Capture the Flag — Christian Dirnhofer

TL;DR: Look for flags in the format drnhfr{...}. The command submit <flag> unlocks the next level. Have fun, the timer is already running! BTW, use this terminal if you can ;)

Where it comes from

Capture the flag started as an outdoor game in which two teams try to bring the other team’s flag back to their own base. In IT security it became a competition format. The best known competition has run at DEF CON in Las Vegas since 1996.

Most CTFs today use the jeopardy format. There is a list of challenges, sorted into categories such as web, cryptography, forensics or reverse engineering. Solving a challenge turns up a flag, a string in a fixed format, and that earns points. In the attack-defense format, every team runs the same vulnerable services instead, patches its own and attacks the others.

For beginners there are competitions like picoCTF, aimed at school and university students. CTFtime keeps an overview of running CTFs and the teams behind them.

How I got into it

It started with a former colleague, Mazzoo. An old Linux specialist, embedded engineer and maker in general. In one of our conversations we somehow ended up on CTFs.

It did not take long before we were playing a small unofficial CTF at the office after hours. It was great fun and less about Linux, more about .NET and web stuff you had to reverse engineer. Apart from Mazzoo, none of us back then really knew Linux. But that is when my Linux journey really got going.

I do not play CTFs actively, but I have worked my way through one or two of the wargames on OverTheWire. I will not become a reverse engineer who happily digs through assembly and enjoys Ghidra in this life. I do not need to be one to enjoy it, though.

At some point the idea came up to build one myself. Nothing big, but something for beginners with a minimal idea of how software works. And well, here we are, right in the middle of it. It has already started!

Tools

If you have never played a CTF, you need surprisingly little. A browser is enough for this game. For other CTFs these tools are a good start:

The browser’s developer tools (F12) and view source (Ctrl+U) show what a page really delivers, including what is not displayed.
base64 encodes text as base64 and decodes it again. This site’s terminal has the command too.
curl sends HTTP requests from the command line and also shows the response headers. This site’s terminal has a simple version of it.
strings and file tell you what is inside an unknown file, and cat prints its contents.
Wireshark opens recordings of network traffic and takes them apart packet by packet.
A hex editor shows the raw bytes of a file.
An ASCII table turns numbers into characters and back.

How this game works

Behind five doors are stories about things I built. Every door is encrypted, and the flag is the key. The first flag is somewhere on every page, every other one behind the door before it.

Flags look like drnhfr{...} and are entered in the terminal with submit. hint gives you a nudge in the right direction.

If you have never worked in a terminal, The terminal explains cat, curl and base64. To look up character codes there is the ASCII table.

Some things are staged, so you should use the drnhfr-sh (see below). You open it by clicking or with / or Ctrl + K.

Have fun!