## [See original writeup on site](https://barelycompetent.dev/post/ctfs/2021-04-11-ritsecctf/#inception-ctf-dream-3)
### Inception CTF: Dream 3> Note: This challenge builds on Inception CTF: Dream 2.>> While the first two steps were easy it’s all hard from here on out, ThePointMan is the most crucial role of the mission he has to be presentable but without giving away our intentions. Use Alternate Dream State to find the flag before the kick.>> Author: Brandon Martin
So, from level 2, we already know the password for the 7z for this level is `WaterUnderTheBridge`, so can now extract accordingly:
```bash7z x TheHotel.7z
7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,32 CPUs AMD Ryzen 9 3950X 16-Core Processor             (870F10),ASM,AES-NI)
Scanning the drive for archives:1 file, 158376 bytes (155 KiB)
Extracting archive: TheHotel.7z
Enter password (will not be echoed): <enter "WaterUnderTheBridge">--Path = TheHotel.7zType = 7zPhysical Size = 158376Headers Size = 264Method = LZMA2:192k 7zAESSolid = +Blocks = 1
Everything is Ok
Files: 3Size:       158141Compressed: 158376```
Which gives us:
```bash  rw-rw-r--   1   ganondorf   ganondorf    153 KiB   Wed Feb 24 13:35:31 2021    SnowFortress.7z  rw-rw-r--   1   ganondorf   ganondorf    154 KiB   Fri Apr  9 18:10:13 2021    TheHotel.7z  rw-rw-r--   1   ganondorf   ganondorf      1 KiB   Wed Feb 24 13:25:31 2021    ThePointMan.txt```
Which (**_groans_**) is the following garbage:
```cat ThePointMan.txtQ3JlYXRlIGEgbWF6ZSBpbiB0d28gbWludXRlcyB0aGF0IHRha2VzIG1lIG9uZSBtdW5pdGUgdG8gc29sdmUuIA==
59 6f 75 27 72 65 20 77 61 69 74 69 6e 67 20 66 6f 72 20 61 20 74 72 61 69 6e 2c 20 61 20 74 72 61 69 6e 20 74 68 61 74 20 77 69 6c 6c 20 74 61 6b 65 20 79 6f 75 20 66 61 72 20 61 77 61 79 2e 20 59 6f 75 20 6b 6e 6f 77 20 77 68 65 72 65 20 79 6f 75 20 68 6f 70 65 20 74 68 69 73 20 74 72 61 69 6e 20 77 69 6c 6c 20 74 61 6b 65 20 79 6f 75 2c 20 62 75 74 20 79 6f 75 20 63 61 6e 27 74 20 62 65 20 73 75 72 65 2e 20 62 75 74 20 69 74 20 64 6f 65 73 6e 27 74 20 6d 61 74 74 65 72 20 2d 20 62 65 63 61 75 73 65 20 77 65 27 6c 6c 20 62 65 20 74 6f 67 65 74 68 65 72 2e 20
|[email protected]@DH.GLBB@W	.aDWILKB. BXOR 25
Gung znal qernzf jvguva qernzf vf gbb hafgnoyr!
