Challenge: Santa has run out of money for the presents. He’s checking some old TXT messages from his supporters to check where he miscalculated the budget as he had to calculate it from 3 different sources.

There was no other hint. I spent again a few minutes searching in the page sources and on social media profiles for txt files coming up short. It was obvious that it has again to do with the three participants - BSidesLjubljana, Viris and SSRD.

After a short while I stepped back and read the challenge text again. Why is TXT written in all caps? Oh… Of course.. The DNS challenge.

There was one part of the flag on each domain - bsidesljubljana.si, viris.si and ssrd.io.

Flag: xmas{1tStHeM0stW0ndErFulT1me0fThEyE4r}

What did I learn: Ther’s always a DNS challenge…