Emojibius

Platform: Broncoctf2026 | Category: Cryptography | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-07-11 | Status: Solved Techniques: emoji_index_mapping, image_grid_extraction, polybius_square_decode

Summary

Task: intercepted transmission of space-separated emoji pairs plus an image of a face with 5 header emojis and a faint 5x5 character grid. Solution: title 'Emojibius' = Emoji + Polybius; header emojis index rows/cols of a 5x5 Polybius square whose cells are the grid characters, each pair (row,col) looks up a character.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: broncoctf2026 | ID: 20260711_broncoctf2026_emojibius
• Tags: substitution, emoji, coordinate_cipher, polybius, image_stego
• Indicators: ciphertext is space-separated emoji PAIRS, exactly 5 distinct emojis used, 5 header emojis printed on an image, title is a pun combining Emoji + Polybius
• Source: 20260711_broncoctf2026_emojibius.md

Foothold

Vulnerability / Misconfiguration

1. emoji_index_mapping
2. image_grid_extraction
3. polybius_square_decode

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• emoji_index_mapping
• image_grid_extraction
• polybius_square_decode
• Tags: substitution, emoji, coordinate_cipher, polybius, image_stego

Original Writeup

<details><summary>Click to expand original content</summary>

Emojibius — broncoctf2026

Description

Our intelligence agency has intercepted a strange transmission. It looks like Gen-Z developed a new language. We found a cryptic image of an elderly person on a nearby server?? Can you recover the secret message?

Hint: Sometimes you can tell what's written all over someone's face.

Two artifacts are provided:

• intercepted_signals.txt — a single line of space-separated emoji pairs.
• artifact.png — a 2816x1536 close-up of an elderly person's face. Five header emojis (🍎 🦊 🍐 🐶 🎈) run across the forehead, and a faint 5x5 character grid is written across the face.

Goal: recover the hidden message.

Analysis

The title Emojibius is the key clue: Emoji + Polybius. This is a Polybius square cipher where the row/column coordinates are encoded as emojis instead of digits.

• The ciphertext uses exactly 5 distinct emojis, and each token is a pair — classic Polybius (row, col) coordinates.
• The image supplies the missing pieces the "written all over someone's face" hint points to:

  • The 5 header emojis on the forehead define the axis order (index 0-4 for both rows and columns): [🍎=0, 🦊=1, 🍐=2, 🐶=3, 🎈=4]

  • The 5x5 character grid written on the face is the Polybius square content:

    b r o n c
    { e m 0 j
    1 s _ g 3
    } a d f h
    i k l p q
    

Each intercepted pair (row_emoji, col_emoji) maps to grid[row][col].

Solution

Map every emoji to its header index, then look up the grid cell for each pair.

 python read-only • copy allowed Copy
#!/usr/bin/env python3

# Header emoji order from the forehead -> index 0..4 for both axes
header = ["🍎", "🦊", "🍐", "🐶", "🎈"]
idx = {e: i for i, e in enumerate(header)}

# 5x5 Polybius square written across the face (row-major)
grid = [
    list("bronc"),
    list("{em0j"),
    list("1s_g3"),
    list("}adfh"),
    list("iklpq"),
]

with open("intercepted_signals.txt", encoding="utf-8") as f:
    tokens = f.read().split()

def emojis(tok):
    # each token is a pair of emoji code points
    return [c for c in tok if c in idx]

plaintext = ""
for tok in tokens:
    r_e, c_e = emojis(tok)
    plaintext += grid[idx[r_e]][idx[c_e]]

print(plaintext)

Decoding the 23 pairs step by step:

🍎🍎=(0,0)=b  🍎🦊=(0,1)=r  🍎🍐=(0,2)=o  🍎🐶=(0,3)=n  🍎🎈=(0,4)=c
🍎🍐=o        🦊🍎=(1,0)={  🦊🦊=(1,1)=e  🦊🍐=(1,2)=m  🦊🐶=(1,3)=0
🦊🎈=(1,4)=j  🍐🍎=(2,0)=1  🍐🦊=(2,1)=s  🍐🍐=(2,2)=_  🍎🦊=r
🍐🍐=_        🍎🎈=c        🍎🦊=r        🍐🍎=1        🍎🐶=n
🍐🐶=(2,3)=g  🍐🎈=(2,4)=3  🐶🍎=(3,0)=}

Concatenated: bronco{REDACTED}.

</details>

---

signed by XESXOR