Writeup 4 Speak Softly Love

题目概览

赛事：RCTF 2025（移植至攻防世界）
类型：Misc / OSINT（开源情报搜集）
核心：围绕 DOSMid 开发者 Mateusz Viste 及其项目展开的四阶段信息检索
本地验证 ：Challenge 2 可通过 svn log 直接确认

这道题不涉及漏洞利用，所有答案都来自公开可查的信息。四个挑战环环相扣，从项目视频到代码版本，再到作者个人网站，最后延伸到 Gopher 协议空间。

Challenge 1： Video ID

题目提示：

复制代码

Even with the limited hardware of that era, this small player could still produce surprisingly gentle melodies. Please help me locate the ID of the original upload of this piece.

解题过程：

关键词指向 DOSMid ------一个在 DOS/8086 环境下运行的 MIDI 播放器。在 YouTube 搜索 "DOSMid 8086" 或直接搜索 "DOSMid"，可以定位到作者发布的演示视频。从视频链接中提取 v= 参数后的 ID。

答案：8ssDGBTssUI

国内无法访问 YouTube，照抄答案。

Challenge 2： Code Revision

题目提示：

复制代码

The developer behind it has quietly maintained his corner of the net for many years. Please help me locate the version entry in the author's own code history where he introduced a safeguard to prevent endless "soft error" loops caused by missing playlist items.

解题过程：

百度搜索"dosmid"，找到一个链接：https://mateusz.fr/dosmid/

在页面中找到项目仓库地址：

复制代码

Subversion

DOSMid's source code is tracked and versionned on its svn repository:
svn co svn://svn.mateusz.fr/dosmid

直接对远程仓库执行日志查询，在日志中搜索题目提示中给的关键字 soft：

复制代码

root@Rambo:/攻防世界/SpeakSoftlyLove/dosmid# svn log | grep -B 2 -A 2 -i "soft"
r178 | mv_fox | 2016-05-09 01:21:38 +0800 (Mon, 09 May 2016) | 1 line

if too many 'soft' errors occur in a row, dosmid aborts (protects against 'soft errors loops', typically with playlist filled with non-existing files)
------------------------------------------------------------------------
r177 | mv_fox | 2016-05-09 01:07:46 +0800 (Mon, 09 May 2016) | 1 line
--
r65 | mv_fox | 2015-06-17 00:26:17 +0800 (Wed, 17 Jun 2015) | 1 line

setting volume in software again, reinstated default delay=2ms, improved keyboard reaction times and adjusted documentation
------------------------------------------------------------------------
r64 | mv_fox | 2015-06-16 01:53:15 +0800 (Tue, 16 Jun 2015) | 1 line
root@Rambo:/攻防世界/SpeakSoftlyLove/dosmid#

定位到 r178。

该提交正是题目描述的"防止播放列表缺失文件导致软错误死循环"的安全机制。SVN revision 号的格式需要在数字前加 r。

答案：r178

Challenge 3： Name-pronunciation URL

题目提示：

复制代码

The developer has quietly maintained his corner of the net for many years. Please help me locate the full URL that points to the recording in which he pronounces his own name.

解题过程：

在浏览器中访问：https://mateusz.fr

点击页面中作者名字的链接：Mateusz

访问作者 Mateusz Viste 的个人主页 https://mateusz.viste.fr/。

在页面的最下面：

提供了他名字发音的录音文件链接。

点击链接：here it is

跳转到新的网址：

http 复制代码

https://mateusz.viste.fr/mateusz.ogg

完整 URL 即音频文件的直接地址。

答案：https://mateusz.viste.fr/mateusz.ogg

Challenge 4： Donation address

题目提示：

复制代码

The developer has quietly maintained his corner of the net for many years --- a place filled with personal tools, archived ideas, and even a way to show appreciation if his work ever brought you something valuable. Please help me locate the address he published for donations in digital currency.

解题过程：

在 Mateusz Viste 的个人网站 https://mateusz.viste.fr/ ，找到：

复制代码

Hobbies

I enjoy writing open-source software in my spare time - mostly related to retro-computing, but not exclusively. I also run a modest gopherspace node (this is a gopher link - your browser probably won't know how to handle it).

