdmJTOXEK
dVp5QnRaU0JsYzIKTmhjR1VnZEdobElH
ZENCNWIzVWdjMlZ1WkdsdVoKeUIwYUdG
UjI5dlpDQnFiMklzSUhsdmRTQm9ZWFps
MElHVnRZV2xzTGdwQmJHd2dlVwo5MUlH
ZUhkRlIwUnhOU0IwYUdVZ2NHRnpjM2R2
a0lnCnBpYjNSMGIyMGdjR0ZrWkdsdVp5
bVZwYm1jZwphR1Z5WlM0S1FXZGhhVzRz
YwptUWdhWE1nSW5WdWMyTnlZVzFpYkdW
OTFJR0YKeVpTQjNiM0owYUhrZ2IyWWdZ"""

lines = text.split("\n")
order = [11, 7, 6, 17, 15, 4, 9, 1, 2, 10, 12, 5, 8, 13, 16, 14, 3]

for n in order:
	print(lines[n-1]) # -1 bc index starts at 0

we decode the final base64 and it gives us another base64. we decode again.

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’
Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’

Final Text:
Good job, you have solved the last step and proved you are worthy of being here.
Again, thanks for helping me escape the fbi, I wouldn't have made it without you sending that email.
All you have to know is here pastebin.com/jxwEGDq5 the password is "unscrambled"
bottom padding text.

Password: unscrambled

Last Step - pastebin.com/jxwEGDq5

Alyxx tells us what happened during isHaacK adventure and Alyx 2.0

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’

The link downloads a zip file with some files captured by the backdoor in the FBI.

Investigation - http://tiny.cc/Alyxx

Files/

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’

Files/FBI-Files-09-29-2020/

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’

the datadump.txt contains a bunch of names, emails and passwords.

name, email, ip, password
Jac Robertson, jrobertson@mac.com, 160.45.3.140, 040269
Bret Blanchard, bblanchard@netlog.com, 219.122.235.227, Bond007
Natalya Anderson, nanderson@webeden.co.uk, 197.198.61.162, sexy1
Jareth Fitzgerald, jfitzgerald@chron.com, 137.104.31.144, 03021955
Tonicha Cochran, tcochran@gmail.com, 72.178.0.0, tranzit
[...]

Patient-Consent-Covid-19.pdf is the only pdf without a password.
You can find in the metadata that Michael Stewart is the author of the pdf.
Searching that name in the data dump shows the HR password

Michael Stewart, hrdepartment@mail.net, 59.210.10.88, HrP@55w0rd321!

We can use that password to decrypt the FBI Agents Email Log.pdf

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’

In this document we can see Kosiak's password and his email.

  • his password is 4pr1l2019!
  • Searching Kosiak's email in the datadump shows an entry.
    Kaisok Vorodis, undercover@mail.net, 89.21.2.175, F4k31nt3rn3tP@55w0rd
    Password: F4k31nt3rn3tP@55w0rd
  • None of those passwords decrypt Kosiak N0tpr0n Classified Data.pdf

Investigation - Finding Kosiak's password

For this task, let's recap all the relevant info we have

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’

  • Human Resources Password is HrP@55w0rd321!
  • The pdf was updated on april 2019 and Kosiak's password is 4pr1l2019!
  • The folder is named FBI-Files-09-29-2020 so it's from september 2020
  • The entry of Kosiak's email in Datadump.txt gives
    • F4k31nt3rn3tP@55w0rd - His fake internet password

Kosiak's password might be september2020! but we are missing the leet speak like in 4pr1l2019!

Note that F4k31nt3rn3tP@55w0rd and HrP@55w0rd321! share the P@55w0rd part, which means Kosiak took that part from the FBI department for his fake password.
This means that Kosiak writes passwords himself like F4k31nt3rn3t and 4pr1l.
He only converts vocals to numbers
september2020! โ€“> s3pt3mb3r2020!

Password: s3pt3mb3r2020!

Investigation - N0tpr0n Classified Data

We can now decrypt Kosiak N0tpr0n Classified Data.pdf

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’

We can see an RSA private key and a link for decryption. It can be used to decipher the data in N0tpr0n_RSA_Encrypted_Data.txt

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More โ†’

Solution: alyx{N0tpr0n_0p3r4t10n_w1ll_c0nt1nu3}