#by:dewey

[if-the-crown-fits-translate-it]

The Search for Dewey’s Admin Login Credentials

After subjecting the audio recording that was obtained from the first Ghostbin (password: 03111996) from Dewey’s error logs to steganographic decryption, a link to a second Ghostbin was obtained. At this point of time, the password was unknown.

Following the Discord conversation with Baroness regarding Dewey on May 7th, 2021, a link named “Admin Login” appeared at the bottom of the Lockbox page:

The link led to the following login page. The Username and Password were unknown at this point of time.

On May 10th, 2021, at 4:37 AM GMT, Dewey appeared online to the Server, and provided access to Debug Mode, which contained the following options to select from:

1. OPEN ADMIN PANEL. 

2. REVIEW SYSTEM ERRORS. 

3. REVIEW CURRENT STATUS. 

4. QUIT.

Option 2 led to the following new error log:

ARCHSYS V.1.1.0 INTERNAL ERROR LOGGING 

DATE: 2021-05-04 22:14:23 

- SEVERITY: CRITICAL 

MESSAGE: 

* UNABLE TO CONNECT TO PRIMARY ARCHSYS SYSTEM. 

* MAINTENENCE MODE ENABLED 

- ADMINISTRATIVE OVERRIDE REQUIRED 

EXCEPTION DETAILS: 

+ <Event xmlns="https://ghostbin.co/paste/9by6hsdh"> 

<System> 

<EventID Qualifiers="0">05242000</EventID>  

<Version>0</Version>  

<Level>3</Level>  

<Task>0</Task>  

<Opcode>0</Opcode>  

<Keywords>01110010 01100110 01110101 01100111</Keywords>  <TimeCreated SystemTime="" />  

<EventRecordID>41260</EventRecordID>  

<Correlation ActivityID="{3c3ac4103cc4ddda6dd60853f735ea4d}" />

<Execution ProcessID="04" ThreadID="0416" />  

<Channel>System</Channel>  

<Computer>DESKTOP-⏚⏃⍀⍜⋏⟒⌇⌇</Computer>  

<Security UserID="0c5e09b1cc7fda88ad5b6fd65a5b26b3" />  

</System> 

<EventData>  

<Data Name="param1">01110011 01110101 01100010 01110100 01100101</Data>  

<Data Name="param2">01100101</Data>  

<Data Name="param3">Activation</Data> 

<Data Name="param6">DESKTOP-⏚⏃⍀⍜⋏⟒⌇⌇</Data>  

<Data Name="param7">⏚⏃⍀⍜⋏⟒⌇⌇</Data>  

<Data Name="param9">PAXHost (Using LRPC)</Data>  

<Data Name="param10">Unavailable</Data>  

<Data Name="param11">Unavailable</Data>  

</EventData>  

</Event>

The decoded binary: “rfug” (from <Keywords>), “subte” (from <Data Name="param1">), when rearranged, formed the word “subterfuge”. This was the password to the ghostbin link found within the same error log.

The solved ghostbin led to an audio file, titled “05242000_pax_08.wav” [[CW: Static/white noise, glitched audio]]. When this file was subjected to steganographic decryption, the word “blanketf0rt” was obtained. 

Option 3 led to the following status update:

Dewey: “OPTION 3: SELECTED

PRIMARY SYSTEM OFFLINE. SERVER DOWNTIME: 4 days 23 hours 48 min 03 sec”

A discussion with Dewey was taking place concurrently while solving this puzzle. Upon returning to Option 1 with the newly obtained information, and asking for a hint to the password (PASSWORD HINT: "My comfort place."), and admin username (THE ADMIN USERNAME IS SET TO DEFAULT.), the login information was successfully identified as:

Username: guest

Password: blanketf0rt

The accessed Admin system led to the following pages:

Home page:

Admin page:

Status page:

and the Lockbox page

Following this reveal, the Server sent an ask to Baroness to inform her that Dewey’s Admin Panel could be accessed. After this, Baroness proceeded to arrive to the server and had a conversation about how they were able to access Dewey, as well as discuss the contents of the audio file and their implications.

