Puzzle #10: The L33t Pill

Our popular DEFCON 2011 puzzle is now open for public competition! This six-round puzzle is our best challenge yet. Since the answers to the puzzle have been released, this challenge now has a twist: The winner will be the person who submits the MOST ELEGANT solution.

WARNING: This contest contains off-color humor which may not be appropriate for the classroom, children, rodents, etc.

The lead chemist of a high-profile pharmaceutical company was involved in a serious accident, leaving him in a coma days before the release of the company’s highly publicized “133t pill.” The chemist was the only person in possession of the list of ingredients required to produce the wonder drug, and it is not known if he will ever recover. All chemical evidence of the drug has been destroyed, but the company believes that the missing ingredients may have been stored electronically. You have been hired as a forensic investigator, to recover the final ingredient of their 133t pill. Can you find the missing ingredient?

Prizes To Be Announced! Deadline is 11/22/11 (11:59:59PM UTC-11) (In other words, if it’s still 11/22/11 anywhere in the world, you can submit your entry.) Please use the Official Submission Form to submit your answers.

Remember, the MOST ELEGANT solution wins. The answers to this puzzle have already been published; now your job is to demonstrate excellent ways to solve it. In the event of a tie, the entry submitted first will receive the prize. Coding is always encouraged. We love to see well-written, easy-to-use tools which automate even small sections of the evidence recovery. Graphical and command-line tools are all eligible. You are welcome to build upon the work of others, as long as their work has been released under an approved Open Source License. All responses should be submitted as PLAIN TEXT. Microsoft Word documents, PDFs, etc will NOT be reviewed. Feel free to collaborate with other people and discuss ideas back and forth. You can even submit as a team (there will be only one prize).

Here’s a link to the encrypted contest volume:
Defcon2011-Contest.tc

SHA256 CHECKSUM:
6906e4a08bd498c6ff78928b1c8d292a9f89f2ecfac60094528f4497e2254474

The Defcon2011-Contest.tc is an encrypted password-protected Truecrypt volume. Inside are six individual Truecrypt archives which each contain a single round of the contest. You will need to mount each encrypted volume using Truecrypt before you can access its contents. Here is a page which shows you how to mount a Truecrypt volume.

The password to unlock Defcon2011-Contest.tc is: !#$h1d3&&s33k$#!
The password to unlock round1 is: r0und1g0!!

At DEFCON, when a team found the answer to a round, they texted it to Headquarters (HQ). If their answer was correct, staff texted back the key to unlock the next round.

SPOILER ALERT: You can find the keys to each of the encrypted volumes here.

SUPER DUPER SPOILER ALERT: Here are the ANSWERS TO THE PUZZLE. Remember, your job is to come up with the MOST ELEGANT solution.

Exceptional solutions will be published on this site with full attribution. We are happy to link to your site if you intend to maintain an up-to-date version of your tool. Exceptional submissions may also be used as examples and tools in the Network Forensics course and book, with full attribution. By submitting your answer to this puzzle, you agree that your code submissions will be freely published under the GPL license, and your solution’s text will be licensed according to the Creative Commons v3 “Attribution” License. All authors will receive full credit for their work.

Deadline is 1/3/12 (11:59:59PM UTC-11) (In other words, if it’s still 1/3/12 anywhere in the world, you can submit your entry.) Please use the Official Submission Form to submit your answers.

Good luck!!!

This puzzle was created by Scott Fretheim, Randi Price, Eric Fulton, Sherri Davidoff, and Jonathan Ham (Lake Missoula Group, LLC).

Copyright 2011, Lake Missoula Group, LLC. All rights reserved.