Wednesday, April 13, 2011

another ctf from novaha

A crypto ctf this time from NoVA great group. This time the challenge was a to decipher a text. The give text was the following,

Cipher text:

NDJJE ETD’RF Y NTE ZYHF Y NUA PTUBF
KIYEUP’ UP WGF BWRFFW ATPPY NF Y NUA ZYP BTZF JYE

ETD ATW ZDJ TP ET’ XYVF
ETD NUA JUBARYVF
HUVHUP’ ETDR VYP YII TSFR WGF KIYVF

MF MUII MF MUII RTVH ETD
MF MUII MF MUII RTVH ETD

NDJJE ETD’RF Y ETDPA ZYP GYRJ ZYP
BGTDWUP’ UP WGF BWRFFW ATPPY WYHF TP WGF MTRIJ BTZF JYE
ETD ATW NITTJ TP ET’ XYVF
ETD NUA JUBARYVF
MYSUP’ ETDR NYPPFR YII TSFR WGF KIYVF

MF MUII MF MUII RTVH ETD
MF MUII MF MUII RTVH ETD

NDJJE ETD’RF YP TIJ ZYP KTTR ZYP
KIFYJUP’ MUWG ETDR FEFB ATPPY ZYHF ETD BTZF KFYVF BTZF JYE

ETD ATW ZDJ TP ETDR XYVF
ETD NUA JUBARYVF
BTZFNTJE NFWWFR KDW ETD NYVH UP ETDR KIYVF

MF MUII MF MUII RTVH ETD
MF MUII MF MUII RTVH ETD

The challenge this time was easy since at the website the author provided a lot of information about substitution ciphers and also a nice tool to measure the occurrences of each letter. The link for the tool is, http://novactf.org/challenges/challenge-march-2011/rubyscript/ and the output on the text above is the following,

[A => 15]       2.94%
[B => 13]       2.54%
[D => 30]       5.87%
[E => 35]       6.85%
[F => 53]       10.37%
[G => 8]        1.57%
[H => 12]       2.35%
[I => 36]       7.05%
[J => 20]       3.91%
[K => 8]        1.57%
[M => 27]       5.28%
[N => 15]       2.94%
[P => 29]       5.68%
[R => 26]       5.09%
[S => 3]        0.59%
[T => 58]       11.35%
[U => 31]       6.07%
[V => 19]       3.72%
[W => 18]       3.52%
[X => 3]        0.59%
[Y => 38]       7.44%
[Z => 14]       2.74%

From http://en.wikipedia.org/wiki/Letter_frequency. We can assume, based on the frequency of possible occurrences for a start, that letters T and or F on the cipher text are one of the following e, t, a, or o. Since the author of the challenge already describe that he kept punctuation and format of the original text we can try to substitute using sed T and F accordingly. I won’t take this long this was an easy challenge, there are not many common words in English that have 2 letters and the second is e. That comes by substituting F with e, also we have the pattern MF MUII MF MUII RTVH ETD the second word, MUII has 2 occurrences of the same letters at the end, we can look for that at, http://www.morewords.com . Keeping it sort,  

cat text  | sed s/F/e/g | sed s/T/o/g | sed s/M/w/g | sed s/I/l/g | sed s/U/i/g | sed s/R/r/g | sed s/V/c/g | sed s/H/k/g | sed s/E/y/g | sed s/D/u/g

will result on the following,

NuJJy youY Noy ZYke Y NiA PoiBe
KlYyiP WGe BWreeW AoPPY Ne Y NiA ZYP BoZe JYy

you AoW ZuJ oP yoce
you NiA JiBArYce
kickiPur cYP Yll oSer WGe KlYce

we will we will rock you
we will we will rock you

NuJJy youY youPA ZYP GYrJ ZYP
BGouWiP WGe BWreeW AoPPY WYke oP WGe worlJ BoZe JYy
you AoW NlooJ oP yoce
you NiA JiBArYce
wYSiPur NYPPer Yll oSer WGe KlYce

we will we will rock you
we will we will rock you

NuJJy youYP olJ ZYP Koor ZYP
KleYJiPWG your eyeB AoPPY ZYke you BoZe KeYce BoZe JYy

you AoW ZuJ oP your XYce
you NiA JiBArYce
BoZeNoJy NeWWer KuW you NYck iP your KlYce

we will we will rock you
we will we will rock you

I believe we don’t need more than that, we will rock you by Queen (http://www.lyrics007.com/Queen%20Lyrics/We%20Will%20Rock%20You%20Lyrics.html) .

2 comments:

  1. This challenge is really easy. Another solution. By searching google you can find all 4-letter words that have the last 2 letters the same (http://wiki.answers.com/Q/What_four_letter_words_have_their_last_two_letters_the_same). Taking into consideration that the first letter of both "MF" and "MUII" words is the same you will soon realise that the words can be we will. The "we will we will" is all that you need in order to guess the song. Thats all. No more than 5 minutes.

    ReplyDelete
  2. A challenge is a challenge no matter easy or hard, kudos always to the person that spend his time preparing it.

    ReplyDelete