How to get first blood without understanding the service. Take 2.

Same exploit as in SL Online Compiler from FAUST CTF 2019.

Step 1. Grab a random TCP stream.

Step 2. Test your submitter with it.

Step 3. First blood.

Thanks NARF! to get your flag ;).


This is the request with the flag. Can you spot it?

POST /api/check/?x5c9d-lg084-ha4ux-gd330 HTTP/1.1
Host: 10.61.222.3:17171
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Accept: */*
Accept-Encoding: identity
Content-Length: 20512
Content-Type: text/plain; charset=utf-8

H2NJJIY39314CV=SVEPU2NI42R86TXH73JRZ0R2GRP5JFHZTZNXU3VBH2L351R4XEF175Z91=5BF1LGR
RLMT8P3QI9TGPZ0KJYMOCAXSGVSYAC9WD=XX0F8252QVDZSESM9MQOMY5AEVISKQUJWT8F=LYBOTJG2F
66ETVDZZBIM04L7E6Y6HL76HC1GEV3DSS95CMINS1EQK5H=9KXGLONJO63WNJUKAJSB2EIGFL9JOMP5S
5197V=XF8H0H8HPM9X43HKVAZGMD3A2PHFHA8JKTDDF71H8QVZD2R5J=1XODSFPYI583V9LTMJVL6E2Q
SXATWMXXBXXXLUVTC7US38N9286QISGKXVTM5K4R1UBCWSRSB38866SF98BJVJP4I2U8X4=WZIWO672S
MS35Q637ISYME==KVWSTW6XVVT4MPV7CQXN83NKSMNXD=VT8AUBD=9U=KJQ5I4D5F76NWK6CWBY=1H8W
WGF70JGWIEHOJPBO7Q2Y5U=W9FXOJ9PHKCQ4=FPRT4SEW18RTH8CLPKGN3KLLQF8ST=QHV2ZZXRDRQBF
AW4KTF=K77LNHGW2YBCD72KDLMEDR0QSI6=MQ=FVM=LWHSYC0YBO4Y7CR4FFVRT53T6C3=VFX2RGP51C
0CMAAUFAH8MLJLO1JW2AQVMTAM5CEGWDIFKXX7PTCX3R=RV4G8PFB2D8E3O7WQQTP2QIMHDBON4M=EJP
TYOZZZY1Z3CTCHVWDKFT0QOEO6KOOGKD0XUC=KAU4CNW22VPG=H7YBYR=MT1LI38H9EPXJG2M3T6TVW1
DKI=7BQZBUZBZFTSWHLP0HL31FC25E=MU80KP=NEMSTQ=TM7AZMHKC4BIKAW1I1ULIEQ3XKHC8IAODCE
6ORCYA209QPR6DLCKL3BQOGCXUC2JT6HM0KYW73XF5MGEK6XWKSZW49OKMRLNCH6G7I=VUXXPM=JOG0K
FEX3UR4VU2FZF7JRPRT3HJ54P8M7KV6V34Q9AE8USL=RQE97IOGHLQNFES=OH19SGOIE3V43=3R7QTIZ
BDYVP67S07G0X0PIMZA3659BEIEBGBU445ZN5HPZ=N4Z2VGPVQ946JGQMMXRDEB3OGBFEC=ICL2SHL0D
0MGEFMXDBCNSM0MA7FXJE4Q6YOKIL52C=HG9E4P27HQIRE36N89AB1427VVA8SL54J51OURDSQ71TJ5K
7QLWAA31P2373FUH5Z7AETMGXEMZ8XUUK7QIPVOQ5A12MR6VDONWZC=0OKLRHY6HLDS2USELOFXC0IWK
02Q225=FK10LYY5ZWBIN2G2J95NG32S=SVCJ3ZU0YRW3CD54JXNP=QWLK30DSJT8KE3UJQ3XDQ4EIDUN
Q37ED77HRK3G32URKKPMDGHUZR20=UP8482RAH25U5I7JLNQVZVFXSU2MAVTGV6U88UTFWDNUUJ71KE6
1T5L3N7N068ZVU5J9WDOM35UAZXWT=XO2O8WLGCO713F5Q3NX1JC06J9R2PCVGYSM4RYMBA93KM9LJ85
VOWPP6YDB6B=AP6L1CXB2XP2GB=4HIK0YXW8FZLPIV1RU2FVGOBBJ=V6QFNQCFJ317C=8X5VX7KQXFDK
Y5=4JNQNGU9X5HZ2KAFM22UTN5TU4GG8XQS006IEB5RDHR5BFS03BYT3CAXLRX=S6R9F=81NGGATXHU3
IUULUUYWTWVGVM02ZYIQPHEKL9071UZVW13JXMS=OEGFQT28S4QM2M5FYY=S8QGX2WZO7Q05BN6IT4IC
YE6B08HUM=ABI=AFRYNPR3GEW3RRNVJE7XBY9FQQNUTN7YYGTXCOPM4S10UJMC=6SO7T60D3FZG3LWOT
ITTRPLY8WR51HHQ55CSEY61CM=M7IQK1UI38S0OZNZ8Q0JTVIAZ3VHCPXK4YPKGV6EWJ0DIFG1RFNK7P
8V5HYEB5EAYBEMCYHAELUJH4D0A7HVDUWI51K8QUP6Q7UX05ALNOI0PUQJKHP7VUG1NFWYS=J1COYA7O
CTSE2A=9IPDYY8WSZ4YQK2=7550TLDJIQSZNSQUD74J2=CE044GHAFYXOIGYY9XVJFZQ10DXZGE3E2=M
PD2BLDBW7ML3GFS4K30MIHQTS2EDT79XE17Z0Z2S1U4WEVE1WESITX3C=96LHERN54WJ0LKK455NY5S0
