The 2023 “MAMMOTH mini-CTF” was a 10 challenge music themed CTF embedded in the .mp3 for our song “Debugged (the sound of an exploit)”. It ran from 2023-08-04 17:00 PDT to 2023-08-13 17:00 PDT, and has since wrapped — here’s a look back at the scoreboard, the challenge set, and how each one worked.
This mini-CTF is jeopardy style with 10 challenges. The challenges are puzzle based and generally involve music related themes — steganography and hiding/encoding data in various music/audio formats, a basic encryption challenge, a couple networking related challenges and even a challenge involving chatting with an AI over the phone to convince it to give up the key. No software or binary exploitation skills are required, but some challenges are significantly easier to solve with coding/scripting. Hello Universe, All Your Bass, Stego-saurus2, 8-bit Universe Escape, Mirrors, and MIDIcryption are still playable today from the files embedded in the contest .mp3; the rest (Universe Traveller, MIDI-TCP, MammothAI, and Note knocking) relied on a phone line and network servers that are no longer online.
Details and source can still be found here.
Final scoreboard
3 Players solved all the challenges!
Challenge set
Hello Universe (10 pts — 14 solves)
All Your Bass (25 pts — 12 solves)
Universe Traveller (50 pts — 3 solves)
Stego-saurus2 (150 pts — 4 solves)
MIDI-TCP (175 pts — 5 solves)
8-bit Universe Escape (200 pts — 5 solves)
The most ambitious build of the set: a fully playable custom NES ROM (mapper 30), run in an emulator, where the flag was hidden somewhere in a mini-game (inside a mini-CTF).
MammothAI (225 pts — 6 solves)
Mirrors (250 pts — 3 solves)
MIDIcryption (300 pts — 4 solves)
Note knocking (300 pts — 4 solves)
Midi over TCP as a “music authentication protocol”. Gotta send the right notes to authenticate and get the key!