Spot The Difference

Platform: Broncoctf2026 | Category: Misc | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-07-11 | Status: Solved Techniques: case_insensitive_filtering, decoy_noise_removal, per_character_diff

Summary

Task: two near-identical files of random-looking ASCII differ in 79 positions; a naive diff yields garbage. Solution: most diffs are decoy case flips — filter them out with a case-insensitive comparison and read the remaining substantive characters from file2 to recover the flag.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: broncoctf2026 | ID: 20260711_broncoctf2026_spot_the_difference
• Tags: text_stego, file_diff, case_flip_decoy, spot_the_difference
• Indicators: two near-identical random-looking text files, one char per line, friend updated file1 into file2 to hide a message, most diffs are pure upper/lower case flips
• Source: 20260711_broncoctf2026_spot_the_difference.md

Foothold

Vulnerability / Misconfiguration

1. Case_insensitive_filtering
2. Decoy_noise_removal
3. Per_character_diff

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• case_insensitive_filtering
• decoy_noise_removal
• per_character_diff
• Tags: text_stego, file_diff, case_flip_decoy, spot_the_difference

Original Writeup

<details><summary>Click to expand original content</summary>

Description

My friend said that she updated file1 to send me a top-secret message, but I don't get it. File2 is still just a bunch of random characters?

Two files are provided: file1.txt (350 chars) and file2.txt (351 chars). Both are ASCII text that look like random character junk of similar length. The goal is to recover the "top-secret message" hidden in the update from file1 to file2.

Analysis

The two files are stored one character per line and are nearly identical. A byte-level diff shows they differ in 79 positions:

cmp -l file1.txt file2.txt   # 79 differing byte positions

Reading all 79 differing characters straight out of file2 produces garbage — this is the trap. The key insight is that the overwhelming majority of those 79 differences are pure case flips (e↔E, W↔w, C↔c, ...). These case-only edits are decoy / noise deliberately inserted to make a lazy diff produce nonsense.

The real payload lives only in positions where the two characters differ by more than letter case — i.e. where file1[i].lower() != file2[i].lower(). Filtering on this condition leaves exactly 29 substantive differences:

file1 side: gd6VeBn9ltja5VoTt3WmTyThP5q[C
file2 side: bronco{REDACTED}[C

Reading the file2 side up to the closing brace gives the flag. The trailing [C is spillover from the 1-character length mismatch between the files and lies outside the closed {...} braces.

Solution

Compare the two files character by character, discard every position that is only a case flip, and concatenate the surviving file2 characters.

#!/usr/bin/env python3
from pathlib import Path

a = Path('file1.txt').read_text().splitlines()
b = Path('file2.txt').read_text().splitlines()

# Keep only genuine (non-case-only) differences; read them from file2.
flag = ''.join(y for x, y in zip(a, b) if x.lower() != y.lower())
print(flag)  # bronco{REDACTED}[

The output is bronco{REDACTED}[; everything through the closing } is the flag.

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR