SCRAMBLE is a misc challenge that was part of the Cyber Security Rumble CTF. We had to play 100 games of wordle (custom word list) with an average score of less than 5 guesses per game to get the flag.

To practice, we were supplied with all files to start a local instance of the game.

Files

main.py

#!/usr/bin/env python3

import random
import string
from secret import FLAG

NUMBER_OF_GAMES = 100
THRESHOLD = 5
SIZE_OF_WORDLIST = 12000

rng = random.SystemRandom()


def game(secret_word, wordlist):
    print("[start game]")
    chars = set(secret_word)

    for guess_count in range(1, 7):
        guess = input("> ")[:5]
        assert(len(guess) == 5)
        assert(guess in wordlist)

        if guess == secret_word:
            print("[guess correct]> ")
            break

        result = ""
        for i in range(5):
            if guess[i] == secret_word[i]:
                result += "+"
            elif guess[i] in chars:
                result += "*"
            else:
                result += "-"

        print(result)
    else:
        print("[number of guesses exceeded]> ")

    return guess_count


def main():
    wordlist = set()
    while len(wordlist) < SIZE_OF_WORDLIST:
        word = ''.join(rng.choices(string.ascii_uppercase, weights=[
            7.58, 1.96, 3.16, 4.98, 18.93, 1.49, 3.02, 4.98, 8.02, 0.24,
             1.32, 3.60, 2.55, 12.53, 2.24, 0.67, 0.02, 6.89, 8.42, 7.79,
              3.83, 0.84, 1.78, 0.05, 0.05, 1.21], k=5))
        wordlist.add(word)

    print("Here is your personal wordlist:")
    print("[begin of wordlist]")
    for word in wordlist:
        print(word)
    print("[end of wordlist]")

    guesses = []
    for _ in range(NUMBER_OF_GAMES):
        secret_word = rng.choice(list(wordlist))
        guesses.append(game(secret_word, wordlist))

    average_guesses = sum(guesses) / NUMBER_OF_GAMES
    print(f'avg.: {average_guesses}')
    if average_guesses < THRESHOLD:
        print(FLAG)


if __name__ == '__main__':
    main()

secret.py

FLAG = b"CSR{lololololololololololol}"

First steps

$ nc chall.rumble.host 2568
Here is your personal wordlist:
[begin of wordlist]
EGLER
RLSRM
NRRIN
EEAEN
TNEEM
GRLNT
...
NITUS
IISBS
UOUEU
RESRR
SCMSF
[end of wordlist]
[start game]
>

First we get a custom word list, 12000 words, and then the game begins. The wordlist stays the same for all games until we reconnect to the server.

Solution

Writing a wordle-bot in python with pwntools.

Custom word list

The wordlist is between the two strings [begin of wordlist] and [end of wordlist].

from pwn import remote

r = remote("chall.rumble.host", 2568)

r.recvuntil(b"[begin of wordlist]\n")
custom_wordlist = r.recvuntil(b"[end of wordlist]\n") \
    .split(b"\n[")[0].decode().split("\n")

Game logic

Based on the given game logic:

if guess[i] == secret_word[i]:
    result += "+"
elif guess[i] in chars:
    result += "*"
else:
    result += "-"

We just had reverse the logic:

print(f"Wordlist size before: {wordlist.size}")

if "+" in result:
    indices = [i for i, x in enumerate(result) if x == "+"]
    for i in indices:
        print(f"remove words without {guess[i]} at index {i}")
        for word in wordlist:
            if word[i] != guess[i]:
                wordlist = np.delete(wordlist, \
                    np.where(wordlist == word))

if "*" in result:
    indices = [i for i, x in enumerate(result) if x == "*"]
    for i in indices:
        print(f"remove words without {guess[i]}")
        for word in wordlist:
            if guess[i] not in word:
                wordlist = np.delete(wordlist, \
                    np.where(wordlist == word))

if "-" in result:
    indices = [i for i, x in enumerate(result) if x == "-"]
    for i in indices:
        print(f"remove words with {guess[i]}")
        for word in wordlist:
            if guess[i] in word:
                wordlist = np.delete(wordlist, \
                    np.where(wordlist == word))

print(f"Wordlist size after: {wordlist.size}")

