← Back to Writeups
CUSTOMEasyCrypto

Мандариновый шифр

XESXOR9/10/20262 min read
#crypto#custom#easy#emoji_substitution

Мандариновый шифр

Platform: hl_hacker | Category: Crypto | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2025-12-27 | Status: Solved Techniques: emoji_substitution

Summary

Task: Decrypt letters encrypted with emoji substitution cipher (tangerines and Christmas trees). Solution: Reverse the cle.py script logic - count tangerines per block, subtract 3 to get alphabet index.

Мандариновый шифр — hl_hacker

Description

In this task we are given a set of "letters" (text files) encrypted using the cle.py script (Capybara Letter Encryptor). The letters appear as sequences of tangerine (🍊) and Christmas tree (🎄) emojis. Our goal is to decrypt the letters and find the flag.

Analysis

The cle.py script implements a simple substitution cipher. Let's examine the key points:

Alphabet

A fixed alphabet is used, including Latin letters (both cases), digits, and special characters:

python
ALPHABET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_{}@$.,!?:-()'\n \"+*#%&"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Encryption Algorithm

  1. For each character in the text, find its index in ALPHABET.
  2. Add 3 to the index (count = index + 3).
  3. Replace the character with a string of count tangerines (🍊).
  4. If the character is not in the alphabet, replace it with a "coal" (⚫).
  5. Join all tangerine blocks with a delimiter — the Christmas tree (🎄).

Example: Character 'a' has index 0. It becomes 0 + 3 = 3 tangerines: 🍊🍊🍊.

Solution

To solve the task, we need to perform the reverse operations:

  1. Split the string by the 🎄 character.
  2. Count the number of 🍊 in each part.
  3. Subtract 3 from the count to get the index in ALPHABET.
  4. Reconstruct the original text. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Decryption Script

python
#!/usr/bin/env python3
import os

ALPHABET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_{}@$.,!?:-()'\n \"+*#%&"

def decrypt_text(encrypted_text):
    parts = encrypted_text.split("🎄")
    res = []
    for part in parts:
        if "⚫" in part:
            res.append("?")
            continue
        count = part.count("🍊")
        index = count - 3
        if 0 <= index < len(ALPHABET):
            res.append(ALPHABET[index])
        else:
            # In case something went wrong
            res.append(f"[{count}]") 
    return "".join(res)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

def main():
    letters_dir = "letters"
    if not os.path.exists(letters_dir):
        print(f"Directory {letters_dir} not found!")
        return

    for filename in os.listdir(letters_dir):
        if filename.endswith(".txt"):
            filepath = os.path.join(letters_dir, filename)
            with open(filepath, "r", encoding="utf-8") as f:
                content = f.read()
            
            decrypted = decrypt_text(content)
            
            # Look for flag or flag mention
            if "CODEBY" in decrypted:
                print(f"--- {filename} (FOUND FLAG!) ---")
                print(decrypted)
                print("-" * 40)
            elif "flag" in decrypted.lower():
                print(f"--- {filename} (Contains 'flag') ---")
                print(decrypted)
                print("-" * 40)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

if __name__ == "__main__":
    main()

Running the script, we find the flag in the file letter_elder_tangerined.txt. This is a letter from the capybara elder. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