Intruder

Task description

You read the format of the solutions in the rules; now it’s time to show whether you learned it. Find the right solution among the many wrong ones.

The original was in Croatian; this is my translation.

The file

The task comes with flags.txt, which has 100,000 lines. Every line looks roughly like a flag. Here are the first six:

CTF2022(GA48I0Z00X9G)
CTF2021(1435K33GKK68)
CTF2004[FN5O670UIJ49]
CTF2015<PY429DNM69XE>
CTF2002<F4565F70KVOT>
CTF2028(C8SK38THT6TL)

Each fake gets something wrong. Some have the wrong year, some use round or angle brackets instead of square ones, and most mix letters in with the digits.

The task points back to the competition rules, which we read for the Rules task. They say a flag is CTF2021 followed by square brackets. Every flag we had seen so far, including the example in the rules, also had exactly 12 digits inside the brackets. Put together, the real flag must be:

• the text CTF2021,
• then [,
• then exactly 12 digits, with no letters,
• then ].

Searching for CTF2021[ with Ctrl+F doesn’t get you far. 881 lines in the file start that way and have 12 characters in square brackets, and only one of them is digits all the way through. Checking 881 lines by eye isn’t practical.

Describing the flag as a pattern

A regular expression (regex for short) is a small language for describing what a piece of text should look like, so a computer can find every match for you. Here is the flag format written as one:

CTF2021\[[0-9]{12}\]

It reads left to right like this:

Piece	Meaning
CTF2021	The letters and digits CTF2021, exactly as written.
\[	A literal [. The backslash is needed because [ has a special meaning in regex.
[0-9]	Any single digit from 0 to 9. This is that special meaning: a set of allowed characters.
{12}	Exactly 12 of whatever comes just before, so 12 digits in a row.
\]	A literal ], escaped the same way.

Running the search

We pasted the file into regex101.com, a free site where you type a regex and it highlights every match in your text. It highlighted exactly one line.

If you’d rather stay on your own computer, the same search is one command. On Linux or macOS:

grep -E 'CTF2021\[[0-9]{12}\]' flags.txt

On Windows, in PowerShell:

Select-String -Pattern 'CTF2021\[[0-9]{12}\]' -Path flags.txt

Both print the single line that matches, out of 100,000. It’s line 13,130, and it’s the flag.