# Green Cabbage (for, 322p, 7 solved) A pretty random challenge. It was very simple "technically", but the hardest part was to guess what's going on there. We get a [pcap](Green_Cabbage.pcap) to analyse. The only interesting part is some communication with server `37.139.4.247` on port `31337`. Some base64 binary-looking payloads are sent back and forth. The server is up so we can try sending data as well, but without knowing what we're looking at it's a bit hard. One communication in the pcap is interesting, because it results in: ``` BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB BBBBBBBBBBBBBBBBBBBBBBrrrrrrrrrrrrrrroBBBBBBBBBBBBBBBBBBBBB BBBBBBBBBBBBBBBBtrrrrrrrrrrrrrrrrrrrrrrrrrtBBBBBBBBBBBBBBBB BBBBBBBBBBBBBrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrBBBBBBBBBBBBB BBBBBBBBBBBrrrrrrrrrrrrrrrrrrrrrr rrrrrrrrrrrrBBBBBBBBBBB BBBBBBBBBrrrrrrrrrrrrrrrrrrrrrr rrrrrrrrrrrrrBBBBBBBBB BBBBBBBrrrrrrrrrrrrrrrrrrrrrrr rrrrrrrrrrrrrrrBBBBBBB BBBBBBrrrrrrrrrrrrrrrrrrrrrrr lrrrrrrrrrrrrrrrBBBBBB BBBBtrrrrrrrrrrrr rrrrrrrr rrrrrrrrrrrrrrrrroBBBB BBBBrrrrrrrrrrrl rrrrrrr rrrrrrrrrrrrrrrrrrBBBB BBBrrrrrrrrrrrr rrrrrr rrrrrrrrrrrrrrrrrrrBBB BBrrrrrrrrrrrr irrrrrr rrrrrrrr rrrrrrrrrrrBB BBrrrrrrrrrrr rrrrrr rrrrrrri rrrrrrrrrrBB Borrrrrrrrrrr rrrrri rrrrrr rrrrrrrrrroB Brrrrrrrrrrr rrrrrr rrrrrr rrrrrrrrrrrB Brrrrrrrrrrr rrrrrr rrrrrr rrrrrrrrrrrB Borrrrrrrrrr rrrrrr irrrrr rrrrrrrrrrroB BBrrrrrrrrrr irrrrrrr rrrrrr rrrrrrrrrrrBB BBrrrrrrrrrrr rrrrrrrr rrrrrri rrrrrrrrrrrrBB BBBrrrrrrrrrrrrrrrrrrr rrrrrr rrrrrrrrrrrrBBB BBBBrrrrrrrrrrrrrrrrrr rrrrrrr lrrrrrrrrrrrBBBB BBBBBrrrrrrrrrrrrrrrrr rrrrrrrr rrrrrrrrrrrroBBBB BBBBBBrrrrrrrrrrrrrrrl rrrrrrrrrrrrrrrrrrrrrrrBBBBBB BBBBBBBrrrrrrrrrrrrrrr rrrrrrrrrrrrrrrrrrrrrrrBBBBBBB BBBBBBBBBrrrrrrrrrrrrr rrrrrrrrrrrrrrrrrrrrrrBBBBBBBBB BBBBBBBBBBBrrrrrrrrrrrr rrrrrrrrrrrrrrrrrrrrrrBBBBBBBBBBB BBBBBBBBBBBBBrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrBBBBBBBBBBBBB BBBBBBBBBBBBBBBBorrrrrrrrrrrrrrrrrrrrrrrrrBBBBBBBBBBBBBBBBB BBBBBBBBBBBBBBBBBBBBBBrrroootttllliiiBBBBBBBBBBBBBBBBBBBBBB ``` At some point one of our friends googled thr word in the bottom -> `Brrroootttllliii` and we found https://github.com/google/brotli with matching logo. We did a quick check and yes, the payloads are simply compressed with brotli. The only thing left was to communicate with the server: ``` hi all, ******************** send the exact time in epoch format please... ``` Once we send the timestamp we get back the logo. Then: ``` as you found that we are using Brotli compression algorithm for connection in this task you should find a compressed string inside the given byte stream are you ready? [Y]es or [N]o ******************** RJYafFyURxsp3r0D6jJVZibafFyURxsp3r0D6jJVZibafFyURxsp3r0D6jJVZibXcV whats the message?********** ``` Now this was very confusing because we didn't understand what is the goal here. We tried to do some cryptanalysis on this strange string, but eventually someone suggested that maybe we simply need to send this random string back. We did and we got the flag: `ASIS{Brotli_iz_the_b35t_lOssl3s5_c0mpr3ss1oN_algOr1thm___Ri9ht??}` Full solver [here](cabbage.py) Original writeup (https://github.com/p4-team/ctf/tree/master/2018-11-24-asis- finals/for_cabbage).