C++ Unplugged

Platform: Broncoctf2026 | Category: Misc | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-07-11 | Status: Solved Techniques: compile_and_run, lexical_token_restoration, source_deobfuscation

Summary

Task: a C++ source file where every language token (keywords, operators, punctuation) is replaced by a pop-song title, even inside identifiers. Solution: build a title->C++ token map by grammatical slot, apply longest-first string replacement, fix space-padded char literals, then compile and run to print the flag.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: broncoctf2026 | ID: 20260711_broncoctf2026_cpp_unplugged
• Tags: esoteric_language, static_analysis, cpp, source_substitution, lexical_obfuscation, token_mapping, compile_and_run
• Indicators: C++-looking source where every keyword/operator is a capitalized pop-song title, hint: song titles begin with a capital letter, substitution leaks into identifiers (Abcdefuacters = char+acters), file reports 'c program text' but does not compile
• Source: 20260711_broncoctf2026_cpp_unplugged.md

Foothold

Vulnerability / Misconfiguration

1. compile_and_run
2. lexical_token_restoration
3. source_deobfuscation

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• compile_and_run
• lexical_token_restoration
• source_deobfuscation
• Tags: esoteric_language, static_analysis, cpp, source_substitution, lexical_obfuscation, token_mapping, compile_and_run

Original Writeup

<details><summary>Click to expand original content</summary>

Description

I can understand getting a song stuck in your head, but when your life revolves around music so much that you start writing code using song titles, there may be a problem. I mean, what does this file even print?

Hint: All song titles to replace begin with a capital letter.

A single C++ source file totallynormalcode.cpp is provided. It looks like C++ but every language token (keywords, operators, punctuation) has been swapped for a pop-song title (Taylor Swift / The Weeknd / Ariana Grande / GAYLE, etc.). The goal is to restore the real source and find out what it prints.

Analysis

file reports the artifact as "c program text", and the structure is clearly C-like: #include lines, a using namespace std line, function definitions, and a main. But the body is full of capitalized multi-word tokens:

 cpp read-only • copy allowed Copy
using namespace std EndGame

void updateNum FromTheStart CountingStars Starboy  start IsItOverNow  BeginAgain
  PleasePleasePlease  FromTheStart  Starboy start SmallerThanThis 5 IsItOverNow
     Starboy start ThisIsMe 5 EndGame

Reading it grammatically, each song title occupies a fixed C++ syntactic slot:

• EndGame always ends a statement -> ;
• FromTheStart / IsItOverNow wrap arguments -> ( / )
• BeginAgain / EndOfTime wrap blocks -> { / }
• CountingStars types a variable -> int
• Starboy dereferences / multiplies -> *
• ThisIsMe assigns -> =
• PleasePleasePlease / ShouldveSaidNo -> if / else

The hint "all song titles to replace begin with a capital letter" confirms this is a pure lexical-substitution puzzle. The important gotcha: the substitution also happened inside identifiers, e.g. Abcdefuacters = Abcdefu (char)

• acters = characters, and flag_selector_1WithoutMeWithoutMe = flag_selector_1 + --. That means a tokenizer-based rewrite is wrong — plain string replacement is exactly what is needed.

Solution

1. Map every distinct capitalized title to the C++ token that fits its grammatical slot.
2. Apply the substitutions with plain str.replace, longest title first, so that shorter titles don't corrupt longer ones (and so replacements inside identifiers resolve correctly).
3. Clean up one artifact: some character literals were padded with spaces around the substituted token (' * ', ' { ', ' } '), which makes them multi-character char constants. Strip the separator spaces back to '*', '{', '}'.
4. Compile with clang++ -std=c++17 and run.

First compile attempt failed with -Wc++11-narrowing / multi-character char constant errors on ' * ' etc. — those padded spaces were the culprit; step 3 fixes it.

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pathlib import Path

p = Path(__file__).with_name("totallynormalcode.cpp")
s = p.read_text()

# Song titles stand in for C++ lexical tokens. Replacement also occurred inside
# identifiers (e.g. Abcdefuacters -> characters), so plain string substitution
# is intentional. Longest titles are processed first.
m = {
    "BreakUpWithYourGirlfriendImBored": "/",
    "FreshOutTheSlammer": "]",
    "PleasePleasePlease": "if",
    "SmallerThanThis": "<",
    "CallItWhatYouWant": "string",
    "YouBrokeMeFirst": "break",
    "ShouldveSaidNo": "else",
    "PieceByPiece": "[",
    "FromTheStart": "(",
    "CountingStars": "int",
    "ThisOrThat": "||",
    "SameOldLove": "==",
    "ComeBackBeHere": "return",
    "WithoutMe": "-",
    "IsItOverNow": ")",
    "GoodForYou": "for",
    "Positions": "switch",
    "CaseClosed": "case",
    "BadIdeaRight": "bool",
    "TruthHurts": "true",
    "FalseGod": "false",
    "EndOfTime": "}",
    "BeginAgain": "{",
    "AsItWas": "default",
    "OnMyWay": "continue",
    "PartOfMe": "%",
    "Higher": ">",
    "Greedy": "&&",
    "DejaVu": "while",
    "ThisIsMe": "=",
    "Starboy": "*",
    "EndGame": ";",
    "Abcdefu": "char",
    "Mine": "+=",
    "More": "++",
}
for old in sorted(m, key=len, reverse=True):
    s = s.replace(old, m[old])

# The source pads song titles inside character literals with spaces; those
# spaces are separators, not part of the original literal.
for token in ("*", "{", "}"):
    s = s.replace(f"' {token} '", f"'{token}'")

Path(__file__).with_name("restored.cpp").write_text(s)

 bash read-only • copy allowed Copy
python3 translate.py
clang++ -std=c++17 restored.cpp -o restored
./restored
# The flag is bronco{REDACTED}

The restored program builds the flag piece by piece across part1..part6 (switch/case index math, char-array lookups, char(int) arithmetic) and prints it. The flag itself is a pun: "i came in like a segfault".

</details>

---

signed by XESXOR