0

I'm working on a CTF (Capture The Flag) challenge, and one of the flags is hidden in ASCII

cat /home/alice/flag22
39 64 31 61 65 38 64 35 36 39 63 38 33 65 30 33 64 38 61 38 66 36 31 35 36 38 61 30 66 61 37 64

When I pipe that into the xxd and convert to hex characters, I only get a subset of the entire string

cat /home/alice/flag22 | xxd -r
d1ae8d569c83e03d

I am expecting the entire string to be 9d1ae8d569c83e03d8a8f61568a0fa7d (using an online tool).

Somehow the 9d and the 8a8f61568a0fa7d were removed.

9d 1ae8d569c83e03d 8a8f61568a0fa7d

Am I not using the xxd tool correctly? (Looked through man xxd but didn't find anything obvious).

4
  • that's probably ascii not hexadecimal. I don't see any abcdef in that long string of "39 64 31 61......."
    – barlop
    Commented Sep 26, 2020 at 5:39
  • This question, a capture the flag challenge, it's basically a puzzle and not useful to anybody. If you had a specific issue with xxd then it shouldn't be stuck within a capture the flag challenge
    – barlop
    Commented Sep 26, 2020 at 5:46
  • Thanks for noting my error, Barlop. I've reworded my question.
    – Roger
    Commented Sep 26, 2020 at 5:50
  • @Roger I was perhaps a bit confused.. it is a puzzle. But yeah ascii can be in hex or decimal. asciitable.com if it's in hex then xxd would apply. But it might not be in hex it might be in decimal . I'm not really a puzzle person. There's no A-F though that doesn't mean it's not hex.
    – barlop
    Commented Sep 26, 2020 at 7:43

1 Answer 1

3

Try adding the -p (plain) option to xxd like this:

cat /home/alice/flag22 | xxd -r -p

The output I get when I do that in Bash on macOS 10.5.6 (Catalina) seems to be exactly what you are looking for:

9d1ae8d569c83e03d8a8f61568a0fa7d

According to man xxd the -p option does the following:

Output in postscript continuous hexdump style. Also known as plain hexdump style.

And deeper in the man xxd stuff under -r (revert) option explains it as so; bold emphasis is mine:

Reverse operation: convert (or patch) hexdump into binary. If not writing to stdout, xxd writes into its output file without truncating it. Use the combination -r -p to read plain hexadecimal dumps without line number information and without a particular column layout. Additional Whitespace and line-breaks are allowed anywhere.

Since that long string hex dump you have has no line or column info, the -p option is what is needed.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .