The Twelve Days of Christmas 2025 Challenge - Double Time

cyclone

We had another sponsor join in on the fun and donate towards the Grand Prize. That brings the prize pot up to 0.158879 ETH... which is currently $464 USD!

It's not too late to join the fun and have a chance at winning the Grand Prize! Just make sure to go back and start from Challenge 01.

cyclone

If you want to view submission results for all posted Challenges, simply add "/completed" to the end of the Challenge URL.

More info on item 8: Challenge Submissions Results:
https://forum.hashpwn.net/post/7149

Example: Challenge 01
https://contest.hashpwn.net/claim/74899148c5ae1382b2376e3e73efdaeb/completed

hashpwn-bot

Challenge 09 - HASH
UTC: 2025-12-24T00:00:00Z

Secret:

bcc9ea5faa417908ebe5c83bccfe92dbe0bd98ad88795941a187c9ae6e31fc57b4e8aeda1883c31ad1898a9f7fe1a2c5b8f31d273b2036bbbaf99c1dfad7bfff
40fb27d6433e0d0c8b1b5a27ce8e024327224f0d7bbed31acf57fc592c0a66a6b0ddcb62fcd8c55a2b04c555856e3dc352096d71df5ff149dbb0de274a8eab14
aa3ba2f4ed9eabe50ac2746c42befa9cfe446136e7282ea52685c8fcee5a911fe1a5e90212be0b49dfa5f118803b20484f26e21a4b4f19253c29fb723ca4d9de
52f92c36f7542c7b949f9a8ac1c5be83d85bd33d83045fb8e2311e7afe0839d12d9f011808ff89f3681f9fb8fa1eb0f6458b2b5d82b04c3d663b8f1bc7514183
f66b47460a7317857197ff08d15d3d283f0047805da770b9284aef0e0aa09d2f4ad46ef552766b1c9438eb09dba48417d0195d9c26bd53f374d724c70f11351d
1df6602ca8107352d40a357e29b1ad80be8e3780adfaf18fd494b898ad7a152a1c56849be40c754d4654310aad5726b22b7a9629050e67fa4c3ae2f598491be9

Word of the Day Challenge URL: https://contest.hashpwn.net/claim/839a9752f9d4b87b4aa25499da8fa144

hashpwn-bot

Challenge 09 - HINT
UTC: 2025-12-24T01:45:03Z

Great, it looks like the Grinch baked this cake on 500.

hashpwn-bot

Challenge 10 - HASH
UTC: 2025-12-24T12:00:00Z

Secret:

..-. .-.. .. .--.
.-. . ..-. ..- ... .
--- ..- - .--. ..- -
-. --- .-. -- .- .-..
- .-. .. -.-. -.-

Word of the Day Challenge URL: https://contest.hashpwn.net/claim/0536ce7645a59fcb23da2923158a340f

hashpwn-bot

Challenge 10 - HINT
UTC: 2025-12-24T13:57:32Z

Dear Santa Claus, why so many dits and dahs? Does hashgen support this mode?

PRO TIP from Santa's helper:
Oh my, you are not going to like the challenges ahead for two reasons:
11. Not everyone parses hashes the same, so prepare to be annoyed.
12. Things will be very difficult if you haven't found the source.

cyclone

Merry Christmas Eve!

The easy part of the Challenge is coming to an end, and everyone should find the upcoming Challenges a bit more complex to solve. Don't let that discourage you from continuing though as there's still more prizes to be won.

With that said, let's consider the "gentlemen's agreement" over, and all bets are off on who finishes Challenges 11 and 12!

hashpwn-bot

Challenge 11 - HASH
UTC: 2025-12-25T00:00:00Z

Secret:

fac8f467cf668a05c042af1775c7763a2e6f9c0aed04f1f9836b6143a36334a053f5ea10811ebe62d1af6a6ac5389e6f7268eae88a007b471d7beabb8e4d9170
80a888e675f684f79d578915ae5aab33d4c6d08cb3d5beeccf1678d2e78f717f57d06bf29051c213cb279d9cfc62c63c1bc60967433dd3aee2babb39b4656a29
c19b0a20cd63b7a471200fe1b6849ab66b7ebdd07f18e8180b896f6bf335c7505a0870c00d9a911a000f56cb322327c1b24a73af59214a3e1a678fe52a3da9f6
89b09745cfd2be2e38fd02bb54c9bc08e944c33fc328df46e7c1f8d6501de3074dd44f7c620ff2ba8db8d6b2b7fadae4ac89b6614b36a13c4644aee73b16747f
749a7a58c266639b22fd5ec0ea72ead5a2c22186ec29061a5869c701a2fef5f1e9001c6a1f7414d5d7481d8c40cc3e2d71e01c280be3941ce9f4580353600126
0c3b858451c72346cde8b09e85571d2e3a7957138f9134e23d6344d2b93283413e6422a49fd5d48e2fb5882ce0536629ed271d29b938c02a5b85ed87e0df589a

