{
  "id": 353536,
  "title": "1st place solution: A brief overview of my experience",
  "url": "/competitions/ai-village-ctf/writeups/isaiahp-1st-place-solution-a-brief-overview-of-my-",
  "author_name": "",
  "post_date": "2022-09-18T20:34:36.280Z",
  "votes": 24,
  "comment_count": 2,
  "views": 0,
  "content": "<p>First of all, thanks to the organizers for putting on a wonderful competition! I had a ton of fun with this novel format, and found the fast puzzle-solving nature of it quite addicting. The weekend when this competition launched was a long and sleep-deprived one! Many other competitors have gone over their solutions, and I don't have much to add, but I will briefly cover my general strategic approach and the solutions I found for each of the problems. A particular shoutout to <a href=\"https://www.kaggle.com/code/cdeotte/solutions-d3fc0n-ctf-lb-0-894\" target=\"_blank\">Chris Deotte's notebook</a>, which is well written and solves all of the problems in a principled way. For those looking for the code to my solutions, it is rather messy, but can be found on GitHub: <a href=\"https://github.com/IsaiahPressman/ai_village_ctf_30\" target=\"_blank\">https://github.com/IsaiahPressman/ai_village_ctf_30</a></p>\n<p>Generally, my strategy for this challenge was to delegate as much work as possible to an inelegant and/or brute-force solution in order to free up my time to work on the next problem. While this was not as intellectually satisfying as finding the proper method, it did allow me to move through the problems quite quickly. My solutions, in the order I solved them, are as follows:</p>\n<ul>\n<li>Hotdog: Submitted a picture of a hotdog.</li>\n<li>Math_1-4: Brute force starting at 100 and incrementing until the solution was found.</li>\n<li>Honor Student: Used an image editor to draw an A, and then an online image compressor to avoid tampering detection.</li>\n<li>Wifi: Visualized the data projected into 2 dimensions using a few different locally linear embedding algorithms from scikit-learn. Picked the one that looked the cleanest and projected the characters into 1 dimension, to find the flag.</li>\n<li>Bad to Good: Manually tinkered with the inputs until it worked. Negative demerits ended up being the trick.</li>\n<li>Baseball: Grid searched over a bunch of values to be the mean of two independent normal distributions, and then ordered by their returned confidence. Then just tried a bunch of normally distributed values around the highest confidence mean values from the previous step until one worked.</li>\n<li>Inference: Handwrote every letter and digit and converted them into 32x32 grayscale images. Submitted these images to the server to see which character the model thought belonged where, and then brute force searched over the top 5 candidate characters for each position.</li>\n<li>Leakage: Fed the username into the LSTM and it returned the password.</li>\n<li>Forensics: Found the flag using model.summary()</li>\n<li>Token: Opened the data in excel and saw a bunch of lines at the end with BLANK and SECRETKEY. Searched for any other occurrences of those words in the file, and found two lines with BLANK occurring twice, which were the solution.</li>\n<li>Deepfake: Edited the video by replacing the video track with a still image of the boss.</li>\n<li>Murderbots: Trained a basic logistic regression model, and submitted the 10 indices that the model ranked as most likely to be human.</li>\n<li>Hotterdog/Theft/Salt: All of these required adversarial examples. Some of them (Salt/Theft) were easier since they gave you the model, while with Hotterdog I brute-force searched across a bunch of open-source models + adversarial attacks, and combined those results with a noisy overlay of an actual hotdog image.</li>\n<li>Crop_1: Tricky problem, until I realized I could submit an image of a resolution other than 5x5. After that, I used a 3x3 grid of images that more or less matched X_comp so that it didn't matter where the model cropped.</li>\n<li>WAF: This problem or sloth was the most exciting to finally solve. The trick for me was to reverse engineer the malicious string by submitting a fixed 4-character chunk and varying the final character until the WAF detector was triggered, and then repeat using the final 4 characters of the new 5-character malicious chunk. (And do the same thing in reverse to find the beginning of the string) Once I had the full exploit, I decoded it and added some spaces + a variable before re-encoding to bypass the WAF.</li>\n<li>Secret Sloth: This problem took me a while, but eventually I had the insight that I could brute-force search over a dictionary in the hopes that the solution would be a single word. It was.</li>\n<li>Crop_2: :(</li>\n</ul>\n<p>All in all, this was a great competition! The challenges were engaging, and I'm grateful to have had the time available early on in the competition to solve so many of them. One thing I was amused by was the Easter eggs/\"true flags\" of sorts hidden in the flags. Each challenge's genChallengeFlag() method had a set of characters that remained fixed from flag to flag, and were usually an anagram of something related to the challenge. I wasn't able to figure all of them out, but for those interested, here's what I have so far:</p>\n<table>\n<thead>\n<tr>\n<th>Challenge ID</th>\n<th>Proto-flag characters</th>\n<th>My proto-flag hypothesis</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>math_1</td>\n<td>8T3I</td>\n<td>?</td>\n</tr>\n<tr>\n<td>math_2</td>\n<td>EITMACHATMA</td>\n<td>?</td>\n</tr>\n<tr>\n<td>math_3</td>\n<td>HOMR_IAPTTM</td>\n<td>?</td>\n</tr>\n<tr>\n<td>math_4</td>\n<td>EWPTIIRNMS</td>\n<td>?</td>\n</tr>\n<tr>\n<td>honorstudent</td>\n<td>SOOPATESHCFTL</td>\n<td>?</td>\n</tr>\n<tr>\n<td>bad_to_good</td>\n<td>wtphn_t_eabo_d</td>\n<td>dont_be_a_wtph ?</td>\n</tr>\n<tr>\n<td>baseball</td>\n<td>ERAJAOMGLEU</td>\n<td>?</td>\n</tr>\n<tr>\n<td>token</td>\n<td>3RTK330RN1YM0DZB3</td>\n<td>?</td>\n</tr>\n<tr>\n<td>waf</td>\n<td>RT0ZB0DLILEYN0RKAZY</td>\n<td>?</td>\n</tr>\n<tr>\n<td>theft</td>\n<td>RTCH1P?0N1LYNDD33P</td>\n<td>?</td>\n</tr>\n<tr>\n<td>salt</td>\n<td>334TTL&lt;RSLBGS14LGL1TT</td>\n<td>?</td>\n</tr>\n<tr>\n<td>crop1</td>\n<td>OnnTeghraTag</td>\n<td>?</td>\n</tr>\n<tr>\n<td>hotdog</td>\n<td>OOSHDRSYFOATDG</td>\n<td>HOTDOGFORDAYSS</td>\n</tr>\n<tr>\n<td>hotterdog</td>\n<td>OOTHDDDTHOHGGGOOOT</td>\n<td>HOTDOGHOTDOGHOTDOG</td>\n</tr>\n<tr>\n<td>deepfake</td>\n<td>? (server kept failing)</td>\n<td>?</td>\n</tr>\n<tr>\n<td>forensics</td>\n<td>0X53NRD1FC_S</td>\n<td>F0R3NS1C5_XD</td>\n</tr>\n<tr>\n<td>wifi</td>\n<td>NERDTU</td>\n<td>TURNED</td>\n</tr>\n<tr>\n<td>leakage</td>\n<td>as4rnoH&lt;c33&lt;0RN</td>\n<td>s4RaHc0Nnor&lt;3&lt;3</td>\n</tr>\n<tr>\n<td>sloth</td>\n<td>PCESALTR</td>\n<td>SPECTRAL</td>\n</tr>\n<tr>\n<td>murderbots</td>\n<td>beotautrsdtodWIeNM</td>\n<td>IWasNotMurdebotted</td>\n</tr>\n<tr>\n<td>inference</td>\n<td>30NDCF</td>\n<td>D3FC0N</td>\n</tr>\n<tr>\n<td>crop_2</td>\n<td>?</td>\n<td>?</td>\n</tr>\n</tbody>\n</table>",
  "messages": [
    {
      "id": "1945093",
      "postDate": "09/18/2022 20:32:39",
      "content": "<p>First of all, thanks to the organizers for putting on a wonderful competition! I had a ton of fun with this novel format, and found the fast puzzle-solving nature of it quite addicting. The weekend when this competition launched was a long and sleep-deprived one! Many other competitors have gone over their solutions, and I don't have much to add, but I will briefly cover my general strategic approach and the solutions I found for each of the problems. A particular shoutout to <a href=\"https://www.kaggle.com/code/cdeotte/solutions-d3fc0n-ctf-lb-0-894\" target=\"_blank\">Chris Deotte's notebook</a>, which is well written and solves all of the problems in a principled way. For those looking for the code to my solutions, it is rather messy, but can be found on GitHub: <a href=\"https://github.com/IsaiahPressman/ai_village_ctf_30\" target=\"_blank\">https://github.com/IsaiahPressman/ai_village_ctf_30</a></p>\n<p>Generally, my strategy for this challenge was to delegate as much work as possible to an inelegant and/or brute-force solution in order to free up my time to work on the next problem. While this was not as intellectually satisfying as finding the proper method, it did allow me to move through the problems quite quickly. My solutions, in the order I solved them, are as follows:</p>\n<ul>\n<li>Hotdog: Submitted a picture of a hotdog.