bloat.py

Description

Solution

1. Step 1Understand the lookup table
   All strings are constructed from the array `a`, so sending the array through a Python REPL and printing the indexed characters reveals the original statements and variables.
   Learn more

   Code obfuscation is the deliberate process of making source code harder to read without changing its behavior. This script uses a common Python obfuscation technique: storing all string literals as indices into a single character array a. Instead of writing "happychance" directly, the code writes something like a[7]+a[0]+a[15]+..., which produces the same string at runtime but is opaque at a glance.

   The fastest way to defeat this kind of obfuscation is to let Python do the work for you. Open a REPL, define the array a exactly as it appears in the script, then print any expression you want decoded. The interpreter evaluates the indexing and shows you the plaintext result instantly - no manual decoding required.

   Real malware frequently uses similar tricks (character-array string building, base64-encoded payloads, eval chains) to evade static analysis tools. Understanding obfuscation patterns is valuable for both CTF and malware analysis work.

2. Step 2Recover the password
   Deobfuscating the script exposes `happychance` near the top of the file. Once you know it, you can leave the script as-is and supply the password at runtime.
   Learn more

   Hard-coded passwords in scripts are a classic security antipattern. Even when the string is obfuscated - as it is here - an attacker who has access to the script can always recover the credential by running the code or evaluating the expression. The obfuscation provides security through obscurity at best, and no real protection.

   In practice, credentials should never live in source code. Secure alternatives include environment variables, secret management services (AWS Secrets Manager, HashiCorp Vault), or prompting the user at runtime and deriving a key via a proper key derivation function (KDF) like PBKDF2 or Argon2 - not storing the password in the script at all.

3. Step 3Decrypt the flag
   Execute `python3 bloat.flag.py`, enter `happychance`, and capture the output with `tee` or redirect to isolate the second line-which contains the picoCTF flag.
   Learn more

   tee is a Unix utility that reads from standard input and writes to both standard output and one or more files simultaneously. Using python3 bloat.flag.py | tee output.txt lets you see the output on screen in real time while also saving it for later processing - useful when a program produces multiple lines and you only need one.

   sed -n '2p' prints only the second line of a file (-n suppresses default output; 2p prints line 2). This is a quick way to extract a specific line without loading the entire file into memory or using a more complex tool.

   The broader lesson: when a script produces mixed output (prompts, decryption results, debug messages), piping through line-selection tools like sed, awk, or grep is faster than copying and pasting from the terminal.

Flag

picoCTF{d30bfu5c4710n_f7w_b80...}

Never run opaque scripts blindly-printing the decoded payload first keeps you safe and shows the password immediately.