RiceTeaCatPanda CTF - Writeup

CTF location:


Description: It was just a typical day in the bakery for Delphine. She was preparing her famous chocolate cake, when all of a sudden a GIANt burst through the doors of her establishment and demanded a cookie. Being the strong-willed girl she was, Delphine refused and promptly threw her rolling pin at the GIANt. Doing what any sensible being would do when faced with projectiles, the GIANt let out a shriek and ran out of the shop. Delphine smiled to herself, it was another day well done. But oh? What’s this? It seems the GIANt dropped this behind while he was screaming and scrambling out of the shop.


$ echo '69acad26c0b7fa29d2df023b4744bf07' > hashes
$ hashcat -m 0 ./hashes /usr/share/wordlists/rockyou.txt --force
69acad26c0b7fa29d2df023b4744bf07:chocolate mmm

General Skills

Title: Come Eat Grandma

Description: Oh, my bad, this spreadsheet appears to be missing its commas.

Go to the google spreadsheet version history (only visible if logged in with a google account). The second version contains the following line:



Robots. Yeah, I know, pretty obvious.

Description: So, we know that Delphine is a cook. A wonderful one, at that. But did you know that GIANt used to make robots? Yeah, GIANt robots.
User-agent: *



Description: My friend made this cool remix, and it’s pretty good, but everyone says there’s a deeper meaning in the music. To be honest, I can’t really tell - the second drop’s 808s are just too epic. (75)/Save Me.mp3

$ strings Save\ Me.mp3 | grep -oE "rtcp{.*}"

Allergic College Application

Description: I was writing my common app essay in Mandarin when my cat got on my lap and sneezed. Being allergic, I sneezed with him, and when I blew my nose into a tissue, the text for my essay turned really weird! Get out, Bad Kitty!

$ wget ""
$ mv Common_App_Essay.txt\?token\=eyJ0ZWFtX2lkIjpudWxsLCJ1c2VyX2lkIjoyMTgxLCJmaWxlX2lkIjo1fQ.Xj8hVw.O8bCYY5GuX2tddvJvDBu0OZq5to app
$ python3
>>> f = open ('app', encoding='gb2312').readlines()
>>> f
end of output: {我_只_修改_了_两_次}
cat app | iconv -f GBK -t UTF-8



Description: nyameowmeow nyameow nyanya meow purr nyameowmeow nyameow nyanya meow purr nyameowmeow nyanyanyanya nyameow meow purr meow nyanyanyanya nya purr nyanyanyanya nya meownyameownya meownyameow purr nyanya nyanyanya purr meowmeownya meowmeowmeow nyanya meownya meowmeownya purr meowmeowmeow meownya purr nyanyanyanya nya nyameownya nya !!!!

nya and meow are repeated a lot together, trial and error led to nya being . and meow being - in morse code. I tested and wrote a sed command to parse cat-chat into morse which I saved into sed 's/nya/./g;s/meow/-/g;s/purr//g'

I downloaded a morse decoder from git.

git clone /opt/morse
cd $_
ln -s /opt/morse/bin/morse ~/bin/morse

I also copied all the chat from the discord channel into the file meows.txt.

$ cat meows.txt | ./ | morse -d | grep RTCP |  sed 's/?/_/g'  #output is in all caps



Description: 636274425917865984

Navigate to

Copy output from message at the id 636274425917865984:

$ echo "meowmeowmeow nyanyanyanya purr meownyanyanya meownyameowmeow purr meow nyanyanyanya nya purr nyameowmeow nyameow meownyameowmeow meowmeownyanyameowmeow purr nyanyanyanya nya nyameownya nya nyameowmeowmeowmeownya nyanyanya purr nyameow purr nyameownyanya nyanya meow meow nyameownyanya nya purr nyanyanya meowmeowmeow meowmeow nya meow nyanyanyanya nyanya meownya meowmeownya meowmeowmeownyanyanya purr nyameowmeow meowmeowmeowmeowmeow nyameowmeow nyanyameowmeownyameow meownyanya nyameowmeowmeowmeow nyanyanyanyanya meownyameownya meowmeowmeowmeowmeow nyameownya meownyanya nyanyameowmeownyameow nyanyanyanya nyanyanyanyameow nyanyanya nyanyameowmeownyameow nyanyanya nyanyanyameowmeow nyanyanyanyameow nyameownya meownyameownya nyanyanyanya nyanyameowmeownyameow nyanyameownya nyanyanyameowmeow nyanyanyanyameow meow nyanyameow nyameownya nyanyanyameowmeow nyanyanyanyanya" | ./ | morse -d | sed 's/?/_/g'


Chugalug’s Footpads

Description: Chugalug makes footpads that he can chug and lug. However, his left one is different from his right… I wonder why?

$ xxd -c1 left.jpg > l && xxd -c1 right.jpg > r
$ grep -Fxvf r l | cut -d " " -f4 | tr -d "\n"

BASmati ricE 64

Description: There’s a flag in that bowl somewhere… Replace all zs with _ in your flag and wrap in rtcp{…}.

$ steghide extract -sf rice.jpg -xf extracted.txt
$ cat extracted.txt | base64 | sed 's/z/_/g'


League of Asian Grandmas

Description: We recently intercepted an exorbitantly delicious and commodious shipment containing cleaned rice, unrealistically sweet-smelling jackfruit, elegantly peeled rambutan, seedless lychee, large, round and plump grapes, succulent nectarines, viscid peaches, and fried rice (among other things). I’m not too sure, but this seems a tad bit suspicious, don’t you think? Just looking at this makes me dizzy….

I stitched the 4 provided pictures together in GIMP. Unswirl the text to find the flag. It is very hard to read, so it took some guessing.



Strong Password

Description: Eat, Drink, Pet, Hug, Repeat!

Eat rice, drink tea, pet cat, hug panda



Description: #off-topic

Go to the #off-topic channel on discord, and it has a subtitle: who here knows the name of the catpanda in the server picture? The catpanda in the server picture is the same as the one on the home page. The associated text with the picture is Jubie.

<img class="w-100 mx-auto d-block" style="max-width: 350px;" src="/files/71a3cdff21828480efb3bd1a2203c159/riceteacatpanda.png" alt="Jubie">


A Friend In Need Is A Friend Indeed

Description: Hm, I see a lot of potential friends in the midst of that discord, but… one is not like the others; maybe I’ll slide into their dms and strike up a conversation about passwords!

Join RTCP slack channel and message bot Jade, whose status says “Listening to people’s worries”. Message the flag from Strong Password, rice_tea_cat_panda, since she likes passwords. Responds with: You’re such a great friend! Here, have a flag!



Description: Wew a survey!!! Free points are always nice :3

Fill out the survey and recieve the flag.