Beginner PicoMini 2022 on picoCTF Writeup

Codebook

Mon, 13 Jul 2026 04:15:00 +0800

題目連結

https://learn.cylabacademy.org/library/238

題目解法

將 codebook.txt 與 code.py 下載到同個目錄中。執行 code.py 即可得到 flag。

$ python code.py
picoCTF{c0d------------------82c}

題目原始碼

codebook.txt

1

azbycxdwevfugthsirjqkplomn

code.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43



import random
import sys



def str_xor(secret, key):
 #extend key to secret length
 new_key = key
 i = 0
 while len(new_key) < len(secret):
 new_key = new_key + key[i]
 i = (i + 1) % len(key)
 return "".join([chr(ord(secret_c) ^ ord(new_key_c)) for (secret_c,new_key_c) in zip(secret,new_key)])


flag_enc = chr(0x13) + chr(0x01) + chr(0x17) + chr(0x07) + chr(0x2c) + chr(0x3a) + chr(0x2f) + chr(0x1a) + chr(0x0d) + chr(0x53) + chr(0x0c) + chr(0x47) + chr(0x0a) + chr(0x5f) + chr(0x5e) + chr(0x02) + chr(0x3e) + chr(0x5a) + chr(0x56) + chr(0x5d) + chr(0x45) + chr(0x5d) + chr(0x58) + chr(0x31) + chr(0x58) + chr(0x58) + chr(0x59) + chr(0x02) + chr(0x51) + chr(0x4c) + chr(0x5a) + chr(0x0c) + chr(0x13)



def print_flag():
 try:
 codebook = open('codebook.txt', 'r').read()

 password = codebook[4] + codebook[14] + codebook[13] + codebook[14] +\
 codebook[23]+ codebook[25] + codebook[16] + codebook[0] +\
 codebook[25]

 flag = str_xor(flag_enc, password)
 print(flag)
 except FileNotFoundError:
 print('Couldn\'t find codebook.txt. Did you download that file into the same directory as this script?')



def main():
 print_flag()



if __name__ == "__main__":
 main()

convertme.py

Mon, 13 Jul 2026 04:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/239

題目解法

使用 wget 指令下載檔案。

wget https://artifacts.picoctf.net/c/24/convertme.py

使用 python 執行腳本，腳本惠要求將一個十進位數字轉為二進位，輸入後即可得到 flag。

$ python convertme.py
If 16 is in decimal base, what is it in binary base?
Answer: 10000
That is correct! Here's your flag: picoCTF{4ll-----------------b39}

題目原始碼

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35



import random



def str_xor(secret, key):
 #extend key to secret length
 new_key = key
 i = 0
 while len(new_key) < len(secret):
 new_key = new_key + key[i]
 i = (i + 1) % len(key)
 return "".join([chr(ord(secret_c) ^ ord(new_key_c)) for (secret_c,new_key_c) in zip(secret,new_key)])


flag_enc = chr(0x15) + chr(0x07) + chr(0x08) + chr(0x06) + chr(0x27) + chr(0x21) + chr(0x23) + chr(0x15) + chr(0x5f) + chr(0x05) + chr(0x08) + chr(0x2a) + chr(0x1c) + chr(0x5e) + chr(0x1e) + chr(0x1b) + chr(0x3b) + chr(0x17) + chr(0x51) + chr(0x5b) + chr(0x58) + chr(0x5c) + chr(0x3b) + chr(0x42) + chr(0x57) + chr(0x5c) + chr(0x0d) + chr(0x5f) + chr(0x06) + chr(0x46) + chr(0x5c) + chr(0x13)


num = random.choice(range(10,101))

print('If ' + str(num) + ' is in decimal base, what is it in binary base?')

ans = input('Answer: ')

try:
 ans_num = int(ans, base=2)

 if ans_num == num:
 flag = str_xor(flag_enc, 'enkidu')
 print('That is correct! Here\'s your flag: ' + flag)
 else:
 print(str(ans_num) + ' and ' + str(num) + ' are not equal.')

except ValueError:
 print('That isn\'t a binary number. Binary numbers contain only 1\'s and 0\'s')

fixme1.py

Mon, 13 Jul 2026 03:50:00 +0800

題目連結

https://learn.cylabacademy.org/library/240

題目解法

下載腳本並執行後可以發現在第 20 行的地方報錯。

1
2
3
4


$ python fixme1.py
 File "/home/kali/workspace/fixme1.py", line 20
 print('That is correct! Here\'s your flag: ' + flag)
IndentationError: unexpected indent

使用 nano 或其他習慣的文字編輯器編輯檔案，將第 20 行最開頭的兩個空格刪除。

nano fixme2.py

要退出 nano 要按下 Ctrl + X，接著按下 Y，再按下 Enter 即可退出。退出後再次執行 python 腳本即可得到 flag。

$ python fixme1.py
That is correct! Here's your flag: picoCTF{1nd-------------------c8f}

