Retrowave

Platform: alfactf.ru | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-19 | Status: Solved Techniques: Source code analysis for hidden files, Speech-to-text recognition (Whisper), Audio steganography detection

Summary

Retrowave — alfactf.ru

Description

Вы поймали волну! Но радоваться рано: вода здесь неоновая с кислотным отливом — это ретроволна. Чтобы не потонуть под электронными битами 2000-х, нужно ухватиться за спасательный трек. Но вот незадача, его недавно убрали из ротации.

URL: retrowave-1mx8j97m.alfactf.ru/ Исходники радио: https://alfactf.ru/files/retrowave_2b38a19.tar.gz

Analysis

1. Examining the source code

Download and extract the source archive:

 bash read-only • copy allowed Copy
wget https://alfactf.ru/files/retrowave_2b38a19.tar.gz
tar -xzf retrowave_2b38a19.tar.gz

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Project structure:

retrowave/
├── copyright/
│   └── REMOVED.mp3      # <-- the track "removed from rotation"!
├── songs/
│   ├── Andrew_Vice_-_Follow_The_Stars.mp3
│   ├── Domitori_Taranofu_-_Tunnel_of_Lovers.mp3
│   └── c152_-_Endless_Dreams.mp3
├── static/
├── templates/
├── app.py
└── Dockerfile

2. Analyzing app.py code

 python read-only • copy allowed Copy
SONGS_DIRS = ['/copyright','/songs']

@app.route('/<path:filename>')
def serve_song(filename):
    filename = os.path.normpath("/"+filename)
    if Path(filename).expanduser().absolute().is_relative_to("/copyright"):
        return "Access denied", 403  # Access to copyright is blocked!
    return send_file(filename)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The server knows about the /copyright folder but blocks web access to it. However, the REMOVED.mp3 file is in the source code!

3. Listening to the audio

The file copyright/REMOVED.mp3 (also flag.mp3 in sources) is a retrowave-style song ~3:23 long.

At the very beginning of the track, a voice speaks the flag!

4. Speech-to-Text with Whisper

 bash read-only • copy allowed Copy
# Extract first 15 seconds for analysis
ffmpeg -i flag.mp3 -t 15 -ar 16000 -ac 1 first15.wav

# Recognize speech using Whisper
whisper first15.wav --model base --language en

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Recognition result:

Flag is alpha listen to the radio while solving tasks and of flag

Interpretation:

• "Flag is alpha" → alfa{
• "listen to the radio while solving tasks" → REDACTED
• "and of flag" → } (end of flag)

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# Download source code
wget https://alfactf.ru/files/retrowave_2b38a19.tar.gz
tar -xzf retrowave_2b38a19.tar.gz

# Find the hidden track
ls retrowave/copyright/
# REMOVED.mp3

# Convert beginning to WAV for Whisper
ffmpeg -i retrowave/copyright/REMOVED.mp3 -t 20 -ar 16000 -ac 1 first20.wav
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Recognize speech
whisper first20.wav --model base --language en --output_format txt

# Read the result
cat first20.txt
# Flag is alpha listen to the radio while solving tasks and of flag

Notes

• Whisper handles speech recognition well even with background music
• Flag format alfa{...} is recognized as "alpha" — consider phonetics
• "end of flag" may be recognized as "and of flag"
• Always check source code for hidden files and directories ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