Knight Squad Academy Jail 2 - PWN Challenge Writeup#

CTF: KnightCTF 2026
Challenge: Knight Squad Academy Jail 2
Category: PWN / Jail

Challenge Description#

In the world of Knight Squad Academy jail only a knight can help you!

Flag Format: KCTF{flag_here}

Connection: nc 66.228.49.41 41567

Hints:

There is a function called knight()
Simply run knight("K") and you will get “too short” message
Find out the flag length

Initial Reconnaissance#

Connecting to the Service#

1
nc 66.228.49.41 41567

We’re dropped into a Python jail with heavy restrictions. Most inputs are rejected with generic errors, indicating a strict parser with a blacklist.

Discovering the Oracle#

The hint mentions a knight() function. Testing reveals:

1
>>> knight("A")
2
too short
3

4
>>> knight("A"*29)
5
too short
6

7
>>> knight("A"*30)
8
1 0
9

10
>>> knight("A"*31)
11
too long

Key Finding: The flag length is exactly 30 characters.

Understanding the Feedback System#

Mastermind-Style Response#

For a length-30 guess, the response format is:

1
<first> <second>

Where:

first = Number of correct characters in the correct position
second = Number of correct characters in the wrong position

Testing the Theory#

1
>>> knight("A"*30)
2
1 0   # One 'A' in correct position
3

4
>>> knight("B"*30)
5
0 0   # No 'B' in the flag
6

7
>>> knight("K"*30)
8
1 0   # One 'K' in correct position (likely position 0)

This confirms a Mastermind-style oracle!

Exploitation Strategy#

Step 1: Find a Filler Character#

We need a character that does NOT appear in the flag (returns 0 0):

1
>>> knight("X"*30)
2
0 0   # Perfect! 'X' is our filler

Step 2: Position-by-Position Brute Force#

The algorithm:

Start with all filler: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
For each position i (0 to 29):
- Get baseline score with current guess
- Try each candidate character at position i
- If score increases by 1, that character is correct
- Keep it and move to next position

Python Implementation#

1
#!/usr/bin/env python3
2
import socket
3
import re
4
import string
5

6
HOST = '66.228.49.41'
7
PORT = 41567
8
FLAG_LEN = 30
9

10
class JailConnection:
11
    def __init__(self):
12
        self.sock = None
13

14
    def connect(self):
15
        self.sock = socket.socket()
16
        self.sock.settimeout(10)
17
        self.sock.connect((HOST, PORT))
18
        # Consume banner
19
        self.sock.recv(4096)
20

21
    def knight(self, guess):
22
        cmd = f'knight("{guess}")\n'
23
        self.sock.send(cmd.encode())
24

25
        self.sock.settimeout(2)
26
        r = ""
27
        for _ in range(3):
28
            try:
29
                chunk = self.sock.recv(4096).decode()
30
                r += chunk
31
                if '>' in chunk:
32
                    break
33
            except:
34
                break
35

36
        match = re.search(r'(\d+)\s+(\d+)', r)
37
        if match:
38
            return int(match.group(1)), int(match.group(2))
39
        return None, None
40

41
def solve():
42
    conn = JailConnection()
43
    conn.connect()
44

45
    # Find filler character
46
    filler = 'X'
47

48
    # Charset - prioritize likely flag characters
49
    charset = "KCTF{}_" + string.ascii_letters + string.digits + "!-"
50

51
    flag = [filler] * FLAG_LEN
52

53
    for pos in range(FLAG_LEN):
54
        baseline, _ = conn.knight(''.join(flag))
55

56
        for c in charset:
57
            if c == filler:
58
                continue
59

60
            test = list(flag)
61
            test[pos] = c
62

63
            score, _ = conn.knight(''.join(test))
64

65
            if score and score > baseline:
66
                flag[pos] = c
67
                print(f"[Pos {pos:2d}] '{c}' -> {''.join(flag)}")
68
                break
69