6UF1WUTG26CLPDH63PQ08=A6K=L3QZGJ5OCXVUHSTYAO1L7QL9L5=IQBN2QQ=LYU=WPBKZWFSM1WPDUC
QYA82ODF=64WVBQAZBRNSVZ82P8IUU=PP=2KUP6CRFA7JF8H771CNYLT8KYFUXN96DZQEL30TEUOMJ3H
FCUGYMHES6D48L7EETG3XW89CRBZOLMZG=TVEJ4R7N8RJ6RML45HYPRAL5=7U4984L4H0O8HOJZM69BC
R5TI4NUV58IQEYOX1JRT3GSXZ5C31OIA87K7JRMBOIPRMLB3EKFM3C61ZOBVHOGHVOGVHEZ5OWPTIP1Z
VJPOJPLN7VK92CRUSEOT6E6MIHCEFXYAC90AHD=2VWT8C8Q2=LN8OLJ6YF0JKSZ9UJONPUI4JYP08IP1
8YAKS5OQXGB=D891CO74PG9PGCF5NAK7VZVNIM3790JYM6QTG77IJRR3BQKOO33EMA2EGYFL7F46SDH5
YG7W29LF96SEZ1JJDQ0X39I1YHMFVQBIQTHUYJLXVVF1HREDRFS991V8U4Q97JJ88F0OP9QV47959=EU
0FUMB5QYKPZPU7E8LJFV3XQL8Q=1OYWK06R6SIAR7B8G94DGMDN2P5JC7Z0WHKRG2NA40L9N4CS4X5QZ
6ZZ4WZLFZISUSBRTYC7YZT06VM=IWLLW4CM4JJW8HFIP48PSDUV0VKDLTMBLGD119CMUW479MMVOBCY=
1I=X7MNPTO7149VUSN4MMVOYXKRYS5Z2WE6QYO9UOKRO26F89YH9WA12CKBF54HG2NWVQFMW25CUQ9CE
QDM3IT19B7N9CPKHP3AM6EHHSVL5TA61FV6EW4BBG5V2R598DA70KZXY490GJBJXR128DZXFV431EBXW
XF6XJCD8V4PO2OIYZ3VK=A11BYAEP2ZNOQG7LIS1QL5366RAFK3DHP2EH9VMS4HO8673T8Y00TOI0LJN
=469HQH055SWM3O1TT6G=TZ6SDCKT1AJ5GRKE7YTI5QX0WR73PLM=LIZUFZ0=ASV5AHI1POCNWGFG3V3
NHCT2CCPKN4MAVYHTP9=FUN0X1MXDQW18B8FB8DJSDX7H1IU895PV1VSY0MOBII6UGSQZFWQT6P5DSDL
MP6=X52GI72OF48U4LY7GR6Q51WJA9C0CPWLUFBP80EJHDIJY9UQIF309BCVZSG59XSULHVILO3UAV3D
1TWBAJBMSAMT6B=88KN455HJNWUM5NWG2QGUOTOGRQZY361HSDFVOKFIP8XPZ02C7JZRFAPB=4EXW50M
AE4CE9UBCJ5=EJMRBFMNYIN8BZKQZ6ITFZLIET0WTTJE5P38M9PWLZ64O60WHCBSWNQ7AV19QV3LL7MR
PX=CC5GF1A0FF=NICWZRY87VQ9CAYB6CIB630=AN428KXEPAVP7=GRZO5S6MTCL9NSIBRUEU2PL0RIPF
MKZKEW1QHI85M1BHPFQWGNJ7BD3XQ0C31GQK8=GEWU89UTG4END0FFHU79AUMMZU25S6JI2Z3I=K32MR
TNEYK5BSDL5ZVVV5RARD35WW08CO240N54ESRNI2RK14C1=QIW3T5BWV3FM22VFHXGDX9CFEA7UF8MFR
GNLUMNTSOICS65TE2TTE7YPP73M=MR3IJF78PVK0O2GHGTVELRK=YSFTKXS3R9LVONF4BLWAUR7J2A=8
7LNHY0KM3BJS1QD9VPUQ0LETD8VKKY=OAL1X65D8LGAZ84EECE8TYHLXTBLSGOYZA=VOHBTOFPNQQERR
JJOZ5RC36ZGVW2QAV4AXRSIKEOB0CEH4NTUZZHU5SN4=1F3NCPL4C76PDO6QMPFQFSZ9XQ6EHSI94BBB
NBX3GXYVVGCDFFRV4D9EOOV1TSNPHWUZXN9ALFRKZNBAKAIMCZO8ZQ1JEZBCQFGGZHWIDJI0QK6B3Z6V
4OI1YEHAHKMVMK6UQ9UHS4=MN5DJR170VVG1QKE3ISZAV4MI64BPXIOM9=X5OVF2YJHX0OLEAOEL227C
AA2M6FRXG3WQKG4DSTIM1ZYGMM3LS1HPFZDDE042K1XCPOR0KELQUOWOGY=UHUS5S=8XR750A9XZYBIB
PWZNQ2FVLAZI57S636OA1VIH2R07QFTPSB5NQT0BCF5MV2PAJOKRLOGTW35FD9QP0CADO=HLEKGQA2LH
TVZZKZ5HT1Z7V2C1ZQG0O7SKDPWQ7D6IH0N04SG40Z2XP0WSOR=ES=2AH3SNXFJCRWXJ65ZOEXAVPSCM
CBU61LG0X6331VKJ04F=I8T9QU7J24JWFAYUUZ=VKJ=U119RHC10S0GH7WB39H0URY=6VP7KTFC5A1JP
4QVQTSK69Z78C90K2YYW9Y5GVW939EKG9QW7AKHN7Y8U8BV153=VPXD6UAUN6OZSNQE5ZDPI287=3I9=
1=4DHH4=B63708HG500507A1RUG9QX3S9QXEHXY3D2UNX92E18CQWH4G6GUJU3NVJTNUISBWT5GN5N5N
D1U3ISVJIDXI9Q7GW7G4MY3PQ7I8MU6U5E=2L3L3QQ0LNH7LX7RR3ADZYVGNURU0NICTH4OA=3G3WEKR
WIDBK7EQJEFHHAWASR460G65WOL0DL5N74YCKV5QSNRTF1P7I118A17HXZACF44SCQW9WV5B512WSHF8
I29MQHSP0D8R2X7HYUY21BIWEVR4H6G61KBXI0D3G0L==IT4VE6C83XSV40ENLMQDDIEZP9QCHOT2RLL
7BJNMA4SCAJ7LQKK=YZJH1A6EVED042T0ZLAJM6NY6GC7LZ325LBE1TG8I9X=8QXS=GIUH107NMCFQ0G
5Q0U6WYR81SR3F3LH=SFRJ76BTM9Q0A0YHC8XGJ9T87D92URR9HJ1OUATJD1UCIMK=9Q1MJW1DHWZFVA
WIQ=TXD=RO5=60U9SVQZWH1U1Z=DIUKWOHA1S4AK=BLO=9IYS=Y808KOS2HSQD37CSSL8E9KE39473MB
4VNSSVBIXQG9E3==GWCL1NCNLTSS7B86F8T4AKA9TAFY3QCZMUNVUEX38NB6YNPDINTQHNEGAB4W2901
SYGHQU8SM5VVJBFIBVS60RHGD2I6CJCSTWF6NO3MXZVJPFNYZLQQ7JRJQG787USGBFKB3JM0IPY4MRA8
3TS7BM2V8WS535LUGJTYMP7MP6R70L3N7OYNX3A009UA0LJWY68UAB3HAN4W0K=7NV=ETWZHV46LJY16
SKPGUZ0YF2MNH77V9Y=9PNVSWHFB05DB1QYCWBQR0=OQP9NQXQ60E5OSVEBVCGGQZGZYKWA21HHF5O1R
GMWX=FW826NVUGRZCG8KNU0G2NCX=8Q5CZE9QTDTMB1UUC9JG1HTTIMLI1FQUOJ519O17TP4XTB6IEWI
Y7H09=NP54ZZZGN0TZQ8DIJP2975A3MNJGA1EA1V39ZT1GPAORRS380K070WO5=ZX19IOXFSJ1H6WRTV
RJJ7XQ1L42OED0JKC97MYIZQ4MDF8KKV6SDBEWXVL=PD==7H2F58JA7JMHM0HBA9VUYBMVFW9PG94FYN
LHHXVT06TDYBWVEX9TKNVOQSBGI=DH74W3IBRG2TAX5KJ9971BWBG=U5O7NMWD51O6PK4MK9CZE9TANM
J=7MNMTBDHCWTKTCE5HWELFCYDGIQI07OJ4AV626WFHZBTF3V5KJ6P8TURCVJ969VRQNURZ1F313HUHA
JOHDIBMNITEOT12QMPOCLRO5H6=G=ICUX0CF8M8I2WJUW==C7JEMGZRAYUPVPSZ08A76L0B2IHFRLF5C
CPEC59V=L60OK90RKWJ9=KEIL0PW3FDNY2ED5T8RXSBCG0LCZI3KYVDJELSZ8AL7UUY77N84OEWRQ1MU
VGTR3F118WHSGJRRYUME3BFB9H94OMG7T45UHT=IGCS1WQRUVXCFA7MI=QOXGHS=Z0HNA8USV6TX7=03
449GXZ0WIF5DCZZPUWBAG28K805003UO0SEAJ61T2GR3FZ8X2HNJMA9WMJP98GDL0=2YQPH8DS5Y4EE0
HH75LHYOQHN2NDEZIOZS73SYVPFMS1YQMTU8PU=14QGDRE5QFMHQX=ELPHTU841OJLMFE60CPSYHOFH7
0SJCW=RCWD=3HAGPY8WH6LXG5FN5R0GJ72IL1DQ0MNNH2=I14E9P=6CWPWJP7U2CQBURO33DGFBYYVR2
WE7ME7EY6MHOSR5WQQTUT8EJ6CL7UA8JHLS171IPVBW2GA1AZ9PRD1DI4SAR7U3USUN=2ANHJ6F=8SIA
16=4CP4ROPB8RR3KNSEWIT8KVZSNMMRPJH=01QCP50PHAIT34S7KWC33CMXZ=2C2UFYKXDPQ6T2J6RF3
4BB8R=AJ=72C8QK4IYQ4429EC22MK2ODDTLVOEUE49BDM6RJVTXI3ENA93IZNMRSHU54VW30MACH059G
JNKPT6IAZ67N8WVJP1W2JK9YSNDLX63APLU2MUXBMXXGKO1M1Z7XIDC10XNTRLQ1QG6286ROD0J4VS=P
BB79NG936TPAMVQB8P4RZ0IRC4LQTP=X6MHQUX1RI9ANB817RQ7HNYHEOW=AELJVIKNZK2X8ONYMDX5F
H5O19O704K1503O6S93U=06OKEXMJGBT07KK5ZEYVQDULC2MALBLQMW6NBMPFN768GDAJ3QOZEZATT5S
TSLN20=OLC6XXMT40I4RLBKTOOYYX31E1ESGOU=0DQQQSDVC782R4G3VE0YQ8KXN6=BXH788CJERCD87
YD3YH1Z1=HNRG800YR0SDMOUUHZ7L=G4WYODA=0JGE4XGNGK8Y=60KHJQW4TE2RTY8RPTNLJU3X69CZT
5NYR3O18K1TX1A5H2Y7BOUW2HOZRNLOLGN1QV5NZSOCWTAGBJ=ZG338I6OA=RZRZPVJ4UZXA6A3D5297
B3GYQD2ZVRF5MCIHQV54FY4POVOTV9CKYHAKNQX1X930H383D77UH2RZQRWF8D9GXJIJP0GT=I7AVNID
32H6YKMWA8AAWXV9H26PFGFK7UZHUFWQ88O82X7AUPQ2HVGS4T16CHF6T62H=KMQSSYW54YB46CZDT=A
UGUCFB9EA5CYY2NUO7UP99HIPO1H2IB9A7HMGL3UKXV7K53M6=CS0=3CHI2MZ0J039JU4R4F2M1FJS4L
BOHH064WLLA3IX7IEF78XE4ZMTH=GM6S92VNAX0TDLE9VJXEVAO1=7VSYL5OP857WDL3KQTQS4C=7C48
5KMSGEYYEF9NNHB1AJH96PQ3QRINBNS9HBZUMDIZ41R3XD3A7IHIB4OJIE7WRBZMC5FRM96FIIN1RBJH
IQGL8O8LBH63Z0GU=M67YIQDZGN09SBISQS8TCUN5N2XO3ZP=FSIUK1N4KH=NPNT20M68Z1287C15=DT
V2QUC0GU99VVFC2WCHVPRMBO3RMR7QKLB1WVWNXB8LSXRWNMI7MB62RZH044ASHK6FVA2SVAVRZ9DNOG
