MailBox

Platform: spbctf | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: base64_decoding, caesar_cipher_rot17, email_header_analysis

Summary

Task: Extract flag from mbox email archive. Solution: Found custom STEGSOLVER header with base64 string, decoded it and applied ROT-17 Caesar cipher to get the flag.

MailBox — Forensics Kids 2.0

Description

Достаньте флаг из почтового ящика!

Формат флага: spbctf{...}

Given file corresp.mbox (4107 bytes) — a mailbox in mbox format.

Analysis

The mbox file contains 8 email messages of "secret correspondence" (Subject: Secret correspondence). Messages are written in transliterated Russian:

1. "Zdarov" (Hello)
2. "Pomnish o chem mi govorili v lekcii?" (Remember what we talked about in the lecture?)
3. "Nastalo tvoe vremya tvorit' velikie dela!" (It's your time to do great things!)
4. "No snachala test" (But first a test)
5. "V odnoi iz svoih messag ya spryatal flag" (I hid the flag in one of my messages)
6. "Naidi ego!" (Find it!)
7. "Flag nam nuzhez bistro" (We need the flag quickly)
8. "Ili ne ochen c:" (Or not really :c) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Upon careful examination of the headers of one of the emails, a non-standard header is found:

STEGSOLVER: YnlrbGNve3d4Zl9yY2JfaHhkYV9jcnZuX3ZqcnV2and9

Solution

Step 1: Base64 Decoding

 bash read-only • copy allowed Copy
echo "YnlrbGNve3d4Zl9yY2JfaHhkYV9jcnZuX3ZqcnV2and9" | base64 -d
# Result: byklco{wxf_rcb_hxda_crvn_vjruvjw}

Step 2: Caesar Cipher (ROT-17)

The resulting string byklco{wxf_rcb_hxda_crvn_vjruvjw} looks like a flag encrypted with Caesar cipher.

Finding the shift, knowing the result should start with spbctf:

• b → s = shift 17 (ROT-17) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import base64

# Decode base64
encoded = "YnlrbGNve3d4Zl9yY2JfaHhkYV9jcnZuX3ZqcnV2and9"
decoded = base64.b64decode(encoded).decode()
print(f"Base64 decoded: {decoded}")

# ROT-17 (shift by 17 positions)
def rot(text, shift):
    result = []
    for c in text:
        if 'a' <= c <= 'z':
            result.append(chr((ord(c) - ord('a') + shift) % 26 + ord('a')))
        elif 'A' <= c <= 'Z':
            result.append(chr((ord(c) - ord('A') + shift) % 26 + ord('A')))
        else:
            result.append(c)
    return ''.join(result)
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

flag = rot(decoded, 17)
print(f"ROT-17: {flag}")
# Result: spbctf{REDACTED}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