CORRIDORS

web 65 solves by sportshead

---

Challenge

The path will guide you to the flag.

Live service, no source handout. Just a URL.

Approach

When you go on the page you reach a hallway with two options. These options map to two links, /l and /r, appended to whatever path you're already on. It's a binary maze. Following either link from the root either continues the path or dead-ends it, and the end is never really the end, since a "wrong" branch just means backtrack and try the other letter.

Two distinct branch labels immediately narrows the encoding scheme down to two options: something like a Bacon cipher, or straight binary. It isn't Bacon cipher, so it's binary: l as 0, r as 1, and once you have a full bit string, standard ASCII, 8 bits per character.

Solution

A small crawler walks the tree depth-first, trying both directions at each step and keeping whichever one the server confirms is on the correct path (rather than a dead end), building up the full l/r string until it reaches the end:

import requests

url = "https://<instance>.play.gaslightctf.cooking:1337"
path = ""
while True:
    for direction in ("/l", "/r"):
        res = requests.get(url + path + direction).text.strip()
        if "correct" in res:
            path += direction
            print(path)
            break
        elif "nope" not in res:
            path += direction
            break
    else:
        break

clean_path = path.replace("/", "")
if clean_path:
    binary_str = clean_path.replace("l", "0").replace("r", "1")
    decoded_chars = []
    for i in range(0, len(binary_str), 8):
        byte = binary_str[i:i + 8]
        if len(byte) == 8:
            decoded_chars.append(chr(int(byte, 2)))
    print("".join(decoded_chars))