Based picoCTF 2019 Solution

Description

1. Step 1Understand the challenge format

   Observation

   The description mentions binary, octal, and hex conversion, and the server talks back interactively. Before converting anything, get the exact prompt format and the time limit straight.

   The server sends you encoded strings one at a time in binary, octal, or hex format and asks you to convert them to the word they represent. You must respond correctly within a short time limit.

   Learn more

   The three bases you need to handle:

   • Binary (base 2): digits 0 and 1. E.g., 01110000 = 112 = 'p'
   • Octal (base 8): digits 0-7. E.g., 160 = 112 = 'p'
   • Hexadecimal (base 16): digits 0-9 and a-f. E.g., 70 = 112 = 'p'

   In Python: int('01110000', 2) for binary, int('160', 8) for octal, int('70', 16) for hex. Then chr() to get the character.

2. Step 2Write a pwntools script to automate responses

   Observation

   The server allows very little time per round and cycles through several bases. Converting by hand times out every time, so a pwntools script that reads, parses, converts, and sends in a loop is the reliable path.

   The time limit is tight, so write a Python script using pwntools to automate the conversion. Read each encoded string, detect the base from context, convert it, and send the answer.

   bash

   pip3 install pwntools

   Copied!

   python

   python3 << 'EOF'
   from pwn import *
   
   r = remote('<HOST>', <PORT_FROM_INSTANCE>)
   
   def decode_word(encoded, base):
       parts = encoded.strip().split()
       chars = []
       for p in parts:
           chars.append(chr(int(p, base)))
       return ''.join(chars)
   
   for _ in range(3):
       line = r.recvuntil(b'?').decode()
       print(line)
       if 'binary' in line.lower():
           encoded = r.recvline().decode().strip()
           answer = decode_word(encoded, 2)
       elif 'octal' in line.lower():
           encoded = r.recvline().decode().strip()
           answer = decode_word(encoded, 8)
       else:
           encoded = r.recvline().decode().strip()
           answer = decode_word(encoded, 16)
       r.sendline(answer.encode())
   
   r.interactive()
   EOF

   Copied!

   What didn't work first

   Tried: Manually typing the converted value into the terminal for each round.

   The server enforces a strict time limit of a few seconds per round. Manual conversion and typing is too slow, and the connection closes before you can submit. The pwntools script reads and responds programmatically in milliseconds, well within the limit.

   Tried: Using recvline() instead of recvuntil(b'?') to capture the prompt before parsing the base type.

   The server may split the base label and the encoded string across lines, or send them together in a way that does not line up with recvline() boundaries. recvuntil(b'?') waits for the question mark that ends the prompt, so the base keyword is fully buffered before you parse it. recvline() can return a partial prompt and make the base detection miss the keyword.

   Learn more

   pwntools is a Python library designed for CTF challenges involving network connections and binary exploitation. The remote() function creates a TCP connection. recvuntil() reads until a specific byte sequence appears, and sendline() sends data followed by a newline.

3. Step 3Receive the flag

   Observation

   The script's final r.interactive() holds the connection open after the last round. That is where the server hands over the flag once all three conversions are correct.

   After correctly converting all encoded strings, the server outputs the flag.

   Learn more

   Number base conversion is fundamental to computer science. Computers store all data in binary; hexadecimal is a compact human-readable notation for binary (each hex digit represents 4 bits); octal (each octal digit represents 3 bits) was common in early Unix systems.

Flag

Automate binary/octal/hex to ASCII conversion using pwntools to respond within the server's time limit.