YGI3NGPU13R7EIUHZ4JPE6YJEC4ZD556A72PP=G6JDXVA25UUFKH91=REJFOX488072HDZEAQZP3CSHN
SOMIYHD8UGAG5BUU7R93UU25D1Z06VAVSEI0HB0YN=XFP3AZ1V6QFQUGGAD1KT35T3V3XWC7AAZ0LFEC
6MCI95NPBW=21E84HCDC5RHRJR0AIQSHSGWWDTEU=NFX=70FW98S5YYK5XIHBWF2X42QUHUOE4R=66AG
CUN26QN=8RX54X=2ZL1=F25LVYJU1Z22IJ5ZLMFALZOQH2CCA7638TCIVXPTFVYTUD=XRKF=JC69ZKY2
UX1HZ6O0W4Q64KD0T1Z9OYI9Q52=MK4A65VJFRG5CFA=F312A7ZCZAA0B0BL9WH0NLPBG7NTFI3WDXEH
MORE3VNGWD5P8AJ8NGR10QUDURNHDYCGD4WIT9VBT=KTINOVAT1YV4FMLD675QDIW2KPQ5VGXXP4G563
=9HGR4G7MI3=MDR7GHY0Y=WTBKL=782W45Q082JY9URWC2K79IQL5OWOP6YYLN8UX=GUMZ6HTJU93GCD
HK3WDW0P6ALA2W1TOKVDRCOOR109Q7QV3IAMIEPDYI=R=TI7GX4SSQMK44US0FC4BGA49G09JAEI=Z47
0C9R4OPLTHYLZL3RGOMDICGQFFTMXJUF6LKERWW34=VPDI=3F1GQKTX=ZNEXH0IQCHE7FUNXUYFUZOVE
H3ZTQFJ3JYY=7SFX26KMA6JXKYTE==55TDNY4AJLR8H2K04C4IVVL3N1DSKQKL76F3PROZ6OQQ4Y2ZA=
7ZF3GX47XISC9AKFS3=FWJY2FC3V8VUS3WXXIVNT5WZ001GQG9=IYCAB6YJUZ8M3MNXL0PNVTM3N2DG4
YCC1ZHH56VSSD0VWJGCVCRZBBW0CIQR36E6OGAFAUE8UMS1822VXR25H=4583VZ13DLQH8UHSSBQ5O9G
1SQ9Z78ZF4LSAX4EGO2UGPT2R6GJQRAQAACV3WHQLPX2U8BHFPAVZ5L9RD2VEUDBDV1939RB45GJ63J8
RJWE38PNTNC7SJZB2QPHXVG=C56TRGM8STOG06JT0ICTJPIT8B1P3EY6CSRGPNB5TXGAVNS437TR05OH
FSRO21BHY8U03KN31732KP8=STZL=CV7E9085U6V88Z5YV4ENJQNIR7Y7WEBCYHYG81W00GBAG=8XPGA
CCZ9ZGVZZQS9NS5RYRBWG=HE=5=G=2TONQJ7W95WD6GLHQ6FPKPBI35M7KV=FISQ6D7IJDCTRG=7G=UT
RTK5DX5F2TO05LLTC93HZMO97=EGKV=JKW8ALHE7SX12R3WFO2JNQC1HJUPB9LPCVV2MU8YJOAV7D=SR
KMSM6V5YTZYIP4HD=IKN31K5BM6JDKZCTQ58R0YJFFZCD7R7A09=J47L78Y7XSPOFZLQBSB80CVD737Z
Z1T84HOSO3V1HCTL79XQK01G1EK0M1141207RQOZTE08SNPMG99UD1TNPR49RH93HWCTD8AP8PWN3TYD
8LCHMBBTY3JV=TAF05BM3PLE9V719UXYTZB090LP229ETH1WCYNJNF5Y=CT3VMSY5FBW08JDYSIKL97U
UWMMA760EHHVO8COJK3V6Q9CEANUV37YCZRWO1S9Z6PEG0G37QI=2SUYUT266JX=CFVOP6O7B0ADWM3E
5JC853EXSVSY2XHAAP4J7LB8L5P5J699TWOKY3O0305AMGJ18AD33BAIVJHEOGQCI84QH7FY9GPVBHGU
VT4RT931N=PP8=6T=RAGPL=FWTHQVB5RIRTVD3CEMCCPKPE1K3H9OGLLNW7NXI5=ELCGRO7ZMPAH8LQC
CXH=1PI4CA1E63UMU398FO7=FEPBJAEFS04RQ73=BB027Y3LC07WFDRT0BPMVEZICZ2HRAMKSNWKBLI9
TJ5QGSDV2FWVV5MG2Q=B5N50A10I69S2LLL3S9J110JKHRTFDW3W9OCREJCXFE2B4WK1CGUNDM4E3OOB
HMBQNX236FHTJF99BQ1Z=CFRIGXOX766GYS84YP92TWN0FATC1I4P6TBMJDHKV6=EKI=LW5=IRQIVQX6
RHYXVUKUUKQ2838Q8H3SYHTRE5QTBQEMQN3UFWTQA7G121PAXSY74MZHIJKX=2WC2MDBYQO5LTZPD=T4
47DH=BYWT8MN8VW80ILGST1Q9ERNVJ6XS1F=GHHITY3DA=F7YFBCOH7LJKHQPO=ES2X7TOGB=ER7584A
46BI49=73LXPG=A8MVQCHLNE7FRJDG5X3VSHSUI4ODPWVUEG5FHQNLLNJY75OHXVE8JUOL0NXJWGFH0J
3ODDK=TTMSR98BC2S6YSTKBUERWGHXM67BI73HY8NS5416AKYYPW49BBFALCNCL7Y7V2FGUDNESU5XAW
UECR9PO0VEXK7VE94LISKAZMM0QMF90XIX79B100SFKNIQCWOXKQ32IES31=H=XFIAJZ1I69ZGKIC3UM
KC6=Z22KUPFPWPFYCGL12R5TPXAY7C4FHZUO0PAO26EZ2ZS5DAPN=MJJEATBQBR46GK5NT9RZTANPWMW
JB59NCHF0SLG1MH8DIP1HTV06NKVE6E22P3TLU8MK6CL=Q3BWK=IDCWPCC0B0JI26XK=S09MQMDADTD7
RDA9HHMXR0GNE85VDJ25LQL7OHFBAXNH5F4950W2J3SRCTIGIZ6Y5FOXLZEBA4BN8H28H13F9KBOHJID
