So I'm trying to get into CTFs and the first one I'm doing is the picoCTF 2019. I used gawk and strtonum() to solve one of the problems. Basically, I had to look at this output:
49734 231 160
49735 235 151
49736 230 143
49737 310 157
87663 12 103
162650 364 124
175231 153 106
175232 261 173
211986 230 164
211987 222 150
211988 15 63
211989 330 171
284427 122 162
292340 174 63
292341 371 137
331830 216 141
331831 365 65
426632 346 137
439903 360 144
515770 112 61
515771 252 146
583608 341 146
640996 310 63
688795 77 162
688796 107 63
702943 23 156
751424 243 164
754731 61 137
754732 113 64
754733 274 163
754734 304 137
796226 43 142
871159 256 165
871160 6 67
871161 316 67
871162 346 63
927506 347 162
927507 212 137
927508 122 64
994666 376 156
994667 43 144
994668 377 137
1068577 234 152
1068578 344 63
1068579 203 61
1068580 222 61
1068581 162 171
1101444 5 137
1101445 173 141
1101446 7 163
1101447 300 154
1171017 53 153
1171018 147 152
1171019 356 146
1241182 51 144
1241183 224 163
1241184 200 141
1241185 106 154
1272572 217 153
1272573 156 146
1337150 4 163
1410459 345 154
1410460 340 153
1460208 5 146
1510914 237 154
1567157 322 153
1567158 100 152
1567159 42 144
1567160 220 163
1567161 205 146
1581925 315 144
1581926 244 163
1581927 215 172
1581928 147 155
1581929 257 172
1677065 176 61
1677066 341 60
1764510 357 65
1764511 210 64
1764512 31 70
1766742 13 175
which is from the command cmp -l kitters.jpg cattos.jpg, and decode the octal ASCII encodings of the strings in the third column.
To accomplish the task, I used this command:
cmp -l kitters.jpg cattos.jpg | gawk '{printf "%c", strtonum(0$3)}' && echo
which gave the desired output, the flag:
picoCTF{th3yr3_a5_d1ff3r3nt_4s_bu773r_4nd_j311y_aslkjfdsalkfslkflkjdsfdszmz10548}
However, before finding this solution, I tried this command:
cmp -l kitters.jpg cattos.jpg | gawk '{printf "%c", strtonum($3)}' && echo
which is exactly the same as the other command except that there is no 0 before $3. It gave this ouput:
g|j¤?«¢?A=?¢?¤@£¥CC?¢@?==«£££££¬=<A@F¯
I'm just curious why these two commands gave very different outputs, and what the significance of the 0 in strtonum() is. I assume it is related to octal, but I couldn't find confirmation on that anywhere.
The manual describes strtonum like this:
strtonum(str)Examine
str, and return its numeric value. Ifstrbegins with a leading0, treat it as an octal number. Ifstrbegins with a leading0xor0X, treat it as a hexadecimal number. Otherwise, assume it is a decimal number.
So, as you can see below, 160 and 0160 are different numbers; it's all documented.
$ gawk 'BEGIN { print strtonum("160"), strtonum("0160") }'
160 112