Pickle

1 minute to read

We are given a file called out.pickle. The flag is stored inside, we can visualize its contents in hexadecimal:

$ xxd out.pickle
00000000: 8004 958c 0000 0000 0000 008c 085f 5f6d  .............__m  
00000010: 6169 6e5f 5f94 8c0b 466c 6167 5072 696e  ain__...FlagPrin
00000020: 7465 7294 9394 2981 947d 9428 8c04 666c  ter...)..}.(..fl
00000030: 6167 945d 9428 4b69 4b63 4b74 4b66 4b7b  ag.].(KiKcKtKfK{
00000040: 4b63 4b75 4b63 4b75 4b6d 4b62 4b65 4b72  KcKuKcKuKmKbKeKr
00000050: 4b73 4b5f 4b6f 4b72 4b5f 4b70 4b69 4b63  KsK_KoKrK_KpKiKc
00000060: 4b6b 4b6c 4b65 4b73 4b3f 4b7d 658c 0466  KkKlKeKsK?K}e..f
00000070: 616b 6594 8c1d 6a63 7466 7b63 3075 6c64  ake...jctf{c0uld
00000080: 5f74 6831 735f 6233 5f74 6833 5f66 6c34  _th1s_b3_th3_fl4
00000090: 673f 7d94 7562 2e                        g?}.ub.

First of all, we see a fake flag: jctf{c0uld_th1s_b3_th3_fl4g?}. But if we take a closer look, we see that the real flag is interleaved with K:

$ head -c 108 out.pickle | tail -c 54
KiKcKtKfK{KcKuKcKuKmKbKeKrKsK_KoKrK_KpKiKcKkKlKeKsK?K}  

$ head -c 108 out.pickle | tail -c 54 | tr -d K
ictf{cucumbers_or_pickles?}

And the real flag is ictf{cucumbers_or_pickles?}.