# Brainr0t

| Info     | Details          |
| -------- | ---------------- |
| Category | Web Exploitation |
| Points   | 50               |

## Challenge Overview

![](https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FDLXD3rfIWlLs66TPKxq9%2Foverview.png?alt=media\&token=7920789c-71cd-45ba-b2c2-1f587df2decf)

> From the very begginng I realized that "r0t" was a hint to rot13 or similar.\
> Viewing page source we see this suspicious line.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FFFAtDMuPjbdA8ljZcYVW%2Fpage%20source.png?alt=media&#x26;token=b003eceb-a0ca-4838-b3ff-ac4832d851ce" alt="" width="563"><figcaption><p>incognitoctf hint</p></figcaption></figure>

### Cookie manipulation

When we check if the site has any cookies, we find an "admin". As we put `"incognitoctf"` as the value and test it using BurpSuite, we get this response indicating **ROT26** in the title tags:

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2F9qfGvXSCXFxFwP1684Ei%2Fburp1.png?alt=media&#x26;token=aae81a49-975a-442d-9b42-e68868cb2e60" alt=""><figcaption><p>rot26</p></figcaption></figure>

If we try to ROT-bruteforce `"incognitoctf"` as the cookie value, we get various responses. After some trials, I found that the correct rotation was **ROT23**.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FinGLFrO8fdBNeBGebOL4%2Fburp2.png?alt=media&#x26;token=949326dc-7368-4a4c-98c8-6d0dc08a823b" alt=""><figcaption><p>rot23</p></figcaption></figure>

##

### 1. Analyze the .mp3

After downloading the `.mp3` file from the google drive link, I opened it in **Audacity**. Initially, I suspected a spectrogram-based message, but the real hint was in the audio itself.

However, the audio needed to be **slowed down**. I used the speed/pitch change settings to reduce speed. You can find them in **Effects -> Pitch and Tempo -> Change Pitch and Speed** <br>

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FtUp1NyuxDB7wNGjWC1FL%2Faudacirt1.png?alt=media&#x26;token=17e3c073-6008-448d-b49b-3b37b7ce7467" alt=""><figcaption><p>good settings</p></figcaption></figure>

> You have to apply these settings twice.

Now we can clearly hear the Indian guy say:

```
nkfqruxqeulq
```

### 2. ROT it

Since this is a rot-based challenge, we ROT14 the phrase and obtain:

```
bytefilesize
```

Which clearly points to the size of the `.mp3` file itself: **52712** bytes.

## Final Flag

```
ictf{52712}
```

*made by k0d*
