Here's half of a challenge. Visiting
http://aotw2019.overthewire.org/challenge-zero we're greeted with a
blocky GIF of a fireplace and a silly saying. In Firefox it's:
> Did you know: Plain text goes best with a text browser.
>
> Hint: $ target remote localhost:1234
But in Chromium it's:
> Fox! Fox! Burning bright! In the forests of the night!
>
> Hint: $ break *0x7c00
How odd. My habit of viewing websites in different browsers paid
off. Let's check the source view:
<!-- browser detected: chrome -->
That explains it. Browsers are typically detected by checking the
user agent, so let's collect some more hints by trying all the
well-known user agents out there:
- "D0NT PU5H M3 C0Z 1M C1053 T0 T3H 3DG3"
- "Hint: If only the flames wouldn't move that much..."
- "This is quite the browser safari, don't you agree?"
- "Hint: Pause qemu by add -S to the args and type 'c' in the monitor"
- "Opera: Music for the masses"
- "Hint: Try reading between the lines."
- "Put your hands up, this is the Chrome Shop mafia!"
- "Hint: qemu-system-x86_64 boot.bin -cpu max -s"
Something more interesting happens if one simulates `wget`:
> Is that a curling iron in your pocket or are you just happy to see
> me?
Retrying again with curl displays a textual fire animation. The
previous hints suggests to read between the lines. This kind of stuff
is best analyzed when stored to disk, this can be done by downloading
the output for a while until the frames start repeating, then
splitting them into frames. The following steps are required to make
sense of them:
- Ensure it's five unique frames
- Strip the ANSI escape codes
- Discover that there's lots of `#` and a bunch of other characters
- Filter everything not looking like a `#`
- Notice it's two identical base64-encoded strings
- Decode either
- Decode the resulting uuencoded text into a 512-byte binary
The other half of the challenge has been designed by Retr0id, beg him
for an official write-up.