其中有链接：gopherspace node

mateusz viste 维护的一个 Gopher 空间 （gopher://gopher.viste.fr）。由于现代浏览器已不支持 Gopher 协议，需要使用 Gopher 客户端（如 lynx、gopher）或网页代理（如 Floodgap 的 gopher.floodgap.com/gopher/gw.lite）访问。

http 复制代码

https://gopher.floodgap.com/gopher/gw.lite?gopher://gopher.viste.fr

页面显示：

复制代码

	 ......................................................................
	..........#######.... ##......... All that is gold does not glitter ..
	 ......####      #####  ####...... all that is long does not last   ...
	 ....###                   ###..... All that is old does not wither ...
	......###  Mateusz' gopher   ##..... not all that is over is past.  ..
	 ....###          lair     ###.......                               ...
	 ......##########       ####........................ J.R.R. Tolkien ...
	.................#########............................................
	 ......................................................................
	 
	The Observable Gopherspace Universe Project
	My Guestbook (leave a note!)
	Personal notes, probably useful only to me
	Ancient software (games & programs I appreciated back in old days)
	Ancient hardware (drivers & notes related to old computer hardware)
	Programming (mostly *really* old technologies)
	My Code Bastion: a place that mirrors all my open-source code
	My Hangman game (apparently many people like it, so here it is)
	The attic - stuff I don't know where else to put
	About this server
	 
	This gopher node is powered by the Motsognir gopher server.
	Looking for a light gopher client with a retro vibe? Meet Gopherus
	 
	Wanne help keep the light on?
	Donate some BTC bits
	 
	______________________________________________________________________
	 This gopher lair belongs to Mateusz Viste.
	 Running since 2009.
Top of page | Gopher proxy home | Floodgap home gopher 	version 645 port 2 	All access must be in accordance with Floodgap Terms of Service.

Proxy too slow? Get free clients and plugins for your favorite mobile and desktop browsers. Visit the Overbite Project.
Simultaneous clients: 2 (capped at 8)
Access to the proxy is limited to 16K/sec and maximum 4MB per access. Please use a full client for larger files.

进入 Gopher 空间后浏览菜单，可以找到作者公布的加密货币捐赠地址：Donate some BTC bits：

点击该链接，网址跳转到：

http 复制代码

https://gopher.floodgap.com/gopher/gw.lite?=gopher.viste.fr+70+312f646f6e6174652f

页面显示：

复制代码

 [?] gopher.viste.fr:70 > donate

	 
	Keeping this gopher server on-line means costs: electricity, internet
	access, maintenance, spare parts, OS updates, domain renewal, etc...
	 
	If you enjoyed your visit and/or found interesting stuff here, or simply
	find my software useful, feel free to drop me a few bits. That would be
	very much appreciated.
	 
	My bitcoin address: 16TofYbGd86C7S6JuAuhGkX4fbmC9QtzwT
	 
	Thank you for your visit, and see you around!
[?] gopher.viste.fr:70 > donate

Top of page | Gopher proxy home | Floodgap home gopher 	version 645 port 2 	All access must be in accordance with Floodgap Terms of Service.

Proxy too slow? Get free clients and plugins for your favorite mobile and desktop browsers. Visit the Overbite Project.
Simultaneous clients: 2 (capped at 8)
Access to the proxy is limited to 16K/sec and maximum 4MB per access. Please use a full client for larger files.

其中：

16TofYbGd86C7S6JuAuhGkX4fbmC9QtzwT就是第四问的答案。

Flag

四个问题都答对之后，页面显示 flag：

复制代码

RCTF{wh3n_8086_s4ng_s0f7ly_0f_l0v3}

总结

这道题的核心能力是信息关联与检索，而非技术漏洞。

路径是：

从题目关键词定位项目 → 从项目找到代码仓库 → 从仓库定位版本号 → 从项目官网找到作者主页 → 从主页延伸到 Gopher 空间。

每一步的答案都为下一步提供线索，形成完整的 OSINT 链条。

Rambo

2026年10月24日

🎉🎉🎉