Capture The Flag - The Wired

It has been almost five years since this was first posted here. An anon made a Lain-inspired CTF and with it ruined my life. For the uninitiated - here is the first step: hsvvrp.zjsvzlsfo.paola.lluayhujlp..pzy.bolyl. For those who have seen this before - what the fuarrrk is this difficulty spike at the end? Five years and only three people have solved it? I'm posting this in hopes that the three people that solved it are still active on lainchan and can provide some hints. I've messaged the creator and the first solver had had hints given to them but the second and third solvers did not. Or at least both of them denied being given any help from the first solver. Because those two people managed to solve it without any help - the creator won't give any further hints. Please help me escape. I want my life back.

>>34490 Whelp, your post caused me to blow through the first nine steps just now.

I've been working at this too, I think I'm pretty close I use discord (yeah botnet I know), should I post my tag?

>>34499 >yeah botnet I know Then why would you use it, out of all the other options? Do you like being spied on, giving away your data for free to unethical companies and getting other people to use that platform too?

>>34499 Ye sure go ahead. botnet or not, we are all connected in the wired.

Anything i should know before going into this? Going thru it but I'm pretty much fumbling my way around this. The first hint was already challenging enough, but anything web related or format related is surprisingly easy enough. I struggle with ciphers because I don't know many, at least from the top of my head.

>>34529 >I struggle with ciphers because I don't know many https://www.dcode.fr/cipher-identifier

I'm not smart enough to do this alone

>>34529 Being able to program will help - but you can also waste hours and hours of time pouring over a hex dump instead of figuring out how to get data programmatically. It's a good "Baby's first CTF" until the end.

>>34499 I've never done any actual CTFs before. Got any resources?

i feel dumb i cant even do the first hint. like i know i'm not very adept at all this soykaf but i thought id be able to at least do the first one lmfao

>>34531 Aaah that's a cool. Thanks! >>34538 >Being able to program will help 100%. Glad I know enough to do lil scripts. One of the files would have been impossible without getting myself bloodshot eyes. It's an enjoyable small CTF so far :) >>34620 The link >>34531 has the answer in it! Just gotta look into the different ciphers the site suggests and see how they work and try it on the message. It's not too complicated, It's rather simple actually

>>34621 thank you i'm an idiot wow

>>34621 hey i'm kinda illiterate tech/programming wise, what would you recommend to get started so that i can begin to tackle CTFs and stuff like this?

It took me one day to get to stage 9/10. But now I've been stuck for a week present day present time how does it feel to have entered the wired? this is the final step you must escape

>>34621 I managed to make some progress. 1st step I got to the thing about the entrance, but it was still kind of scrambled. I had to look at the text in between two characters. 2nd step took me to an HTML comment tag. 3rd step took me to a unlisted txt file.

>>34494 >>34624 >>34621 I managed to get to step 3 with the text file, but now I'm stuck. Also, I used this for step 1: https://www.dcode.fr/cipher-identifier but it was still a little bit scrambled using the ciphers it recommended. Is there a way to get it nice and clean?

>>34629 I'm wondering if step 3 has anything to do with base64 since the last line ends with ==.

>>34624 Very impressive getting that far in only a day! It took me a week or two because I didn't think to do what had to be done for an earlier step. This is the step I've been stuck on for years. The difficulty spike is unreal! >>34617 Hop in and test your knowledge! If you get stuck - you may have to investigate ciphers to be able to vaguely guess at what it might be based on the pattern of the ciphered text. This CTF leans more on knowledge of ciphers/steganography than on programming a bruteforce or using known exploits like HackThisSite or HackTheBox. >>34630 == at the end is a typical sign of Base64! So good intuition but I'll give you a HINT: it's a red herring. Look a bit more closely and I'm sure you'll spot the answer.

>>34629 >but it was still a little bit scrambled using the ciphers it recommended. Is there a way to get it nice and clean? No, because the plaintext message that was ciphered had the noise to begin with. Adding noise like that is an easy trick to make it more challenging to notice whether you've solved a cipher or not. Depending on the kind of cipher and the type of noise added it can make it a little more difficult or extremely difficult to solve. You're meant to recognize what could be a plaintext message and ignore the noise. For example... Poems with riddles commonly use noise to hide the answer As the brain is quite adept at noticing patterns Take a moment to read this example again. Think about books you may have read as a kid. Eragon? No? Redwall? Maybe? Now do you see? The entire example is noise and the answer is: PATTERN.

>>34623 Personally, first thing I did was spoil myself and look into how people solved some old CTFs lol. Don't just look at videos or read blog posts, but follow along the steps on your own too. Don't be shy to stop following steps and start trying to figure out what to do from there. Later on, you'll find out your niche that you like in CTFs and start reading into some more theory on a certain topic, and then it'll lead to learning about another topic, to another... And don't be afraid of technicalities while reading and take your time. They are just nerdy puzzles after all :) (I'm sure there are websites dedicated to learn how to solve CTFs and get started but I don't know any to be honest.)

