From the challenge description, it was clear that the challenge was related to a USB Rubber Ducky.
To analyze the payload, I used the following tool from GitHub:
from the output we can find this website https://justpaste.it/grp32
Blitz{1'm_4_nak}
The zip file provided contains a seemingly normal Snake game. After a bit of digging, we discover that it's written in the Brainfuck programming language.
Inspecting the source code of the Snake game, we notice a chunk of Brainfuck code at the very bottom: cat examples/snake.b
++++++++++[>+>+++>+++++++>++++++++++<<<<-]>>>----.>++++++++.---.+++++++++++.++++++.+.<.>---------.-----------------.++++++++.+++++.
When decoded using DCode's Brainfuck decoder, this gives us the first part of the flag:
Blitz{Brain
Continuing further, we use ls -la
to look for hidden files and spot a .git
directory. This indicates that git history might reveal more clues.
Running the following command: git log
, you’ll find a some ciphers
000000000000000000000000000000110010000010000000000010000000000000000000000010000000000000000000000000000000011011011011001111010010010000000000000000000000000000000000000100010000000000000000000000000000000000100011011000000000000000000000000000000000000000000000000000000000000000000000000000100100100100
AND
111111111100100010101011101011111110101111111111011011011011000001101001001001000000000000000000101001111111111110010100111111111111111111110010101111111001010001010000000000001010010000000001010010111111111111111111111111111111001010