Based picoCTF 2019 Solution

Description

1. Step 1

   Understand the challenge format

   Observation

   I noticed the challenge description mentioned binary, octal, and hex conversion and that the server communicates interactively, which suggested I needed to understand the exact prompt format and time constraints before attempting any conversions.

   The server sends you encoded strings one at a time in binary, octal, or hex format and asks you to convert them to the word they represent. You must respond correctly within a short time limit.

   Learn more

   The three bases you need to handle:

   • Binary (base 2): digits 0 and 1. E.g., 01110000 = 112 = 'p'
   • Octal (base 8): digits 0-7. E.g., 160 = 112 = 'p'
   • Hexadecimal (base 16): digits 0-9 and a-f. E.g., 70 = 112 = 'p'

   In Python: int('01110000', 2) for binary, int('160', 8) for octal, int('70', 16) for hex. Then chr() to get the character.

2. Step 2

   Write a pwntools script to automate responses

   Observation

   I noticed the server enforces a tight time limit per round and cycles through multiple encoding bases, which suggested that manual conversion would consistently time out and that a pwntools script automating read-parse-convert-send in a loop was the only reliable approach.

   The time limit is tight, so write a Python script using pwntools to automate the conversion. Read each encoded string, detect the base from context, convert it, and send the answer.

   bash

   pip3 install pwntools

   Copied!

   python

   python3 << 'EOF'
   from pwn import *
   
   r = remote('<HOST>', <PORT_FROM_INSTANCE>)
   
   def decode_word(encoded, base):
       parts = encoded.strip().split()
       chars = []
       for p in parts:
           chars.append(chr(int(p, base)))
       return ''.join(chars)
   
   for _ in range(3):
       line = r.recvuntil(b'?').decode()
       print(line)
       if 'binary' in line.lower():
           encoded = r.recvline().decode().strip()
           answer = decode_word(encoded, 2)
       elif 'octal' in line.lower():
           encoded = r.recvline().decode().strip()
           answer = decode_word(encoded, 8)
       else:
           encoded = r.recvline().decode().strip()
           answer = decode_word(encoded, 16)
       r.sendline(answer.encode())
   
   r.interactive()
   EOF

   Copied!

   What didn't work first

   Tried: Manually typing the converted value into the terminal for each round.

   The server enforces a strict time limit of a few seconds per round. Manual conversion and typing is too slow, and the connection closes before you can submit. The pwntools script reads and responds programmatically in milliseconds, well within the limit.

   Tried: Using recvline() instead of recvuntil(b'?') to capture the prompt before parsing the base type.

   The server may send the base label and the encoded string across multiple lines or in a single transmission that does not align neatly with recvline() boundaries. recvuntil(b'?') waits for the question mark that ends the prompt, ensuring the base keyword (binary, octal, hex) is fully buffered before you parse it, whereas recvline() may return only part of the prompt and cause the base-detection logic to miss the keyword entirely.

   Learn more

   pwntools is a Python library designed for CTF challenges involving network connections and binary exploitation. The remote() function creates a TCP connection. recvuntil() reads until a specific byte sequence appears, and sendline() sends data followed by a newline.

3. Step 3

   Receive the flag

   Observation

   I noticed the pwntools script's final call to r.interactive() keeps the connection open after the last round, which is where the server delivers the flag once all three conversions are answered correctly.

   After correctly converting all encoded strings, the server outputs the flag.

   Learn more

   Number base conversion is fundamental to computer science. Computers store all data in binary; hexadecimal is a compact human-readable notation for binary (each hex digit represents 4 bits); octal (each octal digit represents 3 bits) was common in early Unix systems.

Flag

Automate binary/octal/hex to ASCII conversion using pwntools to respond within the server's time limit.