PicoCTF Writeup – WhitePages
# Information:
CTF Name: PicoCTF
CTF Challenge: WhitePages
Challenge Category: Forensics
Challenge Points: 250
PicoCTF 2019
# Challenge Description:
I stopped using YellowPages and moved onto WhitePages… but the page they gave me is all blank!
# Writeup
In this challenge we have a file named whitepages.txt. After downloading this file I decided to open it using a simple text editor like kate or sublime and the file seemed empty. I decided to see the hexdump of the file. To do so I used the following command:
mregra WhitePages $ xxd -g 1 whitepages.txt
00000000: e2 80 83 e2 80 83 e2 80 83 e2 80 83 20 e2 80 83 ............ ...
00000010: 20 e2 80 83 e2 80 83 e2 80 83 e2 80 83 e2 80 83 ...............
00000020: 20 e2 80 83 e2 80 83 20 e2 80 83 e2 80 83 e2 80 ...... ........
00000030: 83 e2 80 83 20 e2 80 83 e2 80 83 20 e2 80 83 20 .... ...... ...
00000040: 20 20 e2 80 83 e2 80 83 e2 80 83 e2 80 83 e2 80 ..............
00000050: 83 20 20 e2 80 83 20 e2 80 83 e2 80 83 20 e2 80 . ... ...... ..
00000060: 83 20 20 e2 80 83 e2 80 83 e2 80 83 20 20 e2 80 . ......... ..
00000070: 83 20 20 e2 80 83 20 20 20 20 e2 80 83 20 e2 80 . ... ... ..
00000080: 83 e2 80 83 e2 80 83 e2 80 83 20 20 e2 80 83 20 .......... ...
00000090: e2 80 83 20 e2 80 83 20 e2 80 83 e2 80 83 e2 80 ... ... ........
000000a0: 83 20 e2 80 83 e2 80 83 e2 80 83 20 20 e2 80 83 . ......... ...
000000b0: e2 80 83 e2 80 83 e2 80 83 e2 80 83 20 e2 80 83 ............ ...
000000c0: 20 e2 80 83 e2 80 83 e2 80 83 e2 80 83 e2 80 83 ...............
000000d0: 20 e2 80 83 20 e2 80 83 e2 80 83 e2 80 83 e2 80 ... ...........
000000e0: 83 e2 80 83 20 e2 80 83 e2 80 83 20 e2 80 83 e2 .... ...... ....
000000f0: 80 83 e2 80 83 e2 80 83 20 e2 80 83 e2 80 83 20 ........ ......
...
We get this output (this is just the start, it has some extra lines). By looking closely I was able to see that we have a pattern repeating itself several times, “e2 80 83“. I did not know what this represented but I went to google and pasted these hexadecimal values. This was the first search result. It seems that these values represent the UNICODE EM SPACE:
Knowing this I went back to the hexdump of the file and I was able to see that we also have another pattern, the conventional hexadecimal space representation in ASCII: “20“. And these are the only two patterns in the hexdump. It seems to me that this is relevant. After thinking for a while I thought that maybe these two representations of the space correspond to binary. I decided to give this idea a try and created a Python 3 script that converted the hexdump patterns to binary. See the code below:
def convertSpacesToBinary():
with open('whitepages.txt', 'rb') as f:
result = f.read()
result = result.replace(b'\xe2\x80\x83', b'0')
result = result.replace(b'\x20', b'1')
result = result.decode()
return result
def convertFromBinaryToASCII(binaryValues):
binary_int = int(binaryValues, 2)
byte_number = binary_int.bit_length() + 7 // 8
binary_array = binary_int.to_bytes(byte_number, "big")
ascii_text = binary_array.decode('ascii')
print(ascii_text)
convertFromBinaryToASCII(convertSpacesToBinary())
As we can see, in the first function, “convertSpacesToBinary” I first read the file. Then I convert the pattern “E28083” to 0 and the “20” to 1. If this does not work I will try the other way around.
The second function, “convertFromBinaryToASCII” does exactly what its names says, it converts the input received from the “convertSpacesToBinary” function in binary into ASCII text.
After running this script we get the flag:
The Python 3 script source code can be found here.
Thank you very much for reading!
Cheers,
MRegra
You’ve made some good points there. I checked on the
net for more info about the issue and found most individuals will go along with your views on this website.
Hi there, yup this piece of writing is in fact fastidious
and I have learned lot of things from it concerning blogging.
thanks.