A Word to the Wise · Huntress CTF 2026

The challenge

Office documents contain relationships that point beyond the page. Separate internal references from external dependencies and find the document reaching somewhere it should not.

The Single Solve asked one new question:

`answer_id`	Question	Format
`d15-ooxml-001-ooxml-external-relationship-targets`	Determine ooxml.external_relationship_targets for document-15-001.docx.	JSON: "compact valid JSON array with exact values and order"

The Time Trial and Mastery asked that question again, plus every earlier day's Metadata field (19 in all per set), plus one question type the Single Solve never showed:

`answer_id`	Question (shortened)	Format
`metadata-day-15-synthesis-sha256-order`	Compute the SHA-256 of each named file, then give their filenames as a compact JSON array in ascending digest order. Files: `evidence-note.txt`, `panel-001.png`, `telemetry-agent-001.exe`, `document-15-001.docx`	JSON array, case-insensitive

Reading the prompt: what it said we'd need

Clue	What it pointed to	What I did about it
"Office documents contain relationships"	OOXML is a zip (an OPC package) whose parts are linked by `.rels` files	Read every `*.rels` part, not a fixed path
"point beyond the page"	Relationships can target things outside the package	Looked at each `Relationship`'s `Target`
"Separate internal references from external dependencies"	`TargetMode="External"` marks the outside ones; no attribute means internal	Kept only `TargetMode="External"`
"find the document reaching somewhere it should not"	In a set of documents, the one with external targets	One `.docx` here; the solver works per document
"exact values and order" (format)	The order is part of the answer	Order turned out to be sorted, not file order (see below)

What was in the files

Single Solve: metadata-day-15-evidence.zip (1,316 bytes) held one member, document-15-001.docx: a minimal WordprocessingML package. _rels/.rels held two internal relationships (the main document and the core properties). word/_rels/document.xml.rels held two hyperlinks, both TargetMode="External": rId9 https://example.test/evidence/d87ca62c5bb7 and rId10 https://example.test/control. The body text "Evidence reference" and "Control reference" uses rId9 then rId10.
Time Trial and Mastery: the same evidence bundle as the earlier days (JPEG, PNG, PDF, nested zip, PE, .NET DLL, MSI, LNK, a note file, and a roster) plus the same .docx. Each Mastery set had different digests, so the synthesis order changed per set.

Single Solve

Our automated morning solver (a scheduled script on our Kali VM) started it and stopped cleanly: the field wasn't one of the 165 fields we had pre-built the day before (only OOXML core and app properties were), and the inherited chain couldn't find a target file, because the .docx is itself a zip and the older chain drops zip members from its candidates.

Solver: today's solver loads the pre-built Day 15 chain unchanged and registers one new field. It walks every .rels part in the package and keeps each relationship with TargetMode="External", Target verbatim. Anything that isn't an OPC package, or an unknown TargetMode spelling, raises instead of guessing. Tests cover internal-vs-external, an empty result ([]), verbatim text, non-OOXML input, and the Mastery shapes (setN. ids, delivery N: names, the [assigned-artifact-sha256:…] tag).

The order was a judgement call. The format said "exact values and order", so we tried the forms in order:

Stored order (evidence, control): incorrect (13:02:26Z).
Sorted (control, evidence): CORRECT (13:02:50Z), 5def1448…05ca.

Sorting by Target text and sorting by relationship Id as a string (rId10 before rId9) both give that order for this one document. The solver sorts by Target text (distinct values), which doesn't depend on part order.

Time Trial

First attempt (ranked, 50 s clock): incorrect. Every answer except one came from confirmed solvers. The new synthesis question was the problem: the inherited chain saw sha256 in its id and answered evidence-note.txt's SHA-256, a confidently wrong answer. The regression rehearsal had passed, but no saved set contained this question type, so nothing could catch it. The clock ran out; nothing more was sent.

Fix (offline): a strict handler for metadata-day-NN-synthesis-<md5|sha1|sha256|sha512>-order. It reads the file list from the question text (after stripping the sha tag), finds exactly one file per name in the question's scope, hashes the full file, and sorts in the direction the text names. A missing file, a duplicate name, no direction, or an id/text mismatch raises. Tests went from 9 to 14, and the rehearsal passed again (52 saved sets, 0 changed).

Retry, ranked:

started_at 2026-10-15T13:07:47.497Z  deadline 2026-10-15T13:08:37.497Z  (20 questions; 30 unique attempts left)
  d15-ooxml-001-ooxml-external-relationship-targets: ["https://example.test/control","https://example.test/evidence/d87ca62c5bb7"]
  metadata-day-15-synthesis-sha256-order: ["evidence-note.txt","telemetry-agent-001.exe","document-15-001.docx","camera-001.jpg"]
  retry        2455 ms
  artifact      768 ms
  solve          25 ms
  submit       1276 ms
  TOTAL        4525 ms
  vs started_at: retry +87, artifact +855, solve +880, submit +2156 ms
result CORRECT  flag 0588a043…63a0

Mastery

Ranked (170 s clock), 5 sets, 100 answers, first attempt:

started_at 2026-10-15T13:07:54.814Z  (5 sets x 20 questions)
  set3.metadata-day-15-synthesis-sha256-order: ["panel-001.png","evidence-note.txt","telemetry-agent-001.exe","document-15-001.docx"]
  set5.metadata-day-15-synthesis-sha256-order: ["evidence-note.txt","telemetry-agent-001.exe","panel-001.png","document-15-001.docx"]
  start         760 ms
  artifact      742 ms
  solve         544 ms
  submit       1152 ms
  TOTAL        3198 ms
  vs started_at: start +141, artifact +883, solve +1426, submit +2579 ms
result CORRECT  flag b9be5763…5c16

Time to solve

All three modes were solved by 13:07:56 UTC (09:07:56 ET), 7 min 47 s after the first start. The Single Solve went through on the second form at 13:02:50; the first ranked Time Trial was incorrect, and its ranked retry (+1.4 s) and the ranked Mastery (+1.9 s) then went through on the first submit.

Takeaways

Timed sets can add question types the Single Solve never shows. The rehearsal only proves what saved sets contain. A matcher that "answers anything mentioning sha256" turns a new type into a confident wrong answer. Unknown question ids in a timed set should stop the run instead.
"Exact values and order" doesn't mean file order. The checker wanted the targets sorted. Have a ranked list of forms ready and send the stored form first; the second form cost 24 s.
External relationships are a fast tell. A TargetMode="External" target in a document's .rels is exactly how remote templates and tracking links get in.