Glitch Cat Beginner picoMini 2022 Solution

Description

1. Step 1Connect and receive the output

   Observation

   The description says the flag-printing service has glitched and tells you to connect and decode the output. A raw TCP connection with netcat is the first step, to see what the service is actually sending.

   Connect with netcat. The server sends a string like: 'picoCTF{gl17ch_m3_n07_' + chr(0x61) + chr(0x34) + chr(0x39) + ... where some characters are expressed as Python chr() calls instead of literals.

   bash

   nc saturn.picoctf.net <PORT>

   Copied!

   What didn't work first

   Tried: Try reading the raw output as a finished flag and submit it directly.

   The server sends a Python expression like 'picoCTF{gl17ch_m3_n07_' + chr(0x61) + chr(0x34) + ..., not a completed string. Submitting that literal text fails because the portal expects the evaluated result. The chr() calls must be resolved to their character equivalents first.

   Tried: Use curl or a browser to connect to the service instead of netcat.

   The endpoint is a raw TCP service, not HTTP. curl and browsers speak HTTP and will hang or report a protocol error, because there is no handshake to complete. netcat opens a plain TCP connection and passes the raw bytes to your terminal, which is what this server expects.

   Learn more

   netcat (nc) is a lightweight networking utility that opens a raw TCP or UDP connection and passes data between your terminal and the remote host. It is sometimes called the "Swiss army knife of networking" because it can act as both a client and a server, making it invaluable for CTF challenge connections, port scanning, and debugging network services.

   The server here sends a Python expression rather than a plain string. This is a form of light obfuscation - the flag is technically present in the output, but not immediately human-readable because some characters are encoded as chr() calls with hexadecimal arguments. The challenge teaches you to recognize this pattern and reverse it.

   Hexadecimal arguments like 0x61 are common in low-level contexts: 0x61 is 97 in decimal, which is the ASCII code for the lowercase letter a. Understanding the relationship between hex values and ASCII characters is a core CTF skill used constantly in reverse engineering and binary exploitation.

2. Step 2Evaluate the Python expression

   Observation

   The server sends back a Python expression mixing string literals, chr() calls, and the + operator. Feeding that whole expression to python3 -c inside a print() lets the interpreter assemble the flag instantly.

   Copy the full output and run it as a Python print statement. Python evaluates the chr() calls and string concatenation, assembling the complete flag.

   python

   python3 -c "print('picoCTF{...}')

   Copied!

   What didn't work first

   Tried: Manually look up each hex value in an ASCII table and transcribe the characters by hand.

   This works in principle but is slow and easy to get wrong when the output has many chr() calls. The expression is already valid Python, so handing it to the interpreter is faster and removes transcription mistakes. Let the runtime do the work.

   Tried: Run python3 -c with just the raw server output pasted in without wrapping it in print().

   Pasted as a bare statement, Python evaluates the expression and silently discards the result, so nothing prints. Wrap the whole expression in print() to write the assembled string to stdout. Outside the interactive REPL, Python 3 does not display expression values on its own.

   Learn more

   chr() is Python's built-in function that converts an integer to the corresponding Unicode character. For values 0-127, Unicode matches ASCII exactly, so chr(0x61) returns 'a', chr(0x7d) returns '', and so on. Its inverse is ord(), which converts a character back to its integer code point.

   The python3 -c "..." flag lets you run a Python one-liner directly from the shell without creating a file. This is extremely useful for quick calculations, decoding, and scripting during CTF challenges. The expression is evaluated exactly as if it were in a .py file.

   String concatenation with + in Python joins strings left to right. The server is effectively building the flag character by character - mixing literal substrings with chr()-encoded characters - and printing the resulting expression instead of the evaluated result. Wrapping it in print() forces Python to evaluate and display the assembled string.

Flag

chr() converts an integer to its Unicode character - the server 'obfuscates' parts of the flag by expressing them as Python chr() calls rather than literal characters, but evaluating the expression immediately reveals them.