you wouldn't git it

"you wouldn't git it" was a follow up to an earlier challenge where i'd found a crew member's github repo. the repo had a browser extension that hides text inside normal looking text using invisible unicode. the new prompt was just someone ranting about content creators and memes, so i figured the answer was still somewhere in that repo.

it was not in the repo

i went through every commit, every deleted file, every hidden unicode trick the extension supports. everything decoded to a joke. one of them was literally:

not the flag. did you really think it would be this easy, Maude?

the challenge author's twitter was the same. lots of hidden messages, all of them bits. my favourite was False. Bears.

so i asked

eventually i just messaged the author on discord. he asked me to list every site i'd visited for the ctf, and the list was missing one: ghosttown, a fake forum the organizers run for the in-game hacker crew. i'd used it for a different challenge and completely forgot it existed.

his next hint was "maybe they mentioned some social media." so i grepped every thread on the forum for platform names. one post had a character asking to put a photo on something called doomscroll.

doomscroll

doomscroll.dctf.io is a whole fake instagram. the crew had profiles, and a bunch of posts had zero width characters in the comments. more jokes. so i scanned every post id in range instead of clicking around:

for pid in range(195, 275):
    text = visible_text(fetch(f"/post/{pid}"))
    zw = sum(c in "\u200b\u200c" for c in text)
    if zw: print(pid, zw)

post 247 had way more hidden characters than the rest. the zero width ones were still jokes, but one comment also had unicode tag characters, a completely different scheme hiding under the first one.

tags = [c for c in text if 0xE0000 <= ord(c) <= 0xE007F]
print("".join(chr(ord(c) - 0xE0000) for c in tags))
# YES! YOU'RE ALL USING IT! deadface{13_h4ck3r5_walk3d_int0_a_bar_each_says_Ill_h4v3_a_r00t_b33r}

flag:

deadface{13_h4ck3r5_walk3d_int0_a_bar_each_says_Ill_h4v3_a_r00t_b33r}