WPICTF - zommercrypt

14 Apr 2019

description: My daughter is using a coded language to hide her activities from us!!!! Please, help us find out what she is hiding! made by rm-k https://drive.google.com/open?id=1BO3v97Igzs7KruDkK7B4AGqxsNB7BaWE

category: Cryptography

The challenge was providing a picture : phonecap.png

We can see on this picture, an sms conversation and some emojis separated by spaces, braces and an underscore. This looks like a flag encoded in some way with emojis… If we get the value of this emojis, we get the following :

\xF0\x9F\x98\x83 \xf0\x9f\x98\x81 \xf0\x9f\x98\x95 \xf0\x9f\x98\x97 \xf0\x9f\x98\x88 \xf0\x9f\x98\x97 \xf0\x9f\x98\x87 \xf0\x9f\x98\x8b \xf0\x9f\x98\x84 \xf0\x9f\x98\x97 { \xf0\x9f\x98\x86 \xf0\x9f\x98\x93 \xf0\x9f\x98\x84 \xf0\x9f\x98\x93 \xf0\x9f\x98\x82 \xf0\x9f\x98\x88 _ \xf0\x9f\x98\x8e \xF0\x9F\x98\x83 \xF0\x9F\x98\x83 \xf0\x9f\x98\x81 \xf0\x9f\x98\x93 \xf0\x9f\x98\x86 \xf0\x9f\x98\x87 }

If we take only the 3 emojis before the ‘{‘, we can see that their last bytes are : 0x8b, 0x84, and 0x97

0x8b and 0x84 have the same “distance” as ‘W’ and ‘P’ : 0x8b - 0x84 = ord(‘W’) - ord(‘P’) = 7.

But 0x97 seems out of bount for the letter ‘I’. Except if we apply a modulo as follow :

80 L, 81 M, 82 N, 83 O, 84 P, 85 Q, 86 R, 87 S, 88 T, 89 U, 8a V, 8b W, 8c X, 8d Y, 8e Z, 8f A, 90 B, 91 C, 92 D, 93 E, 94 F, 95 G, 96 H, 97 I, 98 J, 99 K, 9a L, 9b M, 9c N, 9d, …

With that said, we can decode the message and get the flag : WPI{REPENT_ZOOMERS}