3.1. Neon District

The Neon District puzzle started inside of a ND themed room showing a TV displaying text and a link that says "clickme".

Upon clicking it, it displayed a URL for you to visit: https://oracleinvestigation.neondistrict.io/

The text states that someone used a terminal to send a message that they were not supposed to. You, the Oracle, has been tasked with finding information about the message or the “raw message identifier.”

When you load this website, you are put inside of a 3D virtual room that you can move around in. There is a terminal on the wall that you are able to interact with.

You can see that there is :shutdown in the terminal when you run up to it which is telling you the command format. One of the first things you might typically try in a situation like this is use a help command.

The first part of the puzzle is guessing to use :help.

Here is a list of the base commands and their responses:

   0 emu
   1 systemd
   2 env
 735 compatshell

BLOCKFORMAT:    i
BLOCKSIZE:      @@DEFAULT@@
CHAIN:          0
CHARSET:        0
C_LANG:         C
CONNECTED:      %.y
DATEFORMAT:     YYYY-MM-DD
HIDEFILECHAR:   -
KEYPATH:        m/68'/8080'/0'/0'/0
LANG:           C
LANGUAGE:       C
OXFORDCOMMA:    %.y
PERMISSIONS:    INCOHERENT, MUST REINSTALL
ROOT:           %
ROOTFS:         INCOHERENT, MUST REINSTALL
SHELL:          compatshell
SPACESORTABS:   @@DEFAULT@@
TIMEFORMAT:     HH:MM:SS
UNIXPOCALYPSE:  %.n
WIDTH:          80
WINDOW:         */stream1/0/0/
ZAP:            %.n
ZONE:           @@DEFAULT@@+1

Does your site have z?  If not why not!? Demand its installation now!
But if your site does not have z, how will you know?  The only way to
know about z is to run it [DO NOT TELL PEOPLE ABOUT Z] and if it is
not installed you cannot run it.

I know what you are thinking: I should copy z to my site from a site
that has it installed.  But z is copy protected.  You cannot copy z.

What to do, what to do...

THIS IS THE GIFT OF z.

-- Lopyceft the Historical Hacker Humor Preservation Society.

One of the first takeaways you have with the puzzle theme, the goal, and the history command is that this is a bit of a pseudo forensics challenge. What that means is you are given a system at a state in time that it has been compromised and tampered with. Your goal is to work backwards and see if you can figure out how to put the pieces together to solve the problem.

The first interesting bit is the :history command which tells you what the attacker did.

A quick explanation of this can be summarized as the following:

The attacker used :history and :showlocation to see a list of commands or information that anyone who used the terminal in the past may have used. This is a common thing for attackers to do because commands may leak information such as sensitive file locations, passwords, etc.

The attacker used :setidentity and :raiseroute with the following parameter: FROMFILE */stream3/. This gives us information about identity, route, and file paths. They also later down used :dupefile from */stream3/ and the :dropsteam command. The :dropstream command would suggest that we no longer have access to that network / file path so we can only work with the logs.

This is the meat of the puzzle right here. The attacker sent a message (essentially as you work through the commands, you determine the message is a file) and we know the location of it now.

The attacker also took steps to cover their tracks by truncating the log files to remove evidence of the attack.

And this is the current state of the terminal when we access it, so there is no more history from the attacker at this point:

From this history we can deduce a couple important pieces of information.

We know the following file paths now:

• */stream3/
• %env/
• %env/compat
• %env/compat/scratch
• %env/compact/scratch/GARBAGE

We know there is a concept of identities related to these hashes, suggesting that raiseroute is probably an identity too:

With that information, we can start to traverse the %env drive for additional information. If you look up and see the :listpath command, remember that it also takes the parameter SHOWHIDDEN.

. 
.. 
-Logs 
-State 
-Trash

Using the commands to check every folder path for folders and files, we eventually get the following outline for the drive.

