Bundle 99 — broncoctf2026

Description

Yoshie found this random file laying around. Do you have any idea what this 'bundle' is? Apparently someone told him it's the 99th bundle of brushes? What is that supposed to mean... P.S. This challenge can be solved without downloading any software, but you'll have to hunt for a way to run the related program online and send the bundle to it.

English summary: An extensionless file Bundle_99 (83110 bytes) is provided. The wordplay ("bundle", "brushes", "99th bundle", "run the related program online") points to Krita and its .bundle resource bundle format. The goal is to recover a bronco{...} flag. The intended path was to load the bundle in Krita (or a web build of Krita) and paint with a text brush to stamp the flag — but the flag is stored as plaintext in the brush preset's PNG metadata, so no software is required.

Analysis

Recon on the unknown file:

$ file Bundle_99
Bundle_99: Zip data (MIME type "application/x-krita-resourcebundle"?)

$ strings Bundle_99 | grep -Ei 'mimetype|kpp|preview|manifest|meta'
mimetype
application/x-krita-resourcebundle
paintoppresets/Brush 99.kpp
preview.png
META-INF/manifest.xml
meta.xml

Key deductions:

• The file magic + MIME application/x-krita-resourcebundle identifies this as a Krita resource bundle — a ZIP container. Krita is the "related program" the description hints at.
• The internal entry paintoppresets/Brush 99.kpp is the "99th bundle of brushes" / "Brush 99" wordplay: a single brush preset named Brush 99.
• Krita .kpp brush presets are PNG files (here 200×200 RGBA) that store the serialized preset XML inside a PNG text chunk named Preset. Krita text brushes (kis_text_brush) store their rendered string in a text= attribute — a perfect place to hide a flag.

...