One More Thing · Huntress CTF 2026

The challenge

Thirty-two, a little pressure, then sixty-four. Unpack that thought.

answer_id	Question	Format
`message`	"Decode the assigned blob completely. What exact answer slug does its final non-empty decoded line instruct you to submit?"	three lowercase words and a two-digit number, hyphenated; the slug only

The Mastery asked the same question once per blob (setN.message), 153 sets.

Reading the prompt: what it said we'd need

Clue	What it pointed to	What I did about it
"Thirty-two"	Base32	The innermost layer is standard Base32 with `=` padding
"a little pressure"	Compression	gzip: the middle layer, and why the outer text starts `H4sI` (gzip's magic in Base64)
"then sixty-four"	Base64	The outer layer
"Unpack that thought"	Decompress, then keep decoding	After inflating, the result is Base32 text, not plaintext yet
"One More Thing" (title)	One more layer on the pile	The Mastery blob's line 31 is this new layer; lines 1–30 are each earlier day's

Reading order note: the prompt lists the layers in the order they were applied (Base32, then gzip, then Base64). Decoding runs the other way: Base64 → gunzip → Base32.

What was in the files

Single Solve: 01-blob.txt, 196 bytes, the whole sentence in the new stack. Slug quick-piano-fern-76.
Time Trial: 01-blob.txt, 196 bytes, the same template with a different value. Slug bright-candle-pepper-63.
Mastery: 153 blobs of 31 labelled lines (the two saved as test data are 2,297 and 2,729 bytes). Line N is in Day N's layer, and line 31 is in today's. For example, H4sI… decodes to MUWTKMI=, which decodes to e-51.

The Single and Time Trial didn't need anything new. The solver's Day 27 chain already read the whole-sentence form by stacking decoders it had. The 31-line Mastery is what broke.

Single Solve

The solver solved it with no stop, using the Day 30 Warmups chain.

deadline    none (Single Solve)
answers     1   quick-piano-fern-76
start        274 ms
artifact     274 ms   (196 bytes)
solve         24 ms
submit       832 ms
TOTAL       1404 ms   (submit +1,221 ms after started_at)
result      CORRECT   flag 2a7370ad…110c   (09:00:21.4 ET)

Time Trial

CORRECT on the first attempt, ranked (fresh variant, 30 s clock).

answers     1   bright-candle-pepper-63
start        451 ms
artifact     283 ms   (196 bytes)
solve         21 ms
submit      1109 ms
TOTAL       1863 ms   (submit +1,510 ms after started_at)
result      CORRECT   flag fbcdcccb…5baf   (09:00:28.1 ET)

Mastery

The ranked run: stopped unsent, clock expired

The solver started the ranked Mastery at 09:00:34.6 ET (153 sets, deadline 09:03:24.6, a 2 min 50 s clock). Every set failed with "no instruction line found": line 31 had no strict layer, and the chain's walk found no instruction line in the mixed blob. The solver logged "solve budget used up after 0 answers", sent nothing, and the clock expired. The solver doesn't retry on its own.

The new layer (Claude helper agent)

Today's solver builds on the Day 30 solver and adds: - A strict Base64-gzip-Base32 decoder for label 31: validated Base64, the gzip magic, then upper-case padded Base32. With every label 01–31 now having a strict layer, Day 30's strict per-day reading handles the 31-line Mastery. Nothing else in it changed. - The same stack as a low-cost text decoder (the same slot Days 24, 26, and 27 used), with the memo caches cleared, so the chain also reads the stack on short blobs. Without it the regression rehearsal's 12-line synthetic mix failed with "no instruction line found", even though the real Mastery only needed the strict layer. - An encoder for the new stack (for synthetic tests), and per-set solving.

Checks before sending: - Its tests: 12 passed. They cover the Single and Time Trial blobs, the new decoder on known and rejected input, the label-31 strict layer, saved Mastery sets, an older layer on line 31 not taken as strict, the chain reading the new layer, and older layers (Ook!) still read. - Offline on the saved Mastery: 153/153 answered by the strict per-day reading, each with exactly one strict ending, the same as the whole-blob solve; the solve took 0.03 s; no ambiguity. - The Single and Time Trial blobs gave the same answers as the solver's CORRECT sends. - A regression rehearsal against earlier days' puzzles (60 synthetic sets with the new layer): passed. 187 saved attempts, slowest 2.79 s, per-set identical; 186 identical, 1 newly solved (today's Mastery), 0 changed; synthetic 60/60 in 0.81 s.

The untimed retry: CORRECT, not ranked

One untimed retry of the expired Mastery.

untimed retry; deadline None; not ranked
answers     153 (one per set)
retry        939 ms
artifact     320 ms
solve         32 ms
submit      4041 ms
TOTAL       5.3 s
result      CORRECT   flag 3a07d524…1190   (09:12:36.6 ET, solved_by.at 13:12:36.556Z)

Not ranked. The Game Master log shows no later Mastery run, so this lane has no ranked Mastery for Day 31. Today's solver then became our Warmups solver.

Time to solve

The solver's Single (09:00:21.4 ET) and ranked Time Trial (09:00:28.1) each took under a second from their start. The ranked Mastery's 2 min 50 s clock expired unsent at 09:03:24.6, and the untimed, unranked retry was CORRECT at 09:12:36.6, 12 min 36.6 s after release.

Takeaways

The prompt was the recipe, in reverse. "Thirty-two, pressure, sixty-four" lists the layers as applied; decoding undoes them from the outside in.
H4sI means gzip. A Base64 string starting H4sI is a gzip stream, and what comes out may still be encoded.
A chain that reads the Single can still miss the Mastery. The whole-sentence blob decoded by stacking existing decoders; the 31-line Mastery needed a strict layer per line label.
Fix both paths. The strict label-31 layer was enough for the real Mastery, but the short-blob path also needed the new decoder, and only the rehearsal's synthetic mix showed that.
The ranked clock doesn't wait for a new layer. Same pattern as Day 30: the solver's ranked Mastery expired, and the retry gave a CORRECT without a Hall of Fame time.