Posted on by and filed under PHDays 2012.

This was a fun challenge. We are given “I am lost” and a remote host to connect to.

Connecting via netcat gives us

Hi there! Stupid CAPTCHA: enter your name, user40319

Entering the username gives us a bunch of mazes in this format…

layer (1, y, z):
= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = 
= =     =   = = =         =     = =     = =   =   = =   =     = = = = =   = =       = = =     =   = 
=   =     =   = =   = =   = = =     =     =   = = = = =   = =               = =   =   =   = = =   = 
=   = =     = =   =   = =     = =   =   = =     = =   = = =   =   = = = = =     =   =   =       = = 
=   =   =       = = =     = =     = = =     =             =     = =     = =   = =       = = = =   = 
=   =   =   = =   =     =     = =   =     = = =   = = = =   = =     = = =   =     = = =     =     = 
= =   =   =   =     = =   = =     =     =   = =     = =     = = = = =     =   = =       =   =   = = 
=   = =     =     = =   =   =   =   = = =   =     = = = = = =       = = = = = = =   = = =   =     = 
=   =   = = =   = = =       = =   = =   =     = =   =   =       =   =     =   =   =   =   =   =   = 
= = = =       = = =   = = = = = =       =   = =       =   =   =   =   =   =       = = =   = =   = = 
=   = = = = = = = = = =       =   =   = =     = =   =     = =   =   =   = =   = = =   =   = =   = = 
=       =     = =       = = = = =   = =   = = =   = = =     = =       =   =   =       =     = =   = 
= = =       =   = =   = =   = =   =     =       =     = = =     = =   =     =     = = =   =   = = = 
=   =   = = = =     =     =       =   = = =   =   =   =   =   = = =   = = = = = =       =         = 
=   =       =   =     =   =   = =   = = =   = =   = =     = =   =   =             = = =   = =   = = 
=   =   =   =   = =   = =       = =     =     = =   = =       = =   = = = =   = =   = =   =   =   = 
=   =     =     = =       = = =     = =   =   = =   =     =   =   =       =   =   =   =   =   =   = 
= =     =   = =       = =     =   =       = = = = =   = = = =     = =   = = =     = =   =     = = = 
=   = =       = = =   =     =       = = =   =   =           =   = =   =   =     =       = =       = 
=   =   = = = =     =     = =   = = = = =           = = = =     = =     =   =     =   =     = =   = 
= = = =     =     =   = =     =       =     = = = = =       = = =   = =       = =   = = = =   = = = 
=   =     =   = =   =   =   =     = =   =   = =   =   = = =   =     =     = =                 =   = 
=   = = = =   =     =     =   =                       =   =     = =     =   = =   = =   = =     = = 
=         = =   = =   =     = = = =   = = = = =   = =   =     =   = =   =     = = = = =     = = = = 
= =   =           =     = =   = = = =           =       =   = =   =   = = =         = =   =       = 
= = =     = = =     =   =       =     =   = = =   = = = =       =     = = = = =   =   =     = = = = 
= =     = =     =   =   = =   = = =   =                 =   =     = = = =   =   = =   =   = = =   = 
=   =     = =     = =     =     =   = = =   =   = = = = = =   = =   =     =     = =   =     =     = 
=   =   = = = =     = = =   =     =   =   = =     = = = =   = = = =     =   =   =         = = =   = 
=     =     =   = =   =   =   = =   = = =   =   = = = = = =         = =     = =   = = =     = =   = 
= = =     = =   = =   =   =   =     = =     =           =   =   = =     = =     =     = =       = = 
=     =   = =   = = =   =       =   =   = = =   =   =       = = = =   =     =   = = =   =   =   = = 
= =   = = = =     =       = = =   = =   =     = =     = = =         = = =   =   =     = =   =     = 
=         =   = = = = = =     =             = =   = = =   = =   =   =     = =   = = =   =   = = = = 
= =   =   =             = =   = = = = = =       = =     =   =     =   =   =         =   = = =     = 
=       = = = =   = = =   =   = =         =   = =   = =   = = = =     = =   =   = =   =   =   = = = 
= =   =   =     =     =     =     =   =     = =     = =     =     = =     =       = = =           = 
=         =   =   = = = = = = = =     = = = = =   = = = =   =   = =   =   = =   =     = = =   = = = 
= =   = = = =     = = =     =   =   =       = =   = = =     = =   =   = =     =   = =       =     = 
=           = = =     =   = =     =     = =   = =   =   =   =   = =   =     = =   = =   =   =   = = 
=   = = = =       =     = =   = =   =               = = = =     =       = =   = = =   =   = = =   = 
=   = =   =   =     = =   =       = =   = = = = = =     =   =   =   = =   =     =   = =   =     = = 
= = =       =     =       =   = = =       =   = = = =     =   = =     =   = =   =   =   =   =   = = 
=     =   = = = =   = =         =   = =   =   = = = =   = =     =   =     = =   =   =     =   = = = 
= =   = = = =       =     = =         = = = =   =       = =   = =   =   =       = =   = =   =     = 
= = =   = =   = = =   =     =   =   =         = = =   =       =       = =   =   = =   = = = = = = = 
= = =   = = =       = =   = =     =   = = =     = =       = =   = =   =     = =     =   =         = 
= = = =   = =   = = =   =     =     = =   = = =     = =     = =     =   = =       =   =   = = =   = 
=   = =     = =       =     =   =             = =       = =     = =   =     = = =     = = = = =   = 
= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = 

