# Vector Fun

{% hint style="info" %}
Vectors are my favorite Zeek type. Vectors of any are full of surprises. Place your guess for the flag in the your\_guess variable and invoke the script to see if you guessed correctly.
{% endhint %}

Original provided source code. 

```c
# Set your guess and run the script to see if you guessed correctly.

global your_guess: string = "" &redef;

global v: vector of any = {"Kjjm=", 8, "VGhl", -1, "0lz", "HbL", "Rs==", 9, "VGhpc", "ZzIy", 3, 12, "2Jc", "Mw==", "Rmxh", function(): count { return 13; }, "kr1", 14};
your_guess = encode_base64(your_guess);
if (your_guess[20:24] == (v[(v[15] as function(): count)()] as string)) { if (your_guess[5:8] == (v[4] as string)) { if (your_guess[12:16] == (v[(v[(v[3] as int):][0] as count)] as string)) { if (your_guess[16:20] == (v[(v[7] as count)] as string)) { if (your_guess[0:5] == (v[(v[1] as count)] as string)) { if (your_guess[8:12] == (v[(10 - (v[1] as count))] as string)) {
  print "your guess was right!";
}}}}}}

```

Let us take a look when properly formatted.

```c
# Set your guess and run the script to see if you guessed correctly.

global your_guess: string = "" &redef;

global v: vector of any = {
    "Kjjm=", 8,
     "VGhl",
     -1,
     "0lz",
     "HbL",
     "Rs==",
     9,
     "VGhpc",
     "ZzIy",
     3,
     12,
     "2Jc",
     "Mw==",
     "Rmxh",
     function(): count { return 13; },
     "kr1",
     14
};
your_guess = encode_base64(your_guess);
if (your_guess[20:24] == (v[(v[15] as function(): count)()] as string)) {
    if (your_guess[5:8] == (v[4] as string)) {
        if (your_guess[12:16] == (v[(v[(v[3] as int):][0] as count)] as string)) {
            if (your_guess[16:20] == (v[(v[7] as count)] as string)) {
                if (your_guess[0:5] == (v[(v[1] as count)] as string)) {
                    if (your_guess[8:12] == (v[(10 - (v[1] as count))] as string)) {
                        print "your guess was right!";
                    }
                }
            }
        }
    }
}



```

We have a base64 encoded string (your guess) and uses a vector of any, which can be an ordered collection of type string, count, and even an anonymous function. 

It slices up the string and compares those slices to string computed from the vector. 

I noticed the slice comparisons are nicely aligned, and nested, so I just reorganized the computation and append the chunks to a string in the correct order from the inside out, and decode.

Note the typecasting usage in order to evaluate values from the vector.

Note the function typecast with return type and the subsuquent function evaluation on line #25. 

```c
redef exit_only_after_terminate = F;

global v: vector of any = {
    "Kjjm=",
    8,
    "VGhl",
    -1,
    "0lz",
    "HbL",
    "Rs==",
    9,
    "VGhpc",
    "ZzIy",
    3,
    12,
    "2Jc",
    "Mw==",
    "Rmxh",
    function(): count { return 13; },
    "kr1",
    14
};

event zeek_init() {
    local msg: string = "";
    msg += (v[(v[1] as count)] as string);
    msg += (v[4] as string);
    msg += (v[(10 - (v[1] as count))] as string);
    msg += (v[(v[(v[3] as int):][0] as count)] as string);
    msg += (v[(v[7] as count)] as string);
    msg += (v[(v[15] as function(): count)()] as string);
    print decode_base64(msg);
}
```

{% hint style="success" %}
The solution

```
ThisIsTheFlag223
```

{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://eephillip.gitbook.io/zw2020-ctf-writeup/writeup/vector-fun.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.