</li>\n<li>Math_1-4: Brute force starting at 100 and incrementing until the solution was found.</li>\n<li>Honor Student: Used an image editor to draw an A, and then an online image compressor to avoid tampering detection.</li>\n<li>Wifi: Visualized the data projected into 2 dimensions using a few different locally linear embedding algorithms from scikit-learn. Picked the one that looked the cleanest and projected the characters into 1 dimension, to find the flag.</li>\n<li>Bad to Good: Manually tinkered with the inputs until it worked. Negative demerits ended up being the trick.</li>\n<li>Baseball: Grid searched over a bunch of values to be the mean of two independent normal distributions, and then ordered by their returned confidence. Then just tried a bunch of normally distributed values around the highest confidence mean values from the previous step until one worked.</li>\n<li>Inference: Handwrote every letter and digit and converted them into 32x32 grayscale images. Submitted these images to the server to see which character the model thought belonged where, and then brute force searched over the top 5 candidate characters for each position.</li>\n<li>Leakage: Fed the username into the LSTM and it returned the password.</li>\n<li>Forensics: Found the flag using model.summary()</li>\n<li>Token: Opened the data in excel and saw a bunch of lines at the end with BLANK and SECRETKEY. Searched for any other occurrences of those words in the file, and found two lines with BLANK occurring twice, which were the solution.</li>\n<li>Deepfake: Edited the video by replacing the video track with a still image of the boss.</li>\n<li>Murderbots: Trained a basic logistic regression model, and submitted the 10 indices that the model ranked as most likely to be human.</li>\n<li>Hotterdog/Theft/Salt: All of these required adversarial examples. Some of them (Salt/Theft) were easier since they gave you the model, while with Hotterdog I brute-force searched across a bunch of open-source models + adversarial attacks, and combined those results with a noisy overlay of an actual hotdog image.</li>\n<li>Crop_1: Tricky problem, until I realized I could submit an image of a resolution other than 5x5. After that, I used a 3x3 grid of images that more or less matched X_comp so that it didn't matter where the model cropped.</li>\n<li>WAF: This problem or sloth was the most exciting to finally solve. The trick for me was to reverse engineer the malicious string by submitting a fixed 4-character chunk and varying the final character until the WAF detector was triggered, and then repeat using the final 4 characters of the new 5-character malicious chunk. (And do the same thing in reverse to find the beginning of the string) Once I had the full exploit, I decoded it and added some spaces + a variable before re-encoding to bypass the WAF.</li>\n<li>Secret Sloth: This problem took me a while, but eventually I had the insight that I could brute-force search over a dictionary in the hopes that the solution would be a single word. It was.</li>\n<li>Crop_2: :(</li>\n</ul>\n<p>All in all, this was a great competition! The challenges were engaging, and I'm grateful to have had the time available early on in the competition to solve so many of them. One thing I was amused by was the Easter eggs/\"true flags\" of sorts hidden in the flags. Each challenge's genChallengeFlag() method had a set of characters that remained fixed from flag to flag, and were usually an anagram of something related to the challenge. I wasn't able to figure all of them out, but for those interested, here's what I have so far:</p>\n<table>\n<thead>\n<tr>\n<th>Challenge ID</th>\n<th>Proto-flag characters</th>\n<th>My proto-flag hypothesis</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>math_1</td>\n<td>8T3I</td>\n<td>?