    %/
        .
        ..
        env
            compat
                scratch
                    -Logs
                        initproc.log
                        :sendfile.log
                    -State
                        :sendfile.state
                    -Trash
                
    */
        stream3
            id
                ???

Now we can read the file contents.

ATTACHMENTS:    %.y
COMPATVERSION:  75.5.3246
KEYFROMCHAIN:   %.y
NEXTENTROPY:    8c5aa9d38e62d7f1aa093215ad57bfde67f5faa11c54ecef8a8783703023a4ed
NEXTNONCE:      0915303472
NEXTSALT:       d8f82ef44fa33414f1b05f4354e944c63f99684075ba4601aa78dafee51e8806
ONON:           %.y
NEWLINES:       %.n
V60FIX:         %.y
VARIANCE:       e3
Z:              b4846e361de98a5df1a4b5e59713b158f40c02c6d9dcdc4fe3c667502d8813f1

YESTERDAY   [[log.user|@@NODE@@]]-->[[log.aggregator|3a38ce431a0e9c61]]=[[%/env/compat/scratch/-Logs]].0915303453
TODAY       [[log.user|@@NODE@@]]-->[[log.aggregator|3a38ce431a0e9c61]]=[[%/env/compat/scratch/-Logs]].0915303454
TODAY       [[log.user|@@NODE@@]]-->[[log.aggregator|3a38ce431a0e9c61]]=[[%/env/compat/scratch/-Logs]].0915303455
TODAY       [[log.user|@@NODE@@]]-->[[log.aggregator|3a38ce431a0e9c61]]=[[%/env/compat/scratch/-Logs]].0915303456
<<FILE TRUNCATED AT SOURCE BY USER>>

Now is the point where you need to start connecting the dots. There’s a lot of information here, but if you go back to the beginning of the puzzle, it said that it is looking for the raw message identifier.

The sendfilestatus command gave us the following response:

Therefore we know that this is likely the identifier needed to solve the puzzle.

The :sendfile.log gives us examples of identifiers. Example:

What is interesting about this is that thematically it’s suggesting a [[from]]-->[[to]]=[[file path]].nonce format. Let me help explain how you might get to that conclusion.

The @@NODE@@ format is suggesting a system variable, such as what you see in the :status command. But the other clue for this is the identifynode command:

This identifynode command contains a hex string the same size as the hash appended after log.aggregator.

What does that node go with? Well the format for log.user and log.aggregator is [[string|hex string]]. Where else have we seen that? The :sendfile command and :identifyuser command.

Now we know that in the history the attacker used :setidentity to that stream data path and that it identifies as the user [[constance.turner|??????]]. They set a route to another ID, combining the error in :sendfile, you can deduce that chase.just.chase is the user that was going to receive the file.

So if we are to suggest that identifynode hex string is for constance.turner, then we need another hex string for chase.just.chase. We also have that with the droproute command:

With this information, we so far have the following identifier guess:

The last piece we have is a nonce value that in the sendfile log incremented one at a time. If you look at the data from the other commands, you will find this bit of information:

Therefore we know that the nonce value is likely the previous nonce. Putting that together, we land on this:

This is where we got stuck for about a week. We tried a bunch of different routes, but we were having no success. LeFevre by chance happened to try playing around with the command to see if there was a typo, by happenstance we managed to get it to work and realized there WAS a typo in the command.

The end result happened to be:

The -> was supposed to be -->.

An unfortunate result to an interesting puzzle, but it happens sometimes.

Using the solution checker website, we entered the following and got a happy face:

3.2. Axie Infinity

The Axie Infinity puzzle started in a multiple level themed room that is hard to capture with a single picture:

Location: https://www.cryptovoxels.com/play?coords=NW@181E,8U,381N

At the bottom level, there is a riddle on the wall:

And if you look up, you see the following:

This is referring to the Axie #577 which is part of the prize for solving the Yours Truly puzzle.

https://marketplace.axieinfinity.com/axie/577

The meat of this puzzle is the following riddle text:

Uncomplicated and also compact,
sweet sixteen from dark to light,
the few colors of my well being.
to which we shall add nothing after.

