Challenge Files#

The challenge provides a public.zip file containing three items:

1
encrypt.py         → The encryption program
2
flag.txt           → The encrypted flag
3
study-guide.txt    → Encrypted spelling quiz words

The Encrypted Flag#

Looking at the encrypted flag:

1
$ cat flag.txt
2
brcfxba_vfr_mid_hosbrm_iprc_exa_hoav_vwcrm

This looks like random letters - but it’s actually a substitution cipher.

Understanding the Encryption#

Here’s the encryption program:

1
import random
2
import os
3

4
files = [
5
    os.path.join(path, file)
6
    for path, dirs, files in os.walk('.')
7
    for file in files
8
    if file.split('.')[-1] == 'txt'
9
]
10

11
alphabet = list('abcdefghijklmnopqrstuvwxyz')
12
random.shuffle(shuffled := alphabet[:])
13
dictionary = dict(zip(alphabet, shuffled))
14

15
for filename in files:
16
    text = open(filename, 'r').read()
17
    encrypted = ''.join([
18
        dictionary[c]
19
        if c in dictionary else c
20
        for c in text
21
    ])
22
    open(filename, 'w').write(encrypted)

What this does:

1. Finds all .txt files in the directory
2. Creates a shuffled alphabet (randomized order)
3. Creates a dictionary mapping original letters to shuffled letters
4. For each file, replaces every letter using the dictionary
5. Saves the encrypted text back to the file

Key insight: The same shuffled alphabet is used to encrypt ALL files, including the study guide and flag!

The Study Guide#

The encrypted study guide contains words from a spelling quiz:

1
$ head study-guide.txt
2
gocnfwnwtr
3
sxlyrxaic
4
dcrrtfrxcv
5
uxbvwavcq
6
lwvicwtiwm
7
pwtmwnxvicq
8
avingciisa
9
ylwtmrcawx
10
mwaxdcrrxuwlwvq
11
yciflwnf

Identifying the Cipher Type#

Using cipher identification tools like dcode.fr, these encrypted words are strongly identified as Monoalphabetic Substitution.

How Frequency Analysis Works#

In English, certain letters appear more frequently than others:

• ‘e’ appears most often (~12.7%)
• ‘t’, ‘a’, ‘o’, ‘i’ are also very common
• ‘z’, ‘q’, ‘x’ are rare

If we encrypt English text, the most common encrypted letter should correspond to ‘e’, the second most common to ‘t’, etc.

Cracking the Cipher#

1. Use frequency analysis tools on the encrypted texts
2. Upload to dcode.fr Monoalphabetic Substitution
3. Feed it the encrypted study guide - the tool analyzes letter frequencies
4. The tool outputs the original alphabet mapping
5. Use the mapping to decrypt the flag

Results#

After running frequency analysis on the encrypted study guide and flag:

The decrypted flag:

1
PERHAPS_THE_DOG_JUMPED_OVER_WAS_JUST_TIRED

⚡ Raikiri

🎉 Flag pwned!

Wrap it as: picoCTF{PERHAPS_THE_DOG_JUMPED_OVER_WAS_JUST_TIRED}

💡 TL;DR / Lesson Learned

✅ Substitution Cipher - Each letter maps to exactly one other letter
✅ Monoalphabetic - The mapping never changes (unlike polyalphabetic ciphers)
✅ Frequency Analysis - Using letter frequency patterns to break encryption
✅ Ciphertext-only attack - We don’t need the key, just encrypted text and patterns
✅ Using known plaintext - The spelling quiz study guide is likely real English words!