LEts a GO

Platform: Broncoctf2026 | Category: Misc | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-07-11 | Status: Solved Techniques: backslash_zip_extraction, broken_solver_reproduction, hidden_dotfile_discovery, ordered_fragment_concatenation

Summary

Task: a zip expands to 333 tiny files in a deep noisy directory tree full of decoys; 50 hidden .part_NN fragments must be reassembled. Solution: walk the tree, collect files named .part_00..49, order them numerically and concatenate to recover the flag.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: broncoctf2026 | ID: 20260711_broncoctf2026_lets_a_go
• Tags: file_reassembly, anti_analysis, decoy_files, fragment_reconstruction, hidden_dotfile, zip_backslash
• Indicators: archive with backslash (Windows) path separators, hundreds of tiny .part_NN fragment files in a deep noisy tree, hidden .solver.py docstring describing concatenation, LEGO / brick-by-brick semantic clue
• Source: 20260711_broncoctf2026_lets_a_go.md

Foothold

Vulnerability / Misconfiguration

1. backslash_zip_extraction
2. broken_solver_reproduction
3. hidden_dotfile_discovery
4. ordered_fragment_concatenation

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• backslash_zip_extraction
• broken_solver_reproduction
• hidden_dotfile_discovery
• ordered_fragment_concatenation
• Tags: file_reassembly, anti_analysis, decoy_files, fragment_reconstruction, hidden_dotfile, zip_backslash

Original Writeup

<details><summary>Click to expand original content</summary>

Description

LEts a GO

Go step by step, brick by brick.

(provided file: lego_bricks_challenge.zip)

The title is wordplay on LEGO / "let's-a go", and "brick by brick" hints that scattered fragments must be assembled in order to build the flag.

Analysis

The archive lego_bricks_challenge.zip uses backslash path separators (Windows-style). On macOS/Linux unzip warns and does not build the directory tree correctly, so it must be extracted with a small Python zipfile loop that rewrites \ into real subdirectories.

Once extracted, the archive expands to 333 tiny files (~4.4 KB total) arranged in a deep, realistic-looking project tree: .git/, .cache/, .config/systemd/, src/modules/network/protocols/, data/raw/sensors/, tmp/system_logs/, etc. Almost everything is a decoy:

• empty or 1–4 byte .part_NN fragments,
• red-herring go.sum, Dockerfile, docker-compose.yml, package.json, robots.txt, README.md, .htaccess, .npmrc, .DS_Store files.

The abundance of go.sum / "GO" references and the LEGO theme is intentional misdirection.

The key discovery is a hidden file lego_bricks_challenge/src/modules/network/protocols/.solver.py (906 bytes). Its docstring reads:

Hidden solver for: LEt's a GO! — concatenate .part_00 .. .part_49

Its core logic:

 python read-only • copy allowed Copy
pattern = re.compile(r"^\.part_(\d+)$")
parts = {}
for dirpath, _, filenames in os.walk(start_dir):
    for fn in filenames:
        m = pattern.match(fn)
        if m:
            idx = int(m.group(1))
            if 0 <= idx <= 49:
                with open(os.path.join(dirpath, fn)) as fh:
                    parts[idx] = fh.read()
flag = "".join(parts[i] for i in sorted(parts))

Gotcha: running the bundled .solver.py directly fails with SyntaxError: Non-UTF-8 code starting with '\x97' — the docstring contains a Windows-1252 em dash (0x97) and there is no # -*- coding -*- declaration. So the algorithm is reproduced in a clean snippet instead.

Solution

1. Extract the backslash-path zip with Python:

 python read-only • copy allowed Copy
import zipfile, os
with zipfile.ZipFile("lego_bricks_challenge.zip") as z:
    for name in z.namelist():
        real = name.replace("\\", "/")
        dst = os.path.join("extracted", real)
        if real.endswith("/"):
            os.makedirs(dst, exist_ok=True)
            continue
        os.makedirs(os.path.dirname(dst), exist_ok=True)
        with z.open(name) as src, open(dst, "wb") as out:
            out.write(src.read())

1. Walk the tree, gather the 50 real fragments (.part_00 .. .part_49), order them numerically and concatenate:

 python read-only • copy allowed Copy
from pathlib import Path
parts = {}
for p in Path('extracted/lego_bricks_challenge').rglob('.part_*'):
    try:
        i = int(p.name[6:])
    except ValueError:
        continue
    if 0 <= i <= 49:
        parts[i] = p.read_bytes()
print(b''.join(parts[i] for i in sorted(parts)))

All 50 fragments were present with no gaps. The ordered concatenation yields the flag — a play on "Everything Is Awesome" from The LEGO Movie.

</details>

---

signed by XESXOR