# Green Cabbage (for, 322p, 7 solved) A pretty random challenge. It was very simple "technically", but the hardest part was to guess what's going on there. We get a [pcap](Green_Cabbage.pcap) to analyse. The only interesting part is some communication with server `37.139.4.247` on port `31337`. Some base64 binary-looking payloads are sent back and forth. The server is up so we can try sending data as well, but without knowing what we're looking at it's a bit hard. One communication in the pcap is interesting, because it results in: ``` BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB BBBBBBBBBBBBBBBBBBBBBBrrrrrrrrrrrrrrroBBBBBBBBBBBBBBBBBBBBB BBBBBBBBBBBBBBBBtrrrrrrrrrrrrrrrrrrrrrrrrrtBBBBBBBBBBBBBBBB BBBBBBBBBBBBBrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrBBBBBBBBBBBBB BBBBBBBBBBBrrrrrrrrrrrrrrrrrrrrrr rrrrrrrrrrrrBBBBBBBBBBB BBBBBBBBBrrrrrrrrrrrrrrrrrrrrrr rrrrrrrrrrrrrBBBBBBBBB BBBBBBBrrrrrrrrrrrrrrrrrrrrrrr rrrrrrrrrrrrrrrBBBBBBB BBBBBBrrrrrrrrrrrrrrrrrrrrrrr lrrrrrrrrrrrrrrrBBBBBB BBBBtrrrrrrrrrrrr rrrrrrrr rrrrrrrrrrrrrrrrroBBBB BBBBrrrrrrrrrrrl rrrrrrr rrrrrrrrrrrrrrrrrrBBBB BBBrrrrrrrrrrrr rrrrrr rrrrrrrrrrrrrrrrrrrBBB BBrrrrrrrrrrrr irrrrrr rrrrrrrr rrrrrrrrrrrBB BBrrrrrrrrrrr rrrrrr rrrrrrri rrrrrrrrrrBB Borrrrrrrrrrr rrrrri rrrrrr rrrrrrrrrroB Brrrrrrrrrrr rrrrrr rrrrrr rrrrrrrrrrrB Brrrrrrrrrrr rrrrrr rrrrrr rrrrrrrrrrrB Borrrrrrrrrr rrrrrr irrrrr rrrrrrrrrrroB BBrrrrrrrrrr irrrrrrr rrrrrr rrrrrrrrrrrBB BBrrrrrrrrrrr rrrrrrrr rrrrrri rrrrrrrrrrrrBB BBBrrrrrrrrrrrrrrrrrrr rrrrrr rrrrrrrrrrrrBBB BBBBrrrrrrrrrrrrrrrrrr rrrrrrr lrrrrrrrrrrrBBBB BBBBBrrrrrrrrrrrrrrrrr rrrrrrrr rrrrrrrrrrrroBBBB BBBBBBrrrrrrrrrrrrrrrl rrrrrrrrrrrrrrrrrrrrrrrBBBBBB BBBBBBBrrrrrrrrrrrrrrr rrrrrrrrrrrrrrrrrrrrrrrBBBBBBB BBBBBBBBBrrrrrrrrrrrrr rrrrrrrrrrrrrrrrrrrrrrBBBBBBBBB BBBBBBBBBBBrrrrrrrrrrrr rrrrrrrrrrrrrrrrrrrrrrBBBBBBBBBBB BBBBBBBBBBBBBrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrBBBBBBBBBBBBB BBBBBBBBBBBBBBBBorrrrrrrrrrrrrrrrrrrrrrrrrBBBBBBBBBBBBBBBBB BBBBBBBBBBBBBBBBBBBBBBrrroootttllliiiBBBBBBBBBBBBBBBBBBBBBB ``` At some point one of our friends googled thr word in the bottom -> `Brrroootttllliii` and we found https://github.com/google/brotli with matching logo. We did a quick check and yes, the payloads are simply compressed with brotli. The only thing left was to communicate with the server: ``` hi all, ******************** send the exact time in epoch format please... ``` Once we send the timestamp we get back the logo. Then: ``` as you found that we are using Brotli compression algorithm for connection in this task you should find a compressed string inside the given byte stream are you ready? [Y]es or [N]o ******************** RJYafFyURxsp3r0D6jJVZibafFyURxsp3r0D6jJVZibafFyURxsp3r0D6jJVZibXcV whats the message?********** ``` Now this was very confusing because we didn't understand what is the goal here. We tried to do some cryptanalysis on this strange string, but eventually someone suggested that maybe we simply need to send this random string back. We did and we got the flag: `ASIS{Brotli_iz_the_b35t_lOssl3s5_c0mpr3ss1oN_algOr1thm___Ri9ht??}` Full solver [here](cabbage.py) Original writeup (https://github.com/p4-team/ctf/tree/master/2018-11-24-asis- finals/for_cabbage).