YF83DOISFQDF9GWTC44EQFSVWHD0U7XE95JWD7AJVBASX=C0109V4T9GFIMJCPMZD0BK2A9F5MHPMEU1
FF1RTCNZYUFKB2GL=7A16M51NWPMA58D476ALCC0KSTNZJS44S1AHR9KN=S5KTDVI5DZJV641J6Q6P32
JCH21D35SDGFW=3KL1R4WWM3CL0XS1XI43J0JQDM=AA3Q22BWHHLRFGK6PAV9BFBPKSHTZET=B8POFA8
SI936CBFTFCOMSKP6VEJJQ1EE6CN9JO3XIMN5AAX8K=E6J31YOK0JX7XCWWGBD53ZR3R3VNWSGQPLUJP
VWXTB3Q963WZEY9PPNYD=R=TZ8TYQKPDOF0YB4EBKHSH6L6HOVM8MSK7J2Q72TG0TCG4HTBETVKF2VNA
ZIT5UXC5SL4C3KE7X1OY4V0I226DEDV4W61YK24R01LV00B7VLMU=JE3YRRNYR1ZWL=ZHSFHJB055J5=
0QHYU6GKNDC1SH6A9DK3QKE00WU=8135XZ1E1G5SYZN4PDCSTC3XMUPIBF59J6SFH27YAQLJ135827XZ
5DO48QPYOCJHRL0JFLN=QSBBBQD=13JQGA6R81GEXT4M341YKBMXZ15UY5QE7QJBZXQIXVNPJTZB2FAJ
FGL5WDEFCXFFRGP35H1SN=CE9T519ARTV284AV7NS7J4R489N5R=BRM8WHDSQWT14KWFGUQU9JCW15MK
D6CJD712HZ3D3J86L88UD60U0Y6D9GSPNL3PJRWKN=N70BTU1LNFOQ7CO2LFEU5482ZR918K3Y4FKR23
2URY0021Y6A=YQSWPXGKHHUI15G6O2OTU8M470FLVG0X8L=BMRDIC14MNVNRIFD93L=VP=IAAOYCQEFC
TNDFCO8PH6QFXE5Z9FQVP55S8CSA7YSZQWCVJ60OPA5IXY=A6VYK1E97BXKNA0ZQ4QPYQTRETUNJU5UC
SSQS1UQPEHKTFFDPATPBAY1A0W1ZZCBWXBRBPO=4CO9YMLYECS1HKMZSH1X1SBSSFB8LL5XJN68ELZT7
MTRPX6NNMVU5XM43LAIRMIS51S10QJHP9RIZZSYFA3STNUCZSXEG=57V6HMWC4VY5XVFE2WKA6VLGGFK
XAA7BBMNPA1GRZQKU24PCGNI1M3BYXU2R65N79VBBH9IK754PYEQ3V4YZV8NDNC83SQI9RH8R1BH6C4E
N2DWMFB=K8J954WQ9SE23PB8X=NJEVP26187SLNGHOABT9RBGOWN6NBZCI0GLDMSAP9WHZKTK=5DPXHS
VVK2RD6S6D6CTI4262WNDXWMEFTEIP5Y550O=U8Q76XZQ5=RJ1DSFLR9O99W6NEW2TQGPE2FCCBV9AXC
D7YC0HLPHSL=IKFX=9CD2PCV40ZECC4RYYFFCFT7A1WWLW9VRW2W600ODVW2YHOBQ=BLFEEBNUXHEUPL
M2ICQN69ZRQULIS6JDPEHWDZX6G25HNNX52MNTM1313ODZ2BMS=5Z2Q8HLSKJWVYT1VVS7V13G6PDVM6
H6UR9N3BAIFLF2NWBZYJ125SX2VY1KFOQ7TIOGH7H4JNJW=EIC7STTTKEH079FL7NRIW0MCAH4OH19TP
1=675JGTC0HBVEOKGRK4M00H44052WMSIWU63LEQ4=K3UG0IT09HSHZBRTU02NNG3VJBML6ZFLSLG7X=
E9V2O6J8QOPXVC1ZFKZAOKNKE0ZMYEMK08=B99NFOIHQ1K13DRFHGJMW8=JZBGMRTBA=MTPZW19XO3LS
74XQ2SP1LJWFJ0XHG41UDRFYXL1CZ5N3I3UO43SLKAK82FY0506US7VY9VY13N4IET2=O2=HZOP9QRDF
TGA9QKA92L8GIR19CFFGOGXMTQWRGNCCH=F=ZX5H10NQQMUUE5GHWYIVS42HQ50PNIVMTUNOPEO605BG
VRZSMP5XBYJ4Y1SZ64=KWHD15XQ59FN421KACYDTC=GA4PNMVJAVO61JRTSCN=698=UKIFRBAZN3HH3F
0EE6J71OBG0NE6JLEJFQBQLBSSENKDAS24SW7D4ZRB9TIS=ESQV3HGBNSB4YKBUGVXUN=FZGRXXKDBBV
9HP3ZQGJDZKYBMWHV46S8=XGRGW49SOUABYNETSN90CTT6B1FIQX6WDIL8RIDJA6D=4JT4753YMJBJUK
CA23W564IKBORWGWMXJC65WDTBY6E9=08ZZZ=UJ=011SIPUYIGGK8I1IV8FBXKLQXI2W0CVOW=RLA1WV
NW46FD6IXZODTJ56OI=88NOEHEX7QCKWYMK55OHE4VY248GCF2SX5M5TIMAKL=JS=FWOY56VIUU1TYH4
96VVWBZ2RR7GHIWG8R3P8HVPUZY8L7TWRHBZX0WNQ=5USOMPDMI4GS67Y5JLEHLZ45XFNYOXLYHL1CN3
L7TNM6EWZO029QTWCU06O91GSNUPHI4MQ24Y9K2I2LM50966FQ=1GXJDG=4M2GBYRH3SXA5YFKO3E54U
M5L547TQ94VX2FHRM166NHSM37ETS3A62=WYE401DS=TAN2UL=A7XZ6319=OKTTUNUFVC52JJKHDMQMV
RN215LCLC9XLGHWIW=4=8EU49JMYNF5BPMDD1FGS3Z59JXT0ZGIMS3G43O6=439EPQ3B8BCBK47IS8I7
YNWVTFTMG59LJKUOUPQDH5GSKGXB7U=DX2HX8ASU8HFCPYR071WCS96FDUKZ4H2FCSX6839CR67=29MM
