No Laughing Matter

Platform: Broncoctf2026 | Category: Misc | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-07-11 | Status: Solved Techniques: ah_to_binary_substitution, eight_bit_ascii_decoding

Summary

Task: aha.txt holds 36 space-separated 8-char tokens using only letters A and H. Solution: recognize the two-symbol alphabet as binary, map A=0/H=1, read each 8-symbol group as a big-endian ASCII byte to recover the flag.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: broncoctf2026 | ID: 20260711_broncoctf2026_no_laughing_matter
• Tags: binary_encoding, encoding, semantic_clue, ascii_decode, two_symbol_alphabet
• Indicators: file made of only two distinct letters, tokens exactly 8 symbols long, A/H alphabet evoking laughter (aha/haha), space-delimited groups mapping one byte each
• Source: 20260711_broncoctf2026_no_laughing_matter.md

Foothold

Vulnerability / Misconfiguration

1. ah_to_binary_substitution
2. eight_bit_ascii_decoding

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• ah_to_binary_substitution
• eight_bit_ascii_decoding
• Tags: binary_encoding, encoding, semantic_clue, ascii_decode, two_symbol_alphabet

Original Writeup

<details><summary>Click to expand original content</summary>

Description

You see, that's not funny.

A single file aha.txt was provided containing 36 space-separated 8-character tokens made up of only the letters A and H:

AHHAAAHA AHHHAAHA AHHAHHHH AHHAHHHA AHHAAAHH AHHAHHHH AHHHHAHH AHAHAHAH AHAAAHHA AHAHAHAH AHAAHHHA AHAAHHHA AHAHHAAH AHAAHHAA AHAAHHAH AHAAAAAH AHAAHHHH AHAAHHAA AHAAHHHH AHAAHHAA AHAHHAAA AHAAAHAA AHAAHAAH AHAAHAHA AHAAAAHA AHAAHHHH AHAAHHAA AHAHAAHA AHAAHHHH AHAAAHHA AHAAHHAA AHAAHAAA AHAAAAAH AHAAHAAA AHAAAAAH AHHHHHAH

Goal: decode the two-symbol stream into the flag.

Analysis

Semantic clues drive the whole task:

• The title "No Laughing Matter", the prompt "that's not funny", and the filename aha.txt all evoke laughter (aha / haha). The two-symbol alphabet is A and H — the building blocks of a laugh.
• A two-symbol alphabet is the classic disguise for binary.

Why 8-bit ASCII and not Bacon cipher:

• Bacon uses 5-symbol groups (32 combinations, one per letter).
• Here every token is exactly 8 symbols long, and the groups are already space-delimited. Eight bits = one byte, so each token is one ASCII character. This is straightforward 8-bit ASCII, not a 5-bit Bacon mapping.

Choosing the bit polarity:

• Map A=0, H=1. The first token AHHAAAHA → 01100010 = 0x62 = b, and the run AHHAAAHA AHHHAAHA AHHAHHHH AHHAHHHA AHHAAAHH AHHAHHHH decodes to bronco{ — an immediate confirmation of the correct polarity.
• The reverse mapping (A=1, H=0) produces high-bit / non-printable bytes, which rules it out.

Solution

1. Read the file and split on whitespace into 8-symbol tokens.
2. Translate A→0, H→1 in each token.
3. Interpret each token as a big-endian binary byte and convert to its ASCII character.
4. Join to get the flag.

 python read-only • copy allowed Copy
#!/usr/bin/env python3
# No Laughing Matter — broncoctf2026
# A=0, H=1; each 8-symbol token is one big-endian ASCII byte.

with open("aha.txt") as f:
    tokens = f.read().split()

table = str.maketrans("AH", "01")
flag = "".join(chr(int(tok.translate(table), 2)) for tok in tokens)
print(flag)

Output:

bronco{REDACTED}

The decoded flag content is itself a string of laughter/joke abbreviations (UFUNNY LMAO LOL XD IJBOL ROFL HAHA), fitting the "not funny" theme.

</details>

---

signed by XESXOR