Execution

whitelist = set('abcdefghijklmnopqrstuvwxyz ')

for game in range(1, 101):
    print(f"start game {game}")
    wordlist = np.array(custom_wordlist.copy())
    r.recvuntil(b"[start game]\n> ").decode()
    for i in range(1, 7):
        guess = random.choice(wordlist)
        # improve guess?
        r.sendline(guess.encode())
        info = r.recvuntil(b"> ").decode()
        result = info[0:5]

        if "[guess correct]" in info \
            or "[number of guesses exceeded]" in info:
            print(i, "guesses:", \
                "".join(filter(whitelist.__contains__, info)))
            break

        print(f"{guess} --> {result}")
        wordlist = np.delete(wordlist, np.where(wordlist == guess))

        # Game logic ...

Now we have everything and can start the bot:

...
start game 100
OERDN --> -----
UIGHG --> -----
ABWWA --> *---*
VLSAM --> -+*+-
5 guesses: guess correct 
[+] Receiving all data: Done (12B)
[*] Closed connection to chall.rumble.host port 2568

avg.: 5.35

An average > 5 can’t give us the flag.

We have to improve our bot: ABWWA --> *---* is not a good guess, because “A” and “W” are checked twice instead of 5 different letters. We have to improve our guess.

if wordlist.size > 1:
    for x in range(wordlist.size):
        if len(set(guess)) == len(guess):
            break
        else:
            guess = random.choice(wordlist)
else:
    guess = wordlist[0]

Now we use a random word from the wordlist that doesn’t contain any duplicate letters. This is a very simple improvement, but it helps a lot.

Final bot

#!/usr/bin/env python
from pwn import remote
import random
import numpy as np

whitelist = set('abcdefghijklmnopqrstuvwxyz ')

r = remote("chall.rumble.host", 2568)

r.recvuntil(b"[begin of wordlist]\n")
custom_wordlist = r.recvuntil(b"[end of wordlist]\n") \
    .split(b"\n[")[0].decode().split("\n")

for game in range(1, 101):
    print(f"start game {game}")
    wordlist = np.array(custom_wordlist.copy())
    r.recvuntil(b"[start game]\n> ").decode()
    for i in range(1, 7):
        guess = random.choice(wordlist)
        if wordlist.size > 1:
            for x in range(wordlist.size):
                if len(set(guess)) == len(guess):
                    break
                else:
                    guess = random.choice(wordlist)
        else:
            guess = wordlist[0]
        r.sendline(guess.encode())
        info = r.recvuntil(b"> ").decode()
        result = info[0:5]

        if "[guess correct]" in info \
            or "[number of guesses exceeded]" in info:
            print(i, "guesses:", \
                "".join(filter(whitelist.__contains__, info)))
            break

        print(f"{guess} --> {result}")
        wordlist = np.delete(wordlist, np.where(wordlist == guess))

        #print(f"Wordlist size before: {wordlist.size}")

        if "+" in result:
            indices = [i for i, x in enumerate(result) if x == "+"]
            for i in indices:
                #print(f"remove words without {guess[i]} at index {i}")
                for word in wordlist:
                    if word[i] != guess[i]:
                        wordlist = np.delete(wordlist, \
                            np.where(wordlist == word))

        if "*" in result:
            indices = [i for i, x in enumerate(result) if x == "*"]
            for i in indices:
                #print(f"remove words without {guess[i]}")
                for word in wordlist:
                    if guess[i] not in word:
                        wordlist = np.delete(wordlist, \
                            np.where(wordlist == word))

        if "-" in result:
            indices = [i for i, x in enumerate(result) if x == "-"]
            for i in indices:
                #print(f"remove words with {guess[i]}")
                for word in wordlist:
                    if guess[i] in word:
                        wordlist = np.delete(wordlist, \
                            np.where(wordlist == word))

        #print(f"Wordlist size after: {wordlist.size}")

print(r.recvall().decode())
r.close()

Output:

[+] Opening connection to chall.rumble.host on port 2568: Done
start game 1
ACWTD --> -**--
HIWCZ --> --**-
3 guesses: guess correct 
start game 2
ANECZ --> -++--
TNEOV --> -++--
RNEWH --> -++--
INEUS --> -++-*
SNEDF --> *++--
6 guesses: number of guesses exceeded 
start game 3
NETRA --> **---
UENHK --> +**--
UNEGS --> ++*--
4 guesses: guess correct 
start game 4
...
start game 98
GTUNW --> -*---
TCAEI --> +--*-
TESHD --> ++---
TELTR --> ++-+-
5 guesses: guess correct 
start game 99
HRDBI --> ---*-
AKLTB --> ----*
MBOSN --> -+-*+
4 guesses: guess correct 
start game 100
FURAN --> -+*-+
2 guesses: guess correct 
[+] Receiving all data: Done (66B)
[*] Closed connection to chall.rumble.host port 2568

avg.: 4.81
b'CSR{look_at_all_this_entropy_just_floating_around}'

Alternative solution

Instead of writing our own game logic, we could also do some lazy interpreting in-between the server and an existing bot from GitHub.

