Skip to main content

Dog_barking

Challenge​

Imported from local notes.md.

Solution​

Original Notes​

Dog_barking

Challenge Summary​

  • Given: a single WAV file, challenge.wav, with the hint that the dogs were “trying to tell me something”.
  • Goal: recover the flag in format CIT{...}.
  • Constraints: no other service or files were provided.

Initial Recon / Triage​

  • Observations: the file is a 16 kHz mono PCM WAV about 78 seconds long.
  • File identification: starting_files/challenge.wav is ordinary RIFF/WAV with no embedded extra data or useful metadata.
  • Entry points: the audible bark segments themselves; the spectrogram did not reveal visual text.

Hypotheses & Approach​

  • Hypothesis 1: the message is encoded in the timing of the barks.
  • Hypothesis 2: the message is actually a tone-based binary stream, with different bark pitches representing bits and a third pitch acting as a byte separator.

Execution Steps (Reproducible)​

Stage 1​

Commands:

cd /root/cit2026CTF/Dog_barking
file starting_files/challenge.wav
soxi starting_files/challenge.wav
ffmpeg -y -i starting_files/challenge.wav -lavfi showspectrumpic=s=1600x900:legend=disabled:color=intensity artifacts/spectrogram.png
binwalk starting_files/challenge.wav

Results:

  • The WAV contained no extra chunks or appended payloads.
  • The spectrogram showed repeated vertical events but no visible text.
  • This pushed the analysis toward bark segmentation and frequency clustering.

Stage 2​

Commands:

cd /root/cit2026CTF/Dog_barking
python3 artifacts/analyze_timing.py
python3 artifacts/analyze_segments.py
python3 artifacts/decode_audio.py

Results:

  • Bark segments clustered around three effective frequencies:
    • about 500 Hz = binary 0
    • about 875 Hz = binary 1
    • about 530 Hz = byte separator
  • A few 435 Hz segments appeared, but these aligned with damaged 875 Hz symbols and had to be treated as binary 1 to preserve valid 8-bit groups.
  • Splitting the bitstream on the separator tones and decoding each 8-bit group as ASCII yielded the flag.

Recovered bytes:

01000011 01001001 01010100 01111011 01100010 00110100 01110010 01101011
01101001 01101110 01100111 01011111 01110101 01110000 01011111 01110100
01101000 00110011 01011111 01110111 01110010 00110000 01101110 01100111
01011111 01110100 01110010 00110011 00110011 01111101

Artifacts Produced​

  • artifacts/fetch_files.py: helper used to pull the challenge metadata and WAV.
  • artifacts/spectrogram.png: spectrogram generated during triage.
  • artifacts/analyze_timing.py: bark timing helper.
  • artifacts/analyze_segments.py: bark frequency helper.
  • artifacts/decode_audio.py: final decoder used to recover the message.
  • artifacts/decoded_bits.txt: recovered byte groups.
  • artifacts/segment_detail.json: per-segment frequency and symbol data.

Flag​

CIT{b4rking_up_th3_wr0ng_tr33}