interrendec (picoCTF 5)

Challenge Author:

Difficulty: Easy

Description

Can you get the real meaning from this file?

Process / Notes

  1. wget the file
  2. file shows its ASCII text
  3. The tags on the challenge indicate base64 and Caesar cipher
  4. Both cat and strings display the same thing
  5. Trying base64 first
  6. Looks like we’re getting somewhere
  7. Using the inbuilt Neo Vim rot13 cipher with g??
  8. That didn’t seem to help. What about rot13, then base64?
  9. No luck
  10. base64 decode nor encode seemed to do anything. What about encode first?
  11. base64 -d the original text from the file, then trying to base64 -d it AGAIN
  12. Now it’s starting to look like a pictoCTF flag with the “{}” present
  13. Now going to try g??
  14. Nothing with rot13. But online it looks like there’s a built in tr command line command that may help
  15. The tr command will:
    • Translate, squeeze, and/or delete characters from standard input, writing to standard output. STRING1 and STRING2 specify arrays of characters. ARRAY1 and ARRAY2 that control the action
  16. There’s an example using regex expressions for custom offsets on Stack Overflow
  17. With w and c 6 characters apart, going to try that in my expression
  18. Wait, that’s the wrong combination of characters to look at!
    • echo 'string' | tr '[a-zA-Z]' '[g-za-fG-ZA-F]' is not the right offset
  19. I need ‘j’ to become ‘p’
  20. With the [g-za-fG-ZA-F] rotation, the flag is revealed

21 minutes 9 seconds to complete

Hints

  1. Engaging in various decoding processes is of the utmost importance

Core Lessons

  1. Messages may be double, triple, or more encoded, even in the same manner, as with the base64 encoding
  2. How to use tr to rotate characters encrypted with a Caesar cipher