--. ..- .-...-. .-. .-. --.---. ..- -. --..--- .-.-.-. -.-- -. .- --. .-. --.-...- .---. ..- ...- ..-.--.. -. .- .----. ..-.--.. ...- .- --.---.. -. .-...--. ..- -. .- - .-..-. .. .-. . .-.. --. ..- ...- .- - .-.-.-
No place for a tourist in this job.```
So, in order of appearance:
* base64:
```bashecho 'Q3JlYXRlIGEgbWF6ZSBpbiB0d28gbWludXRlcyB0aGF0IHRha2VzIG1lIG9uZSBtdW5pdGUgdG8gc29sdmUuIA==' | base64 -dCreate a maze in two minutes that takes me one munite to solve.```
* [hex -> ascii](https://gchq.github.io/CyberChef/#recipe=From_Hex('Auto')&input=NTkgNmYgNzUgMjcgNzIgNjUgMjAgNzcgNjEgNjkgNzQgNjkgNmUgNjcgMjAgNjYgNmYgNzIgMjAgNjEgMjAgNzQgNzIgNjEgNjkgNmUgMmMgMjAgNjEgMjAgNzQgNzIgNjEgNjkgNmUgMjAgNzQgNjggNjEgNzQgMjAgNzcgNjkgNmMgNmMgMjAgNzQgNjEgNmIgNjUgMjAgNzkgNmYgNzUgMjAgNjYgNjEgNzIgMjAgNjEgNzcgNjEgNzkgMmUgMjAgNTkgNmYgNzUgMjAgNmIgNmUgNmYgNzcgMjAgNzcgNjggNjUgNzIgNjUgMjAgNzkgNmYgNzUgMjAgNjggNmYgNzAgNjUgMjAgNzQgNjggNjkgNzMgMjAgNzQgNzIgNjEgNjkgNmUgMjAgNzcgNjkgNmMgNmMgMjAgNzQgNjEgNmIgNjUgMjAgNzkgNmYgNzUgMmMgMjAgNjIgNzUgNzQgMjAgNzkgNmYgNzUgMjAgNjMgNjEgNmUgMjcgNzQgMjAgNjIgNjUgMjAgNzMgNzUgNzIgNjUgMmUgMjAgNjIgNzUgNzQgMjAgNjkgNzQgMjAgNjQgNmYgNjUgNzMgNmUgMjcgNzQgMjAgNmQgNjEgNzQgNzQgNjUgNzIgMjAgMmQgMjAgNjIgNjUgNjMgNjEgNzUgNzMgNjUgMjAgNzcgNjUgMjcgNmMgNmMgMjAgNjIgNjUgMjAgNzQgNmYgNjcgNjUgNzQgNjggNjUgNzIgMmUgMjA)
```You're waiting for a train, a train that will take you far away. You know where you hope this train will take you, but you can't be sure. but it doesn't matter - because we'll be together.```
* Base58?* [ROT13](https://gchq.github.io/CyberChef/#recipe=ROT13(true,true,false,13)&input=R3VuZyB6bmFsIHFlcm56ZiBqdmd1dmEgcWVybnpmIHZmIGdiYiBoYWZnbm95ciEK)
```That many dreams within dreams is too unstable!```
* [Morse code (and ROT13)](https://gchq.github.io/CyberChef/#recipe=From_Morse_Code('Space','Line%20feed')ROT13(true,true,false,13)&input=LS0uIC4uLSAuLS4KLi4tLiAuLS4gLi0uIC0tLi0KLS0uIC4uLSAtLiAtLS4KLi0tLSAuLS4KLS4tLiAtLi0tIC0uIC4tIC0tLiAuLS4gLS0uLQouLi4tIC4tCi0tLiAuLi0gLi4uLSAuLi0uCi0tLi4gLS4gLi0gLi0tLS0uIC4uLS4KLS0uLiAuLi4tIC4tIC0tLi0KLS0uLiAtLiAuLS4uCi4tLS4gLi4tIC0uIC4tIC0gLi0uCi4tLiAuLiAuLS4gLiAuLS4uIC0tLiAuLi0gLi4uLSAuLSAtIC4tLi0uLQo)
```THE SEED THAT WE PLANTED IN THIS MAN'S MIND MAY CHANGE EVERYTHING.```
So nothing there. Though, I just noticed there is also an additional file that I missed from before, as the name of the file is a special character (`<200e>`, which is the "Left to Right mark"):
```strings ./<200e>You mean, a dream within a dream? NTIgNDkgNTQgNTMgNDUgNDMgN2IgNDYgNDAgMjEgMjEgNjkgNmUgNjcgNDUgNmMgNjUgNzYgNDAgNzQgNmYgNzIgN2Q=```
Which then:
```bashecho NTIgNDkgNTQgNTMgNDUgNDMgN2IgNDYgNDAgMjEgMjEgNjkgNmUgNjcgNDUgNmMgNjUgNzYgNDAgNzQgNmYgNzIgN2Q= | base64 -d52 49 54 53 45 43 7b 46 40 21 21 69 6e 67 45 6c 65 76 40 74 6f 72 7d```
Which then [decodes into](https://gchq.github.io/CyberChef/#recipe=From_Hex('Auto')&input=NTIgNDkgNTQgNTMgNDUgNDMgN2IgNDYgNDAgMjEgMjEgNjkgNmUgNjcgNDUgNmMgNjUgNzYgNDAgNzQgNmYgNzIgN2Q) `RITSEC{F@!!ingElev@tor}`.
Flag is `RITSEC{F@!!ingElev@tor}`.