Nice netcat... picoCTF 2021 Solution

Description

1. Step 1Connect and observe the output

   Observation

   The description says the server just outputs some numbers. So connect with netcat and capture the raw output before trying to interpret anything.

   Connect to the server. It streams a series of space-separated decimal numbers, then exits.

   bash

   nc mercury.picoctf.net 43239

   Copied!

   What didn't work first

   Tried: Paste the raw number output into CyberChef's 'From Decimal' recipe expecting to get the flag directly.

   CyberChef's 'From Decimal' recipe interprets comma-separated values by default, not space-separated. The output appears garbled or empty because the entire space-delimited string is treated as one token. Switch the delimiter to 'Space' in the recipe options to get correct character conversion.

   Tried: Try reading the numbers as hexadecimal instead of decimal, suspecting the server output is in hex.

   The values are plain decimal ASCII codes: 112 for p, 105 for i. Read them as hex and 112 becomes 274, well past 127, which is not ASCII at all. Python's chr() raises no error there, it just returns unexpected Unicode glyphs. Printable ASCII sits between 32 and 126 in decimal.

   Learn more

   netcat (nc) is a fundamental network utility sometimes called the "Swiss Army knife" of networking. It can open raw TCP or UDP connections to any host and port, and it passes data between your terminal and the remote endpoint with no protocol overhead. Security researchers use it constantly to interact with CTF challenge servers, probe open ports, and debug networked services.

   When the server streams numbers and then exits, that's a one-shot interaction - the server sends a sequence of decimal integers (each one is an ASCII code for a single character of the flag) and closes the connection. Your job is to read those integers and convert each one back to its character. The same encoding can appear as octal, hexadecimal, or binary in other challenges.

2. Step 2Convert decimal values to ASCII characters

   Observation

   Every number the server streams falls between 32 and 126, which is exactly the decimal ASCII range for printable characters. Python's chr() maps each integer back to its character.

   Each number is the decimal ASCII code of one character of the flag. Use Python to convert them all at once. Copy the numbers from the output and paste them as a space-separated string.

   python

   python3 -c "output = '<paste numbers here>'; print(''.join([chr(int(x)) for x in output.split()]))"

   Copied!

   Expected output

   picoCTF{g00d_k1tty!_n1c3_k1tty!_...}

   What didn't work first

   Tried: Use ord() instead of chr() in the Python one-liner, expecting it to decode numbers to characters.

   ord() runs the other way: it takes a character and returns its integer code. Pass it a string like '112' and it raises a TypeError, because it expected one character and got three. What you want is chr(int(x)).

   Tried: Split the pasted number string on commas instead of spaces because some Python examples use comma-separated lists.

   The server separates values with spaces, not commas. split(',') on a space-separated string returns a single-element list holding the whole thing, so chr() receives one long multi-digit string instead of individual tokens and int() raises a ValueError. Call split() with no argument, which splits on any whitespace including newlines.

   Learn more

   ASCII (American Standard Code for Information Interchange) is a 7-bit character encoding that maps integers 0 to 127 to characters. Printable characters occupy 32 to 126: lowercase letters are 97 to 122, uppercase 65 to 90, digits 48 to 57, and common punctuation fills the gaps. Understanding ASCII values is essential for CTF work - you'll encounter them in many forms: decimal, hexadecimal (0x70 = p), octal, and binary.

   Python's chr() function converts an integer to its corresponding Unicode character (which is identical to ASCII for values 0 to 127). The inverse is ord('p') which returns 112. The one-liner splits the space-separated number string, converts each token to an integer, maps it through chr(), and joins the results into the flag string.

   Combining with netcat in one pipeline: You can also pipe netcat's output directly into Python without copy-pasting:

   • timeout 5 nc mercury.picoctf.net 43239 | python3 -c "import sys; print(''.join(chr(int(x)) for x in sys.stdin.read().split()))"

   The timeout 5 prefix bounds the wait at 5 seconds. nc sometimes does not detect the remote close cleanly and will hang forever waiting for more input; the timeout is a defensive guardrail.

   This kind of pipeline - connecting tools with | - is a core Unix philosophy skill that makes terminal workflows far more powerful.

Flag

The server streams the flag as space-separated decimal ASCII values.