Solution: Capture the Flagration

Answer: THAT'S HOT

Written by Adib Surani with additional code from jontay999; artwork by Janice Heng

This puzzle essentially breaks down into five independent challenges, and the landing page is effectively a metapuzzle that combines these feeder answers (aka flagrations). We'll split each challenge into its own subheading.

Pwnp Ladder (easy):

This challenge should be quite tractable. The one minute timeout can be frustrating, but it's the exact same puzzle each time you refresh so you can explore a bit more each time. The intended solution path is: right, then bottom, then top, then left.

The flagration for this puzzle is CTF{PumP_tH3m_enG1n3S}.

Reverse Extinguishing (medium):

This is basically a logic puzzle, where there is a slight ambiguity from which classes the dry powder extinguisher can extinguish. A standard dry extinguisher typically looks like this:

The icons indicate that it is compatible with classes A, B, C, and E. A specialised dry powder (such as M28) can also tackle class D, but we can infer from the puzzle anyway that we need the dry powder extinguisher to be incompatible with at least two classes. So using this information (or by trial-and-error, there aren't too many possible combinations), we should have a extinguisher-to-class mapping that looks like the following:

Now, we can immediately place the paper fire (class A) as either Room 1 or Room 6, since it is incompatible with exactly two extinguishers. Likewise, the dry powder extinguisher must also be in Room 1 or Room 6, but not the same room as the paper fire. Proceeding in this manner we can quickly arrive at the solution:

The flagration for this puzzle is CTF{FaR_3xTiN-Gu1Shed}.

Wetwork Traffic (medium):

The way the monitor works in this challenge is not fully documented, but you can infer from connecting it to the hydrant or firetruck that it shoots over a distance of two. In any case, the trickier bit is to come up with a solution that uses at most 15 bends. To this end, the space on the right of the bottom fire is actually a trap and I don't actually know of a valid solution that goes through there. In any case, one possible solution is as follows:

The flagration for this puzzle is CTF{sTr35sFul_hyDraN7}.

Creeptography (hard):

Like a typical cryptography challenge, this challenge is meant to require some hard-core mathematics. With a bit of analysis or some trial-and-error, we can infer that the mechanical advantage must always be a ratio of two odd numbers. For the specific case of π, the smallest ratios would be 47/15 and 85/27. The former can be done with just seven consecutive pulleys, but the latter is probably easier to construct since 85 appears naturally by chaining six consecutive pulleys, and 27 is just 3 x 3 x 3. Incidentally, 355/113 is also possible, though we leave the construction of this to the reader. In any case, here's a possible solution for the 85/27 case:

The flagration for this puzzle is CTF{cL4usTr0PhoB1c_4s}.

Red Team (hard):

This challenge is probably as close as you can get to programming without actually saying "you need to know how to code to solve this".

Anyway, the trick to be able to solve this is to realise that the fires form a square (with the bottom row "hidden", if you wish). It is then quite natural to form g() = 3x (extinguish plus forward) as the initial building block, followed by f() going halfway around the square (of which there are three possibilities). The main block is then the tricky bit, as we have to get to a corner of the middle of a side within 4 steps. It turns out that is just about possible by chaining g() as well as reversing twice.

This is the intended solution (it's unclear whether this solution is unique, up to swapping f and g):

The flagration for this puzzle is CTF{3R_iS_0n_th3_W4y!}.

Combining the answers:

Each time you capture a flagration, you can verify it on the landing page, where it gets overlaid on three flames. This is what it would look like if you complete all five:

In the spirit of a chill puzzle hunt, this puzzle should also be solvable with only 4 challenges solved (or even 3, if you're so inclined). The natural thing to do is to arrange the flames in order, and possibly wheel-of-fortune some of the blanks. With all five flagrations, this could be arranged as such:

This spells out the intermediate cluephrase PARIS HILTON SAYS, for the final answer THAT'S HOT.

This was by far the longest puzzle I've ever written, taking well over a year from conceptualisation to being finalised and probably some 100+ manhours of on-and-off work within that year-and-a-bit. (I was even warned that the payoff might not be worth it, but that's totally not why I write puzzles.) Consequently, you can expect quite a lot of notes from this puzzle, so I have tried to break the notes themselves into smaller sub-notes (!).

Background (CTF):

So, obviously the theme may not make much sense if you've never heard of it, but there is a type of competition called a Capture the Flag (CTF). The challenges in a CTF are rooted in cybersecurity and tend to involve hacking various things, or otherwise solving quite mathematical/logical puzzles. There are various links on Google explaining more, here's one for example.

The core categories in a CTF would typically be Cryptography, Reverse Engineering, Pwn (aka Binary Exploitation), and Web Exploitation. Unfortunately I couldn't get a good pun in for "Web". Other than these core categories, you can also often expect forensics challenges where you would analyse network traffic, or otherwise get involved in some red teaming.

I've participated in quite a number of CTFs, possibly more so than puzzle hunts, and have noticed that these two worlds have started to converge slightly. There are plenty of similarities between them, e.g. they both tend to have elegant aha moments, but I guess the main difference is that CTFs tend to require highly specialised knowledge about a narrow range of topics, while puzzles tend to require google-able knowledge about a wide range of topics. Also CTFs tend to be more pragmatic about when you've solved a challenge (they just go "here's your flag"), while puzzles would typically get you to perform an (usually thematic) extraction step to get a final answer. Flags always have a weird-looking form, e.g. CTF{wh4t_i5_th1s?} compared to puzzle answers which tend to look much more human-friendly. And I haven't even said anything about metapuzzles...

