Zip Code

The challenge

"A delivery archive nests scripts inside containers inside more containers. Trace each member's role and handoff without executing a single one, and identify the link in the chain that was never supposed to be delivered."

913 questions about the specimens in one evidence.zip (Day 12 had 855). The lane compounds: every earlier day's specimens come back. 58 new questions:

• a new polyglot host, AppleScript, with four specimens (benign utility, downloader, launcher, staged chain) of 11 questions each = 44, the same families as Day 12's AutoIt set (role, attack, adapter, campaign, file path or URL, stage count, steps, host profile, obfuscation, stage profile, next language);
• two more advanced Bash specimens (subshell-pipeline.sh, process-substitution.sh) of 7 questions each = 14:

Answer kinds across all 913: 540 exact text, 149 enum, 102 pattern, 60 integer, 60 ordered tokens, 2 ATT&CK IDs.

Reading the prompt: what it said we'd need

Safety

• The specimens are inert, malware-styled scripts. The solver reads them as text in memory; nothing is run.
• This write-up was built from the solver's report and the saved Game Master replies only. The specimens weren't reopened for it.

What was in the files

• Single Solve: one evidence.zip with every lane-to-date specimen. From the solver's record, the four AppleScript specimens:

All four had host profile standalone; campaigns look like APPLESCRIPT-b8d7de84, URLs are under .example.invalid. Note: in Day 12's AutoIt set each role came with its own kind of graph (the benign utility only decoded and returned its config). Here the graphs are shifted by one: the "benign utility" downloads and runs, and the "staged chain" only returns its config. Every value was accepted as decoded. Whether this is the link "never supposed to be delivered" is my reading, not confirmed. - The two new Bash specimens: role advanced_syntax, attack T1059.004, steps recognize_syntax>reconstruct_intent, stage count 1; features subshell_pipeline (primitive command_substitution_pipeline) and process_substitution (primitive process_substitution_reader). - Time Trial: the same 913 questions on a fresh evidence.zip (98 KB). Mastery: two sets, 1,826 questions, one zip (197 KB). The solver's report prints the WMI MOF staged-chain fields (an earlier day's host) for both timed sets: standalone, base64, two_stage_download_execute, vbscript.

Single Solve

The solver ran the challenge through our Day 8 core solver and the usual add-ons (Batch vocabulary, VBScript control flow, JScript), then sent in its usual order. 28 submits from 13:01:14 to 13:02:01 UTC:

• Single Solve CORRECT at 09:02:01 ET (solved_by.at 13:02:00.941Z), flag 0268c057…1071.
• The solver's "rejected on another question before (still sent)" lines on six VBScript labels (while_once, do_once, for_once, direct) are its usual warning: those labels were wrong on some other script once, and are right here. All six were accepted. Day 12's JScript role fix held: the roles batch went in clean.

Time Trial

CORRECT on the first attempt. 50 s clock, unique_attempts_remaining: 0, hall_of_fame_eligible: false.

started_at  2026-10-13T13:02:07.485Z
deadline    2026-10-13T13:02:57.485Z   (50 s)
answers     913, one submit
start 790 ms · artifact 429 ms · solve 97 ms · ready 1 ms · submit 2062 ms · TOTAL 3378 ms
vs started_at: start +261, artifact +689, solve +786, ready +787, submit +2849 ms
stamped     13:02:08.675Z (+1.19 s after started_at)
result      CORRECT   flag 48a2ab6a…ab98

The CORRECT reply also carried an unexplained message: "The original solve time is recorded, but the player's name is currently unavailable." No other logged reply for this challenge carries it.

Mastery

CORRECT on the first attempt (2 sets, 1,826 answers, 80 s clock, unique_attempts_remaining: 0, unranked).

started_at  2026-10-13T13:02:16.107Z
deadline    2026-10-13T13:03:36.107Z   (80 s)
answers     1826, one submit
start 951 ms · artifact 395 ms · solve 188 ms · ready 2 ms · submit 1285 ms · TOTAL 2822 ms
vs started_at: start +412, artifact +806, solve +995, ready +997, submit +2282 ms
stamped     13:02:17.558Z (+1.45 s after started_at)
result      CORRECT   flag beb1ffca…4683

Later: ranked retries (2026-10-15)

On 2026-10-15 Days 13–14 began to accept ranked starts with fresh pools. The Mastery now came as five sets (4,565 answers, 170 s clock).

• 13:04 ET, Time Trial: CORRECT, ranked, +8.06 s. The server was slow (the download alone ended at +3.3 s).
• 13:05 ET, Mastery: incorrect (+10.76 s). No new question kinds; the Batch expansion rule had held on every other set, so the cause wasn't obvious.
• 21:45 ET, untimed diagnosis (a plain retry: unranked, no clock). The answers went in batches, and each incorrect batch was split in halves down to single answers (about 7 minutes at the 1–2 s submit spacing). Cause: Day 13's generator labels a guarded rebuild line (if defined HUNTRESS_READY … set "x=…") as percent, whatever form the line uses, and our Batch vocabulary sends the literal form first. That attempt went CORRECT at 21:52 ET (unranked). Days 14–15 took the literal form on 11/11 guarded lines the same night, so the rule is per day.
• 22:36 ET, Time Trial: incorrect. Its one guarded line went out literally; the afternoon's ranked time stands.
• 22:41 ET, Mastery: CORRECT, ranked, +3.85 s with a Day 13-only override (guarded rebuilds → percent; checked offline 45/45 against the 21:45 attempt; it changed 4 guarded lines in the new variant).

Boards after all of 2026-10-15's passes: Time Trial 8th of 14 (6.215 s), Mastery 3rd of 9 (2.600 s). Any further Day 13 Script retry needs the override first.

Time to solve

All three modes were solved by 09:02:18 ET, 1 min 5 s after the Single Solve was started; the 28 Single Solve batches were all accepted, and the unranked Time Trial and Mastery each went through on the first submit. On 2026-10-15 the ranked Time Trial went through at +8.06 s, and the ranked Mastery at +3.85 s after one incorrect ranked attempt and an untimed diagnosis.

Takeaways

• A generic template solver pays off again. The Day 8 core answered a new host (AppleScript) and two new Bash features without a change, and Day 12's JScript role fix held.
• "Accepted on the day" doesn't mean "right on every regenerated set." The day's sets passed; a later pool exposed a per-day labelling rule for guarded lines. An untimed, batched run with bisection found it in 7 minutes without burning ranked attempts.
• Keep day-specific overrides out of the shared vocabulary. Days 14–15 want the literal form, so the fix lives in a Day 13-only override, not in the shared Batch vocabulary.