Vault Breaker

Platform: Dawgctf | Category: Cryptography | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-04-10 | Status: Solved Techniques: glyph_deduplication, repetition_pattern_analysis, thematic_hint_correlation, dada_urka_substitution

Summary

Task: a PDF shows a 21-symbol ciphertext made of pigpen-like glyphs with 0, 1, or 2 dots. Solution: extract and deduplicate the glyph masks, notice standard pigpen fails, then use the Donald Duck hint to switch to the Dada Urka alphabet and decode the text as REDACTED.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: dawgctf | ID: 20260410_dawgctf_vault_breaker
• Tags: substitution_cipher, pdf_analysis, classical_cipher, symbol_cipher, image_extraction, dawgctf, pigpen_cipher, dada_urka
• Indicators: A PDF contains isolated pen-like symbols instead of normal text, Glyphs look pigpen-like but standard pigpen decoding produces nonsense, Some symbols are exact duplicates, making repetition patterns easy to test, Challenge flavor text references Donald Duck, Scrooge, or Junior Woodchucks, Symbols use the same shape family with 0, 1, or 2 dots
• Source: 20260410_dawgctf_vault_breaker.md

Foothold

Vulnerability / Misconfiguration

1. glyph_deduplication
2. repetition_pattern_analysis
3. thematic_hint_correlation
4. dada_urka_substitution

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• glyph_deduplication
• repetition_pattern_analysis
• thematic_hint_correlation
• dada_urka_substitution
• Tags: substitution_cipher, pdf_analysis, classical_cipher, symbol_cipher, image_extraction, dawgctf, pigpen_cipher, dada_urka

Original Writeup

<details><summary>Click to expand original content</summary>

Description

The provided PDF contains a row of unusual symbols and explicitly references Donald and Scrooge.

Files provided:

• dawgCTF_2026_vault_breaker.pdf

Source: https://github.com/UMBCCyberDawgs/dawgctf-sp26/tree/main/Vault%20Breaker

English summary: the challenge gives a PDF containing 21 unfamiliar glyphs that resemble a pigpen-family symbol cipher. The goal is to identify the correct variant, decode the hidden password, and wrap it in the DawgCTF flag format.

Analysis

1. Initial recon: this is a symbol substitution puzzle

The PDF did not contain a useful text layer, so the first step was to render or extract the page content as images and inspect the symbols directly. The page contained 21 unusual symbols arranged as a ciphertext.

Visually, the glyphs looked very close to pigpen / Masonic cipher symbols: angular pen shapes, some with no dots, some with one dot, and some with two dots.

2. Standard pigpen gives nonsense

The obvious first attempt was to treat the glyphs as ordinary pigpen symbols. That produced:

 text read-only • copy allowed Copy
JNQVJBJ&W&TKGDCHHETVA

This is not remotely flag-like, not readable English, and not a plausible password. That failure was useful: it suggested the challenge was using a pigpen-family variant, not the standard alphabet.

3. Extract the raw glyphs and compare exact duplicates

Instead of relying only on eyeballing, I extracted the raw symbol masks from the PDF's image/XObject data and compared the resulting SMask streams. That made it possible to verify whether symbols that merely looked similar were actually identical.

This confirmed several exact duplicates:

• symbols 1, 5, 7 were pixel-identical
• symbols 16, 17 were pixel-identical

After deduplicating all 21 positions, there were only 15 unique symbols. Labeling each new symbol in order gives the repetition pattern:

 text read-only • copy allowed Copy
ABCDAEAFGFHIJKLMMNHDO

This is a very strong substitution-cipher fingerprint. Any correct plaintext must have the exact same equality pattern.

4. The theme hint matters: Donald + Scrooge

The challenge text explicitly referenced Donald and Scrooge. That is not random flavor: it points directly to the Donald Duck / Junior Woodchucks cipher known as Dada Urka.

Dada Urka belongs to the same general family as pigpen-style symbol ciphers, so it is easy to mistake for standard pigpen at first glance. Crucially, it also uses very similar pen shapes combined with 0, 1, or 2 dots.

