Here's how to solve the PatriotCTF 2024 Making Baking Pancakes challenge.
Challenge notes
How many layers are on your pancakes?
Author: Dylan (elbee3779) nc chal.pctf.competitivecyber.club 9001
Challenge server
Connect to the challenge server with Netcat:
nc chal.pctf.competitivecyber.club 9001
The challenge server greets you with the following message when you connect:
Welcome to the pancake shop!
Pancakes have layers, we need you to get through them all to get our secret pancake mix formula.
This server will require you to complete 1000 challenge-responses.
A response can be created by doing the following:
1. Base64 decoding the challenge once (will output (encoded|n))
2. Decoding the challenge n more times.
3. Send (decoded|current challenge iteration)
Example response for challenge 485/1000: e9208047e544312e6eac685e4e1f7e20|485
Good luck!
Challenge: Vm0wd2QyVkhVWGhVYmxKV1YwZDRXRmxVU2xOWFZsbDNXa1JTVjFKdGVEQlpNM0JIWVd4S2MxWnFUbGROYmxGM1ZqQmFTMlJIVmtsalJuQlhWbXh3VVZadE1UUlRNbEpYVW01T2FWSXdXbGhXYlhoM1lqRmFjbHBFVWxSTmJFcElWbTAxVjJGc1NuUlZiR2hoVmpOU1lWcFhlR3RYUjFKSVVteFNUbFp1UWxsV2JUQXhVakZaZVZOcmFGWmhlbXhZV1d4b1UwMHhWWGhYYlVacVRWWndNRlZ0ZUc5aFZscHlWMVJDVjAxdVVuWldha1poVjBaT2NtRkhhRk5sYlhoWFZtMHhORmxWTUhoVmJHaHNVak5TV0ZSV1dtRmxWbVJ5V2toa1ZXSlZXVEpXYlhoM1ZqRmFObEpxVGxoV2JIQmhXbFphUzJOV1pIUmlSazVwVmpKb1dWWXhaRFJWTVVsM1RsaE9hbEpXV2xSWmJGWmhWbFpXY1ZKdFJsUlNiSEJKV2xWYWEyRkdTWGhYYm14V1RWZG9NMVpxUmt0ak1XUjFWMnh3YkdFeGNHaFhiRlpoWVRKT2MxZHVUbFJpUjFKVVZGUkJkMDFSUFQwPXw5
(0/1000) >>
The server wants you to decode a Base64 encoded string. When you decode this encoded string once, it gives you another base64 encoded string and a number like 9.
This number tells you how many more times to Base64 decode the string.
Here's what the VM0wd… string decodes to:
Vm0wd2VHUXhUblJWV0d4WFlUSlNXVll3WkRSV1JteDBZM3BHYWxKc1ZqTldNblF3VjBaS2RHVkljRnBXVmxwUVZtMTRTMlJXUm5OaVIwWlhWbXh3YjFaclpEUlRNbEpIVm01V2FsSnRVbGhhVjNSYVpXeGtXR1JIUmxSTlZuQllWbTAxUjFZeVNraFZhemxYWWxoU00xVXhXbUZqTVZwMFVteG9hVlpyV1RCV01uUnZWakZhV0ZOcmFHaFNlbXhXVm0xNFlVMHhVbGhsUjNSWFRWWmFlVmRyWkhkVWJVWTJWbXh3VjFaNlJqTlhWbHBhWlZaS2NWZHRiRk5pVjJoWVYxZDRVMUl3TlhOalJWWlRZbFZhVlZWcVJtRlRSbHBJWlVaa2FGSXhXbmxWTVdoM1ZqRktjMWR1V2xwbGExcGhXbFZhYTJOc1duTlRiR1JUVFRBd01RPT0=|9
Take the Vm0wd…RPT0 string and decode it nine more times. First time:
Vm0weGQxTnRVWGxXYTJSWVYwZDRWRmx0Y3pGalJsVjNWMnQwV0ZKdGVIcFpWVlpQVm14S2RWRnNiR0ZXVmxwb1ZrZDRTMlJHVm5WalJtUlhaV3RaZWxkWGRHRlRNVnBYVm01R1YySkhVazlXYlhSM1UxWmFjMVp0UmxoaVZrWTBWMnRvVjFaWFNraGhSemxWVm14YU0xUlhlR3RXTVZaeVdrZHdUbUY2VmxwV1Z6RjNXVlpaZVZKcVdtbFNiV2hYV1d4U1IwNXNjRVZTYlVaVVVqRmFTRlpIZUZkaFIxWnlVMWh3VjFKc1duWlpla1phWlVaa2NsWnNTbGRTTTAwMQ==
Repeat eight more times to get this string:
fecbec748e717f59aed8db995685373e
Send this string back to the server together with the current iteration count. The iteration count tracks the number of these Base64 encoded strings that you've solved so far.
Solve 1000 of these strings to receive the flag that solves this challenge.
Solver script
The challenge server wants you to do this 1000 times. Use this solve.py Python script to solve the challenge:
#!/usr/bin/env python
# solve.py
import binascii
import re
import nclib
HOST = "chal.pctf.competitivecyber.club", 9001
def main():
nc = nclib.Netcat(HOST)
for iteration in range(1000):
print(
nc.recv_until("Challenge").decode()
)
challenge_raw = nc.recv_until(
") >>"
).decode()
challenge_match = re.search(
r": (.+)\n",
challenge_raw
)
assert challenge_match
decoded_raw = challenge_match[1]
assert decoded_raw
decoded = binascii.a2b_base64(
decoded_raw
)
encoded, number_raw = decoded.split(
b"|"
)
number = int(number_raw)
print(f"{encoded=}, {number=}")
current = encoded
print(f"Decoding {number} times")
for _ in range(number):
current = binascii.a2b_base64(
current
)
print(f"{current=}")
response = f"{current.decode()}|{iteration}"
print(f"{response=}")
nc.send_line(response.encode())
print("answer")
print(nc.read_all(3).decode())
if __name__ == "__main__":
main()
Solution
This screenshot shows the solve.py script solving the challenge:
Here's a sample solution trace printed by the solve.py script. The response= line shows what the script sends back to the challenge server:
…current=b'V1dwQ2FVNXRUVEpaVkZacVRrZE9hazVIVW0xWmVtTjRUVEphYVUxNmFHMWFWRlV6VDBkVk1rNUVSVDA9'
current=b'WWpCaU5tTTJZVFZqTkdOak5HUm1ZemN4TTJaaU16aG1aVFUzT0dVMk5ERT0='
current=b'YjBiNmM2YTVjNGNjNGRmYzcxM2ZiMzhmZTU3OGU2NDE='
current=b'b0b6c6a5c4cc4dfc713fb38fe578e641'
response='b0b6c6a5c4cc4dfc713fb38fe578e641|999'
When you solve 1000 of these challenges, the challenge server prints the following:
Wow you did it, you've earned our formula!
DO NOT SHARE:
pctf{store_bought_pancake_batter_fa82370}