NahamCon 2024 CTF! : Uriel
Uriel
50 points — Warmups — 2193 Solves -
Author: @JohnHammondUriel was browsing the web and he saw this big long blob of text in his address bar! He was telling me about it but I don’t remember everything he said… I think he mentioned something like “it happened twice?”
%25%36%36%25%36%63%25%36%31%25%36%37%25%37%62%25%33%38%25%36%35%25%36%36%25%36%35%25%36%32%25%33%36%25%33%36%25%36%31%25%33%37%25%33%31%25%33%39%25%36%32%25%33%37%25%33%35%25%36%31%25%33%34%25%36%32%25%33%37%25%36%33%25%33%36%25%33%33%25%33%34%25%36%34%25%33%38%25%33%38%25%33%35%25%33%37%25%33%38%25%33%38%25%36%34%25%36%36%25%36%33%25%37%64
Sol:
Step 1: Understanding URL Encoding
URL encoding converts characters into a format that can be transmitted over the Internet. Characters are encoded as %
followed by their ASCII hexadecimal values. For example, the space character is encoded as %20
.
Step 2: The Given Encoded String
Here is the encoded string provided in the challenge:
%25%36%36%25%36%63%25%36%31%25%36%37%25%37%62%25%33%38%25%36%35%25%36%36%25%36%35%25%36%32%25%33%36%25%33%36%25%36%31%25%33%37%25%33%31%25%33%39%25%36%32%25%33%37%25%33%35%25%36%31%25%33%34%25%36%32%25%33%37%25%36%33%25%33%36%25%33%33%25%33%34%25%36%34%25%33%38%25%33%38%25%33%35%25%33%37%25%33%38%25%33%38%25%36%34%25%36%36%25%36%33%25%37%64
Step 3: Decoding the String
First Level of Decoding
Each %25
sequence represents the character %
itself (as 25 is the hexadecimal code for %
). So, let's replace all %25
sequences with %
.
%25%36%36%25%36%63%25%36%31%25%36%37%25%37%62%25%33%38%25%36%35%25%36%36%25%36%35%25%36%32%25%33%36%25%33%36%25%36%31%25%33%37%25%33%31%25%33%39%25%36%32%25%33%37%25%33%35%25%36%31%25%33%34%25%36%32%25%33%37%25%36%33%25%33%36%25%33%33%25%33%34%25%36%34%25%33%38%25%33%38%25%33%35%25%33%37%25%33%38%25%33%38%25%36%34%25%36%36%25%36%33%25%37%64
Second Level of Decoding
Next, decode the remaining sequences by converting each pair of hexadecimal digits to their corresponding ASCII characters:
%36
->6
%63
->c
%31
->1
%37
->7
%37%62
->7b
(note%37
and%62
are separate encodings, so we get7b
)%33%38
->38
%36%35
->65
%36%32
->62
%33%36
->36
%33%37
->37
%33%31
->31
%33%39
->39
%33%35
->35
%33%34
->34
%33%33
->33
%33%34
->34
%33%38
->38
%36%34
->64
%37%64
->7d
After converting all, the decoded string is:
66c6177b3865656266373137396237656237336162313331373139
Step 4: Further Interpretation
The decoded string 66c6177b3865656266373137396237656237336162313331373139
seems to be a long hexadecimal representation. Let's convert this hexadecimal string to ASCII characters to see if it reveals something more readable.
Hexadecimal to ASCII Conversion
Let’s convert each pair of hex digits to their corresponding ASCII character:
66 -> f
6c -> l
61 -> a
77 -> w
7b -> {
38 -> 8
65 -> e
65 -> e
62 -> b
66 -> f
37 -> 7
31 -> 1
39 -> 9
62 -> b
37 -> 7
65 -> e
62 -> b
73 -> s
33 -> 3
61 -> a
62 -> b
31 -> 1
33 -> 3
34 -> 4
36 -> 6
33 -> 3
33 -> 3
34 -> 4
Combining these characters gives us the decoded message:
flaw{8eef71b7eeb73a1b14333}m
Conclusion
The final decoded message is:
flaw{8eef71b7eeb73a1b14333}