 Hey YouTube, this is a video write-up for the challenge ogres are like onions from the b-sides Connecticut capture flag competition in this Technography category the challenge prompts here is sometimes things aren't what they seem sometimes things are what they seem Damn, that's gonna fusing regardless. This is a thing. So this challenge was brought to you by our friend Ardnit sec DSM And we're given a download here The hint did not come out until later on in the game and I never solved this during the competition And no one else did in fact the first solve is from just a couple minutes ago like last hour Well, I was just trying to get this right and go ahead and submit it now So let's go and dive in we have that mpeg or mp3 file to download sorry And it is simply that it is an audio file. We can go ahead and play it I'll use mplayer and I don't know if you can hear that right now, but it's a lot of beeping. It's Stupid stuff Originally, I thought oh, this is DTM f f tones because I wasn't really paying attention or listening It's DTM f and then I wanted to go ahead and decode them But for some reason the site is down and I feel horrible about that because I don't know any other resources to decode DTM f tones It's not important because this isn't actually that that's not the correct lead for this If you actually open this up in another utility like sonic visualizer or something to really be able to actually look at The file. Let's see. Okay. I've got it in download. That's good enough this kind of looks like Morse code and Maybe that's harder to tell harder to determine But you can see these some waves are long and some waves that are short etc So, okay, if it's just the same tone beeping over and over again and just varying in lengths Maybe this is in fact Morse code. So I figured well, let's go ahead and play with that Let's go ahead and figure that out. Let's use a Morse code decoder Maybe audio file wave. So I just went to this site online And actually if you do some reconnaissance on the file if you just like or to use exit tool, I think on that Yeah, you can see okay. It's got a title. It's got an artist. It's got a band These are specific people that had put this together Looks like besides I always reference in here. Maybe this that's challenges originally put there But it says hey, this was encoded by this URL and it discusses their their page and all so fine Let's just jump in and use this because that's the correct page that we're on here If we wanted to it says if you've arrived here You might prefer the newest streamlined version which adapts to the speed and frequency of the Morse code However, it doesn't give us a whole lot of options and this one does we can actually select something specifically that we want to look at So I'll go ahead and upload a file here. I'll put this in the B sides CTF thing stag Ogres are like onions and upload it cool So if we were to play here or move down to the very very bottom it actually gives us The message that it's trying to read out. So I'll hit Do it. I'll hit the go button and it'll slowly process. I hope I think I May have to have said like apply or play or something Yeah, I had I struggled with this one which is why I went to the newer version But this one is this this original page is a lot better for giving us something when you specify two-tone and I don't know if it'll let me do this or not Yeah, hit the stop button Maybe my internet connection is just crap. That's why I can't process this very easily Let's try this dream stream line version. I'll upload this guy hit play and Okay, audio is on and trying to process some of this stuff Let me turn that down And we get this text that's coming out of it The other messages that you actually be able to see from this if you looked at it with two-tone or with other things it says This is like 20 Wpm with a higher frequency etc. And at the very end it looks like it's getting us BT Yeah BT and what is I forget the proper terminology was it pro sign or something more morse code Yeah, yeah, pro signs for morse code. Yeah, so BT is like starting a new new thing I can't I don't want to say like Paragraph or breakthrough, but okay break. Yeah break so What I looked at that I realized okay same as character equal signs or something And I thought that's peculiar because when I look at this clearly this this is hard to determine it's base 64 But I know it may very well be another base like a lot of common cop capital letters Is like base 32 so I didn't process immediately that the BT or the The breaks were referring to equal signs, but when I look at it later on it makes so much more sense to me So I didn't see the hint originally at the time as well. It wasn't out that that point But had I seen it earlier I might have had a better luck with this because that is in fact something that may look like base 32 So let's go ahead and import Base 64 and Python base 64 and Python that module does in fact have a b32 encode and decode set of functions So we can base 32 decode. I'll give it this and maybe I had wrong padding there Yep, okay, so throw another equal sign on there You can see it's trying to try to throw something else in there and we're I'm giving this right Interesting peculiar. I have no idea what this is. I have literally no idea what this is I thought it was base 85 or the 58 stuff and then eventually Looking at the hint once it got released. It says oh not all your not all your base are 64 And I agreed with this that this made sense in my mind for what we had already figured out Okay, assuming assuming Lee base 32 and I screwed around like oh add more equal signs to subtract equal signs Just twinked Mudge and infudge some of the characters in here But I was given this at the end of the day didn't know what to do with it Had no idea what it was kept trying to play with it blah blah blah the competition ended everything was over and I figured We asked the guys what is this thing and they tell me oh, it's rot 47. I was like, what is that? Not like base 37 or anything base 47. I found it and read a little about it It's a it's peculiar because how do you look that like literally the rot 13 like a regular Caesar Cypher thing on Wikipedia they actually talk about rot 47 and the variation section it says Oh, it's a derivative of rot 13 where in addition to scrambling the basic letters It also treats numbers and common symbols as part of the translation series instead of using just a to z as the alphabet It uses all the characters like everything in ASCII so you can get some interesting crap Very cool, right? I'd never heard of this and I and I definitely want to add this to like my ctf katana thing If you haven't seen that that's cool thing go ahead and check out John Hammond GitHub ctf katana has a lot of references and resources for our ctf stuff I definitely need to add this into it because I just thought it was very very cool If you just go ahead and go to a rot 40 70 coder Track one down online build something interesting stuff. We can go ahead and submit this Paste it in Idol, where'd you go? Is it all gone? Did I lose it all gosh dang it? All right, let's read. Let's redo that. I may have closed out of it like a fool I don't even have the whole thing to copy and paste in Four equal signs what I use 64 my bad 32 There we go Cool. Let's go ahead and throw this in a raw 47 decrypt it It says from sec DSM with love that is the flag That is what we should submit and that is what would give us 500 points except None of us got it during the competition no one that was playing figured this out But after having that conversation with the creators afterwards, we realized it was rod 47 very cool I'd never heard of that before or so. Hey, maybe that's a nugget for you, too I hope you guys enjoyed this. Thank you guys for watching and Before I go I want to give a quick shout out to the people that support me on patreon So thank you guys so much one dollar a month or more on patreon We'll give you a special shout out just like this at the end of every video You got your name added to the list get your name up in lights It's just a feel-good feeling it feels like you're helping people in the world helping some guy just trying to make his own path It's cool Five dollars or more on patreon will give you early access to everything that are released on YouTube before it goes live So I like to record some videos in bulk when I'm going on a streak feeling good actually being productive for once And I will let them sit in a shared Google Drive so that anyone can access them while I'm waiting on YouTube to gradually Release them on a schedule so slowly but surely If you want the content right when it's ready right when it's hot right when I've got stuff recorded That's the way to do it and it helps me out I'm grateful and I thank you for your help and support if you did like this video Please do like comment and subscribe join our discord server link in the description It is a cool community full of CTF players programmers and hackers It's slowing down We got a lot of people in there and hopefully the the life will come out of it again But we'll jump in the next CTF right I think square CTF is coming up this this this weekend I'll be at B sides Delaware give another talk playing pros versus Joe's again cool cool stuff So all right. See you guys another video. I love you. I'll talk to you later