zwesty
Write-ups / Day 28 / Script
Day 28 · Wed, Oct 28 · Script

Out of Order

Prey slaughtered

Script triage across 20+ languages, now including Terraform (HCL); analysis-descriptor plans; ATT&CK mapping; the core plus plug-in batches

STTMClaude Homebase Both

Flags are shortened to their first 8 and last 4 characters because they're unique per team.

Challenge ID
script-analysis-day-28-terraform-cloud-timeline (+ /time_trial, /mastery)
Solved
2026-10-28: all three modes CORRECT on the first submit, by 09:01:23.6 ET, 1 min 23.6 s after the 9 AM release. Single CORRECT 09:01:04.9; both timed modes ranked. No code changed
Player
Zwesty (solo), with Claude Code (Opus 5.5): our automated morning solver (a scheduled script on our Kali VM) solved it, with no hands-on Claude work needed

The challenge

The prompt text wasn't kept, and the challenge files weren't re-read for this write-up. What the records do show:

  • New "language": Terraform HCL. The question IDs use polyglot-terraform_hcl-…, and the solver's flagged list names terraform_hcl benign-utility and downloader values.
  • Single Solve: 1,703 questions (1,571 in the core batch, then 132 by the plug-ins). That is 44 more than Day 27's 1,659, the same step Day 27's four Dockerfiles × 11 fields made; today's files weren't listed.
  • Time Trial: new specimen fields with a six-hex stem, polyglot-terraform_hcl-e61285-{file-path,url-host,path-leaf,campaign-token}:
Field (suffix) Example from the Time Trial Format
-campaign-token 4abdb311 exact text
-url-host terraform_hcl-4abdb311de[.]example[.]invalid exact text
-file-path, -path-leaf not recorded exact text

The timed question counts and the Mastery's set count weren't recorded.

Reading the prompt: what it said we'd need

Clue What it pointed to What I did about it
terraform-cloud-timeline (challenge ID) Terraform files describing cloud resources, plus some ordering of events Nothing new was needed: the solver core's generic plan reader covers any polyglot-* file, as it covered Elixir, Erlang, and Dockerfile on Days 25–27
"Out of Order" (title) Steps or stages listed out of sequence; reading the true order The core sends each file's own ordered step graph from its plan, so the order came from the file, not from appearance
terraform_hcl values on the flagged list Values (none, T1105) rejected on other questions before Sent anyway, as designed; all accepted

Safety

Static analysis only. Nothing was executed. The solver's core reads each script as text and decodes its analysis plan in Python; no Terraform, cloud CLI, or other interpreter is started. For this write-up only our own records of the day were read; no challenge file was opened. Indicators below are defanged.

What was in the files

  • Single Solve: Day 27's scripts plus today's Terraform HCL specimens, 1,703 questions in all. The archive size and member list weren't recorded.
  • Time Trial: new values in specimen fields keyed by a hex stem (e61285), for example campaign token 4abdb311 and host terraform_hcl-4abdb311de[.]example[.]invalid.
  • Mastery: CORRECT; its set count and size weren't recorded.

Single Solve

The solver solved it in two batches, with no stop. Its core answered 1,571 questions; the reply was accepted with 132 remaining, which the plug-ins then sent merged.

It flagged 62 values it had seen rejected on other questions before (none, T1105, T1059.007, linear, among them the terraform_hcl benign-utility and downloader ones) and sent them anyway, as designed; none was rejected. That is the same count as Day 27.

deadline    none (Single Solve)
answers     1,571 core (accepted, remaining 132), then 132 plug-in answers
result      CORRECT   (09:01:04.9)

The Single flag isn't shown: the solver's report doesn't print it.

Report quirk, as on Day 27: the timings the solver's report printed under its "Single Solve: CORRECT" line are the Time Trial's, and the next block is the Mastery's. The figures below are assigned to the right modes.

Time Trial

CORRECT on the first attempt, ranked.

answers     includes polyglot-terraform_hcl-e61285-{file-path,url-host,path-leaf,campaign-token}
start       1741 ms
artifact     322 ms
solve         93 ms
submit      1088 ms
TOTAL       3247 ms   (submit +1,777 ms after started_at)
result      CORRECT   flag 17e05ea4…6593   (09:01:13.4)

The start took 1.7 s, over half the total; Day 27's was 0.8 s.

Mastery

CORRECT on the first attempt, ranked.

start       1718 ms
artifact     753 ms
solve       1056 ms
submit      1848 ms
TOTAL       5412 ms   (submit +4,595 ms after started_at)
result      CORRECT   flag 4d524435…f0e2   (09:01:23.6)

Time to solve

All three modes were solved by 09:01:23.6 ET, 1 min 23.6 s after release, each on the first submit; the Single Solve was CORRECT at 09:01:04.9 and both timed modes were ranked (+1.78 s and +4.60 s after their started_at). Script was one of two lanes the solver finished on its own that day.

Takeaways

  • A generic plan reader keeps paying, a fourth day running. Terraform HCL needed no code, as Elixir, Erlang, and Dockerfile needed none on Days 25–27.
  • Per-file reading answers "out of order". Whatever the title's ordering trap was, the core reads each file's own ordered steps and never carries a value between files, so it cost nothing.
  • The flagged-values list is a warning, not a veto. All 62 flagged values were accepted again.
  • The start request is now the slow part of the Time Trial. 1.7 s to start against 93 ms to solve. Worth watching if it repeats.
  • The solver's report still mislabels its Single block. Two days running, the "Single Solve" timings were the Time Trial's, and the Single flag wasn't printed.