PicoCTF-2019 Writeup
  • HHousen PicoCTF-2019 Writeup
  • Binary Exploitation
    • L1im1tL355
    • messy-malloc
    • OverFlow 2
    • CanaRy
    • NewOverFlow-1
    • NewOverFlow-2
    • sice_cream
    • seed-sPRiNG
    • leap-frog
    • GoT
    • rop64
    • rop32
    • Ghost_Diary
    • zero_to_hero
    • Challenge Name
    • Heap overflow
    • slippery-shellcode
    • AfterLife
    • SecondLife
    • stringzz
  • Cryptography
    • la cifra de
    • b00tl3gRSA2
    • b00tl3gRSA3
    • AES-ABC
    • john_pollard
    • b00tl3gRSA2
    • waves over lambda
  • Forensics
    • What Lies Within
    • m00nwalk
    • shark on wire 1
    • shark on wire 2
    • Glory of the Garden
    • pastaAAA
    • Investigative Reversing 0
    • Investigative Reversing 1
    • extensions
    • investigation_encoded_1
    • Investigative Reversing 2
    • investigation_encoded_2
    • Investigative Reversing 3
    • like1000
    • Investigative Reversing 4
    • WebNet0
    • B1g_Mac
    • m00nwalk 2
    • WebNet1
    • WhitePages
    • So Meta
    • c0rrupt
  • Web Exploitation
    • Java Script Kiddie 2
    • Empire1
    • Empire2
    • cereal hacker 1
    • Empire3
    • cereal hacker 2
    • Java Script Kiddie
    • JaWT Scratchpad
    • Irish-Name-Repo 1
    • Irish-Name-Repo 2
    • Irish-Name-Repo 3
  • Reverse Engineering
    • Time's Up, Again!
    • Forky
    • droids0
    • Challenge Name
    • droids1
    • droids2
    • droids3
    • reverse_cipher
    • droids4
    • B1ll_Gat35
    • Time's Up
    • Time's Up, For the Last Time!
    • asm1
    • asm2
    • asm3
    • asm4
  • Challenge Name
Powered by GitBook
On this page
  • Problem
  • Solution
  • Flag

Was this helpful?

Edit on Git
  1. Forensics

WhitePages

Problem

I stopped using YellowPages and moved onto WhitePages... but the page they gave me is all blank!

  • TXT File

Solution

  1. If we inspect the file using a HEX editor, we can see that there are two types of whitespaces:

     $ xxd whitepages.txt | head
 00000000: e280 83e2 8083 e280 83e2 8083 20e2 8083  ............ ...
 00000010: 20e2 8083 e280 83e2 8083 e280 83e2 8083   ...............
 00000020: 20e2 8083 e280 8320 e280 83e2 8083 e280   ...... ........
 00000030: 83e2 8083 20e2 8083 e280 8320 e280 8320  .... ...... ... 
 00000040: 2020 e280 83e2 8083 e280 83e2 8083 e280    ..............
 00000050: 8320 20e2 8083 20e2 8083 e280 8320 e280  .  ... ...... ..
 00000060: 8320 20e2 8083 e280 83e2 8083 2020 e280  .  .........  ..
 00000070: 8320 20e2 8083 2020 2020 e280 8320 e280  .  ...    ... ..
 00000080: 83e2 8083 e280 83e2 8083 2020 e280 8320  ..........  ... 
 00000090: e280 8320 e280 8320 e280 83e2 8083 e280  ... ... ........

  2. We have the standard space (0x20), and the Unicode EM SPACE (0xE2 0x80 0x83). Since we have only two options, let's try to treat them as binary.

  3. Run the script.py (which is commented) and get the flag.

Flag

picoCTF{not_all_spaces_are_created_equal_f71be4d2457dc2d068e8b1e7a51ed39a}

PreviousWebNet1NextSo Meta

Last updated 3 years ago

Was this helpful?