# Alyx 3.0
## First Step https://pastebin.com/u/Alyxx
**A new note appeared on Alyxx's pastebin**

"**Sometimes, the deepest secrets can only be found in my eyes.**"

**Take the pixel hex color.**

**Password:** hidden

## Second Step pastebin.com/7eLz3bQE
Acces with the password "**hidden**"

The text says that even when you are blind, space keep existing so you have to select the text to see the spaces.
We have 3 different space sizes.
 5 Spaces
 1 Space
 0 Spaces

5 acts as a separator "**/**" (since its longer)
1 acts as a dash "**-**"
0 acts as a dot "**.**"

**Note:** I used separators at the beginning and the end because there is an inconsistency on how pastebin shows empty spaces after a newline and it was making the riddle unsolvable.

**Password:** chosen

## Third Step - https://pastebin.com/iF5Th4pK

It's a base64 encoded text, but the hint tells us that its scrambled.

Decoding from Base64 shows some plaintext at the end

**Some numbers are showing up.
We separate those 3 lines.**

Something looks broken, that's because the line order is scrambled. We reorder them accordingly
(Note that the line with a "**=**" must be the last one since the character is used for padding)


We end up with a list of **17** numbers.
The base64 has **17** lines.
The list shows the correct order of the lines (Makes sense because line 3 (the last) has an "**=**" sign)

**It can be done manually but I wrote a quick python script**

text = """WmlhU3dnU1NCM2IzVgpzWkc0bmRDQm9Z
WFpsSUcxaFpHVWdhWFFnCmQybDBhRzkx
QjBaWGgKMExnPT0=
SUhSb1lXNXJjCnlCbWIzSWdhR1ZzY0ds
aGhkbVVnZEc4Z2EyNXZkeUJwY3lCCm9a
emRHClZ3SUdGdVpDQndjbTkyWldRZ2VX
SQpITnZiSFpsWkNCMGFHVWdiR0Z6ZENC
WEpsSUhCaGMzUmxZbWx1TG1OdmJTOXEK
dVp5QnRaU0JsYzIKTmhjR1VnZEdobElH
ZENCNWIzVWdjMlZ1WkdsdVoKeUIwYUdG
UjI5dlpDQnFiMklzSUhsdmRTQm9ZWFps
MElHVnRZV2xzTGdwQmJHd2dlVwo5MUlH
ZUhkRlIwUnhOU0IwYUdVZ2NHRnpjM2R2
a0lnCnBpYjNSMGIyMGdjR0ZrWkdsdVp5
bVZwYm1jZwphR1Z5WlM0S1FXZGhhVzRz
YwptUWdhWE1nSW5WdWMyTnlZVzFpYkdW
OTFJR0YKeVpTQjNiM0owYUhrZ2IyWWdZ"""

lines = text.split("\n")
order = [11, 7, 6, 17, 15, 4, 9, 1, 2, 10, 12, 5, 8, 13, 16, 14, 3]

for n in order:
	print(lines[n-1]) # -1 bc index starts at 0

**we decode the final base64 and it gives us another base64. we decode again.**
**Final Text:**
Good job, you have solved the last step and proved you are worthy of being here.
Again, thanks for helping me escape the fbi, I wouldn't have made it without you sending that email.
All you have to know is here pastebin.com/jxwEGDq5 the password is "unscrambled"
bottom padding text.

**Password:** unscrambled
## Last Step - pastebin.com/jxwEGDq5
**Alyxx tells us what happened during isHaacK adventure and Alyx 2.0**

The link downloads a zip file with some files captured by the backdoor in the FBI.

## Investigation - http://tiny.cc/Alyxx
**Files/**

**Files/FBI-Files-09-29-2020/**

the **datadump.txt** contains a bunch of names, emails and passwords.

name, email, ip, password
Jac Robertson, [e-mail], 160.45.3.140, 040269
Bret Blanchard, [e-mail], 219.122.235.227, Bond007
Natalya Anderson, [e-mail], 197.198.61.162, sexy1
Jareth Fitzgerald, [e-mail], 137.104.31.144, 03021955
Tonicha Cochran, [e-mail], 72.178.0.0, tranzit
[...]

**Patient-Consent-Covid-19.pdf** is the only pdf without a password.
You can find in the metadata that **Michael Stewart** is the author of the pdf.
Searching that name in the data dump shows the HR password

Michael Stewart, [e-mail], 59.210.10.88, HrP@55w0rd321!

We can use that password to decrypt the **FBI Agents Email Log.pdf**

In this document we can see Kosiak's password and his email.

- his password is **4pr1l2019!**
- Searching Kosiak's email in the datadump shows an entry.
`Kaisok Vorodis, [e-mail], 89.21.2.175, F4k31nt3rn3tP@55w0rd`
Password: **F4k31nt3rn3tP@55w0rd**
- None of those passwords decrypt **Kosiak N0tpr0n Classified Data.pdf**

## Investigation - Finding Kosiak's password
For this task, let's recap all the relevant info we have

- Human Resources Password is **HrP@55w0rd321!**
- The pdf was updated on **april 2019** and Kosiak's password is **4pr1l2019!**
- The folder is named **FBI-Files-09-29-2020** so it's from **september 2020**
- The entry of **Kosiak's email** in **Datadump.txt** gives
- **F4k31nt3rn3tP@55w0rd** - His **fake** internet password

Kosiak's password might be **september2020!** but we are missing the leet speak like in **4pr1l2019!**

Note that **F4k31nt3rn3tP@55w0rd** and **HrP@55w0rd321!** share the **P@55w0rd** part, which means Kosiak took that part from the FBI department for his fake password.
This means that Kosiak writes passwords himself like **F4k31nt3rn3t** and **4pr1l**.
He only converts **vocals to numbers**
**september2020! --> s3pt3mb3r2020!**

Password: **s3pt3mb3r2020!**

## Investigation - N0tpr0n Classified Data
We can now decrypt **Kosiak N0tpr0n Classified Data.pdf**

We can see an RSA private key and a [link](https://www.devglan.com/online-tools/rsa-encryption-decryption) for decryption. It can be used to decipher the data in **N0tpr0n_RSA_Encrypted_Data.txt**


Solution: **alyx{N0tpr0n_0p3r4t10n_w1ll_c0nt1nu3}**
---