sparta

Platform: spbctf (rev-kids20) | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-25 | Status: Solved Techniques: columnar_transposition_reversal, disassembly, nested_loop_analysis, static_binary_analysis

Summary

Task: 64-bit ELF binary with columnar transposition cipher (stride 7) on input. Solution: reverse the column-by-column reading order to recover the flag from scrambled string.

sparta — spbctf (rev-kids20)

Description

With a shield or on a shield?

A 64-bit ELF binary (not stripped, dynamically linked) that asks "With a shield or on a shield?" (a Spartan reference) and checks user input against a hardcoded scrambled flag string.

Analysis

Initial Reconnaissance

 bash read-only • copy allowed Copy
file sparta
# ELF 64-bit LSB pie executable, x86-64, dynamically linked, not stripped

strings revealed key strings:

• "With a shield or on a shield?" — the prompt
• "st_3phr_b13gcsvut_3yf1rz{55}" — the scrambled flag (28 chars)
• "Wow, with a shield :)" — success message
• "Oh, on a shield :(" — failure message ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Only one custom function: main

Disassembly Analysis

The main function logic:

1. Prints prompt, reads input via fgets (max 255 bytes), strips trailing newline
2. Loads pointer to hardcoded scrambled string "st_3phr_b13gcsvut_3yf1rz{55}"
3. Uses a nested loop structure:
   • Outer loop: variable i from 0 to 6 (7 iterations, cmpl $0x6, -0xc(%rbp))
   • Inner loop: variable pos starts at i, increments by 7 each iteration (addl $0x7, -0x10(%rbp)), while pos < strlen(input)
   • Sequential counter k (starting at 0) indexes into the scrambled string
   • Compares input[pos] with scrambled[k++]
4. If all comparisons match → "Wow, with a shield :)", otherwise → "Oh, on a shield :(" ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Understanding the Transposition

This is a columnar transposition cipher with stride/width 7. The binary reads the input column-by-column from a conceptual 7-column grid and compares it sequentially against the scrambled string.

The comparison order for a 28-character input:

• i=0: input[0], input[7], input[14], input[21]
• i=1: input[1], input[8], input[15], input[22]
• i=2: input[2], input[9], input[16], input[23]
• i=3: input[3], input[10], input[17], input[24]
• i=4: input[4], input[11], input[18], input[25]
• i=5: input[5], input[12], input[19], input[26]
• i=6: input[6], input[13], input[20], input[27] ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

To recover the flag, reverse the mapping: for each position k in the scrambled string, determine which input position it corresponds to, then place the character there.

 python read-only • copy allowed Copy
#!/usr/bin/env python3
scrambled = 'st_3phr_b13gcsvut_3yf1rz{55}'
length = len(scrambled)  # 28

# Build the position mapping (column-by-column order)
positions = []
for i in range(7):
    pos = i
    while pos < length:
        positions.append(pos)
        pos += 7

# Reverse the transposition
flag = [''] * length
for k in range(length):
    flag[positions[k]] = scrambled[k]
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

print(''.join(flag))  # spbctf{REDACTED}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