Overview

We get access to a web interface that allows us to authenticate by meowing:

Looking at the web requests, we can see that it just sends a webm audio file:

POST /api/verify HTTP/1.1
Content-Type: multipart/form-data; boundary=----geckoformboundaryfeeb6d8b32ad9b49e0b1cd8d8ca5f372
Content-Length: 10818

------geckoformboundaryfeeb6d8b32ad9b49e0b1cd8d8ca5f372
Content-Disposition: form-data; name="audio"; filename="voice.webm"
Content-Type: audio/webm

<binary data>
------geckoformboundaryfeeb6d8b32ad9b49e0b1cd8d8ca5f372--

{
  "best_label": "Cat",
  "cat_score": 0.0006963247433304787,
  "flag": null,
  "top3": [
    {
      "label": "class_35",
      "score": 0.4417385756969452
    },
    {
      "label": "class_500",
      "score": 0.05353209003806114
    },
    {
      "label": "class_0",
      "score": 0.03392855077981949
    }
  ],
  "win": false,
  "win_score": 0.99
}

Solution

I just tried out the first random cat meow sound from the internet using curl <challenge>/api/verify -F audio=@meow.webm and got a 99% confidence.

After cropping it a bit in Audacity, I got the following audio, which returned the flag:

Flag: