Frequency 3000

Platform: Dawgctf 26 | Category: Misc | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-04-07 | Status: Solved Techniques: hex_decode, character_frequency_mapping, clue_guided_reconstruction

Summary

Task: a hex-encoded file decodes to integer frequencies wrapped in a DawgCTF flag template, with a clue pointing to Futurama's pilot transcript. Solution: decode the numbers, count characters in the raw transcript, and use the Futurama hint to reconstruct the obvious phrase 'REDACTED'.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: dawgctf_26 | ID: 20260407_dawgctf_26_frequency_3000
• Tags: hex_encoding, leetspeak, frequency_analysis, transcript, futurama
• Indicators: hex bytes decode into spaced integers inside an apparent flag format, the prompt explicitly points to a specific TV episode and says to 'frequent' it, raw character counts from the supplied text nearly spell a themed phrase even when a few values differ by 1-2
• Source: 20260407_dawgctf_26_frequency_3000.md

Foothold

Vulnerability / Misconfiguration

1. hex_decode
2. character_frequency_mapping
3. clue_guided_reconstruction

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• hex_decode
• character_frequency_mapping
• clue_guided_reconstruction
• Tags: hex_encoding, leetspeak, frequency_analysis, transcript, futurama

Original Writeup

<details><summary>Click to expand original content</summary>

Description

One of my favorite TV shows of all time has to be Futurama. I decided to hide a message that can be solved by frequenting its pilot episode. Good luck and remember to drink lots of Slurm, 'it's highly addictive!'

English summary: the challenge ships a transcript for Futurama's pilot episode, Space Pilot 3000, plus a flag.txt file containing hex bytes. The goal is to decode the hex, interpret the resulting numbers as frequency values, and recover the hidden message from the transcript.

Analysis

The first useful step is to inspect flag.txt. It is not plaintext, but a list of hexadecimal byte values. Decoding those bytes produces:

 text read-only • copy allowed Copy
DawgCTF{ 390 1002 580 1314 191 1589 33 1526 141 762 352 88 1293 379 50 }

So the inner payload is a sequence of integers, not the flag itself.

The prompt makes the intended direction very clear:

• "Futurama"
• "pilot episode"
• "frequenting"

Those clues point directly to the supplied Space Pilot 3000 Transcript.txt file and to frequency analysis. The natural interpretation is that each number corresponds to the frequency of a character in the transcript.

Using the raw transcript text as provided, counting character occurrences gives several exact matches immediately:

• 390 -> W
• 1002 -> H
• 580 -> Y
• 191 -> 0
• 1589 -> T
• 33 -> Z
• 141 -> !
• 762 -> D
• 352 -> B
• 88 -> 3
• 50 -> ?

The remaining values are near-matches rather than perfect matches. That can happen if the transcript version or normalization differs slightly, for example due to spacing, punctuation, line ending, or formatting differences. Even so, the partial decode plus the Futurama theme makes the intended phrase obvious:

 text read-only • copy allowed Copy
REDACTED

This is a leetspeak and punctuation variant of "Why not Zoidberg?", which fits the challenge theme perfectly.

Solution

1. Read flag.txt and notice it contains hexadecimal bytes.
2. Decode the hex into ASCII.
3. Extract the integer sequence from inside the DawgCTF{...} wrapper.
4. Count character frequencies in Space Pilot 3000 Transcript.txt while preserving the raw text context.
5. Match the decoded integers to transcript character counts.
6. Use the strong partial mapping and the Futurama clue to resolve the near-matching characters.
7. Rebuild the final flag string.

Hex-decoding snippet:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pathlib import Path

hex_bytes = Path("flag.txt").read_text(encoding="utf-8").split()
decoded = bytes(int(b, 16) for b in hex_bytes).decode()
print(decoded)

One possible frequency-counting snippet:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import re
from collections import Counter
from pathlib import Path

decoded = "DawgCTF{ 390 1002 580 1314 191 1589 33 1526 141 762 352 88 1293 379 50 }"
nums = list(map(int, re.findall(r"\d+", decoded)))

text = Path("Space Pilot 3000 Transcript.txt").read_text(encoding="utf-8")
counts = Counter(text)

for n in nums:
    matches = [repr(ch) for ch, cnt in counts.items() if abs(cnt - n) <= 2]
    print(n, matches[:12])

That output is enough to see the exact hits and the small set of near-hits. Combined with the episode clue, the intended plaintext is unmistakable:

 text read-only • copy allowed Copy
REDACTED

Therefore the final flag is:

 text read-only • copy allowed Copy
DawgCTF{REDACTED}

</details>

---

signed by XESXOR