@toRi

できたてほやほやのエンジニアです。インフラ、セキュリティ系です。ふんわり命がけ(´・ω・)

picoCTF2018 hex editor - Points: 150

問題

This cat has a secret to teach you. You can also find the file in /problems/hex-editor_2_c1a99aee8d919f6e42697662d798f0ff on the shell server.

解き方

とりあえず、ncコマンドを実行してみます。

$ nc 2018shell.picoctf.com 18581
-------------------------------------------------------------------------------
syeoqbwp knqn vp myhq libo - phfpwvwhwvye_svaknqp_bqn_pyigbfin_sxvioexiea
-------------------------------------------------------------------------------
pwbwnim, aihza fhsc zhiivobe sbzn lqyz wkn pwbvqknbx, fnbqveo b fyji yl
ibwknq ye jkvsk b zvqqyq bex b qbuyq ibm sqyppnx. b mniiyj xqnppveooyje,
heovqxinx, jbp phpwbvenx onewim fnkvex kvz ye wkn zvix zyqeveo bvq. kn
knix wkn fyji biylw bex vewyenx:

-vewqyvfy bx biwbqn xnv.

kbiwnx, kn annqnx xyje wkn xbqc jvexveo pwbvqp bex sbiinx yhw sybqpnim:

-syzn ha, cvesk! syzn ha, myh lnbqlhi dnphvw!
(省略)

ROTかなと思って全部ためしてみたのですが、解読不可能でした。

ncコマンドを送信するごとに別々な暗号が表示されます。???

ここでWeb上のWriteupを読みました。 どうやら a=b みたいに文字を置き換えて復号する問題らしいです。 それをしてくれるサイトがこちらだそうです。 https://www.quipqiup.com/

このサイトを使って復号していきます。

-------------------------------------------------------------------------------
ixutjale snjn we cxzj dyat - ezqelwlzlwxu_iwmsnje_ajn_exybaqyn_ikwytukyum
-------------------------------------------------------------------------------
elalnyc, myzvm qzig vzyywtau iavn djxv lsn elawjsnak, qnajwut a qxfy xd
yalsnj xu fswis a vwjjxj auk a jarxj yac ijxeenk. a cnyyxf kjneewuttxfu,
zutwjkynk, fae ezelawunk tnulyc qnswuk swv xu lsn vwyk vxjuwut awj. sn
snyk lsn qxfy ayxdl auk wulxunk:

-wuljxwqx ak aylajn knw.

saylnk, sn mnnjnk kxfu lsn kajg fwukwut elawje auk iayynk xzl ixajenyc:

-ixvn zm, gwuis! ixvn zm, cxz dnajdzy pnezwl!

exynvuyc sn iavn dxjfajk auk vxzulnk lsn jxzuk tzujnel. sn daink aqxzl
auk qyneenk tjabnyc lsjwin lsn lxfnj, lsn ezjjxzukwut yauk auk lsn
afagwut vxzulawue. lsnu, ialiswut ewtsl xd elnmsnu knkayze, sn qnul
lxfajke swv auk vakn jamwk ijxeene wu lsn awj, tzjtywut wu swe lsjxal
auk esagwut swe snak. elnmsnu knkayze, kwemynaenk auk eynnmc, ynaunk
swe ajve xu lsn lxm xd lsn elawjiaen auk yxxgnk ixykyc al lsn esagwut
tzjtywut dain lsal qyneenk swv, nhzwun wu wle ynutls, auk al lsn ywtsl
zulxuezjnk sawj, tjawunk auk sznk ywgn mayn xag.

qzig vzyywtau mnnmnk au wuelaul zuknj lsn vwjjxj auk lsnu ixbnjnk lsn
qxfy evajlyc.

-qaig lx qajjaige! sn eawk elnjuyc.

sn akknk wu a mjnaisnje lxun:

-dxj lswe, x knajyc qnyxbnk, we lsn tnuzwun isjwelwun: qxkc auk exzy
auk qyxxk auk xzue. eyxf vzewi, mynaen. eszl cxzj ncne, tnule. xun
vxvnul. a ywllyn ljxzqyn aqxzl lsxen fswln ixjmzeiyne. ewynuin, ayy.

sn mnnjnk ewknface zm auk tabn a yxut eyxf fswelyn xd iayy, lsnu mazenk
afswyn wu jaml allnulwxu, swe nbnu fswln lnnls tywelnuwut snjn auk lsnjn
fwls txyk mxwule. isjcexelxvxe. lfx eljxut esjwyy fswelyne auefnjnk
lsjxzts lsn iayv.

-lsauge, xyk isam, sn ijwnk qjwegyc. lsal fwyy kx uwinyc. efwlis xdd
lsn izjjnul, fwyy cxz?

sn egwmmnk xdd lsn tzujnel auk yxxgnk tjabnyc al swe falisnj, talsnjwut
aqxzl swe ynte lsn yxxen dxyke xd swe txfu. lsn myzvm esakxfnk dain auk
ezyynu xbay pxfy jniayynk a mjnyaln, maljxu xd ajle wu lsn vwkkyn atne.
a mynaeaul evwyn qjxgn hzwnlyc xbnj swe ywme.

こちらを何度か試しながら文字を置き換えました。

we=is c=y x=o z=u i=r i=c ように置き換えたら、、、

quipqiup is a fast and automated cryptogram solver by Edwin Olson. It can solve simple substitution ciphers often found in newspapers, including puzzles like cryptoquips (in which word boundaries are preserved) and patristocrats (inwhi chwor dboun darie saren t).
Puzzle: 
-------------------------------------------------------------------------------
ixutjale snjn we cxzj dyat - ezqelwlzlwxu_iwmsnje_ajn_exybaqyn_ikwytukyum
-------------------------------------------------------------------------------
elalnyc, myzvm qzig vzyywtau iavn djxv lsn elawjsnak, qnajwut a qxfy xd
yalsnj xu fswis a vwjjxj auk a jarxj yac ijxeenk. a cnyyxf kjneewuttxfu,
zutwjkynk, fae ezelawunk tnulyc qnswuk swv xu lsn vwyk vxjuwut awj. sn
snyk lsn qxfy ayxdl auk wulxunk:

-wuljxwqx ak aylajn knw.

saylnk, sn mnnjnk kxfu lsn kajg fwukwut elawje auk iayynk xzl ixajenyc:

-ixvn zm, gwuis! ixvn zm, cxz dnajdzy pnezwl!

exynvuyc sn iavn dxjfajk auk vxzulnk lsn jxzuk tzujnel. sn daink aqxzl
auk qyneenk tjabnyc lsjwin lsn lxfnj, lsn ezjjxzukwut yauk auk lsn
afagwut vxzulawue. lsnu, ialiswut ewtsl xd elnmsnu knkayze, sn qnul
lxfajke swv auk vakn jamwk ijxeene wu lsn awj, tzjtywut wu swe lsjxal
auk esagwut swe snak. elnmsnu knkayze, kwemynaenk auk eynnmc, ynaunk
swe ajve xu lsn lxm xd lsn elawjiaen auk yxxgnk ixykyc al lsn esagwut
tzjtywut dain lsal qyneenk swv, nhzwun wu wle ynutls, auk al lsn ywtsl
zulxuezjnk sawj, tjawunk auk sznk ywgn mayn xag.

qzig vzyywtau mnnmnk au wuelaul zuknj lsn vwjjxj auk lsnu ixbnjnk lsn
qxfy evajlyc.

-qaig lx qajjaige! sn eawk elnjuyc.

sn akknk wu a mjnaisnje lxun:

-dxj lswe, x knajyc qnyxbnk, we lsn tnuzwun isjwelwun: qxkc auk exzy
auk qyxxk auk xzue. eyxf vzewi, mynaen. eszl cxzj ncne, tnule. xun
vxvnul. a ywllyn ljxzqyn aqxzl lsxen fswln ixjmzeiyne. ewynuin, ayy.

sn mnnjnk ewknface zm auk tabn a yxut eyxf fswelyn xd iayy, lsnu mazenk
afswyn wu jaml allnulwxu, swe nbnu fswln lnnls tywelnuwut snjn auk lsnjn
fwls txyk mxwule. isjcexelxvxe. lfx eljxut esjwyy fswelyne auefnjnk
lsjxzts lsn iayv.

-lsauge, xyk isam, sn ijwnk qjwegyc. lsal fwyy kx uwinyc. efwlis xdd
lsn izjjnul, fwyy cxz?

sn egwmmnk xdd lsn tzujnel auk yxxgnk tjabnyc al swe falisnj, talsnjwut
aqxzl swe ynte lsn yxxen dxyke xd swe txfu. lsn myzvm esakxfnk dain auk
ezyynu xbay pxfy jniayynk a mjnyaln, maljxu xd ajle wu lsn vwkkyn atne.
a mynaeaul evwyn qjxgn hzwnlyc xbnj swe ywme.
 Clues: For example G=R QVW=THE
we=is c=y x=o z=u i=r i=c


 dictionary

 Solve


 

0   -1.439  ------------------------------------------------------------------------------- congrats here is your flag - substitution_ciphers_are_solvable_cdilgndlnp ------------------------------------------------------------------------------- stately, plump buck mulligan came from the stairhead, bearing a bowl of lather on which a mirror and a razor lay crossed. a yellow dressinggown, ungirdled, was sustained gently behind him on the mild morning air. he held the bowl aloft and intoned: -introibo ad altare dei. halted, he peered down the dark winding stairs and called out coarsely: -come up, kinch! come up, you fearful jesuit! solemnly he came forward and mounted the round gunrest. he faced about and blessed gravely thrice the tower, the surrounding land and the awaking mountains. then, catching sight of stephen dedalus, he bent towards him and made rapid crosses in the air, gurgling in his throat and shaking his head. stephen dedalus, displeased and sleepy, leaned his arms on the top of the staircase and looked coldly at the shaking gurgling face that blessed him, equine in its length, and at the light untonsured hair, grained and hued like pale oak. buck mulligan peeped an instant under the mirror and then covered the bowl smartly. -back to barracks! he said sternly. he added in a preachers tone: -for this, o dearly beloved, is the genuine christine: body and soul and blood and ouns. slow music, please. shut your eyes, gents. one moment. a little trouble about those white corpuscles. silence, all. he peered sideways up and gave a long slow whistle of call, then paused awhile in rapt attention, his even white teeth glistening here and there with gold points. chrysostomos. two strong shrill whistles answered through the calm. -thanks, old chap, he cried briskly. that will do nicely. switch off the current, will you? he skipped off the gunrest and looked gravely at his watcher, gathering about his legs the loose folds of his gown. the plump shadowed face and sullen oval jowl recalled a prelate, patron of arts in the middle ages. a pleasant smile broke quietly over his lips.

Don't like the solutions you got? Try changing the 'solve' mode (click above the 'solve' button)!

Thanks for using quipqiup.com! The code and website are (C) 2014-2016 by Edwin Olson, ebolson@umich.edu

congrats here is your flag - substitution_ciphers_are_solvable_cdilgndlnp という文字がでてきました。 substitution_ciphers_are_solvable_cdilgndlnpがフラグです。