# Green Cabbage (for, 322p, 7 solved) A pretty random challenge. It was very simple "technically", but the hardest part was to guess what's going on there. We get a [pcap](Green_Cabbage.pcap) to analyse. The only interesting part is some communication with server `37.139.4.247` on port `31337`. Some base64 binary-looking payloads are sent back and forth. The server is up so we can try sending data as well, but without knowing what we're looking at it's a bit hard. One communication in the pcap is interesting, because it results in: ``` BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB BBBBBBBBBBBBBBBBBBBBBBrrrrrrrrrrrrrrroBBBBBBBBBBBBBBBBBBBBB BBBBBBBBBBBBBBBBtrrrrrrrrrrrrrrrrrrrrrrrrrtBBBBBBBBBBBBBBBB BBBBBBBBBBBBBrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrBBBBBBBBBBBBB BBBBBBBBBBBrrrrrrrrrrrrrrrrrrrrrr rrrrrrrrrrrrBBBBBBBBBBB BBBBBBBBBrrrrrrrrrrrrrrrrrrrrrr rrrrrrrrrrrrrBBBBBBBBB BBBBBBBrrrrrrrrrrrrrrrrrrrrrrr rrrrrrrrrrrrrrrBBBBBBB BBBBBBrrrrrrrrrrrrrrrrrrrrrrr lrrrrrrrrrrrrrrrBBBBBB BBBBtrrrrrrrrrrrr rrrrrrrr rrrrrrrrrrrrrrrrroBBBB BBBBrrrrrrrrrrrl rrrrrrr rrrrrrrrrrrrrrrrrrBBBB BBBrrrrrrrrrrrr rrrrrr rrrrrrrrrrrrrrrrrrrBBB BBrrrrrrrrrrrr irrrrrr rrrrrrrr rrrrrrrrrrrBB BBrrrrrrrrrrr rrrrrr rrrrrrri rrrrrrrrrrBB Borrrrrrrrrrr rrrrri rrrrrr rrrrrrrrrroB Brrrrrrrrrrr rrrrrr rrrrrr rrrrrrrrrrrB Brrrrrrrrrrr rrrrrr rrrrrr rrrrrrrrrrrB Borrrrrrrrrr rrrrrr irrrrr rrrrrrrrrrroB BBrrrrrrrrrr irrrrrrr rrrrrr rrrrrrrrrrrBB BBrrrrrrrrrrr rrrrrrrr rrrrrri rrrrrrrrrrrrBB BBBrrrrrrrrrrrrrrrrrrr rrrrrr rrrrrrrrrrrrBBB BBBBrrrrrrrrrrrrrrrrrr rrrrrrr lrrrrrrrrrrrBBBB BBBBBrrrrrrrrrrrrrrrrr rrrrrrrr rrrrrrrrrrrroBBBB BBBBBBrrrrrrrrrrrrrrrl rrrrrrrrrrrrrrrrrrrrrrrBBBBBB BBBBBBBrrrrrrrrrrrrrrr rrrrrrrrrrrrrrrrrrrrrrrBBBBBBB BBBBBBBBBrrrrrrrrrrrrr rrrrrrrrrrrrrrrrrrrrrrBBBBBBBBB BBBBBBBBBBBrrrrrrrrrrrr rrrrrrrrrrrrrrrrrrrrrrBBBBBBBBBBB BBBBBBBBBBBBBrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrBBBBBBBBBBBBB BBBBBBBBBBBBBBBBorrrrrrrrrrrrrrrrrrrrrrrrrBBBBBBBBBBBBBBBBB BBBBBBBBBBBBBBBBBBBBBBrrroootttllliiiBBBBBBBBBBBBBBBBBBBBBB ``` At some point one of our friends googled thr word in the bottom -> `Brrroootttllliii` and we found https://github.com/google/brotli with matching logo. We did a quick check and yes, the payloads are simply compressed with brotli. The only thing left was to communicate with the server: ``` hi all, ******************** send the exact time in epoch format please... ``` Once we send the timestamp we get back the logo. Then: ``` as you found that we are using Brotli compression algorithm for connection in this task you should find a compressed string inside the given byte stream are you ready? [Y]es or [N]o ******************** RJYafFyURxsp3r0D6jJVZibafFyURxsp3r0D6jJVZibafFyURxsp3r0D6jJVZibXcV whats the message?********** ``` Now this was very confusing because we didn't understand what is the goal here. We tried to do some cryptanalysis on this strange string, but eventually someone suggested that maybe we simply need to send this random string back. We did and we got the flag: `ASIS{Brotli_iz_the_b35t_lOssl3s5_c0mpr3ss1oN_algOr1thm___Ri9ht??}` Full solver [here](cabbage.py) Original writeup (https://github.com/p4-team/ctf/tree/master/2018-11-24-asis- finals/for_cabbage).