THE GARDEN

resolver-trail

Updated 20 Sep 2026

• •

  Attribution

  • •

    Solved by Muhammad Dhafin Ramadhan during the competition. These are rn’s study notes based on the teammate’s documented solve, not an independent rn solve.

• •

  What it asked

  • •

    Identify ordered hexadecimal fragments hidden in DNS query labels and reconstruct the message.

• •

  Approach

  • •

    Seven queries matched <sequence>-<hex>.exfil.kamsiber.local. The prefix gives order; the next label contains payload bytes.

  • •

    Sort by sequence, remove DNS metadata, concatenate the hex fragments, and decode once.

• •

  Solution

  • •

    labels = [
        "01-4b4d49504e", "02-387b646e73", "03-5f71756572",
        "04-6965735f63", "05-616e5f6869", "06-64655f6461",
        "07-74617d",
    ]
    payload = "".join(x.split("-", 1)[1] for x in sorted(labels))
    print(bytes.fromhex(payload).decode())
    

• •

  Verification

  • •

    The supplied fragments decode locally to the recorded flag.

• •

  Concepts

  • •

    DNS tunneling indicators; ordered fragment reconstruction; hexadecimal encoding.

• •

  Source

  • •

    Source: team document KMIPNVIII-unintended.docx, titled “Writeup unintended KMIPN 8 Final”. Page numbers refer to the rendered document. Rendered pp. 49–50.

  • •

    Flag: KMIPN8{dns_queries_can_hide_data}.

◌ Explore connections in Graph view