Rating: 1.0

Follow the rabbit hole and get the flag.

Visiting one of the urls from the challenge will take us to http://167.71.246.232:8080/rabbit_hole.php?page=cE4g5bWZtYCuovEgYSO1 which displays the following information.

[513, '71'] 4O48APmBiNJhZBfTWMzD

The last string looks similar to the page parameter in the first url, so let’s try visiting that.

http://167.71.246.232:8080/rabbit_hole.php?page=4O48APmBiNJhZBfTWMzD
[803, 'A5'] dUfob5k9t2vH1dVEU9bU
http://167.71.246.232:8080/rabbit_hole.php?page=dUfob5k9t2vH1dVEU9bU
[371, '08'] EiFCRRS86AT19seqH1ls
and on and on...

So we can see we are given a number, a hex byte and a string to the next page. We can write some Go code to visit each page and capture the data. We will store the data in an array, storing each hex byte at the corresponding point in the array to the number before it. When you go far enough down the rabbit hole, you will arrive at a page that simply says “end,” so we will adjust our Go code to watch for this and stop at that point.

Go code at full write-up in link.

We pipe the output of the program into a file called rabbit.hex, and then we can use xxd to convert the hex back into its original binary form. We run file on that output and find out it’s a PNG file. We’ve got the flag!

Original writeup (https://xfava.tax/RabbitHole).