THE GARDEN

fragmented-query

Updated 20 Sep 2026

• •

  Attribution

  • •

    Solved by Muhammad Dhafin Ramadhan during the competition. These are rn’s study notes based on the teammate’s documented solve, not an independent rn solve.

• •

  What it asked

  • •

    Separate DNS metadata, key material, and ordered payload fragments, then reverse a multi-stage encoding pipeline.

• •

  Approach

  • •

    The TXT reply decodes from Base64 to key VOCATION. Metadata specifies Base32 without padding, followed by repeating-key XOR and Gzip.

  • •

    Sort A-query fragments 01 through 08, concatenate the payload, restore Base32 padding, decode, XOR with the repeated key, then decompress.

  • •

    After Base32 decoding, compute $x_i=b_i\oplus k_{i\bmod8}$ before Gzip decompression.

• •

  Solution

  • •

    import base64, gzip
    
    parts = [
        "JHCEWQKQLDLC", "IVFQWC32CRN7", "7X7IC3UMPWAM", "GYLYAYHQ5WIG",
        "QZS5QAHOBGPY", "KZTHDRRYVDM3", "4JFE5CK5ONEH", "ASKPJY",
    ]
    encoded = "".join(parts)
    raw = base64.b32decode(encoded + "=" * (-len(encoded) % 8))
    key = base64.b64decode("Vk9DQVRJT04=")
    unzipped = bytes(b ^ key[i % len(key)] for i, b in enumerate(raw))
    print(gzip.decompress(unzipped).decode())
    

• •

  Verification

  • •

    The supplied fragments decode locally through all three stages to the recorded flag.

• •

  Concepts

  • •

    DNS exfiltration; record-type correlation; Base32; repeating-key XOR; Gzip.

• •

  Source

  • •

    Source: team document KMIPNVIII-unintended.docx, titled “Writeup unintended KMIPN 8 Final”. Page numbers refer to the rendered document. Rendered pp. 81–83.

  • •

    Flag: KMIPN8{multi_stage_dns_exfiltration}.

◌ Explore connections in Graph view