Inferno Sprint - EH4X CTF 2026

Category: Miscellaneous | Points: 500 | Solves: 0 (First Blood baby 🩸)

Challenge Description

The labyrinth burns. You have 90 seconds. Survive 5 rounds of increasingly brutal fire mazes. Dodge multi-speed fires, use portals, and escape to any edge — before the flames consume you.

nc 20.244.7.184 31337

First Look — "How bad can it be?"

So I connect to the server and...

5 rounds. 90 seconds. Fire mazes. Portals.

Me reading the rules:

No way I'm solving this by hand.

Yeah this is NOT a "solve by hand" challenge. 5 rounds, increasing grid sizes (15x15 up to 35x35), fire spreading everywhere, 90 second total timer. This screams scripted solver.

Understanding the Protocol

When you connect, the server dumps the rules then gives you rounds one by one. Each round looks like:

Key things I noticed:

The Grid Legend

After hex-decoding each row:

Movement

Send one line of moves: W (up), S (down), A (left), D (right), P (portal).

Goal: reach ANY edge cell before fire catches you.

Hex Decoding — "Wait, 2e means what?"

Every grid row comes hex-encoded. Two hex chars = one ASCII character.

So 2e2e312e2e decodes to ..1.. — two empty cells, a speed-1 fire, two more empty cells.

Quick python one-liner:

row = bytes.fromhex("2e2e312e2e").decode('ascii')
# Result: '..1..'

The Algorithm — BFS go brrrr

This is a classic time-expanded BFS (Breadth-First Search) problem. Here's the game plan:

Step 1: Fire Arrival Map

Before solving the player's path, we need to know when each cell catches fire.

Think of it like this — every fire source is a BFS root. Fire with speed K takes K turns to spread 1 cell. Multiple fires race each other, and the earliest arrival wins.

We run a multi-source BFS from ALL fire cells simultaneously:

def compute_fire_arrival(grid, rows, cols):
    fire_arrival = [[inf] * cols for _ in range(rows)]
    queue = deque()

    # Seed all fire sources
    for r in range(rows):
        for c in range(cols):
            if grid[r][c] in '123':
                speed = int(grid[r][c])
                fire_arrival[r][c] = 0
                queue.append((r, c, 0, speed))

    while queue:
        r, c, turn, speed = queue.popleft()
        next_turn = turn + speed  # KEY: fire spreads 1 cell every 'speed' turns

        for dr, dc in [(-1,0),(1,0),(0,-1),(0,1)]:
            nr, nc = r + dr, c + dc
            if in_bounds(nr, nc) and grid[nr][nc] != '#':
                if next_turn < fire_arrival[nr][nc]:
                    fire_arrival[nr][nc] = next_turn
                    queue.append((nr, nc, next_turn, speed))

    return fire_arrival

This gives us a 2D array where fire_arrival[r][c] = the earliest turn that cell is burning.

Visual example (Round 1 decoded grid):

Step 2: Player BFS (Time-Aware)

Now we BFS from the player. The state is (row, col, turn).

A move is valid if:

• The destination cell is not a wall
• The destination cell is NOT on fire at turn + 1 (when we arrive)
• We haven't exceeded the move limit

def solve_maze(grid, rows, cols, start_r, start_c, limit, fire_arrival, portals):
    queue = deque([(start_r, start_c, 0, "")])
    visited = {(start_r, start_c, 0)}

    while queue:
        r, c, turn, path = queue.popleft()
        if turn >= limit:
            continue

        for move, (dr, dc) in {'W':(-1,0),'S':(1,0),'A':(0,-1),'D':(0,1)}.items():
            nr, nc = r + dr, c + dc
            if valid(nr, nc) and grid[nr][nc] != '#' and fire_arrival[nr][nc] > turn + 1:
                if (nr, nc, turn+1) not in visited:
                    visited.add((nr, nc, turn+1))
                    new_path = path + move
                    if is_edge(nr, nc):
                        return new_path  # ESCAPED!
                    queue.append((nr, nc, turn+1, new_path))

        # Portal check
        if grid[r][c] in portals:
            # teleport to paired cell, costs 1 turn
            ...
    return None  # rip

Step 3: Portals

Portals are letter pairs (a-e). Standing on one and sending P teleports you to the other one (same letter). Costs 1 turn. This is just another "neighbor" in our BFS — instead of moving to an adjacent cell, you jump to the paired portal cell.

Watching It Solve — the satisfying part

First blood on a 500pt misc. Feels good.

Key Takeaways (Educational Bits)

1. BFS is your best friend for shortest path

BFS guarantees the shortest path in an unweighted graph. Since every move costs 1 turn, BFS finds the optimal escape route. If the graph had weighted edges, you'd use Dijkstra instead.

When to use what:

2. Time-expanded graphs

The trick here is that the graph changes over time (fire spreads). So instead of just tracking (row, col) as visited, we track (row, col, turn). This is called a time-expanded graph — basically treating each timestep as a separate "layer" of the graph.

The player exists in this 3D space of (x, y, time).

3. Multi-source BFS for fire

Instead of running BFS from each fire source separately, we seed ALL fire sources into the queue at once with turn=0. This gives us the earliest arrival time at every cell in a single pass. Very efficient — O(rows * cols) total.

4. Precompute, then solve

The pattern here is super common in competitive programming / CTF:

1. Precompute the "danger map" (fire arrival times)
2. Query against it during path search

This separates concerns and keeps the solver clean.

5. Don't forget edge cases (literally)

The escape condition is reaching ANY edge cell — row 0, last row, col 0, or last col. Easy to forget one of these when coding in a hurry.

Full Solve Script

The complete solver is in solve.py — it handles all 5 rounds automatically over a socket connection. The core logic is ~100 lines of BFS.

Flag

translates to: inferno sprint blaze runner master

GG. The inferno didn't wait, but we were faster.

writeup by smothy | EH4X CTF 2026