Search for a command to run...

What would a CTF be without a one-liner?
echo ${FLAG} | perl -ple '$n=()=/./g; $_=~s/./$|--?ord($&)%$n:ord($&)-$^F**5/eg'
perlbashpython (for analysis)Analyze and understand the line of code and reverse characters mapping.
Here $n=()=/./g counts the number of characters in the input ${FLAG}. The substitution
runs once per character () and uses the special variables and . In Perl, is "the maximum
system file descriptor" which defaults to 2. Thus = 2^5 = 32(number of characters in MD5 hash). The expression inside the regex is
.
s/./…/eg.$|$^F$^F$^F**5$|-- ? ord($&)%$n : ord($&) - $^F**5The key point is that $| (the autoflush flag) toggles on each character: by default $| is 0, so $|-- alternates between false (0) and true (1) on successive
characters. Concretely, for the 1st, 3rd, 5th, … characters $|-- is false, so the code uses ord($&)-32;
for the 2nd, 4th, 6th, … characters $|-- is true, so it uses ord($&) % $n.
In summary:
ord(char) - 32.ord(char) mod n.All these numeric results are concatenated together (no separator) to form the output string. Given the expected output is the 76-digit number:
7032652791156917671465166913651218232017181420241721222618141725201868182311
Now to reverse this mapping, since the flag format is flag{MD5} the total length is 5 (for flag{ ) + 32 + 1 ( } ) = 38 characters, so $n=38. We split the 76 digits into 38 values (2 per character on average).
Because odd positions must come from ord-32 (typically two digits for letters/digits) and even positions come from ord % 38 (0–37, one or two digits), we parse as follows:
ord(char) - 32 , so adding 32 and converting to a character.ord(char) % 38, so we find a character whose ASCII code mod 38 gives that number.Doing this for each pair (we enumerated and tested possibilities) yields the characters. For example, the
first odd index value 70 gives chr(70+32) = 'f', and the first even index value 32 comes from a character with ord % 38 = 32, which is 'l' (since 108 % 38 = 32).
Repeating this for all characters produces:
Position: 1 2 3 4 5 6 7 8 9 10 ... 36 37 38
Characters: f l a g { 5 e 7 c 4 2 ... 8 7 }
flag{5e7c4a6e3a22c47244d1a6f241e48d87}
flag{5e7c4a6e3a22c47244d1a6f241e48d87}