Canium

Canium is a mysterious chatbot that loves anagrams


canium.org

Stage: 1 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9

 

Stage One: Trailhead

Canium is a ChatBot ARG started on 4chan board /x/.It started with this image.


When you visit the site it contains a chatbot that gives you anagrams and certain encoded texts.The first step was hidden in the image above, you just had to reverse the first letters of every line and you would get this link which it’s titled “Second”.  canium.org/gwiFooWH

Concept of the ARG seems to be to collect puzzles from the chat bot, solve the puzzle and submit the solution giving the next stage.

 

Stage Two: Aliens

Second step contained a simple HTML page with a Canium logo on the middle.If you

inspect the page the image is a .svg file so you can examine on an advanced .svg editor or any online service and you would see the hidden text “E.T”

 

Many people thought that it meant Extraterrestial and in the beginning that didn’t give you anything to go on but later devs made a change (this happens a lot they add new responses to the chat bot at the main page)  so when you type it to the chat bot it responded you with “That is incorrect.”. Some people found a clip from the movie E.T and in a scene E.T tried to spell “nuisance” but he wrote “XWVUAFP” instead. At first it didn’t work so somebody said it should be “XWVUAFT” and when you typed that to the bot it gave you a pastebin link. Devs also changed this response so now just typing  “XWVUAF” is enough last latter doesn’t matter.

 

Stage Three: Finn

https://pastebin.com/pEsuwM7N

Pastebin title is “9-19-2-14” which if you convert it to English letters it means” ISBN” it is an international number that is given to every book.The pastebin text contains a text from a book but it is translated to different languages.Once you translate everything to English solvers figured it out that it is the book titled

Mark Twain's "The Adventures of Huckleberry Finn."

The ISBN number for this book is “9781101628270” so when you type that to the main page you get the new pastebin page.

Stage Three: AES

https://pastebin.com/r3G9t5vJ/

Contents:

HLBlydModHLn/1XkilQLygefkGd6RJRWi237Pwsuog8LVpASfFt0UWQZYfalUAdTvhGsPAJ+qE4mSS5MinWlBZowTgkPXaGW6LvZTDKQeFItsecnRCkWHBzM4paIJBVG8yOGcCMWln6wKnMho0C8ItKNhuvKEQlJ68dRB7qYSndAtDU5+oShpXKOTm2lHhgbkG32Vbeqwl3IDQTUy0CuIx/YJuTxrJJLCJ1qPBvSwFli1MSbwevPW9iub78NzSwgQgTGU+roQYp0ejmqXrYOKcj/8Hc+2tZ///TiTNedxiUI3y51VxhgN969Tw7+QUdkM+2HFFQoW5K6E0CZzSob+qWiMA6rwcZ0We5Vx2p6RHkt4PjPPNCFbVskIJaz0kElR2REeyqn22/KVlfOhl11gx+VVt2F5Mnhdw1WH/+8dMJvg54VjaImAaeMvY2RhFNcHBZq43tZ2kteC/A5Shnxj0MB4QzfrW/5nJvIh3hknSpggoHv+m3SfXOKgghfLXhGjpMcwMsrYHEZ6GKeJwYj0hkXwNSQHvGqgp37T6iylG5Db5tRVg3JC6b4qPCkj4vhGx7PQyzmU7vAAALe18xpCxdvhuhXY0Xo0JU/ltgJbnT7IvihA/oF4ZuXgE7zSK40Q4yAXd2a9yy0OxDKfB/wwtJ3eWwMY4s4SJc7iypR29CiSQb+nTl0gYCi013WpQonqy7/SpC/TSVPKqC7OeEwM+sT8T83YA5g/U/whd48OI/eEORxkUS7hOo5v+rmsdE+x0LWxJVFKumsXNbNfNGHUluung/E0G18fTMFZ4wEbheRplDduKGj/Pl9e+cIy9mU/qqMMyyRv3J+bmbbWioQLgrZVkLvxd5YW4N3jWPSoxetuFCO55iWd9GtSp7DOVynmCtT8YCAEi3JCEwiyi6ea+bGIVpBO8nQceQiBRD5fBY6BqrQgYpzFDAHQ2P3K8wag1ROTGqYT7nNOjiH1WTOK6Su4t5bfn5U8pyARsKlnckeImvkjNmSRn3MRNSjxdOAmFMelVUp3o2NZTw2rdIkvZO5+pr92WsjDuArxGY1ab5UFkquFsSLlb/s+1iOvwo/4KlZ2Vp4ELGHVx3wzL+upaphzItSx3I19ENtAKVUY8qrsMKMZhQJ3X6kVA0pbhq3LhzAPMF5QaIP5DIYIy7GD9M9KNUoVEfkGWagLt6Jjtn/g4bLv0EhvAhkXKVFRDt/nAZ3BePHwLJvHybPvHYjvVAiJk+Ls2Cwr3aU9x5QCTWGNtGhtuMKPPi6YzA5pLb6h6koMUjct/kO8Ln4KADshe4TqHVRyvMULALEn9tppFa9RiUx9CGfq70gCSaDtdbbuxEvAfDcn461nUINdc44k6uDHM5kl3GmGD8bVbqkts679VS3klf+D6qCy3SknhduYWjVjYKz+SAqIWyg0SZBAzFn89/V6mtR3ONxToUK9vaXTq4qa9aVHQdWdVX9f66+VzDDOTXDetkdsarJTldItZeBXxZh9VDiwPnpTrL+PSqQXEnmGntz1XOJHR26N3aj1LVVb0BMg1NLHgPGZ19tW7nkJ0Rb2NgfY2lBNoYuL2pn/Nhov9rw1/r2jSRFFQJncfKKPdMFNbTCymmKSMYs+CH23GlBwq3iS+SVswV3iItfgEBFdzatlYyNCLHJom8w2cBJXLKG4uMNYVRMq9hWs+QgldRHMdnHXzAWe6rSaJrCX7Kfaw763NF+jbTg6sNgo1W9FKEhpwwC3GvEBwwUz5al5MmR6xJE5J/PliBdySEHvw3Rb1c8t6CO2ZVWgz+wmXg7AABBdiXE72UYPsZGI8CeJVQSuwu1/pGotQ6SohahHzMZWMS+oPHEGZvpDxm2yEozu0iLGIjf+wPPhXt9zIprecbk0DtIL2KzDuL92UVRxZc6QgAJUlshZByb5a+GRhYBeR92f039l8CQTsTrt3Ju4jJOf331FTKKPTiAx0bYs/aPCfvDnJVSV9qwYJvlrr1/ELJagi1m/gv5CvcCxdbznyTFZbm53tD6HKwDWNNXtpx32d6Nv+lECvP7zeTY5K3U1g6I/nD1EefdQO8JmGarS7BmFc2nCwRVjkxMtRCfPHjP6UQEQ1Z78UMhcTmhApW6xdaM9Sax8pfZW4KZ8iDvdiJOwG766wwNQ/8k9yxbbASH7osHwv3kEl3zc9OE1YLR7bGxBXxVbXtgjYiZgr5ogh7ZVha6WEwK3VxSApjy2zjNjZWGQclXjB9hGvz0ReWD8yrNwBjyfg5Ljxc7TccVMDkmfIsQA2w8FwHk1eNrpYVio3BVk4GZ4tDo9FhidBbtFhe6SgF1t4u9mPSCJ2wy+OOvwyZmCNTM8m5rLur+WVrC8Ea95ojsn+aW0V1lfahTKHIRhRn0DcgE3JCedz8AOPqS9YCzu6K6molzsXaU56XfVRiVSjBFgz/FlG+9qyggzw6FSpzbgCKAdcwneMHEWFYe/Z4Ro9TtS+i431IEET4oZF7YU6ll6BV22bvWGeBfyauegHWXIYJbRQHY5EaxYeoezGFnx+adiIfF4GxCcfN18xqpGhaVtKarWa9MZpujX0EFgTW+8qwU+zjF3HRnHPqy6/EPStt57SGXLLz3cysP6j8XbgBlWU87IYZZyUBdVKF5gaKjiweYt7zfUKJHEI98yiCevELSaWpxftIYRcJdZtkhA/bHroG/O5jZrlVfGhR2VAguAevWkejBg76IdIkuteKREQiT4T40VJ7VHLHV0GoS8F31F2vVdLPysEcCTlLUHxNduvQLHmwBS9pB03SG1cilXTjN0Ifw9/U1JCdLG0/gBs5MCLo98WOvt3KxuRAgt8NvhF3DvxO/Xlo/PXJo5y0aqqhjAzsupUQ06kHUULNhoHsgpliDIlTULQvOuH3Rwuu16xrd/pJDquotZvQJs3AZy/41SxA4gXjiD+7RAaRsN9OtFBTdERnAlHC9KcPr4nsUb7jx3BzLyQLsIAFGOUEm1P3qdK3kS9Rf9/uA5XFrMbrOzbCu+Ie3a1WhU7T35xVQ75P0mRUmxhfFb+Dq5szVwZdUAoHBzQ50CdducJ3ymRGJtFl8WpMO1APsGQAKOW76nRLWRLhJZHjwIbE6t14GAp8Y6IJYqAVrkkK/gW25eT72zTxSFcb92TrgGDv1uvC9zaS9jAzosqdEkdXgOEp0KZchaOTJclPRCpOWAZw9qfLYewVu5Pi1Y3JI/GFvHaa/1akzscjuWFl/Jb8jRVqSVrk/cqGtFGYY7xXiYqgF5nrYJnyG6P+Mx0HcP4zT6J/fi8AdxTVWW49FNrSOfun9ncq6Hdq0DNm4pV+vbIya7hMdNww2XgQqbjLia15CjczH88C1psUNGdiHucsv5th0YKmhFe7EwX37yJUQwNOcK6JhIXnWxsshcbe4cfS+vf/bM4GyyPVLcvcRQclDTDLDyuW9gOQjBP4c4aFh8Gz70+0zJz4jrvQnwDN0saF7aJ39wzaadxQQzt94sducZxMwzP3C+G+tmmR7P44GsHcVFYuMrmlFUj41esdFe2GV6BRwgc30oiNDHIGLEW+KOrR9S+UurUPvf6SnVdIQaKlHnEvWWg8kSz/NdsH3DMVKF+13jURPvvZ9Uxhp+CGz3UtPERSH0VKhffzZ3WGTC+9eVUw2wKMWScnUP8jIdPX+4OJRTaH+PrdRD3m8xqBfmqV0a3TT0M7o2fDScdVUr/RB0qPU/1XnZc2SVIyxvLA8IXLTTBMRLhXObSaYeZ3MGIBTbbiHRwMvKWJyfwt3HVCQ3CEK5zMhmM1pevpqP/ge6rqA2422k/Bi/x93LTJLlp7wOPf5gv7SutW4/3anowUZCEsrf0+9PYZsWqA3a6BMc7LU0O36kjjwUtMn7V2/3eNQIkhgLXT1jnirSJyX0p74QwNvJKxhhkFllMqdnxTSTJJ51m/NVnfUVYtMrhJK452FSgqynTjghMKQu2R8tm2NCcVkTX+FveOZa1s10/UnUNqTngEDffivBRz+kOyDbcas7PTM+pZfsQzWQP7OFoaXEqtx4O4Xye6B+RIt0BZ7q0l/cw9Eh9hmoovkt5afUo5663dXbf0T+8O6fqtN4KiM6KyXZJTYGFlb4XE5iYO6OuhTrkdscDSWoBbZ4OudRR1b+mY5x0fPImo=

