Микс из символов (Mix of Symbols)

Platform: CUSTOM | Category: Crypto | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: frequency_analysis, known_plaintext_attack, substitution_table_recovery

Summary

Walkthrough of the CUSTOM Crypto Микс из символов (Mix of Symbols). Task: Monoalphabetic substitution cipher with flag hidden in encrypted text. Solution: Known-plaintext attack using flag format prefix and common English words to recover the full substitution table.

Description

Флаг находится среди текстового послания, в котором все символы перепутали свое значение. Зашифрованный текст в прикрепленном файле.

English summary: The flag is hidden in a text message where all symbols have swapped their meaning. The encrypted text is provided in an attached file. The goal is to decrypt the substitution cipher and recover the flag.

Analysis

The ciphertext file chall-c1.txt contained:

DPJJZ! 
YDFT YPRY FT LPPMPM YZ FMPLYFAU YDP VDQNQVYPNT YDQY OPNP PLVNUCYPM ETFLS YDP VDQNQVYPN CPNKEYQYFZL KPYDZM. ZLVP YDP YPRY FT TEVVPTTAEJJU MPVNUCYPM, UZE OFJJ XP QXJP YZ NPQM YDP AJQS QT OPJJ. QLM YDP AJQS VZLTFTYT ZA Q TPY ZA TFRYPPL NQLMZK VDQNQVYPNT. 
YDP AEJJ AJQS FT: XESVYA{XQKOFJULPAVEDSMR}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key observations that identified this as a monoalphabetic substitution cipher:

1. Word boundaries preserved — spaces and punctuation are not encrypted, only letters are substituted
2. 1:1 letter mapping — each ciphertext letter consistently maps to the same plaintext letter throughout
3. Flag format visible — XESVYA{...} matches the BUGCTF{...} flag format with curly braces intact
4. Repeated letters — DPJJZ has a double J, matching "HELLO" with double L
5. Structural English — phrases like YDP AEJJ AJQS FT: clearly map to "THE FULL FLAG IS:" ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Recover key from known plaintext

Starting with the most obvious anchors:

Step 2: Extend mapping using context

With partial decryption, more words became readable:

Step 3: Complete substitution table

Full cipher-to-plain mapping (21 active letters):

Cipher: A C D E F J K L M N O P Q R S T U V X Y Z
Plain:  F P H U I L M N D R W E A X G S Y C B T O

Step 4: Decrypt the full message

 python read-only • copy allowed Copy
#!/usr/bin/env python3
# Solve script for "Mix of Symbols" substitution cipher

cipher_to_plain = {
    'A': 'F', 'C': 'P', 'D': 'H', 'E': 'U', 'F': 'I',
    'J': 'L', 'K': 'M', 'L': 'N', 'M': 'D', 'N': 'R',
    'O': 'W', 'P': 'E', 'Q': 'A', 'R': 'X', 'S': 'G',
    'T': 'S', 'U': 'Y', 'V': 'C', 'X': 'B', 'Y': 'T',
    'Z': 'O'
}
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

ciphertext = """DPJJZ! 
YDFT YPRY FT LPPMPM YZ FMPLYFAU YDP VDQNQVYPNT YDQY OPNP PLVNUCYPM ETFLS YDP VDQNQVYPN CPNKEYQYFZL KPYDZM. ZLVP YDP YPRY FT TEVVPTTAEJJU MPVNUCYPM, UZE OFJJ XP QXJP YZ NPQM YDP AJQS QT OPJJ. QLM YDP AJQS VZLTFTYT ZA Q TPY ZA TFRYPPL NQLMZK VDQNQVYPNT. 
YDP AEJJ AJQS FT: XESVYA{XQKOFJULPAVEDSMR}"""

plaintext = ""
for ch in ciphertext:
    if ch.upper() in cipher_to_plain:
        mapped = cipher_to_plain[ch.upper()]
        plaintext += mapped.lower() if ch.islower() else mapped.lower()
    else:
        plaintext += ch
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

print(plaintext)

Decrypted text

hello! this text is needed to identify the characters that were encrypted using the character permutation method. once the text is successfully decrypted, you will be able to read the flag as well. and the flag consists of a set of sixteen random characters. the full flag is: bugctf{REDACTED} ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering frequency_analysis, known_plaintext_attack, substitution_table_recovery was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-05-25 • CUSTOM • Микс из символов (Mix of Symbols) • Difficulty: Easy