Once that connection is recognized, the earlier nonsense decode becomes the clue that we were using the wrong alphabet table.

5. Dada Urka fits both the shapes and the repetition pattern

Using the Dada Urka alphabet, the 21 symbols decode cleanly to:

 text read-only • copy allowed Copy
REDACTED

The positional mapping is:

 text read-only • copy allowed Copy
 1 E
 2 X
 3 T
 4 R
 5 E
 6 M
 7 E
 8 L
 9 Y
10 L
11 O
12 N
13 G
14 P
15 A
16 S
17 S
18 W
19 O
20 R
21 D

This also perfectly matches the earlier repetition structure:

 text read-only • copy allowed Copy
symbol pattern:    ABCDAEAFGFHIJKLMMNHDO
plaintext:         REDACTED

Examples:

• positions 1, 5, 7 use the same symbol and all decode to E
• positions 16, 17 use the same symbol and both decode to S

That exact structural match is strong confirmation that the decode is correct.

Solution

Step-by-step

1. Download dawgCTF_2026_vault_breaker.pdf.
2. Render or extract the page to inspect the glyphs.
3. Notice the symbols resemble pigpen/Masonic glyphs with 0, 1, or 2 dots.
4. Try standard pigpen and observe the nonsense output JNQVJBJ&W&TKGDCHHETVA.
5. Extract raw PDF symbol masks and compare them exactly to identify duplicate glyphs.
6. Record the repetition pattern as ABCDAEAFGFHIJKLMMNHDO.
7. Use the Donald/Scrooge hint to pivot from standard pigpen to Dada Urka.
8. Apply the Dada Urka alphabet and decode the symbols as REDACTED.
9. Wrap the plaintext in the flag format.

Full working helper script for the extracted sym_*_raw.png files:

 python read-only • copy allowed Copy
#!/usr/bin/env python3

from pathlib import Path
import hashlib

ROOT = Path("tasks/metactf/vault_breaker")

# Recovered from the Dada Urka alphabet after recognizing the Donald/Scrooge hint.
DADA_URKA_DECODE = {
    "A": "E",
    "B": "X",
    "C": "T",
    "D": "R",
    "E": "M",
    "F": "L",
    "G": "Y",
    "H": "O",
    "I": "N",
    "J": "G",
    "K": "P",
    "L": "A",
    "M": "S",
    "N": "W",
    "O": "D",
}

def sha256(path: Path) -> str:
    return hashlib.sha256(path.read_bytes()).hexdigest()

def main():
    raw_symbols = [ROOT / f"sym_{i:02d}_raw.png" for i in range(1, 22)]

    seen = {}
    labels = []
    next_label_ord = ord("A")

    for path in raw_symbols:
        digest = sha256(path)
        if digest not in seen:
            seen[digest] = chr(next_label_ord)
            next_label_ord += 1
        labels.append(seen[digest])

    pattern = "".join(labels)
    plaintext = "".join(DADA_URKA_DECODE[label] for label in labels)
    flag = f"DawgCTF{{{plaintext.lower()}}}"

    print(f"unique symbols: {len(set(labels))}")
    print(f"pattern: {pattern}")
    print(f"plaintext: {plaintext}")
    print(f"flag: {flag}")

if __name__ == "__main__":
    main()

Expected output:

 text read-only • copy allowed Copy
unique symbols: 15
pattern: ABCDAEAFGFHIJKLMMNHDO
plaintext: REDACTED
flag: DawgCTF{REDACTED}

Lessons Learned

• When a standard cipher almost fits but produces nonsense, do not stop at "wrong guess"; check for themed variants in the same family.
• Repetition patterns are often as important as the symbols themselves. ABCDAEAFGFHIJKLMMNHDO already constrains the plaintext heavily.
• In PDF challenges, extracting raw image masks is a reliable way to distinguish true duplicates from visually similar glyphs.

References

• Dada Urka / Junior Woodchucks cipher references and decoder pages
• General pigpen / Masonic cipher references for comparison

</details>

---

signed by XESXOR