</td>\n</tr>\n<tr>\n<td>math_2</td>\n<td>EITMACHATMA</td>\n<td>?</td>\n</tr>\n<tr>\n<td>math_3</td>\n<td>HOMR_IAPTTM</td>\n<td>?</td>\n</tr>\n<tr>\n<td>math_4</td>\n<td>EWPTIIRNMS</td>\n<td>?</td>\n</tr>\n<tr>\n<td>honorstudent</td>\n<td>SOOPATESHCFTL</td>\n<td>?</td>\n</tr>\n<tr>\n<td>bad_to_good</td>\n<td>wtphn_t_eabo_d</td>\n<td>dont_be_a_wtph ?</td>\n</tr>\n<tr>\n<td>baseball</td>\n<td>ERAJAOMGLEU</td>\n<td>?</td>\n</tr>\n<tr>\n<td>token</td>\n<td>3RTK330RN1YM0DZB3</td>\n<td>?</td>\n</tr>\n<tr>\n<td>waf</td>\n<td>RT0ZB0DLILEYN0RKAZY</td>\n<td>?</td>\n</tr>\n<tr>\n<td>theft</td>\n<td>RTCH1P?0N1LYNDD33P</td>\n<td>?</td>\n</tr>\n<tr>\n<td>salt</td>\n<td>334TTL&lt;RSLBGS14LGL1TT</td>\n<td>?</td>\n</tr>\n<tr>\n<td>crop1</td>\n<td>OnnTeghraTag</td>\n<td>?</td>\n</tr>\n<tr>\n<td>hotdog</td>\n<td>OOSHDRSYFOATDG</td>\n<td>HOTDOGFORDAYSS</td>\n</tr>\n<tr>\n<td>hotterdog</td>\n<td>OOTHDDDTHOHGGGOOOT</td>\n<td>HOTDOGHOTDOGHOTDOG</td>\n</tr>\n<tr>\n<td>deepfake</td>\n<td>? (server kept failing)</td>\n<td>?</td>\n</tr>\n<tr>\n<td>forensics</td>\n<td>0X53NRD1FC_S</td>\n<td>F0R3NS1C5_XD</td>\n</tr>\n<tr>\n<td>wifi</td>\n<td>NERDTU</td>\n<td>TURNED</td>\n</tr>\n<tr>\n<td>leakage</td>\n<td>as4rnoH&lt;c33&lt;0RN</td>\n<td>s4RaHc0Nnor&lt;3&lt;3</td>\n</tr>\n<tr>\n<td>sloth</td>\n<td>PCESALTR</td>\n<td>SPECTRAL</td>\n</tr>\n<tr>\n<td>murderbots</td>\n<td>beotautrsdtodWIeNM</td>\n<td>IWasNotMurdebotted</td>\n</tr>\n<tr>\n<td>inference</td>\n<td>30NDCF</td>\n<td>D3FC0N</td>\n</tr>\n<tr>\n<td>crop_2</td>\n<td>?</td>\n<td>?</td>\n</tr>\n</tbody>\n</table>",
      "rawMarkdown": "First of all, thanks to the organizers for putting on a wonderful competition! I had a ton of fun with this novel format, and found the fast puzzle-solving nature of it quite addicting. The weekend when this competition launched was a long and sleep-deprived one! Many other competitors have gone over their solutions, and I don't have much to add, but I will briefly cover my general strategic approach and the solutions I found for each of the problems. A particular shoutout to [Chris Deotte's notebook](https://www.kaggle.com/code/cdeotte/solutions-d3fc0n-ctf-lb-0-894), which is well written and solves all of the problems in a principled way. For those looking for the code to my solutions, it is rather messy, but can be found on GitHub: [https://github.com/IsaiahPressman/ai_village_ctf_30](https://github.com/IsaiahPressman/ai_village_ctf_30)\n\nGenerally, my strategy for this challenge was to delegate as much work as possible to an inelegant and/or brute-force solution in order to free up my time to work on the next problem. While this was not as intellectually satisfying as finding the proper method, it did allow me to move through the problems quite quickly. My solutions, in the order I solved them, are as follows:\n\n- Hotdog: Submitted a picture of a hotdog.\n- Math_1-4: Brute force starting at 100 and incrementing until the solution was found.\n- Honor Student: Used an image editor to draw an A, and then an online image compressor to avoid tampering detection.\n- Wifi: Visualized the data projected into 2 dimensions using a few different locally linear embedding algorithms from scikit-learn. Picked the one that looked the cleanest and projected the characters into 1 dimension, to find the flag.\n- Bad to Good: Manually tinkered with the inputs until it worked. Negative demerits ended up being the trick.\n- Baseball: Grid searched over a bunch of values to be the mean of two independent normal distributions, and then ordered by their returned confidence. Then just tried a bunch of normally distributed values around the highest confidence mean values from the previous step until one worked.\n- Inference: Handwrote every letter and digit and converted them into 32x32 grayscale images. Submitted these images to the server to see which character the model thought belonged where, and then brute force searched over the top 5 candidate characters for each position.\n- Leakage: Fed the username into the LSTM and it returned the password.\n- Forensics: Found the flag using model.summary()\n- Token: Opened the data in excel and saw a bunch of lines at the end with BLANK and SECRETKEY. Searched for any other occurrences of those words in the file, and found two lines with BLANK occurring twice, which were the solution.\n- Deepfake: Edited the video by replacing the video track with a still image of the boss.\n- Murderbots: Trained a basic logistic regression model, and submitted the 10 indices that the model ranked as most likely to be human.\n- Hotterdog/Theft/Salt: All of these required adversarial examples. Some of them (Salt/Theft) were easier since they gave you the model, while with Hotterdog I brute-force searched across a bunch of open-source models + adversarial attacks, and combined those results with a noisy overlay of an actual hotdog image.\n- Crop_1: Tricky problem, until I realized I could submit an image of a resolution other than 5x5. After that, I used a 3x3 grid of images that more or less matched X_comp so that it didn't matter where the model cropped.\n- WAF: This problem or sloth was the most exciting to finally solve. The trick for me was to reverse engineer the malicious string by submitting a fixed 4-character chunk and varying the final character until the WAF detector was triggered, and then repeat using the final 4 characters of the new 5-character malicious chunk. (And do the same thing in reverse to find the beginning of the string) Once I had the full exploit, I decoded it and added some spaces + a variable before re-encoding to bypass the WAF.\n- Secret Sloth: This problem took me a while, but eventually I had the insight that I could brute-force search over a dictionary in the hopes that the solution would be a single word. It was.\n- Crop_2: :(\n\nAll in all, this was a great competition! The challenges were engaging, and I'm grateful to have had the time available early on in the competition to solve so many of them. One thing I was amused by was the Easter eggs/\"true flags\" of sorts hidden in the flags. Each challenge's genChallengeFlag() method had a set of characters that remained fixed from flag to flag, and were usually an anagram of something related to the challenge. I wasn't able to figure all of them out, but for those interested, here's what I have so far:\n\n| Challenge ID | Proto-flag characters | My proto-flag hypothesis |\n| --- | --- | --- |\n| math_1 | 8T3I | ? |\n| math_2 | EITMACHATMA | ? |\n| math_3 | HOMR_IAPTTM | ? |\n| math_4 | EWPTIIRNMS | ? |\n| honorstudent | SOOPATESHCFTL | ? |\n| bad_to_good | wtphn_t_eabo_d | dont_be_a_wtph ? |\n| baseball | ERAJAOMGLEU | ? |\n| token | 3RTK330RN1YM0DZB3 | ? |\n| waf | RT0ZB0DLILEYN0RKAZY | ? |\n| theft | RTCH1P?0N1LYNDD33P | ? |\n| salt | 334TTL<RSLBGS14LGL1TT | ? |\n| crop1 | OnnTeghraTag | ? |\n| hotdog | OOSHDRSYFOATDG | HOTDOGFORDAYSS |\n| hotterdog | OOTHDDDTHOHGGGOOOT | HOTDOGHOTDOGHOTDOG |\n| deepfake | ? (server kept failing) | ? |\n| forensics | 0X53NRD1FC_S | F0R3NS1C5_XD |\n| wifi | NERDTU | TURNED |\n| leakage | as4rnoH<c33<0RN | s4RaHc0Nnor<3<3 |\n| sloth | PCESALTR | SPECTRAL |\n| murderbots | beotautrsdtodWIeNM | IWasNotMurdebotted |\n| inference | 30NDCF | D3FC0N |\n| crop_2 | ? | ? |",
      "votes": null
    },
    {
      "id": "1946138",
      "postDate": "09/19/2022 16:15:51",
      "content": "<p>Congratulations <a href=\"https://www.kaggle.com/pressman1\" target=\"_blank\">@pressman1</a> . Fantastic job solving all the puzzles so quickly. I like your solution for <code>Crop1</code>. Discovering that you can submit any size image and tiling/repeating the <code>X_comp</code> image was smart.</p>",
      "rawMarkdown": "Congratulations @pressman1 . Fantastic job solving all the puzzles so quickly. I like your solution for `Crop1`. Discovering that you can submit any size image and tiling/repeating the `X_comp` image was smart.",
      "votes": null
    },
    {
      "id": "1946304",
      "postDate": "09/19/2022 18:38:56",
