This challenge simply presents a line of ciphertext that we must somehow decrypt in order to attain the flag.

When starting a challenge like this, I usually begin by examining the ciphertext for clues. There are a few noteworthy traits that we can observe.

1. The spaces seem to be placed at appropriate intervals for the normal separation of English words. It’s not just one space every 4 letters; it’s one space every 2-5 letters on average. This means we can trust these spaces to actually separate whole words, which isn’t always the case.

2. Some of the letters are very high in frequency. The letters k and z appear very often in the ciphertext, much like how the letters e and t appear very often in standard English. This means it may just be a subsitution cipher, where one letter is just swapped for another.

3. Something that looks very similar to our flag is found at the end. This further confirms our suspicion that it may be a substitution cipher because the inner part of the flag is all numbers plus g, h, i, j, l, much like how hex is all numbers plus a, b, c, d, e, f. Numbers are rarely substituted in this style of crypto, so these stayed the same. Also notice that these letters are in order. We’re missing the k, but we can assume that was a possible outcome as well.

It’s looking more and more like this is a special form of substitution cipher called a rotation cipher. In this method, substitutions are made in-order, not randomly. For example, if A is to be substituted with G, then B must be substituted with H, and C must be substituted with I, all the way through the alphabet (loop back to A after passing Z).

Let’s do a check and find out. Let’s theorize that lrgm == flag, since that is what would fit the flag format. This means l substituted f. If this is a rotation cipher, then m must substitute g, since that’s next in the rotation and it must be in-order. Looking at our fourth character in lrgm, that matches our expectations perfectly.

At this point, it’s safe to make a logical guess that this is a rotation cipher, a form of substitution cipher. Since there are 26 letters in the alphabet, there are only 25 possible rotations (the 26th rotation doesn’t count because it brings you back to the same letter). We can assess that the rotation number is 6, because f (from flag) is substituted with l (from lrgm) which is 6 letters forward. Of course, we could just look at all 25 possibilities to find the answer if we weren’t able to assess what number rotation it was.

Knowing the rotation number, you could solve it by hand by going letter by letter in the ciphertext and replacing it with the letter six positions previously in the alphabet (remember, encryption goes forward and decryption goes backward). Just writing out the alphabet and counting six places to the left for each letter makes this an easy task. So Ykksy becomes Seems. You could also have a script/tool do this for you, such as dcode.fr.

The decrypted result is: Seems you were able to get the text back. The flag is flag{30d3a1aa0cda9f08cdfa52668bc6854a}

Review & Lessons Learned

While you could just take this ciphertext and have a tool brute-force the solution right away, you should understand what the tool is doing and why. Taking the time to analyze the ciphertext first can give many clues as to how it was encrypted. Without the use of tools, we were able to deduce the exact encryption method used (ROT-6) simply by observing patterns in the ciphertext. Even if you can’t make an exact assessment like this, analyzing the ciphertext will always help narrow down the possibilities.