Undo picoCTF 2026 Solution

Description

1. Step 1Understand the challenge format

   Observation

   The task is reversing a series of Linux text transformations, so get the server's prompt-and-response loop straight before decoding anything.

   Connect with netcat. The server shows you a transformed flag and a hint. Type the Linux command that reverses the last transformation, and press Enter. Get it right to advance; the server reveals the final flag after all transformations are reversed.

   bash

   nc <HOST> <PORT_FROM_INSTANCE>

   Copied!

   What didn't work first

   Tried: Trying to decode or reverse the displayed ciphertext yourself without reading the hint.

   The text alone does not identify the transformation: reversed base64 looks like arbitrary characters and could pass for ROT13 or raw binary. The hint names it outright, so read that and match it to an inverse.

   Tried: Typing the full pipeline with echo, such as 'echo <flag> | base64 -d', instead of just the bare command.

   The server pipes the held value through your input on its own, so wrapping it in echo sends a literal echo command instead of a decode. Type the command alone.

   Learn more

   Each prompt shows the current state of the flag and a hint like "B64 encode the string" or "reverse the text". The hint describes what was done TO the flag, so you need to do the INVERSE. For example, if the hint says "B64 encode the string", the current state is base64-encoded, so the reverse command is base64 -d.

2. Step 2Read the hint and write the inverse command

   Observation

   The server names the transformation at each step, whether that is a base64 encode or a reversal. Read the hint and supply the single inverse command rather than deducing the encoding from the text.

   The server provides a plain-English hint at each step describing what transformation was applied to the flag (e.g. 'B64 encode the string', 'reverse the text', 'Replace underscores with dashes'). You do not need to deduce the encoding from the ciphertext - the server tells you. Type the single Linux command that undoes the named transformation and press Enter.

   Learn more

   Transformations seen in this challenge and their inverses:

   • B64 encode -> base64 -d
   • Reverse the text -> rev
   • Replace underscores with dashes -> tr '-' '_'
   • Replace curly braces with parentheses -> tr '()' '{}'
   • ROT13 -> tr A-Za-z N-ZA-Mn-za-m (ROT13 is self-inverse)

   The server responds "Correct. Current flag: ..." on a right answer and "Incorrect. Try again." on a wrong one. Each step is validated individually before the next is shown.

3. Step 3Enter the inverse command for each step

   Observation

   The server pipes the current state through whatever command you type and checks each answer on its own. Enter the bare command, with no echo around it.

   Type the single command that undoes the transformation the server named. The server validates each answer before showing the next step. Common commands for this challenge's transformations are shown below.

   bash

   base64 -d

   Copied!

   bash

   rev

   Copied!

   bash

   tr '-' '_'

   Copied!

   bash

   tr '()' '{}'

   Copied!

   bash

   tr A-Za-z N-ZA-Mn-za-m

   Copied!

   What didn't work first

   Tried: Omitting the '-d' flag when the hint says 'B64 encode the string' (there is no '-e' flag on coreutils base64; encoding is the default).

   The hint describes what was done TO the flag - 'B64 encode' means the current flag is already base64-encoded, so the inverse is decode ('base64 -d'), not encode again. Re-encoding produces a doubly-encoded string and the server returns 'Incorrect. Try again.'

   Tried: Using 'tr '_' '-'' (underscore to dash) when the hint says 'Replace underscores with dashes'.

   The hint says underscores became dashes on the way here, so the inverse turns dashes back into underscores. Run it the other way and any surviving underscores become dashes, and the server rejects the answer.

   Learn more

   You type only the command itself (no echo ... | wrapper). The server pipes the current flag state through whatever you type, so entering base64 -d decodes the base64-encoded flag it is holding. The server then shows the updated flag and the next hint.

   ROT13 note: ROT13 is its own inverse, so tr A-Za-z N-ZA-Mn-za-m both encodes and decodes.

4. Step 4Read the flag

   Observation

   Once every transformation is undone the output starts with picoCTF{, which is how you know you are finished.

   After applying all inverse transformations, the result should start with picoCTF{...}.

Flag

Connect via netcat. The server prompts for the Linux command to undo each transformation. Common answers: 'base64 -d' for B64, 'rev' for reverse, 'tr - _' to replace dashes with underscores, 'tr () {}' for parentheses to braces, ROT13 with 'tr A-Za-z N-ZA-Mn-za-m'.