RunZero Coin Challenge Solution

Journey to Decoding Victory: Conquering the RunZero Coin Challenge

8 min readJul 11, 2023

Task 1: Decoding Roman Numerals

Convert Roman numerals (I, II, III, IV, V, etc.) around the circumference of a coin to their corresponding alphabets (A, B, C, D, E, etc.). For example, the numeral I should be represented as the letter A.

VI  XVI  XIV  I  VI  .  III  XV  XIII
F   P    N    A  F   .  C    O   M

The content on the webpage provides a hint to check the robots.txt file.

Task 2: Hidden Clues in Source Code

I visited the page: /30a70cfed77efbf7.html

I initially didn’t understand the meaning of the content on the webpage. However, I decided to check the source code of the webpage.

I noticed that there was hidden content in the form of a table on the webpage. Each table cell had a background color, and I observed that some of the colors had a “1” in their least significant bit. Changing only the last bit didn’t significantly affect the coloring, so I converted the color #000001 to #FFFFFF (White color hex code). To change the color, I downloaded the webpage and utilized the sed command to replace the relevant strings.

Now I understand the meaning of the content on the webpage. I turned on the light bulbs that were initially dimmed on the webpage. However, I’m still unsure about the meaning of the comment “<! — attention: 13 turns coming up ahead…!->” on the webpage. It is mentioned that it will be explained in the next task.

Task 3: Secrets in Files Structure

Now, I proceeded to visit the next task page: /C70A45B93819748F.HTML

I downloaded the secrets.zip file and checked the source code of the webpage.

Upon inspecting the “secrets.zip” file, I discovered that it was password protected. To uncover the password, I referred to the comment on the webpage, which suggested focusing on the hostname. Additionally, I recalled the previous webpage’s comment about “turn 13,” which referred to ROT13 encoding.

Using ROT13 decoding on the string “fpnaf,” I obtained “scans,” which turned out to be the password for the zip file.

After extracting the contents of the zip file, I noticed that there were multiple directories within it. To explore the file structure and locate the files, I tried using commands like “ls -laR” or “tree” to visualize the directory tree. I also searched for any discernible patterns that could help me solve the challenge.

After locating all the files, I observed that each file contained a single character, and their names were in hexadecimal format. To proceed, I needed to sort the files based on their hexadecimal numbering and extract the characters accordingly.

To simplify the sorting process, I copied all the files into a single directory. This would make it easier to organize and sort them.

After gathering all the files in one location, I attempted to sort them by their hexadecimal names using the sort command. However, I encountered a limitation as the sort command does not directly support hex sorting.

To overcome this hurdle, I wrote a Perl script that handles the hex sorting and outputs the content of all the files based on that sort. I opted for Perl because it facilitates smooth interaction with bash commands, making it easier to accomplish the desired sorting.

my @files = `ls`;  

chomp(@files);  

my @sorted_files = sort { hex($a) <=> hex($b) } @files;

foreach my $file (@sorted_files) {
    open(my $fh, '<', $file);
    while (my $line = <$fh>) {
        print $line;
    }
    close($fh);
}

After obtaining the output from the Perl script, I decoded it using CyberChef.

Task 4: Tile Game

Now, I proceeded to the next task by visiting the page: /dc96a60581d0c6f6.html.

To enhance the playing experience of the tile game, I downloaded all the photos from the webpage onto my machine. I then exported these images into Inkscape, which allowed me to conveniently drag and drop the tiles. To streamline the process of downloading the images, I wrote a Python script that automatically retrieved and saved all 40 images from the webpage.

Invest 1 hour in purposeful practice instead of 15 minutes of repetition.

import requests
import os
import base64
from bs4 import BeautifulSoup

def extract_images_from_url(url):
    
    response = requests.get(url)
    soup = BeautifulSoup(response.content, 'html.parser')
    img_tags = soup.find_all('img')

    os.makedirs('downloaded_images', exist_ok=True)
    os.chdir('downloaded_images')

    for img in img_tags:
        if 'src' in img.attrs:
   # Get the image source URL
            image_src = img['src']

   # Check if the image source starts with 'data:image'
            if image_src.startswith('data:image'):
    # Extract the image file format
                image_format = image_src.split(';')[0].split('/')[1]

    # Decode the Base64-encoded image data
                image_data = image_src.split(',')[1]
                image_data = base64.b64decode(image_data)

                image_filename = f'image{img_tags.index(img)}.{image_format}'

                with open(image_filename, 'wb') as f:
                    f.write(image_data)

                print(f"Image {image_filename} downloaded.")

    print("All images downloaded successfully.")

url = input("Enter the URL of the webpage: ")

extract_images_from_url(url)

After obtaining the images, I arranged them in a specific order to derive the URL for the next task.

Task 5: Understanding the Audio File

I visited: /7ce85c4346c3f29a.html

Checked the YouTube video Comment too.

After spending several hours analyzing the YouTube video, attempting to decode its content, and searching for any hidden information, I eventually realized that the video was outdated.😂 It became clear that the video did not hold any relevant clues or information.

Subsequently, I revisited the challenge page and received a hint through the form for obtaining directions. This hint guided me in the right direction.

This was enough for me to have a sense of direction, and now the comment on YouTube made sense. I looked at the image on the webpage, downloaded it, and found the WAV file signature using a hex editor. You can also find the word ‘WAV’ in the file.”

After finding the WAV file, I removed all the data before ‘RIFF’ (52 49 46 46) using ghex to extract only the WAV file. I also changed the file format from .png to .wav.

Now, since we observed that the asset inventory is written in reverse, we need to reverse the audio and then decode it using any Morse audio decoder. Afterward, you will obtain the answer and the website link to submit your response.

Learning from My Missteps: Recognizing Where I Stumbled and How I Recovered

Remove the data before RIFF2 using any hex editor to avoid introducing junk characters in the wave file, which would result in poor audio quality. I faced this issue when used a text editor and had to filter the audio using Audacity to resolve it. I realized my mistake after solving the challenge again for writing an article.
I forgot to reverse the audio and directly decoded it. After obtaining the output, I converted the ASCII output back to Morse code and reversed it. However, this approach may introduce junk characters or missing characters due to unavailable Morse code characters during decoding. For example, Z is represented as “- ..” in Morse code, but reversing “.. -” results in no valid character. That’s why I couldn’t obtain “.. -” when converting my ASCII output to Morse code.

If you found this article helpful or informative, I would greatly appreciate your support by giving it a like and following me on Medium and my social media accounts. Your support will motivate me to create more content and share my knowledge and experience with others. Thank you for your support!

You can follow me for more informative material on:

Twitter: https://twitter.com/PakCyberbot
LinkedIn: https://www.linkedin.com/in/pakcyberbot/
Medium: https://pakcyberbot.medium.com/
GitHub: https://github.com/PakCyberbot
Instagram: https://www.instagram.com/pakcyberbot/