LSLol — This one's different

Challenge author
Dan Hlavenka (SIGPwny)
Write-up author
Vanilla (Batman's Kitchen)
Points
300
Category
reversing

Become the matrix.

Please read the solution for LSLol — Log in, stay here before this solution.

In the same location as the web server, there is another object. When we click it, it provides a link to documentation for the llMessageLinked function in Second Life's scripting language, LSL, and gives us an executable-but-not-readable script. The script, when placed into one of our own objects, allows us to touch it, but nothing else visible happens.

As background, the world contains objects, objects consist of linked primitives, and each primitive can contain scripts. Chat is one method of communication, but within an object, scripts can use link messages.

We write a script to dump all link messages to us and put it in the same object as the script we were given. We touch the object and we get a link message containing JSON with an "auth" field and a "send_flag" field, set to zero. We send the message back, with "send_flag" changed to 1, and we get a reply with the flag.

(In our implementation, we then replied again (since we got a message!) and spawned a huge storm of messages… oops… but right near the start of the spam was the flag, so I don't care.)