PicoCTF - Wizardlike

Recon

這一題蠻有趣的，如果只是單純執行程式碼，會發現是一個迷宮的遊戲，不過走越多會發現兩個現象

1. 遊戲本身根本無法破關
2. 有一些”道路”回隨著角色本身的移動慢慢浮現出來

我也不知道是哪來的想法直覺想要看他的地圖，因為看IDA翻出來的code，貌似有十個關卡，而如果把地圖翻出來會發現每一個關卡總共會有10000個字元，然後每一列都是100個字元呈現，然後就發現他其實是用地圖的方式呈現他的flag，則我們可以先把10個關卡的所有字元另存一個檔案(純手工)，再寫一點點script就可以把flag還原

Exploit - 通靈

1 2 3 4 5

f = open('./cipher.txt', 'r').read() pt = open('./flag.txt', 'w') flag = "\n".join([f[100 * i : 100 * i + 100] for i in range(len(f) // 100)]) pt.write(flag)

:::spoiler flag

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161

######### #.......# ......#................................... #.......# ....................####.#####.#####..###. #........ .####.#..###..###..#.......#...#......#... #.......# .# #.#.#....# #.#.......#...###...#.... #.......# .####.#.#....# #.#.......#...#......#... #.......# .#....#..###..###...####...#...#......###. #.......# .#........................................ #.......# .......................................... #.......# #.......# #.......# #.......# #.......# #......># ######### #####. ............................................................. #.<.#. ...............#..#.............##.......#..#........#....... #...#. .#..#.###......#..#.......#...#..#.####..#..#.###....#....... #...#. .#..#.#........####.......#.#.#..#...#...####.#...####....... #...#. .####.#...####....#.#####..#.#..###.####....#.#...####.#####. . ............................................................. . ............................................................. . ............................................................. #.... #...# #...# #...# #...# #...# #.>.# ##### ################# ....... #<..............#. ..###.. #...............#.. .#...#. #..............#......###.. #...#.......#...#.. .#...#. #..###.....###..#. ..###.. #...#...#...#...# ....... #......#>#......# ....... #...............# #...#.......#...# #..###.....###..# #...#.......#...# #...............# #...............# #...............# ################# ... .. ....... .<. ####. .#####. ... ...#.. .#..... ... ...#....###... ..>#.. .#..... ####. .#..... .. ....... ....... ######################## #<.............#.......# #..............#.#...#.# #..............#.#...#.# #..............#.#####.# #..............#.....#.# #..............#.....#.# #..............#.......# #..............#.......# ######################## ....... .<..... ....... ....... ....... ....... ....... ....... ....... ....... ....... .....>. ....... ####### ....... .####.. .#...#. .####.. .#...#. .####.. ....... ....... ... .<......... ........... ... .. .. .. .. .. .. .. .............. ..##########.. .# #. .# ....... #. .# ..###.. #. .# .#...#. #. .# .#...#. #. .# .#...#. #. .# ..###.. #. .# ....... #. .# ....... #. .# #. ..##########.. .............> ######################### #<#......#.#.......###..# #.#.###..#.#.......##..## #.#.#.#..#.#.......#..### #.#.#.#..#.#.......#...## #...#....#..#......#....# #.######.##..###.###....# #.#.....................# #.###.#################.# #.......................# #########.###.#########.# #.......#.#.#.#.........# #.#...#.#.#...#.######### #.#...#.#.#.#.#.........# #.#####.#.#.#.#########.# #.....#.#.#.#.#.........# #.....#.#.#.#.#.######### #.......#.#.#.#.........# #.......#.#.#.#########.# #########.#.#.#...#...#.# #...........#.#.#.#.#.#.# #########...#.#.#.#.#.#.# #.......#...#.#.#.#.#.#.# ####.####...#.#.#.#.#.#.# ##..........#.#.#.#.#.#.# #.#..####...#.#.#.#.#.#.# #..#....#####.#.#.#.#.#.# #...#...#...#.#.#...#...# #....#........#.######### #...........#.#........># ########################. ... ....... .<. ..###.. ... .#...#. ... .#####. .#...#. .#...#. ....... ....... #####################################################################################..............# #####################################################################################.#####.###....# #####################################################################################.#.......#....# #####################################################################################.###......#...# #####################################################################################.#.......#....# #####################################################################################.#####.###....# #####################################################################################..............# #####################################################################################..............#

:::

Flag: picoCTF{ur_4_w1z4rd_8F4B04AE}