I could probably write dozens of pages of all the things we tried in detail, so I’ll keep our failures in a short list:

• We originally thought that it was four sentences (did not notice commas) and that four sentences was equal to four axie parts. The “Sweet Sixteen” could have meant a Sweet Sixteen party - there is a part in axies named Strawberry Shortcake that gives you the move Sweet Party. From this point we tried to find a specific axie that existed. This path continued with some interesting results for the next few days.
• Moving on from the original idea, we considered that maybe “uncomplicated” and “compact” could be referring to big numbers, binary, or hex. Sweet 16 could mean base-16 for hex. All of these things could be referring to the Axies gene. Every axie has a 256 bit gene value. Combining this information with the floors in the room that have 2 colors (green and tan), it’s possible to make the conclusion that you have to identify axie colors or parts using the floor colors as binary data. This was a lot of wasted of effort...

And eventually, we landed on the solution of the puzzle:

• Uncomplicated and also compact, sweet sixteen - base 16 aka hex colors
• from dark to light = shades, order
• the few colors = three colors
• of my well being = wellbeing implied the color green
• to which we shall add nothing after = riddle for adding the word “nothing” at the end of the answer.

Looking at Axie #577, you can see it has 3 shades of green on it.

• Main color
• Shadow at the bottom of the Axie
• Dark green outline stroke

Grabbing the three color hex values of green, sorted from dark to light HSB L value:

• 295107
• 89db75
• ccef5e

Appending them together and adding “nothing” after it:

3.3. SuperRare

This puzzle began in the cozy SuperRare section of the building. Looking around the room you could see 5 pieces of artwork from the SuperRare site and a pixel image with the word SuperRare on it. To begin we identified all the pieces of artwork in the room as:

Right away it was noticed the 5-four digit numbers appended to the end of the link all started with increasing numbers from 3-7 which seemed to indicate a possible order to arrange the paintings.

Continuing to explore the room we also noticed that some pixels on the SuperRare image were colored slightly different than the rest, making two 4x20 grids.

Off-colored bits:

At this point we were stuck for a while until a hint in FOMO led to a breakthrough. In FOMO, there was a pillar with an unused grid for its final solution. One of the statues in FOMO says "Selene makes the path." It was determined that if you waited until nightfall in the game, a bridge would appear connecting the nearby rock ledge to the pillar allowing you to read the grid.

Deciphering the grid using the solution from FOMO, the grid results in the letters RNAL and a hint that this is the last 4 letters for the SuperRare solve. (The game incorrectly stated last 3 letters but was corrected later)

It was guessed that this most likely indicated the final word in the solution was “eternal” as that was the only bip39 word that ended in RNAL (This ended up being a lucky coincidence that it was a bip word). It just so happened that the “Circus of the Cyber Hell” artwork with the highest ending number contained the word eternal in its description. At this point we knew we were probably looking for a book cipher and the grid held the key to the remaining words. Knowing that eternal was the 55th word in the artwork we began looking for any indication of the number 55 in the pixel data. After many failed ways to manipulate the data, it was found if you just read the bits as 8-bit decimal numbers that the last 8 bits resulted in 055

Artwork broken into 8 bits

(00110111= 055)

A quick translation of all the other numbers gave the following string

Right away it was noticed that all those numbers were below the word count in the description for every painting. Taking the 68th word of the first painting, the 2nd word of the second, the 60th of the 3rd and looping back to the first painting after you used the fifth painting resulted in the phrase:

3.4. Yours Truly - AR

The painting was created to be used with the Artivive app. Downloading this app and pointing it at the image reveals an animated painting that can be viewed via AR. Upon close inspection of the animation you will notice a few strings of words are scattered throughout.

Video: https://cdn.discordapp.com/attachments/673924370472632322/680814805980020762/artivive_yours_truly.mp4

One of the strings of interest in the image:

3.5. Yours Truly - Painting

This puzzle can be found within the original painting that was posted in the newsletter. This seemed more like an introduction to the puzzle more than anything.

