# BabyPWN CTF 3.0 Writeup As part of **Techparva 3.0**, the **Innovative Computer Engineering Students’ Society (i-CES)** of WRC, Pokhara, hosted an exciting **BabyPWN Capture The Flag (CTF)** competition. I had the incredible opportunity to design a few challenges for this event. In this post, I’ll share the official write-up for three intriguing challenges: **Text Behind**, **Magic Everywhere**, and **Betrayal**. Dive in to explore the solutions and thought process behind these puzzles! # Text Behind: ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736177556918/48e12627-0a23-4fef-8b88-f1b29283caea.png align="center") The challenge contains a text file with text. ```plaintext 42dac71c4914db9587619c303e7b0cec ``` This is an *MD5* hash. Since it's just a hash, cracking it with word lists might not be the best approach. Instead, you can try an online dictionary where people generate their hashes and choose to store the results for future reference. One popular site for this is *https://md5hashing.net*. Simply paste the hash and wait for the magic to happen. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736182302578/1c3a0e4f-7115-4ed2-aad0-317a97abd918.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736182457249/a6b04627-0e9b-4c24-91e8-f2ad8cef09e7.png align="center") ```plaintext i-CES{0nl1n3_d1c7i0n3ry_15_w0r7h_l00k1ng} ``` # **Magic Everywhere:** ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736183222334/3e5cf05e-0749-43f7-aae8-1d6b140ee79b.png align="center") The challenge consists of a image file which does not seem to open. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736183318205/307bfbed-eb6b-42cd-8739-8b6d57212cb5.png align="center") The file seems to be broken. First lets try printing out the strings in the file.It has a fake flag. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736189524356/eb3f3e61-b2b2-44ba-91bc-6c743f4a38c0.png align="center") Looking at the challenge name and the description, it hints towards Magic Byte. Most probably, we have to fix the magic byte to get this file working. > If you are curious about what Magic Byte is and what magic bytes are for different file formats, refer to [https://en.wikipedia.org/wiki/List\_of\_file\_signatures](https://en.wikipedia.org/wiki/List_of_file_signatures) The first thought, looking at the file error, is that it is a JPEG file and needs the file signature fixed. So, let's open the file and view its signature. > Note: You can view and edit the hex value online at [https://hexed.it/](https://hexed.it/) ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736184046213/68c875b6-43e9-45d5-aef9-3d879ef41f5e.png align="center") Comparing it with the signature of JPEG and fixing it does not seem to work. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736184220019/4320b913-f120-4361-b5cd-02c578c1d625.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736184353057/1bd36b98-0e6a-4fcd-8403-56070a854c62.png align="center") The file still shows the same error as before. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736183318205/307bfbed-eb6b-42cd-8739-8b6d57212cb5.png align="center") What could be the solution here? If it's not JPEG, could it be another format like PNG? Let's give it a try. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736185735579/61d362d7-2dd4-4793-821c-514273ea3d62.png align="center") ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736185822858/d0ba94f6-1ac1-48db-9ece-d138f0d61fd1.png align="center") This fixed the file and revealed the flag. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736186045379/046c603d-5209-4a31-bbd4-2dd8756d99a8.png align="center") ```plaintext i-CES{h4ck3r_C4n_f1x_3v3ry7hing} ``` # Betrayl: ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736186678467/1cbcb4ed-fba1-4d72-b231-c0c8cdf797c9.png align="center") The challenge file is a text file with some strange-looking characters. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736186892477/c69c96a3-3e86-4593-a945-0f19177b3983.png align="center") At first glance, it looks like Morse code. Let's try to decode it. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736187103610/bea68c3e-c786-4ac4-8d08-6c13ac007f68.png align="center") However, this doesn't seem to work. Let's revisit the challenge name and description. It suggests that this is something other than Morse Code. So, what could it be? If you look closely at the symbols, they consist of `.` and `-`. What if they represent some kind of state, maybe a binary state of `0` and `1`? Since `.` are lower and `-` are slightly higher, replace `.` with 0 and `-` with 1. You can easily do this using the `sed` command in Linux. ```bash sed -i 's/\./0/g; s/-/1/g' Betrayl ``` The file content will look like this: ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736187650162/2826bbf0-d6ca-4293-800c-54c5c5897a33.png align="center") Converting this binary to text reveals our flag. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736187769041/4be2738e-6388-4094-996a-0215730d1b8c.png align="center") ```plaintext i-CES{wh47_s33ms_t0_h4pp3n_d0sn't_h4pp3n} ``` Thank you for reading. If you took part in the competition, please feel free to share your feedback about the challenges.