BWNHYLYV62X=QLT6MC263S6X62CCVR6HV0QMQQ18CXE07=VA1JB=9Y0CO9Y1ROO4EX0EUAITHQG5WPSQ
AZU36EP77DNSE614S=DJ629CL3ZIF6PRV1043X0Y0SDK2=FFK1BDO6ZDATKWJMSA1L92WQWPNS95TZLN
3ARFMKKYJINBOM7RZAJF545GKQRZ18PQF7HVA0WQKUJT0JTIE7CCY7WZD8=9NQOU7R=NTYMFZQOI17N1
Y5P24KOVP9A8Q9TWBT04PH8M6MET=TND9K50HNXNFD927ZVHERTFDK1=6GN1YT7CT6DVPAR8TONEG1ZE
KBNP4TZLV59034H=WG6V45FYZAUEAI83C9YHLHD=DRKMSDSWI8YF2EE0I=M3BEQ6USVJHJ4AC4EBKOXT
AGEC0GZHROKP4RD=55OZU7YIE3EBN=NE4EGQK0C2WI9Q6T61C93AT6NHIB65A47UYSAW=JEL5E2ZL88K
PYRLNS3NKAM2KGBHV2LRSWV6T4K=TE83LDD1QSHFBT9WDZNTPX6T15CT6T5QWC1=XOXSSOJ=ZZI86RW6
DXOCYNDY1IL02A5FYOISRMSTL4AGFTI2NS9=D7S3OVKOICW1SB09TP35VEKN1RDVB2Y0NEGIOCP76B6B
XR5HHOYYS3EJI7JOOU7T1RHFMRIT08D6UMOZJFO5VUQQMG3MBQWLGO83KTK=AJZOT6C48XG4RLFBSAPA
8EQ5DEO6=J3PREOLVU3SS5Y2FPWW6FR4=EDFMJN5YWW4OMZB8IVGEFPEF7F7PXEJRSWB366M=V1WCTH6
SETQ7AQZMG4DG6ID4YFHTQ6EDKQKYJBH3E71=DY4N8SGR6FDJ2YPAN6B062M6Y2R2H6GO0LI0OH3JHLR
2XILSLH52RVQBZ=HC38HCPD2BUW1PUY8YL3MGBC=ON10EH18XADT0D9VIRFC1UA6M6D2F18HP=GVKE7S
77IP2L41BQ3QUVI5UULULSXD10O92JU4X53DKI9D7YB4LL403ZOAY914FKKTPKSUWP62QMS2F661TAZJ
ZPBVVM0WWT6C9UVRHY2ZS5SAK6PZTMMIA56B5ZO3B15QLRKGKGM6QSNV0LL81OCYO8Q4P7GZ0LNLSVDC
DEUOSJT6S8ZRO4BTVJDA9M6VKMJ7MXMA0UQ1P6C26GJ7LQKND55MHQ76ATUD6UB2MTAVEQ4RC=L=Y04T
I8K4OPJFW6XT=F5BP8AA=J4S9RAXMA1BGE=SDCKC5I7YHN6E094YG6LM2PH6ALLYZIL=9Y5RHVYV8ZFW
LEFZVC9PMY6S78AQL6IN7OVFXV8XSWCXMNB4AFY=Q1B1MRTU3RNA3WZ=SRC87M=SK7ZLFX0WHRZP1XCE
7XOMUJHEH2ZIRWGBDTGDO6PO93UJQPZUZF=O50EW7A4CV3RKYNXJFATNPKELG6P4I4E1DUHWUW=ONSBT
UCA1D1QCADMH9UJRWPJOL8W7N47IX8VTUCZ1K01JMD=BOSQDY78HB998KW6M8N0W4AM7X62NV6R7TG18
NGV=COBAMIXI8ZANIBVZSLJJNJLUPO1HWECW7WJUUOTVP0SU9VZ1DYZ4HWC0QOQWH5WSVT51AADYE4SY
8HW=ACP38G=P7K3BKCZSWBL5WO124BY5AV7CR463398SNM59IG3KX0AJII2=YI80Y41E0MZRLZXT3FNW
VPVXL9M4BMLKI6Q744V=4828P4V2TLMBE3S870D70KV8J1EGEQ88UVH4OGDV2PTI51S8B=18B2LWYLHJ
G0Q5G7AY3AWM3IX4N5FQERBD5USIVMJ4VHR5YLKNAS1=XQ45Q152=BRSZS2MCMLY1FXC23HKRMZCB7UK
MAOPF2XZ7QTFBL3=AWAWXZT6RB9N5UHLNYMRP=QEMKL4KJ7ESQXIKRYATZ29MBNE7IB5YST7EPGIZAKE
UPZWAPGST0NVOW5R54=2XKQKD6PY4SZ4KJL1R3157PRSLWZ2GZO4FOTB=WQXFAUNRXYT7=FG7PA6NTY8
0YMW6YIKJY4NY7SD35NNLI9CYS=M1T0B3KUPAAQA8FCSSQBY3CW43GBIAF5J2M87OWQ6NH060PUW3RFG
I24ML1WF5Z26QVQ8SHK0YJMD3MWY2YH987755U2FSF1E8M3P3TOU==FZWOYWPL5CRGTHUOFM1Y298G4T
W3I=5AO81GIO8QYVPWM39WOR39YLQ=1W3SCAZ57WR07SR944W3H7ZE1KL8KF9ULWHG8EC0MR78WDW5MG
W1M=8=ZAW=IW5LX7E17NVY2Y7BD3YD4H83TC0R2QNZON9D5PGJJBXQJTIOXBU7LU5527BK5A9CZ3RMHB
T4IGALKASJOVQHK2=Z2QZ6F34U8E3K7=L90BPU1JLFF5ED1I1IAY3DU1GSZ8OISCLAPKRXN7UROGCV2H
U03LXC8MV7WKUNLL1XIN62O=ODU3OQ9NC2G5BYSLJOOIV=SYY13KMUB=LKLTAVT5DS8JGRP9B9QWG0RA
UH08Y0P7XEC34MBLF1DUIKI79XHUJP6JEG1X4RGUW1UJHUAURJ4EETHG9OO66VYVLK6CG8PMX91CRR2W
HILWQXAVO857I7OGCPJKUB6MCAKTRTS2DDKPPQMOA8UY8XQZC6XTS99PK6BA008ZTKQ625H6FVT233UW
AEJX2DSXGLW6HWT5ALURYI55FMZU31JP6SPVXYUYHNB1EVDY0EQ8VLHPAEM8F4KFF76B6V3F6SE431HL