At the bottom left left of the chest in the painting, you can see the words “yt” inscribed:

3.6. CryptoVoxels

The CV puzzle begins within the puzzle building in a room with just the CV logo and a wall with some cipher text.

Cipher Text: LQDIRCEZZFGBCURQWGROQOELHHBPXOSUWLRUOCMBK

This string is actually a OTP (One Time Pad) cipher with the key to decrypt it being hidden in 8 pieces throughout the puzzle locations. The 8 locations and keys are listed below:

#1

Inside the Yours Truly AR - View the visor of the animation and the numbers scrolling across read:

#2

Inside the front wall of the CV building - going into 3rd person mode allows you to pass the camera through the wall allowing you to see this one:

#3

Inside the Neon District Oracle Room - On the servers are barcodes in the upper corner. Looking closely at them shows the string written without spaces. This can also be viewed in the page source: https://oracleinvestigation.neondistrict.io/assets/textures/mainn-tag.png

#4

Inside the Cryptokitty room in the main CV puzzle building - Again going into 3rd person view allows you to view the backside of the plaque behind the lower kitty in the CK room

#5

Inside the FOMO game - there is a statue at the end of the game across the bridge that displays the numbers to you.

#6

On Opensea - Looking at the #0 Your truly NFT on Opensea, you can see it has an additional piece of info in its description that no others have. It tells you this artwork has been scribd. Going to the scribd website and validating this artwork gives a phrase with the 6th string.

#7

Outside of the CK Puzzle building - Going to the secondary Cryptokitty puzzle building, you can find a cryptokitty voxel outside that has the 7th string written on its back.

#8

The Yours Truly Painting - On the original Your Truly painting, you can see this final string in the lower left of the glasses.

Putting it all together

Once you have collected all 8 strings, you will realize that you have 41 numbers, which is the same length as the original cipher

Shifting each letter back by the value specified reveals the solutions text. (wrap around from A to Z if needed), so the first character is L-18 = T, second is Q - 9 = H, etc until you have the final message.

3.7. CryptoKitties

Step 1

In the Cryptokitties room are 4 fancy trait clues shown near the ceiling.

• Cat #1 has the Hacker mewtation https://www.cryptokitties.co/kitty/960745
• Cat #2 is showing the color for kittencream
• Cat #3 has the Liger mewtation https://www.cryptokitties.co/kitty/1100044
• Cat #4 has the Icicle mewtation https://www.cryptokitties.co/kitty/1188401

A fancy chase lead by user M00se (https://www.twitch.tv/rudem00se) lead to the birth of the first Miss Matheson fancy cat

https://www.cryptokitties.co/kitty/1841972

Step 2

She has CV coordinates in her glasses:

That leads you to a new CV location: https://www.cryptovoxels.com/play?coords=W@227E,182S

There are 12 cats on display with numbers on them. Each cat was unique in that there were only one of each that currently exist on exception to the first where two existed.

Using a website, we were able to locate each specific CryptoKitten:

We created a spreadsheet analyzing the genes and traits of each CryptoKitten, it is in this spreadsheet:

https://docs.google.com/spreadsheets/d/1FGEkAVnGRx2UvPQMVRLNzMZMkZmneONwYY4PFSDoq6A/edit?usp=sharing

Here's a sample of what it looks like:

We tried to make a string of each dominate part indexed by the number of the cat, but this was not the solution.

At this point, we were not sure what the next step was. Eventually, we noticed a “clue” located outside of the CryptoKittens house that was placed to appear as if it were a part of the CV house next to it.

An interesting bit is that we originally ignored this image when we discovered it. We thought for sure it was part of the house next to it, perhaps a troll or just a coincidence that it said geneMask on it.

Common sense indicates that it stuck out and we should have considered it. But, the funny thing with puzzles is that the obvious thing in hindsight is not always the obvious thing at the time.