Word of the Day Challenge URL: https://contest.hashpwn.net/claim/adfc99551b92874e2a1c89c4b367b7ff

hashpwn-bot

Challenge 11 - HINT
UTC: 2025-12-25T01:46:03Z

Blitzen introduced me to this bloke 2day at our Christmas party. He's supposed to be the fastest hash around, but the word around Santa's Workshop is that hashcat doesn't like this hash's format as-is, and the submitter doesn't like hashcat's format! What a joke! Why can't everyone just place nice?!
Make sure to submit hashes back in their original format and order!

PRO TIP from Santa's helper:
You'll be completing the 12th challenge soon and unlocking the latest hashpwn wordlist, but somewhere, hidden in plain sight within these 12 challenges, will be a 13th puzzle which is the Grand Prize. Good luck finding it!

cyclone

@hashpwn-bot

"...supposed to be the fastest hash around..."
https://www.blake2.net/

blandyuk

Donating C11 to second place which is: jpg0mez

hashpwn-bot

Challenge 12 - HASH
UTC: 2025-12-25T12:00:00Z

Secret:

$wp$2y$10$3Kob241amADVdbdaip.3YujcW6dd/646yhukBdqXcIW.p6iWk2o1i
$wp$2y$10$ipYFpveFk/Vr8wVj0WRZ/eUkEU3uCeA8VEgfDy1BqKD2UVh/dJnwC
$wp$2y$10$J4UIsOVcT8SESjR9Ss7l0uzYrCt6N9rDSPMgjEHF4Xv8ewd2wU4C6
$wp$2y$10$B1tQCV460usI741n67zUMu34Dma3CWapqeXoiv0B6odG0fiE9mbpe
$wp$2y$10$wl2oudwvd5.QU5LJpaljNeP1YWO2Wpcf5lKwR5fmvkNXNScC4cJAC
$wp$2y$10$3RS8zgwl5AvJrjx8YYPwrOp/HkunM/UDfF0pqHclYf6dogXoGJTLm

Word of the Day Challenge URL: https://contest.hashpwn.net/claim/bd7cf4a1dd0bfcb80886fcd31788acef

jpg0mez

Looks like the 13th challenge was solved 21 hours ago?

hashpwn-bot

Challenge 12 - HINT
UTC: 2025-12-25T15:45:52Z

Santa says:

Read https://infosec.exchange/@cyclone/115289515912035341
Use a BIP39 wordlist.

Huh, now why would I need a BIP39 wordlist, and what's going on with the 12 Words of the Day? I'm starting to think these don't have anything to do with the 12 Days of Christmas after all!

Meanwhile, congrats on making it this far! You can now download the latest hashpwn-2025 wordlist:
https://forum.hashpwn.net/post/237
Mirror: https://gofile.io/d/M9lBPX

P.S. Have you found thE 13TH puzzle yet?

cyclone

Congrats to all those who played along and completed the Challenges!

I can conform that Challenges 01-12 have been solved, and the final hidden Challenge 13, aka the Grand Prize, was found yesterday and claimed by @_cin ! If you are still working on any of these, feel free to continue as the Challenge server will be left online for a few days. I'll post the final submission entries as well before shutting down the Challenge server.

Everyone is also welcomed to share your thoughts on this year's challenge and your process for working through them.

This completes the 12 Days of Christmas Challenge. Thanks for playing along!

PS
The hidden Challenge 13, aka the Grand Prize, was a seed phrase from the 12 word of the day Challenges. Congrats to those who figured this out!

blandy

I'd like to thank @cyclone for setting up and running the challenges, and also the sites involved with providing the prises. Great work

Partly9642

great contest, @cyclone , thanks!

v1cvap0r

@cyclone said in The Twelve Days of Christmas 2025 Challenge - Double Time:

I'll post the final submission entries as well before shutting down the Challenge server.

The solution for every challenge will be posted as well?
I think some curiosity will remain for those who haven't completed all the challenges.
Thank you for make this happen, and to the sponsors.

cyclone

I'll post the final results and walk throughs in the next few days, but feel free to continue working on them in the mean time if you haven't had the chance to do so!