>>34623 Also, sorry for double post, but I forgot to mention CTFs usually are centered around specific topics. >>34631 describes this CTFs gimmick well. So you usually can get an idea of what to study going into one

>>34631 I've got a private writeup and copy of all filesjust in case. Because the owner of the CTF said that it may be shut down in a few weeks (https://news.ycombinator.com/item?id=34806481). This is what i got on the final step: The omnipresence.omnipresence file contains what seems to be a pattern of repeating symbols containing 8 Xs and Os: O|X|X X| |O O|O|O As there seems to be eight bits of Xs and Os (1s and 0s) we can decode each segment into an ascii letter giving us: present day present time how does it feel to have entered the wired? this is the final step you must escape Stuck here... The text file seems to be done. The audio track from the mkv looked interesting as it seemed to be PCM, which is quite uncommon. But it seems to be a bit perfect match for the source video (https://invidious.snopyta.org/watch?v=JlBLcLdTYr4). Also, there is nothing interesting in the mkv container (metadata or segments). The only thing I have left is the visual part of the video, that also just seems to be a blockier version of the original. Which seems strange as the video is bigger than the original and is encoded using H.264 high.

>>34635 Luckily it looks like they had the issue resolved: https://news.ycombinator.com/item?id=34838681 DigitalOcean security lmfao. Just reset their password w/o any verification because they were persistent...yikes. What others me the most about this final step is present day present time. That's repeated in the video too. Is it flavor text or is it pointing towards an answer?

>>34639 It isn't a cipher - the block formatting and base64 encoding are both red herrings. Here's another HINT.

>>34641 Use a text editor that isn't soykaf and can do regex search.

i feel like a dumbass because i cant figure out what go back to the girls means and then also how to get to the omnipresence soykaf

>>34628 I got the entrance text, just don't get what I'm supposed to do with it. Any tips?

>>34655 find the unlisted site

>>34648 >>34635 can someone give me a hint as to what to do now that i've found the YOU FOUND US WELCOME TO THE WIRED SHH THEY CAN HEAR YOU GO BACK TO THE GIRLS LAIN WANTS YOU TO WATCH OMNIPRESENCE MKX THEN READ OMNIPRESENCE OMNIPRESENCE message?

I see a number of you are close to escaping. It's been almost 5 years since the last escape! Best of luck! It's been so long since the last escape I was worried step 10 might be broken but having checked on it it can still be solved. But I'll offer one final hint for those of you on step 9 already. Another day. Another time. HAHAHAHAHAHA.

>>34680 ok so it got something to do with the Modify Time it seemed weird because it is very exact. Also my browser just removed the times only got it using wget. stuck again... gonna be a long night

>>34681 Nevermind, all files have that precision (.000000000 +0200)

>>34680 What inspired you for this puzzle?

>>34685 Nothing in particular. I had recently discovered Lainchain and there was a thread on encryption that had turned into a discussion about ciphers and codebreaking. Someone was asking about ciphers and how to learn this type of stuff. The best way to learn is by doing so I made a CTF that would serve as an introduction for them. Which is why the CTF is Lain-themed. Although my memory of the show had betrayed me and the sort of ominous tone and messaging feels off for people more familiar with the show. The puzzles are designed to be able to be solved with little or no programming skills and I chose to stick with mostly "mainstream" methods. For example, even if someone doesn't actually know Morse code, they can recognize it and then look online for how to decode it. It requires being at least a little tech savvy though. I figured since Lainchain is /g/-adjacent that I could safely assume Lains would be tech savvy enough and I think that assumption ended up being mostly correct. I'd like to create more difficult CTF's but most of the fun in creating a puzzle is watching people solve it. Without a financial incentive being offered though I'm not sure there would be enough interest in solving more difficult puzzles. For example - I'd like to create a puzzles that require the use of statistical analysis, knowledge of more complex ciphers and steganography, reverse engineering to patch a binary, deep understanding of how HTTP works, etc. But I don't wish to pour large amounts of effort into a puzzle that nobody will ever solve.

The first time the website appears on archive.org is the same date as the date of last escape. Not sure if this is just a coincidence or if it means something.

>>34776 I'll save you some time. That's purely coincidence.

>>34635 For some reason my post keeps tripping the spam filter so I had to caesar cipher it. Pdbeh wkh "ilqdo vwhs" lv wr mxvw vhqg wkh ghflskhuhg whaw dqg ylghr iloh? L fkhfnhg wkh sdgglqj ri wkh pny dqg orrnhg dw hyhub vwulqj orqjhu wkdq 10 fkdudfwhuv dqg frxogq'w ilqg dqbwklqj. Lw'v srvvleoh wkhuh'v vrph nlqg ri OVE vwxii jrlqj rq, exw L kdyh qr lghd krz wr jr derxw orrnlqj iru wkdw, hvshfldoob zlwkrxw d sdvvzrug. L jxhvv lw'v dovr d olwwoh vxvslflrxv wkdw wkh iloh lv vr odujh. Wkh ylghr sruwlrq lv rqob ~10 pe zkloh wkh dxglr lv durxqg ~20 pe. L grzqordghg wkh ruljlqdo iurp brxwxeh dqg wkh zkroh wklqj lv rqob 12 pe.

