Одноразовый блокнот (One-Time Pad)

Platform: CUSTOM | Category: Crypto | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: Hex encoding recognition and decoding, Misdirection awareness (task name vs actual solution), Flag extraction from plaintext

Summary

Walkthrough of the CUSTOM Crypto Одноразовый блокнот (One-Time Pad). Detailed walkthrough.

Description

"Возможно, нужно додумать что-то самому, но что именно?"

(Perhaps you need to figure out something yourself, but what exactly?)

Analysis

1. Task files: task.zip contains task.txt
2. Content: 13 lines of hex-encoded data
3. Misdirection: The name "One-Time Pad" hints at complex cryptography, but the solution is much simpler

Encoding Recognition

Hex-encoded data is easy to recognize:

• Only characters 0-9 and a-f
• Even number of characters (each byte = 2 hex characters)
• Long strings without spaces ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Hex Decoding

 bash read-only • copy allowed Copy
# Decode each line
while read line; do
    echo "$line" | xxd -r -p
    echo
done < task.txt

Python Alternative

 python read-only • copy allowed Copy
#!/usr/bin/env python3

with open('task.txt', 'r') as f:
    for line in f:
        line = line.strip()
        if line:
            decoded = bytes.fromhex(line).decode('utf-8', errors='ignore')
            print(decoded)

Decoding Result

The decoded text is educational content about cryptography in English.

Line 10 contains the flag:

Take flag - CODEBY{REDACTED} and go away, bro! You are cool.

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Lessons

1. Don't trust the name: "One-Time Pad" is misdirection, the real solution is simple hex decoding
2. Start simple: Always check basic encodings (hex, base64) before complex attacks
3. Flag confirms: REDACTED = "Oh no, OTP was cracked" - ironic name since OTP was not actually used

Related Techniques

• Base64 decoding
• ROT13/Caesar cipher
• Simple substitution recognition ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering Hex encoding recognition and decoding, Misdirection awareness (task name vs actual solution), Flag extraction from plaintext was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-01-02 • CUSTOM • Одноразовый блокнот (One-Time Pad) • Difficulty: Medium