70
    return ''.join(flag)
71

72
if __name__ == "__main__":
73
    print(solve())

Execution Trace#

Running the solver shows the flag being recovered character by character:

1
[*] Brute forcing 30 positions...
2

3
[Pos  0] 'K' -> K?????????????????????????????
4
[Pos  1] 'C' -> KC????????????????????????????
5
[Pos  2] 'T' -> KCT???????????????????????????
6
[Pos  3] 'F' -> KCTF??????????????????????????
7
[Pos  4] '{' -> KCTF{?????????????????????????
8
[Pos  5] '_' -> KCTF{_????????????????????????
9
[Pos  6] 'a' -> KCTF{_a???????????????????????
10
[Pos  7] 'N' -> KCTF{_aN??????????????????????
11
[Pos  8] 'O' -> KCTF{_aNO?????????????????????
12
[Pos  9] 't' -> KCTF{_aNOt????????????????????
13
[Pos 10] 'H' -> KCTF{_aNOtH???????????????????
14
[Pos 11] 'E' -> KCTF{_aNOtHE??????????????????
15
[Pos 12] 'R' -> KCTF{_aNOtHER?????????????????
16
[Pos 13] '_' -> KCTF{_aNOtHER_????????????????
17
[Pos 14] 'J' -> KCTF{_aNOtHER_J???????????????
18
[Pos 15] 'A' -> KCTF{_aNOtHER_JA??????????????
19
[Pos 16] 'I' -> KCTF{_aNOtHER_JAI?????????????
20
[Pos 17] 'L' -> KCTF{_aNOtHER_JAIL????????????
21
[Pos 18] '_' -> KCTF{_aNOtHER_JAIL_???????????
22
[Pos 19] 'Y' -> KCTF{_aNOtHER_JAIL_Y??????????
23
[Pos 20] '0' -> KCTF{_aNOtHER_JAIL_Y0?????????
24
[Pos 21] 'U' -> KCTF{_aNOtHER_JAIL_Y0U????????
25
[Pos 22] '_' -> KCTF{_aNOtHER_JAIL_Y0U_???????
26
[Pos 23] 'b' -> KCTF{_aNOtHER_JAIL_Y0U_b??????
27
[Pos 24] 'R' -> KCTF{_aNOtHER_JAIL_Y0U_bR?????
28
[Pos 25] 'o' -> KCTF{_aNOtHER_JAIL_Y0U_bRo????
29
[Pos 26] 'K' -> KCTF{_aNOtHER_JAIL_Y0U_bRoK???
30
[Pos 27] 'E' -> KCTF{_aNOtHER_JAIL_Y0U_bRoKE??
31
[Pos 28] '_' -> KCTF{_aNOtHER_JAIL_Y0U_bRoKE_?
32
[Pos 29] '}' -> KCTF{_aNOtHER_JAIL_Y0U_bRoKE_}

Technical Analysis#

Why This Works#

Oracle Leak: The knight() function exposes exact match counts
Deterministic Feedback: Each character at each position gives consistent scores
No Rate Limiting: Server allows unlimited queries (though connections may timeout)

Complexity#

Charset size: ~70 characters (a-z, A-Z, 0-9, symbols)
Flag length: 30 characters
Worst case queries: 30 × 70 = 2,100 queries
Best case (with KCTF{ prefix optimization): ~1,500 queries

Optimizations Applied#

Prefix Knowledge: Start charset with KCTF{}_ since flags follow this format
Persistent Connection: Reuse socket to reduce connection overhead
Early Termination: Stop testing once correct char found for each position

Key Takeaways#

Oracle Attacks: Even minimal information leakage can compromise secrets
Mastermind Logic: Classic game theory applies to security challenges
Incremental Recovery: Build the solution one character at a time
Connection Resilience: Handle network issues gracefully in exploit code

Flag#

1
KCTF{_aNOtHER_JAIL_Y0U_bRoKE_}

References#

Author: MR. Umair
Date: January 20, 2026
Competition: KnightCTF 2026