Post cover image

September 20, 2026

CyLab Security Acadmey — bytemancy 2

Category: General Skills

By Aun Raza

2 min read

Difficulty: Medium

Author: LT Syreal Jones

Flag: picoCTF{3ff5_4_d4yz_c689238e}

Challenge Overview

In BYTEMANCY-2, we are given access to a remote service and a short Python source code file. The challenge description says:

"Can you conjure the right bytes?"

We are also told to connect to the program using netcat:

Bash

nc lonely-island.picoctf.net 64477

The program then asks:

"Send me the HEX BYTE 0xFF 3 times, side-by-side, no space."

At first, this looks simple, but the important detail is that the program expects raw bytes, not the ASCII characters representing hexadecimal values.

1. Understanding the Source Code

The provided app.py contains the following important section:

Python

user_input = sys.stdin.buffer.readline().rstrip(b"\n")
if user_input == b"\xff\xff\xff":
    print(open("./flag.txt", "r").read())
    break
else:
    print("That wasn't it. I got: " + str(user_input))

This tells us exactly what input the program is checking for.

The condition is:

Python

user_input == b"\xff\xff\xff"

The b before the string means this is a bytes literal.

Each \xff represents one byte with the hexadecimal value:

0xFF

Therefore, the program expects exactly three bytes:

FF FF FF

However, the challenge specifically says "side-by-side, no space."

So the actual byte sequence that needs to be sent is:

FF FF FF

with no spaces between the bytes:

FFFFFF

2. Why Normal Input Does Not Work

If we simply type:

FFFFFF

the program receives the ASCII characters:

46 46 46 46 46 46

That is not the same as:

FF FF FF

The program is looking for three actual 0xFF bytes, not six ASCII characters representing FF.

This distinction between text representation and raw byte values is the key to the challenge.

3. Generating the Correct Bytes

We can use echo -e to interpret \xFF as a hexadecimal byte.

The required payload is:

echo -e "\xff\xff\xff"

This produces three raw bytes:

FF FF FF

There are no spaces between them.

We can verify the bytes conceptually as:

Byte 1 → 0xFF
Byte 2 → 0xFF
Byte 3 → 0xFF

4. Sending the Payload to the Remote Service

Now we pipe those bytes directly into the nc connection:

Bash

echo -e "\xff\xff\xff" | nc lonely-island.picoctf.net 64477

Here:

  • echo -e interprets \xff as a hexadecimal byte.
  • \xff\xff\xff generates three 0xFF bytes.
  • | pipes the generated bytes into the next command.
  • nc connects to the picoCTF server on port 64477.

The server receives the exact byte sequence expected by the Python program:

FF FF FF

The comparison therefore evaluates to true:

Python

if user_input == b"\xff\xff\xff":

and the program executes:

Python

print(open("./flag.txt", "r").read())

which reveals the flag.

5. Final Solution

The complete command is:

Bash

echo -e "\xff\xff\xff" | nc lonely-island.picoctf.net 64477

The key lesson from this challenge is the difference between ASCII characters representing hexadecimal values and the actual byte values themselves.

Instead of sending the text FFFFFF, we need to send three raw 0xFF bytes:

0xFF 0xFF 0xFF

Once the correct bytes are supplied, the program accepts the input and prints the flag.