Dispatch Cache

The challenge directory looked completely empty at first glance because there were no regular files inside. Instead, it contained 475 directory chains, each nested five levels deep, with names formatted like UUIDs.

Sorting the top-level directory names immediately gave away what was going on:

000000FF-D8FF-E000-104A-464946000101
00000102-0203-0303-0304-030304050805
0000020B-0D14-1414-1414-141414141414

The first six hex characters are sequential indices (000000, 000001, 000002…), and the rest of the first directory name begins with FF D8 FF E0 — the magic header bytes of a JPEG/JFIF file. The directory names themselves were carrying the file data.

Reconstructing the Payload

To extract the file:

1. Traverse down each of the 475 directory chains from root to the empty 5th-level leaf.
2. Concatenate the five directory names in root-to-leaf order.
3. Strip the hyphens and hex-decode the resulting string.
4. Read the first 3 bytes as a big-endian chunk index, with the remaining 77 bytes as the chunk payload.

Each chain decodes to 80 bytes (3 bytes index + 77 bytes payload). The indices span 0 to 474 contiguously.

Get sftp2368’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Sorting and concatenating the payloads in index order reconstructed a 36,575-byte JPEG image (recovered/delivery.jpg).

Finding the Flag

Opening the image shows a blurry picture of Elmo, with no flag in the pixel data. Checking the JPEG metadata revealed a native COM marker (FF FE at offset 20) with length 0x002E:

Cryptix{D1RECT...}

I verified this with a quick Pillow one-liner:

python3 -c "from PIL import Image; im = Image.open('recovered/delivery.jpg'); print(im.info['comment'].decode('ascii'))"

This prints the flag directly.