PicoCTF Writeup – Python Wrangling

# Information:

CTF Name: PicoCTF

CTF Challenge: Python Wrangling

Challenge Category: General Skills

Challenge Points: 10

picoCTF 2021.

# Used Tools:

  • Linux
  • cat
  • python3

# Challenge Description:

Python scripts are invoked kind of like programs in the Terminal… Can you run this Python script using this password to get the flag?

Hints:

Hint 1
Get the Python script accessible in your shell by entering the following command in the Terminal prompt: $ wget https://mercury.picoctf.net/static/325a52d249be0bd3811421eacd2c877a/ende.py

Hint 2
$ man python

# Writeup:

Hello, and welcome to another picoCTF challenge write-up. First, I downloaded the python script, the password, and the flag files.

Step 1:

I used the command cat to find out what was in the Python script, and I was presented with the following code:

Step 2:

I read the code that was in the file ende.py, and I noticed that there was information on how to decrypt a file (which is what we intend to do with the file “flag.txt.en”, where the “en” in the file means encrypted).
We can see this in the image below.

Step 3:

I replaced “python “+ sys.argv[0] +” -d pole.txt” with the correct information. In the following way:

As you can see, I replaced “python” with “python3” because python3 is the one that I use. And I put python3 because it will read the python program that is in front of it, which in this case is “ende.py”.
In front of “ende.py” I added the file that I want to decrypt, wich is “flag.txt.en”.
And this together will stay as we can see in the image above.

Step 4:

Afterwords, I was able to get the password using the cat command on the file “pw.txt”.
Then, I entered the following command: “python3 ende.py – d flag.txt.en”, and I was prompted to insert the password stored in “pw.txt” file, as you can see in the image below.

I got the flag.

The flag:

Show flag
picoCTF{4p0110_1n_7h3_h0us3_ac9bd0ff}


Thank you very much for reading!

Cheers,

SoBatista


Leave a Reply

Your email address will not be published. Required fields are marked *