CryptoHidden Investigations CTF 2026
Just Give Me The Flag Man
chall.txt holds 52 two-character tokens. It is a layered encoding ("shifting through the bases"), not semaphore or a classical cipher.
What this one teaches
- Recognising layered encoding by the character-set constraints each layer imposes — the tokens' character sets narrow the candidates at every stage.
- Using Beaufort/Atbash variant ciphers where a story clue ('noon') gives the shift constant (12).
- Confirming layers by checking intermediate output for plausible structure (all-printable Ascii85, correct prefix alignment).
Task description
Saad lowered his voice and glanced over his shoulder.
Saad: You got the note?
Harun: The one with the strange code? I almost burned it.
Saad: Don’t. Someone has been watching the building since noon.
Harun: What does it say?
Steps
- The second character of every token is a digit 2-7 and the first is 0-9 or u/v/w/x/z. That is a hex byte whose letters a-f were replaced by z,y,x,w,v,u (Atbash on the letters) and whose digits are written in reverse order.
- Undo Atbash on the letters (z->a, y->b, x->c, w->d, v->e, u->f). Reverse the whole 104-character string, which also fixes the nibble order. Then hex-decode. The result is 52 printable characters of Ascii85 text:
,9^T@DG"\&E,G<3?h3b2bn6^.PEM$,:“F#9NcNa?93Bg,<Sq?G5` - Ascii85-decode it to 41 printable bytes:
#!dvnJk6rRHc9"NB7NnI*/1##$!DLYv$^:z3#<Tjw. Every byte coming out printable, with the first character of each 5-character group small, is what confirmed the Ascii85 layer. - Apply ROT47, then Base91-decode. This gives
feKTH{uf1ht1zg_7fv0sgf_7f3_l4u3u}. - The prefix
feKTHagainsthiCTFfits the letter reflection c = (12 - p) mod 26, a Beaufort/Atbash variant (12 matches “noon” in the story). Applying it to the letters only gives the flag.
Submission
POST /submit returned goodFlag (“The flag is correct.”).
The flagReveal
hiCTF{sh1ft1ng_7hr0ugh_7h3_b4s3s}This CTF was possibly solved, and the writeup most likely written by an LLM. Apologies for inconsistencies.