0

I'm working on a CTF (Capture The Flag) challenge, and one of the flags is hidden in ASCII

cat /home/alice/flag22
39 64 31 61 65 38 64 35 36 39 63 38 33 65 30 33 64 38 61 38 66 36 31 35 36 38 61 30 66 61 37 64

When I pipe that into the xxd and convert to hex characters, I only get a subset of the entire string

cat /home/alice/flag22 | xxd -r
d1ae8d569c83e03d

I am expecting the entire string to be 9d1ae8d569c83e03d8a8f61568a0fa7d (using an online tool).

Somehow the 9d and the 8a8f61568a0fa7d were removed.

9d 1ae8d569c83e03d 8a8f61568a0fa7d

Am I not using the xxd tool correctly? (Looked through man xxd but didn't find anything obvious).

Roger
  • 151

1 Answers1

3

Try adding the -p (plain) option to xxd like this:

cat /home/alice/flag22 | xxd -r -p

The output I get when I do that in Bash on macOS 10.5.6 (Catalina) seems to be exactly what you are looking for:

9d1ae8d569c83e03d8a8f61568a0fa7d

According to man xxd the -p option does the following:

Output in postscript continuous hexdump style. Also known as plain hexdump style.

And deeper in the man xxd stuff under -r (revert) option explains it as so; bold emphasis is mine:

Reverse operation: convert (or patch) hexdump into binary. If not writing to stdout, xxd writes into its output file without truncating it. Use the combination -r -p to read plain hexadecimal dumps without line number information and without a particular column layout. Additional Whitespace and line-breaks are allowed anywhere.

Since that long string hex dump you have has no line or column info, the -p option is what is needed.

Giacomo1968
  • 58,727