THE GARDEN

cache-archaeology

Updated 20 Sep 2026

• •

  Attribution

  • •

    Solved by Muhammad Dhafin Ramadhan during the competition. These are rn’s study notes based on the teammate’s documented solve, not an independent rn solve.

• •

  What it asked

  • •

    Enumerate a Redis service read-only, respect each key’s data type, and reconstruct the hidden message from a stream.

• •

  Approach

  • •

    The transcript identified prod:stream:fragments as a Redis Stream, so string commands such as GET are the wrong interface.

  • •

    XRANGE returns ordered entries. Concatenating their fragment fields and Base64-decoding the result reveals the flag.

• •

  Solution

  • •

    redis-cli -h 10.0.100.6 -p 6379 TYPE prod:stream:fragments
    redis-cli -h 10.0.100.6 -p 6379 XRANGE prod:stream:fragments - +
    
    # After copying the fragment values in stream order:
    python3 -c 'import base64; print(base64.b64decode("<joined-base64>").decode())'
    

• •

  Verification

  • •

    The team document records the stream reconstruction. The live Redis service was not queried during this refactor.

• •

  Concepts

  • •

    Redis type awareness; Streams and XRANGE; read-only service enumeration; Base64 reconstruction.

• •

  Source

  • •

    Source: team document KMIPNVIII-unintended.docx, titled “Writeup unintended KMIPN 8 Final”. Page numbers refer to the rendered document. Rendered pp. 42–44.

  • •

    Flag: KMIPN8{redis_streams_can_leak_context}.

◌ Explore connections in Graph view