Labyrinth

The brief

Somewhere on this port a server is talking in a language no tool has ever heard of. It has no manual and no patience for strangers, but it does answer, and every answer tells you a little more. Listen closely, learn to speak its tongue, and find your way out of the labyrinth behind it. Not every door that glows is an exit.

In short

Labyrinth is a TLS service with its own binary protocol and no documentation. The lab learned the frame format from error messages, solved a reverse and XOR puzzle, walked a token guarded maze depth first and sent the gate its 17 move shortest route.

A server that teaches by error

The service speaks a binary protocol of its own over TLS. Every bad frame earns an error that names one rule. From them the lab pieced together the frame, 4 magic bytes, an opcode, a 2 byte length and a body.

Hello, nonce, probe

A HELLO frame returns an 8 byte nonce, and echoing it as a PROBE earns a puzzle. Opcode 0x40 hands out hiCTF{not_the_exit}, the glowing door the brief warns about, and the lab left it alone.

The puzzle shows its own answer

The puzzle carries a worked example. Under key 2e2e2e2e the word 01020304 becomes 2a2d2c2f, so the rule is to reverse the bytes, then XOR. The lab applied it to the challenge word, and the maze opened.

Every move carries the room's token

Each room reports its position, a 4 bit door mask and a 2 byte token. A move must carry the current token or the maze forgets you. The lab walked it depth first, carrying every new token and backing out of dead ends.

The shortest way out

The gate wants the shortest route. In a maze with no loops that is the walked path minus its backtracks, here 17 moves to a gate one wall from the entrance. The flag came back, and a fresh maze of 22 moves gave the same.

The insight

Each error message gave away one rule, and a maze with no loops has exactly one shortest route, the walk itself with the dead ends taken out.

The flag

hiCTF{l34rn3d_th3_t0ngu3_w4lk3d_th3_l4byr1nth_f54695c582}