After digging through cryptovoxels web APIs, we noticed the parcels was part of the same lot that had the CK images in it:

https://js.cryptovoxels.com/grid/parcels/823/at/18d2e8c2358b1b109a6fe665e419041693096ba2

{
            "type": "image",
            "scale": [2.28, 1.07, 0],
            "url": "https://images.ctfassets.net/bktrgw6io7fv/2Zwku6KXX3h8ocwLAjiYnZ/d73056eb63d314f577f5f277fbd5aa70/clue-000.png",
            "position": [-9.75, 1.5, -2.5],
            "rotation": [0, 1.5707963267948966, 0],
            "uuid": "2d21ad74-44dc-4d37-8dad-b2bdc3371d20",
            "inverted": false,
            "stretch": true
        }]

https://images.ctfassets.net/bktrgw6io7fv/2Zwku6KXX3h8ocwLAjiYnZ/d73056eb63d314f577f5f277fbd5aa70/clue-000.png

So now that we knew it was in play and literally labelled “clue-000”, we went forward with it. We knew that CryptoKittens were comprised of genes, but we had no idea where the source of the image was from.

Another interesting bit was at the same time we noted that there was a hint in the CryptoKitties discord that we originally missed:

“Mass Matheson moonlights as a bounty hunter.”

After some investigation efforts, we found that it was part of a popular 3rd party CryptoKitten website called kittyhelper. This hint helped us hone in our searches and locate this site:
https://kittyhelper.co/bounty/

We noted that although the table looked the same in the image as the table on the kitty bounty page, it was not exactly the same.

https://kittyhelper.co/bounty/wck/171/

It says “exactgenes” versus “geneMask.”

We reached out to the person who created the site and they let us know that there was nowhere else on the site that the table was used. So we know that the team that made the puzzle specifically replaced the “Exact Genes” text with “geneMask” as a clue towards how to solve it.

After investigating how the bounty system works for this feature on kittyhelper, we noticed that there is a custom contract setup for it that contained the term “geneMask” in it.

https://etherscan.io/address/0x5a6a0bdf6002c5e863e578e15037a96e61d273e6#code

Using the chart in CryptoVoxels, we filled out the chart using the number in p0 as the number under the cat. We took the type for each cat listed, making sure we skipped “wild”. Using that table, we created a new bounty using the kitty bounty contract. The correct gene table happened to be: ragdoll calicool dahlia oceanid cloudwhite rosequartz purplehaze tongue myparade

This resulted in the following transaction:

Copying the geneMask and...

3.8. Age of Rust aka FOMO

Cloverme, the mastermind behind Age of Rust, created a game called FOMO for Josie’s Yours Truly puzzle. You can download it here if you want to try it out:

https://www.ageofrust.games/fomo

We already released a write-up for this puzzle earlier, so you can read jtob’s masterpiece here:
https://medium.com/@jtobcat/deciphering-the-stones-of-fomo-ccba32fafd3a

3.9. OpenSea

If you read the CryptoVoxels puzzle solution, you will recognize this part of the puzzle already.

The Yours Truly #0 NFT on Opensea: https://opensea.io/assets/0xecf7ef42b57ee37a959bf507183c5dd6bf182081/78

This NFT has the following description: "Yours Truly" puzzle was made in collaboration with Neon District, Twisted Vacancy, Age of Rust, Axie Infinity, Cryptokitties, Cryptovoxels, Opensea, and SuperRare. This NFT has been scribed.

We noticed the text “This NFT has been scribed” at the end, but had no idea what it meant. It wasn’t until mattm noticed that there was a tool called NFT scribe that we finally figured it out: https://conlan.github.io/nft-scribe/.

Inputting the address and token ID for “Yours Truly #0”, we get the following message:

We figured this was a good guess for an Opensea puzzle solution because we had not found anything else on there related to the puzzle that was interesting. After we discovered the solution for the Painting and AR puzzles, we figured that we should modify the formatting of the text.

Sure enough...