glitch

Platform: Tjctf | Category: Misc | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-05-15 | Status: Solved Techniques: resistor_color_code_decoding, color_band_segmentation, paired_digit_ascii_conversion, median_filter_denoising

Summary

Task: PNG image with glitched color bands and noise overlay, description hints 'Do not resist the glitch'. Solution: identify horizontal bands as resistor color codes, read 28 bands in pairs to get two-digit decimal numbers, convert to ASCII.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: tjctf | ID: 20260515_tjctf_glitch
• Tags: image_analysis, ascii_encoding, resistor_color_code, color_bands, test_pattern, palette_png
• Indicators: horizontal color bands in image resembling resistor or test pattern, challenge description contains word 'resist' as wordplay on 'resistor', color bands use standard resistor colors (black brown red orange yellow green blue violet gray white), pairs of color bands encode two-digit decimal numbers mapping to ASCII, heavy glitch/noise overlay obscures band boundaries requiring careful segmentation
• Source: 20260515_tjctf_glitch.md

Foothold

Vulnerability / Misconfiguration

1. Resistor_color_code_decoding
2. Color_band_segmentation
3. Paired_digit_ascii_conversion
4. Median_filter_denoising

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• resistor_color_code_decoding
• color_band_segmentation
• paired_digit_ascii_conversion
• median_filter_denoising
• Tags: image_analysis, ascii_encoding, resistor_color_code, color_bands, test_pattern, palette_png

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Do not resist the g̵͕̗͑̅l̶̢̂̚ḭ̶̐͗t̴͔̞̒͐c̸̭͈̄h̷̨̞͊͠. Wrap flag in tjctf{}

A PNG image (1920×1080, 8-bit palette mode, 156 colors) showing a glitched test pattern with horizontal color bands and heavy noise/glitch artifacts overlaid. The goal is to extract the flag hidden in the color pattern.

Analysis

The image contains horizontal color bands spanning the width of the image, overlaid with significant noise and glitch effects. Several rabbit holes exist:

1. Stego analysis — LSB extraction, bit-plane analysis, palette index manipulation all yield nothing meaningful.
2. Block-based extraction — Averaging 16×16 RGB blocks produces printable ASCII streams in a wedge-shaped region, but these don't decode to anything useful via Ascii85/Base85/BasE91.
3. Channel difference streams — R-B and G-B differences over the wedge region show structured alphabets (32 and 16 distinct symbols respectively), but no valid encoding was found.

The key breakthrough comes from the challenge description: "Do not resist" is a wordplay on "resistor". The horizontal color bands represent resistor color codes.

Resistor Color Code Mapping

The standard resistor color code assigns digits 0-9 to colors:

The image contains 28 horizontal color bands (not 13 as it appears at first glance — thin bands can be missed due to the noise overlay and aggressive denoising merging them with neighbors). These 28 bands are read in pairs, where each pair forms a two-digit decimal number that maps to an ASCII character.

Solution

Step 1: Identify the 28 color bands

Careful segmentation of the image (avoiding aggressive median filtering that merges thin bands) reveals 28 distinct horizontal color bands from top to bottom.

Step 2: Map band pairs to ASCII

Result: REDACTED

Step 3: Solve script

#!/usr/bin/env python3
"""
TJCTF 2026 - glitch
Resistor color code decoding from horizontal color bands in a glitched PNG.
"""

# Standard resistor color code: color -> digit
digits = {
    "black": "0", "brown": "1", "red": "2", "orange": "3",
    "yellow": "4", "green": "5", "blue": "6", "violet": "7",
    "gray": "8", "white": "9",
}

# 28 bands read top-to-bottom, grouped into 14 pairs
pairs = [
    ("blue", "gray"),      # 68 -> D
    ("green", "brown"),    # 51 -> 3
    ("gray", "orange"),    # 83 -> S
    ("yellow", "white"),   # 49 -> 1
    ("violet", "brown"),   # 71 -> G
    ("violet", "gray"),    # 78 -> N
    ("yellow", "orange"),  # 43 -> +
    ("gray", "yellow"),    # 84 -> T
    ("blue", "white"),     # 69 -> E
    ("blue", "violet"),    # 67 -> C
    ("violet", "red"),     # 72 -> H
    ("white", "green"),    # 95 -> _
    ("green", "gray"),     # 58 -> :
    ("yellow", "brown"),   # 41 -> )
]

message = "".join(chr(int(digits[a] + digits[b])) for a, b in pairs)
flag = f"tjctf{{{message}}}"
print(flag)
# tjctf{REDACTED}

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR