Zailgo e0 Game - Investigation Summary (Part 2/3)
Technical Understanding
Port Knocking Sequence
Pattern: "2 3 1" means 3rd largest 1st largest 2nd largest of three selected ports
Known: Port 25519 is the "2" in the sequence
Process: 3 knocks in specific order, then SSH becomes available
SSH Location: Unknown port (tested 22, plus various game-related ports)
IPv6 Address Variations Tested
2607:b4c0:a1ce:b0b0:a5c0::
2607:b4c0:a1ce:b0b0::a5c0
2607:b4c0:a1ce:b0b0:a5c0::1 through ::10
Hex conversions of port numbers (e.g., ::29a for 666)
Special addresses like ::dead, ::beef, ::1337
Comprehensive Port List Developed
# Original game numbers
254, 425, 520, 1995, 2504, 2607, 32768, 3000, 103, 666, 15300, 135, 768, 3791, 112, 25519
# CS/Crypto historical numbers
420, 1337, 443, 80, 53, 22, 3389, 1024, 2048, 4096, 65535
# Zalgo-themed numbers
13, 777, 1984, 2012, 6, 7, 66, 616, 1313, 2666
Attempts Made
Manual Testing Phase
Tested various IPv6 address formats
Tried different port combinations manually
Confirmed IPv6 connectivity (user has working IPv6 from Sydney, Australia)
Tested timing variations between knocks
Automation Development
Created comprehensive PowerShell automation script with:
Quick-Knock function using
System.Net.Sockets.TcpClient
Multiple IPv6 address format testing
Systematic port combination testing using "2 3 1" pattern
Multi-port SSH testing (ports: 22, 25519, 2607, 520, 666, 443, 420, 777, 103, 112)
Progress tracking and success detection
Error handling and rate limiting
Automation Scale:
~50 IPv6 addresses tested
~12 knock sequences per address
~10 SSH ports tested per sequence
Total: ~6,000 combinations tested
Estimated runtime: 4+ hours
Key Technical Details
PowerShell Implementation
powershellfunction Quick-Knock($targetHost, $port) {
try {
$tcp = New-Object
System.Net.Sockets.TcpClient
$tcp.ReceiveTimeout = 3000
$tcp.SendTimeout = 3000
$tcp.Connect($targetHost, $port)
Start-Sleep 1
$tcp.Close()
} catch {
# Expected for port knocking
}
}
Success Detection Criteria
SSH responses: "Permission denied", "publickey", "password", "authentication", "banner", "login", "Welcome", "Last login"
Fast response times (< 1.5 seconds)
Unusual response content (> 10 characters, non-standard errors)