EHAX CTF 2026 - #808080

Challenge Overview

Category: Miscellaneous Points: 492 Target: http://chall.ehax.in:8076/

Prompt artifacts:

• A long binary string within the description.
• Hint text: gray code ? nah grey code
• Flag format: CTF{...}

TL;DR: The challenge involves interacting with a remote “binary wheel decoder” web page. By reversing the API validation rules, we discover it requires a 32-element sequence of 5-bit strings forming a valid valid Gray Code path. Submitting this sequence paired with the binary blob decodes the text into a secondary cipher, which is further decrypted using a custom 32-character alphabet Caesar shift (-4) to produce the flag.

1. Initial Observations

The prompt strongly hints at Gray code (gray/grey code), and the remote page visually represents an interactive “binary wheel decoder”.

Opening the web page source code reveals:

• A wheel UI configured with:
  • SLICES = 32
  • RINGS = 5
• The client sends the user’s arranged wheel data to the backend via:
  • POST /api/validate-wheel
  • POST /api/decode
• The wheel is sent to the backend as an array of 32 elements, with each element being a 5-bit string.

This structure implies the challenge expects us to construct a valid sequence of 32 unique 5-bit codes where adjacent entries satisfy a formal Gray-code property.

2. Reversing the Validation Rules

Instead of manually clicking wheel slices in the UI to brute-force combinations, we can programmatically query the backend validation endpoint to read the exact error messages thrown:

1
import requests
2
url='http://chall.ehax.in:8076/api/validate-wheel'
3

4
tests = [
5
    ['00000']*32,                         # duplicates
6
    ['00000']*31,                         # wrong length
7
    ['0000a'] + ['00001']*31,             # invalid chars
8
    [format(i,'05b') for i in range(32)]  # plain binary order
9
]
10

11
for i,t in enumerate(tests,1):
12
    r=requests.post(url,json={'wheelData':t},timeout=10)
13
    print(i, r.status_code, r.text)

The server’s error responses neatly expose the underlying rules:

• The array must have exactly 32 elements.
• Every element must be a 5-bit string composed exclusively of 0 and 1.
• All elements must be globally unique.
• Adjacent elements (including the wrap-around between index 31 and 0) must differ by exactly 1 bit.

This strictly defines the requirement as a complete 5-bit Gray code cycle.

3. Building a Valid Wheel

We can easily generate a standard reflected Gray code sequence using the standard bitwise formula:

$G(i) = i \oplus (i \gg 1), \quad i=0..31$

Implemented in Python:

1
wheel = [format(i ^ (i >> 1), '05b') for i in range(32)]

If we send this array to the /api/validate-wheel endpoint:

1
import requests
2
url='http://chall.ehax.in:8076/api/validate-wheel'
3
wheel=[format(i^(i>>1),'05b') for i in range(32)]
4
r=requests.post(url,json={'wheelData':wheel},timeout=10)
5
print(r.status_code, r.text)

The server responds beautifully:

• 200 {"valid":true}

4. Decoding the Provided Binary Blob

Now we take the long binary input provided directly in the challenge description:

0010111100011010000101111111110110010010000100010111011001000110010000011111101101100111010000010101011001111110010000000111010001111110010000011

We POST this to /api/decode paired with our validated Gray code wheel sequence:

1
import requests
2
bits='0010111100011010000101111111110110010010000100010111011001000110010000011111101101100111010000010101011001111110010000000111010001111110010000011'
3
wheel=[format(i^(i>>1),'05b') for i in range(32)]
4
r=requests.post('http://chall.ehax.in:8076/api/decode',
5
                json={'binaryInput':bits,'wheelData':wheel},
6
                timeout=15)
7
print(r.status_code, r.text)

The backend successfully executes the first layer of decryption and yields an obfuscated string:

GXJBKVI_DGSHI&KSIWAZIV_AL}VHC

5. Identifying the Secondary Cipher

The string isn’t readable yet. However, by probing how the backend decodes all 32 possible Gray code symbols consecutively, we can dump the backend’s custom substitution alphabet:

ABCDEFGHIJKLMNOPQRSTUVWXYZ@#_{}&

Applying a Caesar cipher shift of -4 across this specific 32-character alphabet transforms:

GXJBKVI_DGSHI&KSIWAZIV_AL}VHC

Perfectly into the flag format:

CTF{GREY&CODE#GOES_VERY_H@RD}

6. Full Solver Script (Automated)

Here is a standalone script that orchestrates the entire exploit chain in a single execution:

1
#!/usr/bin/env python3
2
import requests
3

4
BASE = "http://chall.ehax.in:8076"
5
BITS = "0010111100011010000101111111110110010010000100010111011001000110010000011111101101100111010000010101011001111110010000000111010001111110010000011"
6
ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ@#_{}&"
7

8
def gray_wheel():
9
    return [format(i ^ (i >> 1), "05b") for i in range(32)]
10

11
def decode_backend(bits, wheel):
12
    r = requests.post(f"{BASE}/api/decode", json={"binaryInput": bits, "wheelData": wheel}, timeout=15)
13
    r.raise_for_status()
14
    return r.json()["decoded"]
15

16
def caesar_custom(s, shift, alpha):
17
    n = len(alpha)
18
    out = []
19
    for ch in s:
20
        if ch in alpha:
21
            out.append(alpha[(alpha.index(ch) + shift) % n])
22
        else:
23
            out.append(ch)
24
    return "".join(out)
25

26
if __name__ == "__main__":
27
    wheel = gray_wheel()
28
    v = requests.post(f"{BASE}/api/validate-wheel", json={"wheelData": wheel}, timeout=10).json()
29
    assert v.get("valid") is True, v
30

31
    stage1 = decode_backend(BITS, wheel)
32
    flag = caesar_custom(stage1, -4, ALPHABET)
33
    print("stage1:", stage1)
34
    print("flag:  ", flag)

Execution Output:

stage1: GXJBKVI_DGSHI&KSIWAZIV_AL}VHC
flag:   CTF{GREY&CODE#GOES_VERY_H@RD}

Final Flag

CTF{GREY&CODE#GOES_VERY_H@RD}