 

This is AES-128 encrypted. The key was in the source code of the svg file on the second step:

AES-128 key: XT6n64T7iR6H3YkSUkV6iI7

Resulting in b64:

iVBORw0KGgoAAAANSUhEUgAAASwAAAEsCAYAAAB5fY51AAAABGdBTUEAALGPC/xhBQAAAAFzUkdCAK7OHOkAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAAZiS0dEAAAAAAAA+UO7fwAAAAlwSFlzAAAASAAAAEgARslrPgAAB9FJREFUeNrt3cFtwzAQRUEVof7rUxECnBISwGB2/+48QEcnskhOciCo6yNJIV0egSRgSRKwJAFLkoAlScCSBCxJApYkAUsSsCQJWJIELEnAkiRgSRKwJAFLkoAlScCSBCxJApYkAUsSsCQJWJIELEnAkiRgSRKwJAFLkoAlCViSBCxJApYkYEkSsP7Ufd+f67rGXuUDffj+tn9/8xdYBhxYwDJ/gQUsYAELWAYcWMAyf4FlwIEFLGABC1jAAhawDDiwgGX+AsuAAwtYwEoA63meT+d+u/9vF1Q1ON/+/urPn/752+cvsIAFLGABC1jAAhawgAUsYAELWMACFrCABSxgAQtYwAIWsIAFLGABC1jAAhawZoBVvXHu9IDbOPiJXvDb5y+wgAUsYAHLgAMLWOYvsAw4sIAFLGABC1jmL7AMOLCAZf4Cy4ADC1jAAhawgGX+AsuA/8eAn95Y2X3jZ/oBdsACFrCABSxgAQtYwAIWsIAFLGABC1jAAhawgAUsYAELWMACFrCABSxgAQtYwAIWsGwcPX1/5RMdWMACFrCAZf4Cy4ADC1jAAhawgAUsYAELWMAyf4FlwIEFLGABC1jAAhawgAUsYJm/wPIi1fAD9qaD60WqwAIWsIAFLGABC1jAAhawgAUsYAELWMACFrCABSxgAQtYwAIWsIC1Hqz3fdtewALW5vkLrGHX6QXj87Wf3z5/gQUsnwcWsIAFLJ8HFrCAZcEDC1jAApbPAwtYwAKWzwMLWMCy4IEFLGABy+eBBSwlVL0gv/351Qti+sbcNevAIwAWsIAFLAELWAIWsIAFLGAJWMACFrAELGAJWMACFrCAJWABC1jAOjqhum/8tDHVxt7kzwMLWBYcsIAFLGABC1jAAhawgAUsYAHLggMWsIAFLGABC1jAAhawgAUsYAHL8wPWDLDS72/6xsTt45d+gJ4D/Ex4YAELWMACFrCABSwTHljGD1jAMuGBBSxgAQtYwAIWsEx4YBk/YAHLhAcWsIC1A6zpGwPTF2T6gneAX8gfRmABC1jAAhawgAUsAQtYwAIWsIAFLGABC1jAAhawBCxgAQtYwAIWsIAFLGC1Bg9o2X9wut+/A/yABSxgAQtYwAIWsIAFLGABC1jAAhawgAUsYAELWMACFrCABSxgAQtYJgywgAWsDuBsB616wXffmDp9wXYHH1jAAhawgAUsYAELWMACFrCABSxgAQtYwAIWsIAFLGABC1jAAhawgAUsYAELWEO+yPKNielgVz+/7lf6PwzAAhawgAUsYAELWMACFrCABSxgAQtYwAIWsIAFLGABC1jAAhawgAUsYAELWMDKACl9waaDkb4g0g/ws3EUWMACFrCABSxgAQtYwAIWsIAFLGABC1jAAhawgAUsYAELWMACFrCABSxgAQtYHSZc9wU3feNn+vNL//7AApbvByxgAQtYwAIWsIAFLGABC1jA8v2ABSxgAQtYwAIWsIAFLGABy4IGFrCAtQOs6S863b4xdvoBeengAgtYwAIWsIAFLGABC1jAAhawgAUsYAELWMACFrCABSxgAQtYwAIWsIAFLGABKwOs6QfQpb9otPr7dX8+6c/fi1SBBSxgAQtYwAIWsIAFLGABC1jAAhawgAUsYAELWMACFrCABSxgAQtYwAIWsICVAEL1z98OwvQFb+MosIAFLGABC1jAAhawgAUsYAELWMACFrCABSxgAQtYwAIWsIAFLGABC1jAAhaw/mPCbD9gLx287s8XaMACFrCABSxgAQtYwAIWsIAFLGABC1jAAhawgAUsYAELWMACFrCABSxgAQtYwNoA1vT7734AYvffP33j65QXsQILWMACFrCABSxgAQtYwAIWsIAFLGABC1jAAhawgAUsYAELWMACFrCABSxgAUubF4w/eLPHH1jAAhawgAUsYAELWMASsIAFLGABC1jAAhawgAUsYAFLwAIWsIAFLGABC1g9uu+7/aA5IO7cgqt+Pun350WqwAIWsIAFLGABC1jAAhawgAUsYAELWMACFrCABSxgAQtYwAIWsIAFLGABC1jA+gtYz/O0fpC/3X/5QDc/4K/7AX3bxwdYwAIWsIAFLGABC1jAAhawgAUsYAELWMACFrCABSxgAQtYwAIWsIAFLGABC1g7wKreePctWNMXVPeNkQ5QBBawgAUsYAELWMACFrCABSxgAQtYwAIWsIAFLGABC1jAAhawgAUsYAELWMACFrDmg9UdBC9Srf1+W8ADFrCABSxgAQtYwAIWsIAFLGABC1jAAhawgAUsYAELWMACFrCABSxgAQtYwAIWsJLB2X5/06+UgAUsYLmABSxgAQtYwAIWsFzAAhawgAUsYAELWMACFrCABSwXsIAFLGABC1hnwep+/+lgtZ/Iw1/k6oA/YAELWMACFrCABSzjCyxgmdDAAhawgAUsYAELWMAClvEFFrBMaGABqz1Y7/u2vYAFLOMLrDUb89IPkEsHBbjAAhawLEhgAQtYwAIWsIAFLGABC1jAApYF6fkAC1jAAhawgAUsYAELWMAClgXp+UwAS5KAJQlYkgQsSQKWJGBJErAkCViSgCVJwJIkYEkCliQBSxKwJAlYkgQsScCSJGBJErAkAUuSgCVJwJIELEkCliQBSxKwJAlYkgQsScCSJGBJErAkAUuSgCVJwJIU3g9liB2fXRjwrgAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAxOC0wOS0wMlQxMzoyODo0MCswMDowMHXtuwYAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMTgtMDktMDJUMTM6Mjg6NDArMDA6MDAEsAO6AAAAKHRFWHRzdmc6YmFzZS11cmkAZmlsZTovLy90bXAvbWFnaWNrLU1QTDR0R0dDVUaIMwAAAABJRU5ErkJggg==

This is the b64 of an encoded image of a QR code:

 

Stage Four: Too many files

https://anonfile.com/y773M2gbb6/0512213245607796_zip
 

The Zip password is hc677hr777h which was derived from the anagram of #sasP-:-crhh777h677 from randomly chatting.

The rar file contains 74.420 folders and 901 files

Zip file name: 0512213245607796

n(n+4) = 0 5 12 21 32 45 60 77 96   is the sequnce behind the zip name

 

Most files have 100 english words. Three files have 101 words:

Paths to these files and their additional word:

c656dE50lK9V3ZBkhHuK\

S38IGxv0rVhXsriMbJZw\

OcWdBVu0PVJCKdErFbO2

eNorqPJzAgAEEAF7

POPA9p6YXqJnoxtO1BcW\

QSnjt52C9QU3mjnrnsMm\

1lTO99naKIWbVGjwJTs9

eNrLzE0vLdJLzs8FABIXA5I

kU8GxJyhTMlAbZFN3xKr\

R8zm1JSDQWDIsVdYERV6\

hSOGnWTC5Emw9zy6S5wS

eNrTT9RPTjEBAAXmAbs=

Decoding from base64 + zlib inflating we can decode these extra words:

eNorqPJzAgAEEAF7 : pzNB

eNrLzE0vLdJLzs8FABIXA5I : imgur.com

eNrTT9RPTjEBAAXmAbs= : /a/cd4

https://imgur.com/a/cd4pzNB

 

Stage Five: #DareFriend


 

The jpg image is too low quality to achieve a valid decoding.

Closest attempt:

Here we found that we could consistently decode the binary to give "GNCA???7" but without any more information we were stuck. Progress was made when canium updated the site. The message:

#nothing is broken

appeared together with a new .js animation "glitch" on the logo. Inputting into canium we obtained:

>glitch

>0707

Puttng this with the 4 letters we had alread confrimed we then tried entering into canium:

>GNCA0707

>h6f4u

This new six letter response seemed unique. Searching it as an extension for popular websites we found that @h6f4u is a twitter user.

https://twitter.com/h6f4u

 

Stage Six: Twitter

https://twitter.com/h6f4u

Twitter User Name: H6f4uNik7Kisu78jy

There is only one tweet from this user:

Octal: $150 $164 $164 $160 $163 $72 $57 $57 $143 $154 $171 $160 $56 $151 $164 $57 $145 $143 $160 $142 $63 $150 $160 $166

Decoding this from Octal gives a new link:

https://clyp.it/ecpb3hpv

 

Stage Seven: Morse

https://clyp.it/ecpb3hpv

Audio file contains 3 different notes. Transcribe these from lowest to highest:

11132312131312322312321113121131321213222322311311322211321223

Interpret this as morse:

... - .-. . .- -- .- -... .-.. . -.-. --- -- .. .. ---.. -.--

STREAMABLECOMII8Y

This is a link, with but with a missing letter. We used a script to brute force the site, sending it links with all the possible missing characters until canium replies with "#valid source":

https://streamable.com/iif8y

 

Stage Eight: Streamable

https://streamable.com/iif8y

Video with audio. This audio when reversed and cleaned up a bit says:

Good, you made it this far, two numbers are hidden somewhere in the previous steps. Find them, multiple them, add html in the end
good luck

Before we had noitced some strange, out of place numbers:

Top: 74198 (second)
Top: 90729 (canium .svg)

Multiplying these together we obtain:

http://canium.org/6797235222/

 

Stage Nine: 6797235222

http://canium.org/6797235222/

This puzzle contains the image:

Joining the lines together:

AIR 20P11612
SORT MISSING

This transcription is confirmed by the Canium bot:
>  AIR20P11612 sort missing
> @Thirteenth, solve this

The metadata of the .jpg is full of clues:

Exif: 
Copyright            What is this?
UserComment    GNAC is behind
Img Des              Came here to get you there; #GNAC
Software             3301
ModifyDate         2000:07:07 06:30:00
Artist                   Canium
Copyright            What is this?
DateTime            2000:07:07 06:30:00
CreateDate         2000:07:07 06:30:00
UserComment    GNAC is behind
GPSVersionID        2.3.0.0
GPSLatitudeRef     South
GPSLatitude           49.302151
GPSLongitudeRef  East
GPSLongitude        69.187961
GPSTimeStamp      01:00:00
GPSImgDirectionRef    Magnetic North
GPSImgDirection    0
GPSDateStamp    2000:07:07
GPS: S 49.302151 E 69.187961

GPS coordinates take you to the French Southern and Antarctic Islands:

 

We are currently soulving this step.