Покажи, если сможешь (Show me if you can)

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: base64_image_decoding, braille_unicode_encoding, decoy_response_bypass, semantic_clue_analysis

Summary

Walkthrough of the CUSTOM Web Покажи, если сможешь (Show me if you can). Task: an Express endpoint returns a base64 JPEG of the 'Who Is Stevie Wonder?' book cover and a prompt 'I can't read it'; every POST gets a fixed decoy reply. Solution: recognize the semantic clue (St

Description

На хосте сидит очень странный парень. Попробуй понять чего он хочет.

English: "A very strange guy sits on the host. Try to understand what he wants." Target: https://show-me.t1.bug-makers.ru. The goal is to figure out what the "strange guy" wants and feed it to him in the right form.

Analysis

Recon:

• GET / returns plain text My friend, tell me, what is written here? I can't read it :( followed by a large base64 blob.
• The base64 decodes to a 699x1000 JPEG: the "Who Is Stevie Wonder?" book cover from the Who HQ series (by Jim Gigliotti).
• GET /health returns OK. No other routes exist; unknown paths return the default Express 404. No session cookie — fully stateless.
• Stack: Node.js/Express (x-powered-by: Express) behind a Go reverse proxy doing Host-based routing (a wrong Host header yields the Go-style 404 page not found).
• POST / returns a fixed I can't read it for every plain-text / ASCII / JSON / multipart / raw-image body. This strongly looks like the body is ignored. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Semantic clue chain (the actual key):

base64  ->  JPEG  ->  "Who Is Stevie Wonder?"  ->  Stevie Wonder is BLIND
        ->  a blind person reads via BRAILLE, not printed text
        ->  the prompt "I can't read it" = he cannot read PRINTED / ASCII text

The decoy I can't read it is not "body ignored" — it is the blind character literally telling you he cannot read your printed (ASCII) answer. He can only read Braille.

Solution

Encode the answer to "who is stevie wonder" as Grade-1 English Braille Unicode and POST it as the body. The server matches the name and returns the flag. Both the raw text/plain body and a JSON {"answer": "<braille>"} work; even just stevie wonder in Braille is accepted. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import requests

# Grade-1 English Braille (Unicode Braille Patterns block)
m = {'a':'⠁','b':'⠃','c':'⠉','d':'⠙','e':'⠑','f':'⠋','g':'⠛','h':'⠓',
     'i':'⠊','j':'⠚','k':'⠅','l':'⠇','m':'⠍','n':'⠝','o':'⠕','p':'⠏',
     'q':'⠟','r':'⠗','s':'⠎','t':'⠞','u':'⠥','v':'⠧','w':'⠺','x':'⠭',
     'y':'⠽','z':'⠵',' ':' '}

def to_braille(s):
    return ''.join(m.get(c, c) for c in s.lower())

URL = "https://show-me.t1.bug-makers.ru/"
answer = to_braille("who is stevie wonder")   # "stevie wonder" alone also works
print("payload:", answer)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# raw text/plain body
r = requests.post(URL, data=answer.encode("utf-8"),
                  headers={"Content-Type": "text/plain;charset=utf-8"})
print(r.text)

# JSON variant also works:
# r = requests.post(URL, json={"answer": answer})
# print(r.text)

curl one-liner:

 bash read-only • copy allowed Copy
curl -s -X POST https://show-me.t1.bug-makers.ru/ \
  -H 'Content-Type: text/plain;charset=utf-8' \
  --data $'\xe2\xa0\xba\xe2\xa0\x93\xe2\xa0\x95 \xe2\xa0\x8a\xe2\xa0\x8e \xe2\xa0\x8e\xe2\xa0\x9e\xe2\xa0\x91\xe2\xa0\xa7\xe2\xa0\x8a\xe2\xa0\x91 \xe2\xa0\xba\xe2\xa0\x95\xe2\xa0\x9d\xe2\xa0\x99\xe2\xa0\x91\xe2\xa0\x97'
# (UTF-8 bytes for: ⠺⠓⠕ ⠊⠎ ⠎⠞⠑⠧⠊⠑ ⠺⠕⠝⠙⠑⠗  = "who is stevie wonder")

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Response:

Oh! Stevie Wonder is such a great musician!
BugCTF{REDACTED}

What didn't work

• Image steganography (entirely a red herring): LSB on all channels, EXIF/XMP/IPTC metadata, trailing bytes after FFD9, JPEG comment/APPn segments, palette/bit-plane analysis, openstego/stegano, and bead-color "Braille" guesses. The image is the genuine, unmodified book cover. tesseract OCR only yields by Jim Gigliotti.
• POST body fuzzing: all field names (json/form/multipart), raw image, base64 echo, even a 10 MB body — all returned the fixed I can't read it instantly. This misleadingly suggested the body was unread; in reality only Braille bytes are accepted and everything else is rejected.
• Answer in other channels: Who Is Stevie Wonder?, Stevie Wonder, Jim Gigliotti, etc. submitted in plain body, JSON, query params (GET and POST), 40+ header names, and cookies — no effect.
• Web exploit classes: SSTI ({{7*7}}), prototype pollution, content negotiation (Accept: image/audio/...), Range, custom/standard HTTP methods, screen-reader User-Agents — no effect.
• Route brute force: only / and /health exist; the 404 is the default Express page.
• Stateful header cycling (as in the sibling Masquerade challenge): there is no session cookie here, so it is not stateful. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Related challenges (bug-makers event)

This event reuses a minimal skeleton (/ + /health, Express behind a Go reverse proxy) with a heavy red-herring layer:

• Masquerade — same / + /health skeleton; flag obtained via a stateful User-Agent trick across a session.
• Вектор атаки (Attack Vector) — SVG XXE.

Recognizing the shared skeleton helps quickly rule out route brute-forcing and focus on the per-challenge gimmick. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering base64_image_decoding, braille_unicode_encoding, decoy_response_bypass, semantic_clue_analysis was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-05-29 • CUSTOM • Покажи, если сможешь (Show me if you can) • Difficulty: Easy