Down The Rabbit Hole


problem description

An Excel file was attached.


Let's start by inspecting the Excel Workbook. If we open it with a dedicated program, we get one sheet named "Sheet1" saying "Find the hidden sheet".

We can right-click and select "Show sheet" to view hidden sheets:

Sheet2 says:

And Sheet3:

Excel files are actually just zip archives. We can extract them and look inside.

└─$ ls -al
total 37
drwxrwx--- 1 root vboxsf    0 Nov 10 23:19 .
drwxrwx--- 1 root vboxsf    0 Nov 10 23:21 ..
-rwxrwx--- 1 root vboxsf 9309 Nov 10 22:52 sheet1.xml
-rwxrwx--- 1 root vboxsf 9378 Nov 10 23:09 sheet2.xml
-rwxrwx--- 1 root vboxsf 9458 Nov 10 23:19 sheet3.xml
-rwxrwx--- 1 root vboxsf   48 Nov 10 22:41 sheet4.xml

Sheet4 says:

└─$ cat sheet4.xml
Now go back and find the super DUPer hidden rows

If we check inside the XMLs, we can see that some rows have duplicate entries, e.g.:

    <row r="106" spans="1:1" x14ac:dyDescent="0.25">
      <c r="A106">
    <row r="107" spans="1:1" x14ac:dyDescent="0.25">
      <c r="A107">
    <row r="108" spans="1:1" x14ac:dyDescent="0.25">
      <c r="A108">
    <row r="109" spans="1:1" x14ac:dyDescent="0.25">
      <c r="A109">
    <row r="109" spans="1:1" x14ac:dyDescent="0.25">
      <c r="A109">
    <row r="110" spans="1:1" x14ac:dyDescent="0.25">
      <c r="A110">
    <row r="111" spans="1:1" x14ac:dyDescent="0.25">
      <c r="A111">

Row 109 is duplicate, the first value is 73 which is ASCII for I. We locate the duplicates to get the flag.

This can be done programmatically:

import xml.etree.ElementTree as ET
from pathlib import Path

namespaces = {
    "t": ""

flag = ""

for sheet in Path('out/xl/worksheets/').glob('sheet*.xml'):
        tree = ET.parse(sheet)

        dups = {}

        for row in tree.findall('.//t:row', namespaces):
            row_num = row.attrib["r"]
            row_val = row.find("t:c/t:v", namespaces).text
            if row_num in dups:
                flag += chr(int(dups[row_num]))
                dups[row_num] = row_val
    except ET.ParseError:



└─$ python3