EsaipCTF2024 - Escape the maze

For this chall, we are instructed to help someone escape a maze. We have a netcat interface, lets see what it looks like.

If we take too much time to answer, we die :'(

Lets make a script :

import pwn

url = "127.0.0.1"
port = 1234

r = pwn.connect(url, port)

r.recvuntil("Par exemple, le labyrinthe ci-dessus ne peut etre traversé, il faut donc envoyer 'non'.".encode())

def solve_maze(maze):
    h = len(maze)
    w = len(maze[0])
    dejavues = [[False] * w for i in range(h)]
    
    p = []

    p.append((0, 1))
    dejavues[0][1] = True
    while p:
        case = p.pop()
        x, y = case
        if x == 0:
            indicesAdjacentes = [(x + 1, y), (x, y - 1), (x, y + 1)]
        else:
            indicesAdjacentes = [(x - 1, y), (x + 1, y), (x, y - 1), (x, y + 1)]
        
        adjacentes = []
        for (i, j) in indicesAdjacentes:
            if i >= 0 and j >= 0 and i < h and j < w and maze[i][j] and not dejavues[i][j]:
                adjacentes += [(i, j)]
        
        for (i, j) in adjacentes:
            dejavues[i][j] = True
            p.append((i, j))
    else:
        return dejavues[h - 1][w - 2]

j = 0

while True:
    r.recvuntil("║".encode())
    c = r.recvline()
    l = []
    i = 0
    while "╚" not in c.decode()[0]:
        c = r.recvline()
        line = c.decode()[:-1]
        print(line)
        l.append([])
        for e in line:
            if e != " ":
                l[i].append(0)
            else:
                l[i].append(1)
        i+=1

    out = solve_maze(l)
    r.recvuntil(b": ")
    if out:
        r.sendline(b"oui")
    else:
        r.sendline(b"non")
    
    print("Solved " + str(j))

    j+=1

    if j == 15:
        r.interactive()
        r.close()

To explain it a little bit, we have a function that solve a maze made of 0 and 1 with one beeing walls. The kind of wall doesn't interest us since it is a grid and a wall is a wall, the angles are just here for decoration.

In the while true, we just need to parse the maze and use the function on it (the recvuntil are here because the maze change sizes later on).

After 14 mazes, we get the success message.