Anyway, many CTF people are starting to try out puzzle hunts and vice-versa. The REDDOThunt 2020 puzzle The Illuminator, for example, wouldn't feel out of place in a CTF which might help to explain its decent solve rate, but I guess also felt out of place for non-programmers.

For the purpose of this puzzle, I wanted the puzzle hunting audience to get as authentic a feel as possible as to what participating in a CTF would look like. To that end, I've even based some of the UI on CTFd, which is one of the most popular CTF platforms at the moment. A CTF player should feel completely at home in this puzzle, while a non-CTF player should still find that it all feels quite natural.

Specifically, I aimed to recreate an entire CTF competition (which would typically have on the order of 30 challenges), but with just five challenges. At the same time, I also aimed for a more balanced point on the spectrum where a veteran puzzle hunter wouldn't have a significant advantage over a veteran CTFer or vice-versa. I hope that I've managed to meet these targets.

Finally, if you are an active CTF player, you'll probably want to know more about myself. I play as Neobeo on the Singapore-based team Social Engineering Experts (and yes, we also just ran our inaugural CTF (called SEETF) last month). I mainly specialise in cryptography, but am also quite decent at reverse engineering.

Background (Firefighting):

The idea to pair the CTF concept with a firefighting one was apparent as soon as THAT'S HOT appeared as a possible meta answer. For one, I served my National Service as a firefighter in the SCDF, which makes it a specialty area for me. I've written a couple of fire-themed puzzles before, but nothing that quite captures a proper firefighting experience. So one of the minor aims of this puzzle is to let the solver leave with some knowledge of firefighting.

I played with quite a number of different concepts here, but in the end I was mostly content to just spread general awareness of the types of vehicles and equipments that firefighters use, and the kinds of challenges they might face. For Reverse Extinguishing, though, I definitely aimed for something more educational.

The puzzle title is a portmanteau of Capture the Flag (CTF) and flagration, which is an obscure (if not obsolete) word for a fire.

Writing the challenges:

While I had quite a lot of experience in C++, C#, and Python, web development in general was new to me so this was quite a challenge for myself. Consequently, it made sense that I would begin with the one puzzle that would already have a good existing implementation: this Rush Hour implementation that formed the basis of Pwnp Ladder. I actually spent quite a while making sure this works well on mobile, but there were definitely extra things to consider like responsive design and multiple touches. The other challenges also required more screen estate, so eventually I just gave up on the idea of making it run on mobile.

Somewhere in between all that, I also learnt how to use d3.js and in particular its dragging capabilities. I also used SweetAlert2 as the dialogbox, because alert() is definitely not a thing in the modern web.

I tried outsourcing some of the work, but I think it was quite difficult to find people who were sufficiently motivated to help me out at no cost, and are also willing to keep up with my ever-changing vision of the puzzle. To that end, I am very grateful to jontay999 for helping me code up the implementation of Wetwork Traffic from scratch.

Red Team was directly inspired by a game in the Lost Mind of Dr. Brain called Motor Programming, here's a youtube link of how the game worked. I toyed with the idea of making the fire spread over time, but in the end opted to keep it simple.

There was no particular inspiration behind creeptography; all I knew was that I wanted a very mathsy challenge given the whole affiliation with cryptography. Since the pun was kind of forced, creeping implies a confined space fire which implies ropes I guess, which is how this puzzle was born.

Finally, Reverse Extinguishing happened because I was completely out of gas to create more games. The original idea I had for it remains valid, so I will not discuss it here in case I want to use it in a future puzzle. I totally think this version works though, as the lack of interactivity does mean you have to do some proper research on fire classes and extinguishers, and not just infer the rules from the game.

Much thanks to Janice Heng for the custom artwork, including the landing page roadmap, the pixel art used in Pwnp Ladder and Wetwork Traffic, as well as the background in Creeptography. The jigsaw-style coding pieces were taken from Lego Boost, and the animated fire from JoyPixels.

Other comments:

The original intent was always for Wetwork Traffic and Red Team to be just a single level (for this puzzle), but at the same time I also envisioned them being a series of levels growing in difficulty. The particular inspiration for this would be for my kids to play. Incidentally, both my 7-year-old and 4-year-old successfully test-solved Pwnp Ladder (the latter without a time limit), so I guess they should get some credit as well. Anyway, I never got round to making other levels. Not only that but the starting positions are hard-coded in the javascript so it's non-trivial to decouple it to make new levels. Nevertheless I hope I might find some time in the near future to refactor away the spaghetti code and open-source it.

Speaking of Pwnp Ladder, you might be wondering (especially if you're a CTF player) if the time limit was checked by the server in any way. The answer is no, and if you disabled the time limit via javascript or so you'd still end up with a valid flagration. This was by design — since this was intended to be the easiest challenge anyway, I thought I might as well allow for a CTF-style "unintended solution".

Last but not least, if you enjoy hacking or other cybersecurity-related stuff but have only just discovered CTFs, then welcome! A whole new world awaits you!