#!/usr/bin/env python
from pwn import remote, process
from uuid import uuid4


def new_solver(wordlist_name):
    return process(["python3", "wordle-solver/main.py", "-m", "solve",
            "--dict_file", wordlist_name, "--cand_file", wordlist_name])


def main():
    r = remote("chall.rumble.host", 2568)
    r.recvuntil(b"[begin of wordlist]\n")
    raw_wordlist = r.recvuntil(b"[end of wordlist]\n").split(b"\n[")[0]
    # Save the wordlist to a file with a random name
    wordlist_name = str(uuid4())
    with open(wordlist_name, "wb") as f:
        f.write(raw_wordlist.lower())
    print(f"Saved wordlist to {wordlist_name}")

    attempts = 0
    solves = 0
    attempts_sum = 0

    # Create a new process to run the wordle_bot.py script
    p = new_solver(wordlist_name)

    while solves != 100:
        # If no process is running start a new one
        if p.poll() is not None:
            p = new_solver(wordlist_name)
        # Get ready to send the first word
        r.recvuntil(b"> ")

        # Receive the word suggestion
        p.recvuntil(b"Try the word [")
        suggestion = p.recvuntil(b"]").split(b"]")[0]
        print(f"Suggestion: {suggestion}")

        # Send the suggestion to the server
        r.sendline(suggestion)
        attempts += 1

        # How did we do?
        result = r.recvline().strip()

        # If we got it right, we start over
        if b"[guess correct]" in result:
            print(f"Got it after {attempts} attempts!")
            solves += 1
            attempts_sum += attempts
            print(f"Average attempts: {attempts_sum / solves}")
            attempts = 0
            p.close()
            continue

        # Otherwise, we need to tell the bot what we got
        result = result.replace(b"-", b"0") \
                       .replace(b"*", b"1") \
                       .replace(b"+", b"2")
        print(f"Result: {result}")
        p.recvuntil(b"? ")
        p.sendline(result)

    print("Solved 100 words, exiting...")
    print(r.recvall().decode())
    r.close()


if __name__ == "__main__":
    main()

Output:

Saved wordlist to a06e7e83-c079-434d-a01a-164b9d4f3eb5
[+] Starting local process '/usr/bin/python3': pid 397792
Suggestion: b'TISEN'
Result: b'01012'
Suggestion: b'AEIND'
Result: b'01110'
Suggestion: b'ENLIK'
Result: b'21020'
Suggestion: b'EPRIN'
Got it after 4 attempts!
Average attempts: 4.0
[*] Stopped process '/usr/bin/python3' (pid 397792)
[+] Starting local process '/usr/bin/python3': pid 397798
Suggestion: b'TISEN'
Result: b'10010'
Suggestion: b'EHTRA'
Result: b'10110'
Suggestion: b'RDETD'
Result: b'10120'
Suggestion: b'GEERM'
Result: b'22110'
Suggestion: b'GERTE'
Got it after 5 attempts!
Average attempts: 4.5
[*] Stopped process '/usr/bin/python3' (pid 397798)
...
[+] Starting local process '/usr/bin/python3': pid 399733
Suggestion: b'TISEN'
Result: b'00022'
Suggestion: b'ANEHR'
Result: b'01200'
Suggestion: b'BEDOD'
Result: b'02101'
Suggestion: b'DEEEN'
Got it after 4 attempts!
Average attempts: 4.06
[*] Stopped process '/usr/bin/python3' (pid 399733)
Solved 100 words, exiting...
[+] Receiving all data: Done (66B)
[*] Closed connection to chall.rumble.host port 2568

avg.: 4.06
b'CSR{look_at_all_this_entropy_just_floating_around}'

Now our average score is around 4.0 (but only < 5 was necessary).

Flag

The flag is “CSR{look_at_all_this_entropy_just_floating_around}”.