      "content": "<p>Congratulations <a href=\"https://www.kaggle.com/pressman1\" target=\"_blank\">@pressman1</a>  . You were so fast in solvng the puzzles. I tried something similar to what you did for secret sloth but I tought about multi word flag with letters and numbers like those of forensics and leakage. <br>\nI feel that Crop1 was really easier once the 5x5x3 image size barrier was broken. </p>",
      "rawMarkdown": "Congratulations @pressman1  . You were so fast in solvng the puzzles. I tried something similar to what you did for secret sloth but I tought about multi word flag with letters and numbers like those of forensics and leakage. \nI feel that Crop1 was really easier once the 5x5x3 image size barrier was broken.",
      "votes": null
    }
  ],
  "comments": [
    {
      "id": 1946138,
      "author_name": "cdeotte",
      "author_url": "",
      "post_date": "09/19/2022 16:15:51",
      "content": "<p>Congratulations <a href=\"https://www.kaggle.com/pressman1\" target=\"_blank\">@pressman1</a> . Fantastic job solving all the puzzles so quickly. I like your solution for <code>Crop1</code>. Discovering that you can submit any size image and tiling/repeating the <code>X_comp</code> image was smart.</p>",
      "votes": null,
      "replies": []
    },
    {
      "id": 1946304,
      "author_name": "pietromaldini1",
      "author_url": "",
      "post_date": "09/19/2022 18:38:56",
      "content": "<p>Congratulations <a href=\"https://www.kaggle.com/pressman1\" target=\"_blank\">@pressman1</a>  . You were so fast in solvng the puzzles. I tried something similar to what you did for secret sloth but I tought about multi word flag with letters and numbers like those of forensics and leakage. <br>\nI feel that Crop1 was really easier once the 5x5x3 image size barrier was broken. </p>",
      "votes": null,
      "replies": []
    }
  ],
  "raw_markdown_by_id": {
    "1945093": "First of all, thanks to the organizers for putting on a wonderful competition! I had a ton of fun with this novel format, and found the fast puzzle-solving nature of it quite addicting. The weekend when this competition launched was a long and sleep-deprived one! Many other competitors have gone over their solutions, and I don't have much to add, but I will briefly cover my general strategic approach and the solutions I found for each of the problems. A particular shoutout to [Chris Deotte's notebook](https://www.kaggle.com/code/cdeotte/solutions-d3fc0n-ctf-lb-0-894), which is well written and solves all of the problems in a principled way. For those looking for the code to my solutions, it is rather messy, but can be found on GitHub: [https://github.com/IsaiahPressman/ai_village_ctf_30](https://github.com/IsaiahPressman/ai_village_ctf_30)\n\nGenerally, my strategy for this challenge was to delegate as much work as possible to an inelegant and/or brute-force solution in order to free up my time to work on the next problem. While this was not as intellectually satisfying as finding the proper method, it did allow me to move through the problems quite quickly. My solutions, in the order I solved them, are as follows:\n\n- Hotdog: Submitted a picture of a hotdog.\n- Math_1-4: Brute force starting at 100 and incrementing until the solution was found.\n- Honor Student: Used an image editor to draw an A, and then an online image compressor to avoid tampering detection.\n- Wifi: Visualized the data projected into 2 dimensions using a few different locally linear embedding algorithms from scikit-learn. Picked the one that looked the cleanest and projected the characters into 1 dimension, to find the flag.\n- Bad to Good: Manually tinkered with the inputs until it worked. Negative demerits ended up being the trick.\n- Baseball: Grid searched over a bunch of values to be the mean of two independent normal distributions, and then ordered by their returned confidence. Then just tried a bunch of normally distributed values around the highest confidence mean values from the previous step until one worked.\n- Inference: Handwrote every letter and digit and converted them into 32x32 grayscale images. Submitted these images to the server to see which character the model thought belonged where, and then brute force searched over the top 5 candidate characters for each position.\n- Leakage: Fed the username into the LSTM and it returned the password.\n- Forensics: Found the flag using model.summary()\n- Token: Opened the data in excel and saw a bunch of lines at the end with BLANK and SECRETKEY. Searched for any other occurrences of those words in the file, and found two lines with BLANK occurring twice, which were the solution.\n- Deepfake: Edited the video by replacing the video track with a still image of the boss.\n- Murderbots: Trained a basic logistic regression model, and submitted the 10 indices that the model ranked as most likely to be human.\n- Hotterdog/Theft/Salt: All of these required adversarial examples. Some of them (Salt/Theft) were easier since they gave you the model, while with Hotterdog I brute-force searched across a bunch of open-source models + adversarial attacks, and combined those results with a noisy overlay of an actual hotdog image.\n- Crop_1: Tricky problem, until I realized I could submit an image of a resolution other than 5x5. After that, I used a 3x3 grid of images that more or less matched X_comp so that it didn't matter where the model cropped.\n- WAF: This problem or sloth was the most exciting to finally solve. The trick for me was to reverse engineer the malicious string by submitting a fixed 4-character chunk and varying the final character until the WAF detector was triggered, and then repeat using the final 4 characters of the new 5-character malicious chunk. (And do the same thing in reverse to find the beginning of the string) Once I had the full exploit, I decoded it and added some spaces + a variable before re-encoding to bypass the WAF.\n- Secret Sloth: This problem took me a while, but eventually I had the insight that I could brute-force search over a dictionary in the hopes that the solution would be a single word. It was.\n- Crop_2: :(\n\nAll in all, this was a great competition! The challenges were engaging, and I'm grateful to have had the time available early on in the competition to solve so many of them. One thing I was amused by was the Easter eggs/\"true flags\" of sorts hidden in the flags. Each challenge's genChallengeFlag() method had a set of characters that remained fixed from flag to flag, and were usually an anagram of something related to the challenge. I wasn't able to figure all of them out, but for those interested, here's what I have so far:\n\n| Challenge ID | Proto-flag characters | My proto-flag hypothesis |\n| --- | --- | --- |\n| math_1 | 8T3I | ? |\n| math_2 | EITMACHATMA | ? |\n| math_3 | HOMR_IAPTTM | ? |\n| math_4 | EWPTIIRNMS | ? |\n| honorstudent | SOOPATESHCFTL | ? |\n| bad_to_good | wtphn_t_eabo_d | dont_be_a_wtph ? |\n| baseball | ERAJAOMGLEU | ? |\n| token | 3RTK330RN1YM0DZB3 | ? |\n| waf | RT0ZB0DLILEYN0RKAZY | ? |\n| theft | RTCH1P?0N1LYNDD33P | ? |\n| salt | 334TTL<RSLBGS14LGL1TT | ? |\n| crop1 | OnnTeghraTag | ? |\n| hotdog | OOSHDRSYFOATDG | HOTDOGFORDAYSS |\n| hotterdog | OOTHDDDTHOHGGGOOOT | HOTDOGHOTDOGHOTDOG |\n| deepfake | ? (server kept failing) | ? |\n| forensics | 0X53NRD1FC_S | F0R3NS1C5_XD |\n| wifi | NERDTU | TURNED |\n| leakage | as4rnoH<c33<0RN | s4RaHc0Nnor<3<3 |\n| sloth | PCESALTR | SPECTRAL |\n| murderbots | beotautrsdtodWIeNM | IWasNotMurdebotted |\n| inference | 30NDCF | D3FC0N |\n| crop_2 | ? | ? |",
    "1946138": "Congratulations @pressman1 . Fantastic job solving all the puzzles so quickly. I like your solution for `Crop1`. Discovering that you can submit any size image and tiling/repeating the `X_comp` image was smart.",
    "1946304": "Congratulations @pressman1  . You were so fast in solvng the puzzles. I tried something similar to what you did for secret sloth but I tought about multi word flag with letters and numbers like those of forensics and leakage. \nI feel that Crop1 was really easier once the 5x5x3 image size barrier was broken."
  },
  "source": "meta"
}