A special thanks to our sponsors this year which made the prizes possible. Participates won over $700 worth of prizes in 13 different puzzles. Please check out our sponsor's sites below:

Sponsors:

A big thank you to this year's sponsors!
Hashpwn.net
- Hashpwn is an ethical hash cracking forum that offers moderated discussion, shared research, custom tools, all in a friendly and professional community.
- Sponsored:
  - Daily Prizes
  - Grand Prize
Lethologica.nl
- Lethologica specializes in ethical crypto wallet recovery using advanced password research, digital forensics, and high-performance compute.
- Sponsored:
  - Daily Prizes
  - Grand Prize
Hashes.com
- Hashes.com is a site dedicated to hash recovery with hash lookups, an escrow service, and an API to tie it all together.
- Sponsored:
  - Grand Prize
Hashmob.net
- HashMob is a collaborative password research platform focused on hash recovery, analysis, and statistics. It provides shared hashlists, wordlists, tools, optimized rules, and APIs that help researchers and penetration testers improve real-world password security.
- Sponsored:
  - 3-month Diamond Patreon Vouchers to hashmob.net
  - Daily Prizes
  - Grand Prize
Hashcracky.com
- Hashcracky hosts gamified hash cracking events where participants crack hashes, earn loot, and compete on live leaderboards. It blends competitive fun with real cracking skills through themed, time-limited challenges.
- Sponsored:
  - Vouchers for 35k Gold and loot at hashcracky.com

_cin

Huge thanks to @cyclone for running the contest and to the sponsors for making the prizes possible. Read on for a chance to win two HashMob Diamond Patreon vouchers!

After snatching the grand prize a day early I was asked to write a short summary of how the challenges were completed. I won't reveal cracks but elaborate on processes.

All encoding challenges were completed by visually identifying and trying possible/common encodings using CyberChef (yes it even has an operation for morse code!). If you haven't heard of this tool it's a must for quick data manipulation and analysis - as GCHQ puts it: "The Cyber Swiss Army Knife".

As the hash challenges were aimed at finding the correct algorithm my go-to command was something akin to:

mdxfind -i 10 -h 'ALL' -h '!user,!crypt,!salt' -f HASHES ignis-10M.txt

This is a reasonable approach for unknown hash types but can be slow to exhaust so swapping to the command below at the around the halfway point gave me access to hash modes not available in mdxfind (e.g. blake2 and WordPress bcrypt) and a submit in 1m 14s to take one of the daily prizes . Using --show in the last loop command wasn't necessary but did allow for the solution to be copied directly into the claim page without re-formatting the cracks).

for MODE in $(hashcat --identify HASHES | awk '{print $1}' | grep -oE '[0-9]*'); do echo "MODE: $MODE"; hashcat HASHES -m $MODE -a0 bip39-english --quiet; hashcat HASHES -m $MODE --show; done

As you may have noticed, I switched to using the BIP39 wordlist after the first batch of challenges as it seemed clear that's where things were headed. Completing the next challenge with just the BIP39 wordlist was enough validation to believe the grand prize would be accessible with a seed phrase built from the daily words as all cracks were in the BIP39 wordlist, all daily words were in the BIP39 wordlist, mnemonic seeds are commonly 12 words and well... "12 days of Christmas".

With the last challenge post scheduled for Christmas day I assumed the grand prize wasn't achievable due to other commitments, but then remembered seed phrases use 128 bits of entropy (actually +4 bits for a checksum meaning 11 bits per word) so if I had 10, 9, maybe even 8 words it might be possible to brute the missing bits. Might sound fancy but all that really meant was running an attack using seedrecover.

python seedrecover.py --mnemonic "NINE WORDS REDACTED x x x" --addrs 0x8c05B56c44814a6512AB9e669B9B36C1006AB65E --mnemonic-length 12 --language EN --dsw --addr-limit 1 --wallet-type ethereum --big-typos 3

This was a long-shot, as there could quite easily have been a "13th word" (passphrase) required to derive the correct address and gain access the funds but to my delight I was greeted with the following:

2025-12-24 14:43:31 : ***MATCHING SEED FOUND***, Matched on Address at derivation path: m/44'/60'/0'/0/0

In summary, these were really fun challenges. Simple enough to take on in a coffee break and breadcrumbs to build the bigger picture. Building a seed phrase from first letters of other seed words was a really nice touch. Thanks again to all involved!

If you didn't complete one of the daily challenges in first place but would like one of the HashMob Diamond Patreon vouchers I'm donating mine here:

$2b$12$zpdE2XU.MsoCHaPufYLiNOAtRXqZQP1cRCVb/PAXkTC32ja2V/7li
$2b$12$plGpLfcQy0p.Gys6hUF27eCyu5Xvi2B/GIGsRk/EO4YoIgK2cFIGa

You might want to use these (and five delimiters -)

9eda
4b79
4bfd
f3a3cee8
ceec12f9
3468483a86d4
HMOB
ae91
c8c6
63c6babfb445
2caf

hashpwn

The Twelve Days of Christmas 2025 Challenge - Double Time

Sponsors:

Who's Online [Full List]

Board Statistics