Just Give Me The Flag Man

The brief

Saad lowered his voice and glanced over his shoulder. Saad: You got the note? Harun: The one with the strange code? I almost burned it. Saad: Don't. Someone has been watching the building since noon. Harun: What does it say?

• chall.zip, 245 B

In short

A note of 52 character pairs looked like a cipher with one symbol per flag character. It was hex written backwards with disguised letters, under Ascii85, ROT47, basE91 and a letter substitution, and the flag has only 33 characters.

A note of 52 strange pairs

The note is 52 pairs of characters, made of digits and the letters u, v, w, x and z. It reads like one symbol per flag character. The flag has only 33.

Every pair is a byte, backwards

The second character of every pair is 2 to 7, the high half of a printable byte. So each pair is one byte written low half first, with the hex letters a to f swapped for u to z.

Which letter is which

The plain swap, u for a, gives printable bytes that decode to nothing. The lab scored all 720 ways to pair the six letters with a to f. Only the reversed order fit, u for f down to z for a.

Three bases deep

Read as hex, the note becomes 52 characters of Ascii85. The lab searched chains of decoders from there. Ascii85 gives 41 characters, ROT47 turns them into basE91, and that decodes to 33.

A mirror on the alphabet

The 33 characters start with feKTH. Against hiCTF every letter fits one rule, the reversed alphabet followed by ROT13. Applied to the rest it gives the flag, and the whole chain run backwards rebuilds the note exactly.

The insight

Stacking encodings adds steps, not secrecy. Once the pairs read as reversed hex, every layer below was a standard decoder.

The flag

hiCTF{sh1ft1ng_7hr0ugh_7h3_b4s3s}