This repeats from layer 0 to 49 or so, and then we are asked to find a path from any coordinate in this maze to another coordinate. This looks like a typical Association for Computing Machinery contest question, so I quickly ran over to programming team member Antony Stabile, Progrmaming Diety for the solution. Here’s the main logic from it, it’s a BFS algorithm that finds the shortest path:

Scanner in = new Scanner(new FileReader(new File("map.txt")));
PrintWriter out = new PrintWriter(new FileWriter(new File("map.out")));
ArrayList input = new ArrayList();
while(in.hasNext()) input.add(in.nextLine());
ySize = 1;
while(input.get(ySize).charAt(0)=='=') ySize++;
ySize--;
xSize = (input.size()-1)/(ySize+1);
zSize = (input.get(1).length())/2;

boolean[][][] g = new boolean[xSize][ySize][zSize]; // true if blocked
for(int i=0; i
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

Here's the shoddy python I wrote to handle it:
import socket
import re
import os

# Handle connection
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("ctf.phdays.com", 1165))

# We log everything to a file
mapcount = 10 
def logshit(stuff):
	tempf = open("map%d.txt" % (mapcount), 'a')
	tempf.write(stuff)

# Dump the map to a text file and run the compiled java class from earlier..
def gomap(mapstr):
	f = open('map.txt', 'w')
	f.write(mapstr)
	f.close()
	print "running generatorn"
	os.system("java map")

	print "sending shortest pathn"
	shortestpath = open('map.out', 'r').read()
	print shortestpath + "n"
	s.sendall(shortestpath)	


# parse/log captcha
data = s.recv(1024)
captcha_str = repr(data)
print 'Received:', captcha_str

# get user id
name_match = re.search(r'(d+)', captcha_str)
print name_match

# send captcha back
sendback = 'user%sn' % name_match.group(0)
print sendback
s.sendall(sendback)

# if we receive the chunk below, map is done being sent.
end_regex = re.compile('Find a path between.+:')
map_data = ''

while 1:
	data = s.recv(1024)
	logshit(data)
	
	if not data:
		break
	
	map_data += data

	# got the last chunk of the map
	if end_regex.search(map_data):
		gomap(map_data) # run the solver
		map_data = ''

# We wanted to see if it spawned a shell, it did not.
s.sendall('ls')

data = s.recv(1024)
print 'data: ', data, 'n'
logshit(data)

print 'Connection closed.n'
s.close()

Credits: Antony Stabile, Ditmar Wendt, Luis Sosa, Luis Santana