The Shortcut Home · Huntress CTF 2026

The challenge

"A shortcut collection is a map of intent—if you read where each link points instead of where it sits. Reconstruct the targets and identify the impossible destination."

One question about shortcut-001.lnk inside metadata-day-14-evidence.zip.

answer_id	Question	Format
`d14-lnk-001-lnk-target-path-windows`	"Determine lnk.target_path_windows for shortcut-001.lnk."	`exact_text`: "exact artifact-derived value only"; the literal `none` only when the field is absent; trimmed

Reading the prompt: what it said we'd need

Clue	What it pointed to	What I did about it
"shortcut", "lnk."	A Windows Shell Link file (MS-SHLLINK)	Parsed the header, ID list, LinkInfo, and StringData in Python, statically
"where each link points"	The target: LinkInfo's LocalBasePath (+ CommonPathSuffix), which the ID list also encodes	Read both and checked that they agree
"instead of where it sits"	The decoys: the working directory (`C:\Windows\System32`) and the description string	Kept them out of the answer
"target_path_windows"	A Windows path, written with backslashes	Sent the path exactly as stored
"exact artifact-derived value only"	Day 13's lesson: text fields go verbatim	Ranked list with the stored form first; it was accepted
"identify the impossible destination"	Probably for a later, multi-file variant; not asked today	Noted only

Safety

A shortcut is a launcher. The file was only parsed as bytes and never opened in Windows. The solver reads it in memory on our Kali VM.
The artifacts stayed on the VM.

What was in the files

Single Solve: metadata-day-14-evidence.zip (475 bytes) holding shortcut-001.lnk (547 bytes, deflated).
Header: the shell-link CLSID; flags 0x97 = HasLinkTargetIDList, HasLinkInfo, HasName, HasWorkingDir, IsUnicode (no relative path, arguments, or icon); the create, access, and write times are identical.
ID list: My Computer → C:\ → Windows → System32 → cmd.exe.
LinkInfo: a fixed drive, serial 0xA1B2C3D4, label HUNTRESS; LocalBasePath C:\Windows\System32\cmd.exe, and the CommonPathSuffix is empty.
StringData: the name Huntress deterministic shell-link evidence 7E5EF87F23AC and the working directory C:\Windows\System32.
There are no ExtraData blocks.
Every path in the file agrees: LinkInfo and the ID list both give C:\Windows\System32\cmd.exe. The working directory is its parent folder: "where it sits".
Time Trial: shortcut-002.lnk in a different zip. Mastery: one outer zip with two sets (d14-lnk-003, -004). All four shortcuts point at the same target.

Single Solve

Our automated morning solver (a scheduled script on our Kali VM) downloaded the file and flagged the question as new, as intended (it didn't know what this question asks).

Today's solver wraps Day 13's solver (and through it Days 1–12). It adds: - parsing the shortcut: the header and its flags, then the ID list, LinkInfo, and StringData in order; - the target rule: LinkInfo's LocalBasePath (the Unicode copy when the file has one) plus the CommonPathSuffix, exactly as stored. With no LinkInfo it falls back to the path built from the ID list. With neither, it stops instead of guessing; - matching the field: an exact check for question IDs ending in lnk-target-path-windows, ahead of the older days' matchers; - Mastery support: delivery N: labels, and a per-set mode so the solver can submit set by set if the clock runs short.

Ranked candidates, in order: 1. C:\Windows\System32\cmd.exe: LocalBasePath verbatim (the same as the ID-list path) 2. the same in lowercase 3. the same in uppercase 4. the same with forward slashes (weak)

The first was CORRECT at 09:04:40 ET, so the other three were never sent.

Tests (9, all pass on our Kali VM): - the field match is exact; - a delivery N: Mastery label finds its download; - the ID-list fallback works; - a Unicode LinkInfo plus a suffix is joined correctly; - Day 13's and Day 12's real questions still give their accepted answers.

Regression rehearsal (before the timed starts): 47 saved Metadata attempts, slowest 0.04 s, per-set answers equal on every Mastery. Against Day 13's solver: 45 identical, 2 newly solved (today's), 0 changed.

Time Trial

CORRECT on the first attempt. The challenge list marks this route as not supporting ranked starts, so the start was timed but unranked: 30 s, unique_attempts_remaining: 0.

started_at  2026-10-14T13:05:19.359Z
deadline    2026-10-14T13:05:49.359Z   (30 s)
answers     1   C:\Windows\System32\cmd.exe
solve       1 ms
stamped     13:05:20.645Z (+1.29 s after started_at)
result      CORRECT   flag 459942c4…1543

Mastery

CORRECT on the first attempt (2 sets, 30 s, unique_attempts_remaining: 0, unranked).

started_at  2026-10-14T13:05:27.786Z
deadline    2026-10-14T13:05:57.786Z   (30 s)
answers     2   C:\Windows\System32\cmd.exe (both sets)
solve       2 ms
stamped     13:05:28.538Z (+0.75 s after started_at)
result      CORRECT   flag f59b6858…717d

Time to solve

All three modes were solved by 09:05:28 ET, 5 min 20 s after the Single Solve was started; the Single Solve went through on the first send at 09:04:40 ET (flag 296e1f31…9748), 4 min 32 s after its start. The unranked Time Trial and Mastery each went through on the first submit.

Takeaways

The verbatim rule paid off at once. Day 13's lesson (send stored text exactly as stored, with a ranked list of forms ready) turned yesterday's 24 minutes of wrong forms into a single send.
A shortcut stores its target in several places. LinkInfo and the ID list should agree. The working directory and the description are what the prompt called "where it sits".
Running the morning lanes in parallel helped. Metadata had its own Claude helper agent and finished by 09:05:28, while Warmups was built at the same time.