Trick or Treat

Challenge:

We found a script being used by DEADFACE. It should be relatively straightforward, but no one here knows Python very well. Can you help us find the flag in this Python file?

Solution:

The provided Zip file contained a Python script named "trickortreat.py" that when executed simply printed "Smell my feet.":

$ python3 trickortreat.py 

Smell my feet.

Reviewing the code I saw that show_msg() was the source of the message, and there was another function named show_flag().

from hashlib import md5 as m5


def show_flag():
    b = 'gginmevesogithoooedtatefadwecvhgghu' \
        'idiueewrtsadgxcnvvcxzgkjasywpojjsgq' \
        'uegtnxmzbajdu'
    c = f"{b[10:12]}{b[6:8]}{b[4:6]}{b[8:10]}" \
        f"{b[4:6]}{b[12:14]}{b[2:4]}{b[0:2]}" \
        f"{b[14:16]}{b[18:20]}{b[16:18]}{b[20:22]}"
    m = m5()
    m.update(c.encode('utf-8'))
    d = m.hexdigest()
    return f"flag{{{d}}}" 


def show_msg():
    print(f'Smell my feet.')


show_msg()

I changed the last line of the script to, print(show_flag()) and re-running produced the flag.

$ python3 trickortreat.py 

flag{2f3ba6b5fb8bb84c33b584f981c2d13d}