---
description: spookyghostboy
---

# Ghost

> I tried to send you a bunch of messages :)
>
> MD5 (ghost) = 3f61d4a3d19c3f3ac1f8223f7c7672af
>
> **Author:** Tensor

Ghost challenge was an interesting one! The author of the challenge loves to mock us in a fun way. We were given a file with no extension, but the description of the challenge gives us a hint that it's probably a text file.&#x20;

We then drag our file to the browser and we found a bunch of messages!&#x20;

![ghost file](https://1326575018-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWOW1TQuFBNIp3aDtWk3v%2Fuploads%2FzfNryRdwU2ZtNYpNkcWT%2FScreenshot%202022-06-12%20at%202.12.48%20PM.png?alt=media\&token=e800d5eb-6cfb-4f16-b2b5-6d4ce0d9e989)

The first thing we noticed was the [Base64](https://en.wikipedia.org/wiki/Base64) encoded string, we then use [CyberChef](https://gchq.github.io/CyberChef/) to decode it.&#x20;

!["This is not it man, try harder!"](https://1326575018-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWOW1TQuFBNIp3aDtWk3v%2Fuploads%2Fkus02h89X78K4YLkkQZ7%2FScreenshot%202022-06-12%20at%202.19.14%20PM.png?alt=media\&token=90c76143-1cf1-4b86-bdef-4b6b9f160663)

As you can see, the output clearly gives us a hint that the challenge is not as easy as we think! So, we figured that the other visible text in the file is probably not the flag.&#x20;

Some of you may have noticed the Pika Pika text, and it is a language called the [Pikalang](https://esolangs.org/wiki/Pikalang)! We then decoded it using an online [decoder](https://www.dcode.fr/pikalang-language).&#x20;

!["lol no"](https://1326575018-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWOW1TQuFBNIp3aDtWk3v%2Fuploads%2FtW2fRCysktk0mfdpDV6V%2FScreenshot%202022-06-12%20at%202.25.56%20PM.png?alt=media\&token=90cf470b-4216-4f6d-9e35-63a733231aaa)

At this point, we are sure that the author is messing with us! :cry:&#x20;

But, we have not given up yet! From the file, we noticed a huge chunk of spaces **AFTER** the "Pika Pika" text, and we highlighted it.&#x20;

![](https://1326575018-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWOW1TQuFBNIp3aDtWk3v%2Fuploads%2FDAqzN0EykD3cVXBGxCjG%2FScreenshot%202022-06-12%20at%202.29.56%20PM.png?alt=media\&token=94f11e79-6cca-47c2-ab33-2d42d1d3977e)

We figured that this might be of interest, because as we were highlighting it, we realized there were **tabs** and **spaces** :hushed:&#x20;

After a bit of Googling, we found out that this is a [Whitespace](https://esolangs.org/wiki/Whitespace) language! We learnt something new today! :tada: As we further find out more about the language, we found an [article](https://johnhammond010.medium.com/codefest-ctf-2018-writeups-f45dafebb8c2) by John Hammond.&#x20;

{% hint style="info" %}
**Take Note:** We removed all the other visible text and left **ONLY** the whitespace chunk in the file, and added a .txt extension to the end of the file.
{% endhint %}

To decode it, we wrote a script that converts;&#x20;

1. Whitespace to Binary
2. Binary to Hex
3. Hex to ASCII characters

```python
s = open("ghost.txt").read()

txt = ''

for c in s:
  if c == ' ' or c == '\t':
    txt += str(0 if c == ' ' else 1)

binary_to_hex = ("%x" % eval("0b"+txt))
bytes_object = bytes.fromhex(binary_to_hex)
ascii_string = bytes_object.decode("ASCII")

print(ascii_string)
```

Flag: `grey{gh0s7_byt3$_n0t_1nvisIbl3}`



BOO! Are you afraid of ghosts?

![](https://1326575018-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWOW1TQuFBNIp3aDtWk3v%2Fuploads%2F4FV8ZdpSBdbG8I1v6v1y%2F580b57fcd9996e24bc43c4b1.png?alt=media\&token=43ce340c-925d-45f6-8079-0b9ba93c0502)