>>34812 >Maybe the "final step" is to just send the deciphered text and video file? Given that the creator of the CTF is here and hasn't said that is the case, I don't think so. >The video portion is only ~10 mb while the audio is around ~20 mb. That makes sense as the audio is pcm. If you download the video from YouTube with PCM and H.264 (high), the file sizes are pretty close. Also, if the solution was some text like CTF{...} you wouldn't see a big size difference. And as previously said, the audio is a bit perfect match for the YouTube version. Also, a small update on all the things that I've tried: 1. downloaded all files every minute of the one day 2. ran the text file through ascii shift 3. Modification Dates 4. Solve the text file as Tic-Tac-Toe and then decode 5. diff all frames, then overlay 6. mkv sectors/metadata 7. The audio is a perfect match for the YT version. 8. Reading the text in reverse, etc., gets taken care of using ascii shift At this point, I'm convinced it has something to do with time; maybe the VHS video has some timecode information embedded. Also, try the steps above for yourself. I might have made a mistake.

>>34702 fuarrrk you. The last step isn't a puzzle it's a troll. There's no way you actually expected anyone to ever solve it without your help. Fix your hint. Here's a better one: PRESENT DAY PRESENT TIME HAHAHAHAHA PRESENT DAY PRESENT TIME HAHAHAHAHA PRESENT DAY PRESENT TIME HAHAHAHAHA Lain knows how to escape The Wired! PRESENT DAY PRESENT TIME HAHAHAHAHA PRESENT DAY PRESENT TIME HAHAHAHAHA PRESENT DAY PRESENT TIME HAHAHAHAHA She'll be escaping with the other girls any minute now. PRESENT DAY PRESENT TIME HAHAHAHAHA PRESENT DAY PRESENT TIME HAHAHAHAHA PRESENT DAY PRESENT TIME HAHAHAHAHA Join them in time to escape. PRESENT DAY PRESENT TIME HAHAHAHAHA PRESENT DAY PRESENT TIME HAHAHAHAHA PRESENT DAY PRESENT TIME HAHAHAHAHA >>34815 If you want to spoil the answer - check the below spoiler. If you want a proper hint - check the above spoiler. The answer is 100% literal. There is nothing hidden. The answer is literally PRESENT DAY, PRESENT TIME. Present as in Now(). Day and time. No year, no month. Doesn't look like a custom solution was used to update it, maybe a cronjob? The answer changes every minute. Ask the girls for the file like you did before. The timezone is meant to be bruteforced.

>>34816 I had the idea that I was supposed to set my system time to the time after episode 3 (that's where the video is taken from) of lain finished airing, since the previous step seemed weirdly specific about watching the video FIRST and then reading the text file. But I had no idea what time it finished airing and also I couldn't visit the site if I set my date to 1998 July 20 so I gave up on the idea. If it's really a brute force thing then that's kind of disappointing.

>>34816 fuarrrk all of this. should have just fuzzed the server and DOSed it.

>>34702 >>34816 OK but if it is the case that it requires brute forcing, then how exactly is that solvable with "no programming skills"?

>>34822 The bullshit part is deducing that is the answer. They said "little to no" - a curl script to hit 24 times isn't hard to make. Manually might be a bit hard unless you prepare the URLs in advance and copy/paste them all quickly. Again - knowing you have to do that is the bullshit part.

>>34824 Oh so it's just a random time on the hour each minute? That seems… random. Especially since there's no reason to think you wouldn't have to test every minute and every second too.

>>34825 I think it would've been a lot cooler if the answer was somehow related to the air date of the episode or if there was a hint hidden in the EBLM void of the mkv so that the episode wasn't just a complete red herring.

>>34826 Hidden in the wav file of the mkv is the same text that is in omnipresence.omnipresence. I have the feeling not enough people found this and the game was updated. Just a hunch.

>>34825 Not random and not that precise. The answer changes each minute and the answer will work for that minute - once the minute rolls over the answer changes to be the next minute.

>>34827 Really? strings didn't turn up anything like that. >>34828 So if you just happened to live in the right timezone you would automatically solve it? That's pretty dumb.

>>34827 Surprisingly accurate hunch - that's actually exactly what had happened. When I made the video I didn't realize that one was big endian and the other was little endian. That unfortunate mistake made it almost impossible for people to find the text until they stumbled upon trying to flip the endianness of the file. Something like https://www.youtube.com/watch?v=RY74bG_YZAs but a little less visible. But I couldn't get it working without making it too noticeable. Since it was a bit harder than I had intended it to be I made an alternate route that was a bit easier to discover. >>34816 I'm sorry, Lain. :( The ending was a bit rushed and I could have hinted towards the final step a bit better if I had spent time to edit the video. The original plan was to loop "PRESENT DAY, PRESENT TIME HAHAHAHA" for a minute and in the spectral view of the audio hide the name of the final flag. But I lacked the skill necessary to get the spectral to come out right.