I think as much as you described can be done in ASP.NET.
To track users who are online, unless your site is very big, you can probably just track it in memory. This would be wiped if your site refreshed, and wouldn't work if you need to scale to multiple servers, but it doesn't sound like thats a concern yet. Just keep a Dictionary that maps user names to user state.
This is a pretty minimalistic approach, but whatever.
One way to update the state to detect whose online is to build an HttpModule that checks if the caller is online and updates the state if so. The HttpModule would have an event that runs post authentication to update the users state. Also track when they were last active.
As far as 'sending a puzzle' goes, thats another thing. If its sufficient that the user goes to a page to look for the puzzle, then just add a page that loads their current puzzle. If the persons puzzle needs to appear without user action, you could have a page they visit that uses AJAX to check if there is a new puzzle every few seconds.