Rating:
## [See original writeup on site](https://barelycompetent.dev/post/ctfs/2021-04-11-ritsecctf/#inception-ctf-dream-3)
### Inception CTF: Dream 3
> Note: This challenge builds on Inception CTF: Dream 2.
>
> While the first two steps were easy it’s all hard from here on out, ThePointMan is the most crucial role of the mission he has to be presentable but without giving away our intentions. Use Alternate Dream State to find the flag before the kick.
>
> Author: Brandon Martin
So, from level 2, we already know the password for the 7z for this level is `WaterUnderTheBridge`, so can now extract accordingly:
```bash
7z x TheHotel.7z
7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,32 CPUs AMD Ryzen 9 3950X 16-Core Processor (870F10),ASM,AES-NI)
Scanning the drive for archives:
1 file, 158376 bytes (155 KiB)
Extracting archive: TheHotel.7z
Enter password (will not be echoed): <enter "WaterUnderTheBridge">
--
Path = TheHotel.7z
Type = 7z
Physical Size = 158376
Headers Size = 264
Method = LZMA2:192k 7zAES
Solid = +
Blocks = 1
Everything is Ok
Files: 3
Size: 158141
Compressed: 158376
```
Which gives us:
```bash
rw-rw-r-- 1 ganondorf ganondorf 153 KiB Wed Feb 24 13:35:31 2021 SnowFortress.7z
rw-rw-r-- 1 ganondorf ganondorf 154 KiB Fri Apr 9 18:10:13 2021 TheHotel.7z
rw-rw-r-- 1 ganondorf ganondorf 1 KiB Wed Feb 24 13:25:31 2021 ThePointMan.txt
```
Which (**_groans_**) is the following garbage:
```
cat ThePointMan.txt
Q3JlYXRlIGEgbWF6ZSBpbiB0d28gbWludXRlcyB0aGF0IHRha2VzIG1lIG9uZSBtdW5pdGUgdG8gc29sdmUuIA==
59 6f 75 27 72 65 20 77 61 69 74 69 6e 67 20 66 6f 72 20 61 20 74 72 61 69 6e 2c 20 61 20 74 72 61 69 6e 20 74 68 61 74 20 77 69 6c 6c 20 74 61 6b 65 20 79 6f 75 20 66 61 72 20 61 77 61 79 2e 20 59 6f 75 20 6b 6e 6f 77 20 77 68 65 72 65 20 79 6f 75 20 68 6f 70 65 20 74 68 69 73 20 74 72 61 69 6e 20 77 69 6c 6c 20 74 61 6b 65 20 79 6f 75 2c 20 62 75 74 20 79 6f 75 20 63 61 6e 27 74 20 62 65 20 73 75 72 65 2e 20 62 75 74 20 69 74 20 64 6f 65 73 6e 27 74 20 6d 61 74 74 65 72 20 2d 20 62 65 63 61 75 73 65 20 77 65 27 6c 6c 20 62 65 20 74 6f 67 65 74 68 65 72 2e 20
|[email protected]@DH.GLBB@W .aDWILKB. BXOR 25
Gung znal qernzf jvguva qernzf vf gbb hafgnoyr!
--. ..- .-.
..-. .-. .-. --.-
--. ..- -. --.
.--- .-.
-.-. -.-- -. .- --. .-. --.-
...- .-
--. ..- ...- ..-.
--.. -. .- .----. ..-.
--.. ...- .- --.-
--.. -. .-..
.--. ..- -. .- - .-.
.-. .. .-. . .-.. --. ..- ...- .- - .-.-.-
No place for a tourist in this job.
```
So, in order of appearance:
* base64:
```bash
echo 'Q3JlYXRlIGEgbWF6ZSBpbiB0d28gbWludXRlcyB0aGF0IHRha2VzIG1lIG9uZSBtdW5pdGUgdG8gc29sdmUuIA==' | base64 -d
Create a maze in two minutes that takes me one munite to solve.
```
```
You're waiting for a train, a train that will take you far away. You know where you hope this train will take you, but you can't be sure. but it doesn't matter - because we'll be together.
```
* Base58?
* [ROT13](https://gchq.github.io/CyberChef/#recipe=ROT13(true,true,false,13)&input=R3VuZyB6bmFsIHFlcm56ZiBqdmd1dmEgcWVybnpmIHZmIGdiYiBoYWZnbm95ciEK)
```
That many dreams within dreams is too unstable!
```
```
THE SEED THAT WE PLANTED IN THIS MAN'S MIND MAY CHANGE EVERYTHING.
```
So nothing there. Though, I just noticed there is also an additional file that I missed from before, as the name of the file is a special character (`<200e>`, which is the "Left to Right mark"):
```
strings ./<200e>
You mean, a dream within a dream? NTIgNDkgNTQgNTMgNDUgNDMgN2IgNDYgNDAgMjEgMjEgNjkgNmUgNjcgNDUgNmMgNjUgNzYgNDAgNzQgNmYgNzIgN2Q=
```
Which then:
```bash
echo NTIgNDkgNTQgNTMgNDUgNDMgN2IgNDYgNDAgMjEgMjEgNjkgNmUgNjcgNDUgNmMgNjUgNzYgNDAgNzQgNmYgNzIgN2Q= | base64 -d
52 49 54 53 45 43 7b 46 40 21 21 69 6e 67 45 6c 65 76 40 74 6f 72 7d
```
Which then [decodes into](https://gchq.github.io/CyberChef/#recipe=From_Hex('Auto')&input=NTIgNDkgNTQgNTMgNDUgNDMgN2IgNDYgNDAgMjEgMjEgNjkgNmUgNjcgNDUgNmMgNjUgNzYgNDAgNzQgNmYgNzIgN2Q) `RITSEC{F@!!ingElev@tor}`.
Flag is `RITSEC{F@!!ingElev@tor}`.