2UBKZH6T4F16RY0USEVGW273512604EJWUIUIV69AKWH7J41M4NBFR5C2F4E8F12=YI0BK1Y5F6WHQYW
E2UPAHLI4MMO9S=7G=N6Z07HMK0IRDPP3LCY2S2FCPA5CJRTS9OKD4ESKYM2PK7KIAV137884AWCSL50
FNRC6D4JAD===5UDLM1FHJ4RWC3O9WLHQDHRMXQ5NWHMVV7SB9PG69ABQ2MW77=FQ0VQNSDYW5TO4T0T
N64J72ETN85OAB12POWU=5752RJ4L90F0F87NBVICE9EQKUAWJMOZKHSKB0S7MWFMLJYN336D05=D7ZV
RUR5RNFB83CCZZFI9UVDUV49X7TDM699VDZ6JOLLLOY9T3JH4GT1JMK6SQ9HQTWUJAPFFUA6VV1SBT8D
N5DVP5SAOIF2P5Y3AFZYOFXFIMWR4NJ9X=71W9C9IBSVXT1KY9J0RUHKRSP8J7BMGKV2B6LZG6RM804K
YB6G4W=JFSQZ4HZEWE2EQ3DTRG0K=41I5PEQ5LKOHJ2Y59WU8PYBVHQSI8ISTB=3=KS3NWX7WGCTA3DA
KEZG48PKAN56XYV9V2=JCSIXZMIUPRBD749PLUEAWWMSYMKWKZ9DDK2EA5H1TSMD1HJS0T1XYYNR=3CL
0SUTHJRRJKBCVGI8GH==1IUTH8ZLB0MBWI75647QK7ULGGAB1ZAT2SDIQUR94O4WI6VR4IUU8CSH2153
IS5WU2XWT23I1IHAY1JATL4DSN3MXA4SP1XV4I664C1OI7A1=QTF6MTI==WU5R8IO1IE1LJPY6=7MHTP
K820AKGLGDX2JASYVRY6N38PCV7I0V17921SMEO0Z=WAET5WC3J4JPXKJNG08=3WH16PEQ3TDJ0A2QGC
ZX8PQ8IMK4RX1TRZDKDQYQFX9ZABHBBFWY7JMHI37151AJ=NVNHQIAFSG47D63CU3I7NVTSGUNY80SPB
DLA0JST3QM5MU21XK6NRLUIKTU5481HV5CFDXCAUY=34SLLN9FU=KL82BCT1FVDZZ9QZH2RNGZK6RIHZ
VIZA4IMFAMXHO0W3LCE7YRMLBGP2E=7QDCFTNIGL7=O=5XKWZ99DTQGAK28U8AO7=SP75R8JU3UTHKZO
6T9WMXORZ2VJHG4448=ABWRMY56GEK42IJY7DQCG3HFJLW1URTG2AIQ0OZXB8GEG=I2PI18S99BWPR=7
WLW=6HORBQDD6P9E3B8XULRB8TGYTY59MHX5UXK5JS9PWIDTX9OB2E3AIXSTFMUHC5LMBKXULGZAB96B
DVPRZQTV10WGGX0ZXI84RXW1PVQF2R68IUQM=OI5KXLZOQBLKYO7GW90PF9DQJUKEBG4357MACWQ8MM6
WJL4CX6HZ=A5UARA9PC7UYUEDG4CDTGNU682I3QEJE0Q53I4Z=KKN9CQ81C62FQ2XIYQSO2NOFU3LXLJ
PB7VQZ39C2=U3MRS4PP5XLFKV156W0=UDGJSS218LTJDPTJ3KT6D21M07NTRJT8DVKHYXWORN3KFSXP2
LI05VLP=AHW5YWUMOAK9AUXOEEXHEMU=APUGW3L1IVKM=I7V5HJXFFWQ9N0XMFKL63XGIQH4Y4BGO8J1
MV1V4HWVE1MZG48KM7ZI28K8L3U797SEQXJCGFN6ZPWQRLQ5QS6KR8I505PRMB7EYSQKCA6203NLHYSB
CTCU0XR1MT5A7IS8F8JS04NOQA8TFOXLDZ1W0RO960YK86PNCJVEXRRO0Y03NCWR24LYF0UGLMVWKA9=
TU33PBDCTE10WYROIURS0AKMFSS6AJR8CQ4SVCNKP7MHBDH2Q0K=82KNRJIRTKX754VHAYUKJV7TXJN2
QN6D7OHXCADXT=O1DT=64XSEK5LLGCRIYIA523I3SKBYHPEY47MPVH0IQW38ELH3=1M5VZIQNECE47YP
OH9UAP610P66H2K60A1=882QX42T6RFY0ROOB63QNMXN0RVUZ4UO7DLAISZC2HSSCY1D422WEIO0M2UY
C7B4QNI085WI5EJBOK5JVEJJWJPU3MR6IPYPUQI2OQYRPNMTP=DMKOUBX=IXYT0SQZDVNBD2OG2W3KBY
JZCL3U7=Q1MVYYFR3247I6PECBT68A4AWN24D3ST4P2M9ZBI7C22KNSMK8LA9DL9XH6K28HUOBLC4DFV
BOAX3M9L6BL1TPO8KEU42EACYVKBFQ2ZX1FYX22JMIS7HUDYYIPW051JZ9=DWWWB4507GAVE=4Z9RIB6
FVUU8MZ8FQB0F6MZF8XO0598=ACKNX222RM2B9LI98U4NPJ4TJLDR4ZSTUB4VKOV2XT0OZ3GS17BX8SN
OV4133N4WN8CTM6UV2F9VZMH4L=054OE6GXRZYPRZ5CG063W77MQZEBBXUS1GKO9WPFFZJ5=4EFHJY2B
NV4NDS5D5U=J3296XAMNP714AQLCWMXBUJVPL0IL94TI9JLGHEMX88C9XATLA43SG86NU2E=Q5KC9DCI
LPCI=PVRQ1R=9XF27289Y07O6GH1H7E5VI92XBTK9YPQ0ZO9S12X6IWPVKXBCGNWS=CAZQUGW77B22PY
IFGFCV6O=PR5QP89I=O5IR9EUDNGWQRJG=AXAMEMS6HS0JMX=IVID=H7=P1OCNW=S1751ONN5CIRM3MN
TPE=SRX89ICQSJIW35JO9U5SNMCU6OXIOEN43MGPOKR1GH709JD6P3M9SL6MKBN1GKIYBT=BL535BJ1T
=ITGZKI4PAS2WXCPOEG3KFDS1GHLQAX8I=BXG4O5A9AFT3CU=2ZCPR0V9LG5PD6GN4YBIWSIC29TV5KS
TKDP341LJV93SZMUWAVAXLGFWU7G291LI60H3TP6X0I0YV7ECWW1DCT1BCU3TZY7I01HFTH0ALZMOKJQ
CJ147JMSSM7Y13QV8=2Q9KOWNELUS7L1K4BZQ2BWON48S07JM483KFIL7A8SGUS7C7=AQCN2CN4201ES
0F24EBR=DOIAUSWF4E1ISICJG7W68I2VCWXWE1L7MB841Z8OYGSJ4X4DN2AVQK3D92CK9X=UXVD5E4J0
EGPU13GXB90H07QU2V383T7H32YEM83GJWRWSFBTN=1FK3UU9UP8J1I8GPHP58EE70XFGBRK18QDRDL0
RURXHDFC7=6DRSMZW5M=Y002YDVZNE7NT688G38LD6ZJC6RDAC1GDLKMBYUM3C3BTGSBUP=SSE1WR==D
IEKUEK6RAJ88ZRX0M32ERCJ=GD61GGYPUCUHHL131X1R631GVD6IPJHR=SWGYLF6IIJGLJNY1GYW4GAM
M5KMSOZGZD=2H9Q=VC0W=EOBKGGEFFJHEU81EY65A57AU09UC4R7B8H23KMHCWREKYIYXL145Z7LPNBT
4B2136H8=W2Q2AF36X8IIR2GGKD4LHOZIEGVFS6ALS8FIK1012JTV=XG91=J9CNHJTCB3Y5USC88QB72
WP0SRRVARH4YM3BIK14N46JXRWYMFUA=R8ZFUMX0QYVWZXEV85=SIATLW7YYI721KO1X03H1CCU90FXJ
X1ZFD9328T0PU903DGDWZW8MVZ9U9O6OQP3C4IXLJ5ENHJJRQI1QFSGEM77IK966MTNFFIKNR218F=OW
Z=UC3=OMR92WTS68FIAKQINLYS6UQ1BQQZMHCDUYCLQ5DGKYOUNWKHEWN7U=AIRE8F2=IK95AM5H60=9
4H32X0MPSVEQFBUC5MQRZ=O8YE1APZXTJ21ZJ6E3EAEIE2YLXX16S5WCXSUYVO10TFH5XG=XFY=KMJOR
D7NMFNYXLMQFGEJQCIFSPQEQA6NEER1G9GLBWL7=80ST9JLMLVFXMJXK16SQAX4HES7N4RYN090PHU3L
D93=L297ISYUZ3AKHF4W6=SIG6HX7S76D0NKGV30DAT9CPCQTRNU7OWE24PB75W43OJ5W3OB6HAO4TDY
YONTL3SDV0WEJDW2A61EHA97OXXR1S6K3N8K79TXX2=PDOGSOAAQDEP72EGP3ZG6U06JFY0NXW71CPBR
IGD4AD4E850=5R5AGMU7O=KBQEZAKMSXJZ8NQCUXJPU1CQDYPA61=UPOMJFI6XVI6SS543RHG2J36B7W
SYVNXFN7=8PYVEDC8YVD4G9I03S7FGG7HLNXEKTZGYPK5N624W=W1SPJWUEXPCA239W6K1H7FEQLTVI6
5DDFE4D=EBOFZG6QQXF03ZR1RAFV8IMLMIPWJXP623IDYFPDEQMGDI2XHYF4PTHK7S8WYROGWWU=UWRM
I3SZ13IA9EU=TK6SSPZZB7VU549X8ZVD4OT4A34U56MPYG9=T6QXAFGPOLYHHFOT=LRKOEAMLQSWOFA3
JWBZFH4X4BETHMSLT04HHHSTN227XX7RZEQOMOV8CRE=ZXKSSJIQ949=N9OBRMUP4PNJWBKHOBGH31N2
D8GH8JFODO04J1=V3BYHBM64MHUSOC55=FNXV0UJB54Q8KN0YL=BG2KPOH6TGLU7G57D7MNOKAYV91DN
484YWBB=6DNDS5QH1GL5IWS=Q503OYSZD2P3G682YDWDPA1S2C0GMSMYS78EUKX=XL7IWZ9WK884A01U
ND=2L=1BXE6VFMDZN3WUIS93P=WLQU=R3XPF=2Y187FXDEL7=VXC1N3ZW6OEC9YPQLEPT151GRIMTB3U
35544T1JECOWUNKWR1C0=IHYGQDNJ1CZPAEC09QE4V=UEJNRBNT30LBAMFQP7=UX70PQRJWA8QB7=TEZ

This was the response of the server:

HTTP/1.1 404 Not Found
Server: nginx/1.17.6
Date: Sat, 23 Nov 2019 11:18:42 GMT
Content-Type: text/plain
Transfer-Encoding: chunked
Connection: keep-alive

b
Not found.

By the way, the flag was UIUIV69AKWH7J41M4NBFR5C2F4E8F12=.

This submission was really all about luck. We basically grabbed a flag out of some “random” data stream in our network analytics.

The flag was automatically found at 2019-11-23 12:22:40 CET in our network capture, and submitted manually 2 seconds later for testing purpose:

Flag Submitter

According to some hints, the service was actually not exploitable. We proved the opposit: guessing flags is always an option :P.