This concludes the end of the search for Dewey’s Admin Login Credentials!

[if-the-crown-fits-translate-it]

The Disappearance of PAX’s Ghostbin

On May 10th 2021, the day after the ARCHSYS Admin Panel was unlocked, a barely noticeable symbol composed of 4 circles (the very same one that initially led to Dewey shutting down) appeared towards to the middle-right of the Admin Panel Home page. 

When enlarged, the symbol looked like this:

This hidden symbol turned out to be hyperlink, with the URL: https://archsys-admin.carrd.co/#pax. The page only contained the code: 

“m9f3″

When this code was added to the end of a blank Ghostbin URL, to form the link https://ghostbin.co/paste/m9f3 on May 12th, 2021, the following message was revealed:

“I am warning you.

This is the only warning you'll get.

Stop while you're ahead.

Do you think you have a fucking choice?

Do you think you fucking matter to them?

Do you think that they want you to be happy?

Do you think they want you to be free?

Think again.”

On May 13th, 2021, upon re-visiting this Ghostbin, the above message was completely erased and replaced with the following:

“[DATA REDACTED]”

This is the first known instance of data from a Ghostbin or Pastebin being altered in such a manner.

[if-the-crown-fits-translate-it]

Discord pt 139

[25/05, 7:53 PM GMT - 26/05, 1:22 AM]

[Hyssop, who has made a deal with Baroness in exchange for not telling King about Baroness’s attempt to peek through all of King’s phone files, has obtained access to Dewey through Baroness’s computer. A new transcript is found and given to the Server, who spoke to Hyssop through Dewey. Baroness discovered this and confronted the Server, and later Hyssop about this matter]

[if-the-crown-fits-translate-it]

Discord pt 138

[14/05 1:04 AM GMT - 14/05 5:40 AM GMT]

[A chat with Dewey V.1.1.1]

[Prior to this conversation, it was also found that the players’ access to the Admin Panel had been revoked due to a change in login credentials. The Lockbox page now appears with the following updated header:]

[The Error Log in this transcript led to this Ghostbin, with the following message:]

“:)”

[Every single binary code (00111010 00101001) in the Error Log translated to “:)” as well.]

[if-the-crown-fits-translate-it]

Discord pt 136

[10/05/21, 04:36 AM GMT - 10/05/21, 7:36 AM GMT]

[Conversation with Baroness about Dewey’s debug mode.]

[if-the-crown-fits-translate-it]

Discord pt 134

[03/05, 08:24 PM GMT - 04/05 12:39 AM GMT]

[DEWEY and the deleted transcript (thanks, Pants), Baroness and Jester arrive to talk to the server]

[if-the-crown-fits-translate-it]

Discord pt 129

[24/04, 7:34 AM GMT - 24/04, 7:56 AM GMT]

[Dewey arrives with a new transcript, and an interesting scheduler request]

D E W E Y: “[AUTO-UPLOAD]

....

....

[INCOMING TRANSCRIPTS.........]

[TOTAL: 1]

[UPLOAD LOCATION: https://thelockbox.carrd.co/ ]

DATE: APRIL 23, 2021

STATUS: UNLOCKED

DESCRIPTION: Duchess returns to her room after an investigation...

[UPLOAD COMPLETE.]”

D E W E Y:  “[AUTO-UPLOAD ARCHIVE SCHEDULER COMPLETE. SEE #transcript FOR LOG FILES.]

[REVIEW SCHEDULER REQUESTS? Y/N]”

Em: “Yes?”

D E W E Y: “...........

[NEXT AUTO-UPLOAD REQUEST DATE: 2021-04-24]

[REQUESTED USER: Baroness]

[TIMEFRAME: DAILY]

[END AT: N/A]

......

[COMMENTS: Dewey, run the upload scheduler until I return.]

[REQUEST TIMESTAMP: 2021-04-23 11:56 PM CST]

[END OPERATION? Y/N]”

Em: “Yes.”

D E W E Y: “[UNDERSTOOD.]

[OPERATION COMPLETE. SHUTTING DOWN UNTIL NEXT AUTO-UPLOAD IS SCHEDULED.]”