題目原始碼

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21



import random



def str_xor(secret, key):
 #extend key to secret length
 new_key = key
 i = 0
 while len(new_key) < len(secret):
 new_key = new_key + key[i]
 i = (i + 1) % len(key)
 return "".join([chr(ord(secret_c) ^ ord(new_key_c)) for (secret_c,new_key_c) in zip(secret,new_key)])


flag_enc = chr(0x15) + chr(0x07) + chr(0x08) + chr(0x06) + chr(0x27) + chr(0x21) + chr(0x23) + chr(0x15) + chr(0x5a) + chr(0x07) + chr(0x00) + chr(0x46) + chr(0x0b) + chr(0x1a) + chr(0x5a) + chr(0x1d) + chr(0x1d) + chr(0x2a) + chr(0x06) + chr(0x1c) + chr(0x5a) + chr(0x5c) + chr(0x55) + chr(0x40) + chr(0x3a) + chr(0x58) + chr(0x0a) + chr(0x5d) + chr(0x53) + chr(0x43) + chr(0x06) + chr(0x56) + chr(0x0d) + chr(0x14)


flag = str_xor(flag_enc, 'enkidu')
 print('That is correct! Here\'s your flag: ' + flag)

fixme2.py

Mon, 13 Jul 2026 03:40:00 +0800

題目連結

https://learn.cylabacademy.org/library/241

題目解法

下載腳本並執行後可以發現在第 22 行的地方報錯。

1
2
3
4
5


$ python fixme2.py
 File "/home/kali/workspace/fixme2.py", line 22
 if flag = "":
 ^^^^^^^^^
SyntaxError: invalid syntax. Maybe you meant '==' or ':=' instead of '='?

使用 nano 或其他習慣的文字編輯器編輯檔案，將第 22 行的 = 改成 ==。

nano fixme2.py

要退出 nano 要按下 Ctrl + X，接著按下 Y，再按下 Enter 即可退出。退出後再次執行 python 腳本即可得到 flag。

$ python fixme2.py
That is correct! Here's your flag: picoCTF{3qu--------------------------efc}

題目原始碼

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27



import random



def str_xor(secret, key):
 #extend key to secret length
 new_key = key
 i = 0
 while len(new_key) < len(secret):
 new_key = new_key + key[i]
 i = (i + 1) % len(key)
 return "".join([chr(ord(secret_c) ^ ord(new_key_c)) for (secret_c,new_key_c) in zip(secret,new_key)])


flag_enc = chr(0x15) + chr(0x07) + chr(0x08) + chr(0x06) + chr(0x27) + chr(0x21) + chr(0x23) + chr(0x15) + chr(0x58) + chr(0x18) + chr(0x11) + chr(0x41) + chr(0x09) + chr(0x5f) + chr(0x1f) + chr(0x10) + chr(0x3b) + chr(0x1b) + chr(0x55) + chr(0x1a) + chr(0x34) + chr(0x5d) + chr(0x51) + chr(0x40) + chr(0x54) + chr(0x09) + chr(0x05) + chr(0x04) + chr(0x57) + chr(0x1b) + chr(0x11) + chr(0x31) + chr(0x0d) + chr(0x5f) + chr(0x05) + chr(0x40) + chr(0x04) + chr(0x0b) + chr(0x0d) + chr(0x0a) + chr(0x19)


flag = str_xor(flag_enc, 'enkidu')

# Check that flag is not empty
if flag = "":
 print('String XOR encountered a problem, quitting.')
else:
 print('That is correct! Here\'s your flag: ' + flag)

Glitch Cat

Mon, 13 Jul 2026 03:10:00 +0800

題目連結

https://learn.cylabacademy.org/library/242

題目解法

啟動題目並使用 nc 連線後，會得到一個包含 chr(0x61) 的字串。

$ nc saturn.picoctf.net 65005
'picoCTF{gl17ch_m3_n07_' + chr(0x61) + chr(0x34) + chr(0x33) + chr(0x39) + chr(0x32) + chr(0x64) + chr(0x32) + chr(0x65) + '}'

要解讀該字串有幾種方法，可以手動對照 ASCII 16 進為，或是直接使用 python 印出字串，就會自動轉成原始字元。使用 python 指令啟動 python 環境，用 print 將字串印出。

>>> print('picoCTF{gl17ch_m3_n07_' + chr(0x61) + chr(0x34) + chr(0x33) + chr(0x39) + chr(0x32) + chr(0x64) + chr(0x32) + chr(0x65) + '}')
picoCTF{gl1----------------d2e}

HashingJobApp

Mon, 13 Jul 2026 03:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/243

題目解法

啟動題目後，使用 nc 指令連線後，題目會提供一個字串，要求使用 md5 雜湊後的值，輸入正確三次即可得到 flag。可以搜尋 md5 雜湊工具、cyberchek、或是使用 md5sum 指令。 md5sum 使用方式：

$ echo -n "caffeine" | md5sum
e724f8b8a8349afb5beaeaa300323933 -

實際連線：

$ nc saturn.picoctf.net 56275
Please md5 hash the text between quotes, excluding the quotes: 'caffeine'
Answer:
e724f8b8a8349afb5beaeaa300323933
e724f8b8a8349afb5beaeaa300323933
Correct.
Please md5 hash the text between quotes, excluding the quotes: 'Japan'
Answer:
53a577bb3bc587b0c28ab808390f1c9b
53a577bb3bc587b0c28ab808390f1c9b
Correct.
Please md5 hash the text between quotes, excluding the quotes: 'hangnails'
Answer:
7e3193d5ef5d764bfd8874dda4b5253a
7e3193d5ef5d764bfd8874dda4b5253a
Correct.
picoCTF{4pp-----------------------de2}

PW Crack 1

Mon, 13 Jul 2026 02:45:00 +0800

題目連結

https://learn.cylabacademy.org/library/245

題目解法

將 level1.py 以及 level1.flag.txt.enc 兩個檔案放在同個目錄下。可以看到 level1.py 第 19 行有寫出密碼

user_pw == "1e1a"

執行腳本後輸入密碼 1e1a 即可得到 flag。

$ python level1.py
Please enter correct password for flag: 1e1a
Welcome back... your flag, user:
picoCTF{545---------------060}

題目原始碼

level1.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


### THIS FUNCTION WILL NOT HELP YOU FIND THE FLAG --LT ########################
def str_xor(secret, key):
 #extend key to secret length
 new_key = key
 i = 0
 while len(new_key) < len(secret):
 new_key = new_key + key[i]
 i = (i + 1) % len(key)
 return "".join([chr(ord(secret_c) ^ ord(new_key_c)) for (secret_c,new_key_c) in zip(secret,new_key)])
###############################################################################


flag_enc = open('level1.flag.txt.enc', 'rb').read()



def level_1_pw_check():
 user_pw = input("Please enter correct password for flag: ")
 if( user_pw == "1e1a"):
 print("Welcome back... your flag, user:")
 decryption = str_xor(flag_enc.decode(), user_pw)
 print(decryption)
 return
 print("That password is incorrect")



level_1_pw_check()

PW Crack 2

Mon, 13 Jul 2026 02:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/246

題目解法

將 level2.py 以及 level2.flag.txt.enc 兩個檔案放在同個目錄下。查看題目原始碼，可以看到第 18 行，有寫出 user_pw 的值在等於多少的情況下，會通過。將 user_pw 的 16 進位 ASCII 轉成字元是 39ce。

user_pw == chr(0x33) + chr(0x39) + chr(0x63) + chr(0x65)

執行腳本後輸入 39ce 密碼即可得到 flag。

$ python3 level2.py
Please enter correct password for flag: 39ce
Welcome back... your flag, user:
picoCTF{tr4----------------42e}

題目原始碼

level2.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


### THIS FUNCTION WILL NOT HELP YOU FIND THE FLAG --LT ########################
def str_xor(secret, key):
 #extend key to secret length
 new_key = key
 i = 0
 while len(new_key) < len(secret):
 new_key = new_key + key[i]
 i = (i + 1) % len(key)
 return "".join([chr(ord(secret_c) ^ ord(new_key_c)) for (secret_c,new_key_c) in zip(secret,new_key)])
###############################################################################

flag_enc = open('level2.flag.txt.enc', 'rb').read()



def level_2_pw_check():
 user_pw = input("Please enter correct password for flag: ")
 if( user_pw == chr(0x33) + chr(0x39) + chr(0x63) + chr(0x65) ):
 print("Welcome back... your flag, user:")
 decryption = str_xor(flag_enc.decode(), user_pw)
 print(decryption)
 return
 print("That password is incorrect")



level_2_pw_check()

runme.py

Mon, 13 Jul 2026 02:15:00 +0800

題目連結

https://learn.cylabacademy.org/library/250

題目解法

這題題目官方希望可以學習使用 wget 和 python 執行指令。假設只是要拿到 flag，可以直接下載後打開查看。以下是官方希望的做法：

從網站複製檔案連結，到 webshell 或是自己的 linux 主機使用 wget 指令下載檔案。

wget https://artifacts.picoctf.net/c/34/runme.py

下載後得到一個 runme.py 檔案，使用 python3 指令執行，即可得到 flag。

$ python3 runme.py
picoCTF{run--------run}