picoCTF - interencdec Write-Up

Challenge Overview

• Challenge Name: interencdec
• Category: Cryptography
• Difficulty: Easy
• Description: Decrypt a file with multiple layers of encryption to find the real meaning/flag

Challenge Details

We are given an encrypted file (enc_flag) containing a string with multiple layers of encryption that need to be unpeeled one by one.

Analysis

The encrypted content requires decryption through multiple stages: 1. Base64 Decode (Layer 1) 2. Base64 Decode (Layer 2) 3. Caesar Cipher Decryption (Layer 3)

Layer 1: Initial Base64 Encoding

The original file contains a Base64-encoded string that decodes to:

b'd3BqdkpBTXtqaGx6aHlfazNqeTl3YTNrX2kyMDRoa2o2fQ=='

Layer 2: Nested Base64 Encoding

After removing the b'...' wrapper and decoding the second Base64 string, we get:

wpjvJAM{jhlzhy_k3jy9wa3k_i204hkj6}

Layer 3: Caesar Cipher

The final layer uses Caesar Cipher encryption with a shift of 7.

How to determine the shift: - Looking at the encrypted text: wpjvJAM{...} - The flag format should be: picoCTF{...} - Comparing w → p and p → i, we can calculate the shift - Distance from w to p (backwards) = 7 shifts

Solution Methods

Method 1: CyberChef (Easiest)

Use the online tool CyberChef:

1. Go to CyberChef
2. Paste the encrypted content
3. Add "From Base64" operation (repeat twice for both layers)
4. Add "Caesar Cipher Brute Force" operation
5. Adjust shift value to 7 or let it auto-detect
6. Read the decrypted output

Method 2: Python Script

import base64

def decode_interencdec(encrypted_file):
    """Decrypt the interencdec challenge"""

    # Read the encrypted file
    with open(encrypted_file, 'r') as f:
        content = f.read().strip()

    # Layer 1: First Base64 decode
    try:
        layer1 = base64.b64decode(content).decode('utf-8')
        print(f"After Layer 1 (Base64): {layer1}")
    except Exception as e:
        print(f"Error in Layer 1: {e}")
        return None

    # Layer 2: Second Base64 decode (remove b'...' wrapper if present)
    try:
        # Remove the b'...' wrapper if it exists
        if layer1.startswith("b'") and layer1.endswith("'"):
            layer1 = layer1[2:-1]

        layer2 = base64.b64decode(layer1).decode('utf-8')
        print(f"After Layer 2 (Base64): {layer2}")
    except Exception as e:
        print(f"Error in Layer 2: {e}")
        return None

    # Layer 3: Caesar Cipher with shift 19
    def caesar_decrypt(text, shift):
        result = ""
        for char in text:
            if char.isalpha():
                if char.isupper():
                    result += chr((ord(char) - ord('A') - shift) % 26 + ord('A'))
                else:
                    result += chr((ord(char) - ord('a') - shift) % 26 + ord('a'))
            else:
                result += char
        return result

    # Try all shifts (brute force)
    print("\nTrying all Caesar Cipher shifts:")
    for shift in range(26):
        decrypted = caesar_decrypt(layer2, shift)
        print(f"Shift {shift}: {decrypted}")
        if "picoCTF" in decrypted:
            print(f"\n✓ Found flag with shift {shift}!")
            return decrypted

    return None

# Usage
flag = decode_interencdec('enc_flag')
print(f"\nFinal Flag: {flag}")

Method 3: Bash/Linux

# Layer 1: First Base64 decode
cat enc_flag | base64 -d > layer1.txt

# Layer 2: Second Base64 decode
cat layer1.txt | tail -c +3 | head -c -2 | base64 -d > layer2.txt

# Layer 3: Caesar Cipher (shift 19)
# Using ROT13 variant with custom shift
cat layer2.txt | tr 'a-z' 'd-za-c' | tr 'A-Z' 'D-ZA-C'

Method 4: Manual Caesar Brute-Force

Use online Caesar cipher tools: - dcode.fr/caesar-cipher - Paste the Base64-decoded text - Try all 26 rotations or let it brute-force automatically

Decryption Process Example

Encrypted (Base64 Layer 1): SGVsbG8gV29ybGQh...
↓
After Base64 Decode 1: d3BqdkpBTXtqaGx6aHlfazNqeTl3YTNrX2kyMDRoa2o2fQ==
↓
After Base64 Decode 2: wpjvJAM{jhlzhy_k3jy9wa3k_i204hkj6}
↓
After Caesar (shift 7): picoCTF{caesar_d3cr9pt3d_b204adc6}

Flag

picoCTF{caesar_d3cr9pt3d_b204adc6}

Key Takeaways

1. Layered Encryption: This challenge demonstrates multiple encryption layers working together
2. Base64 Encoding: Not encryption but encoding - often used to wrap data in text format
3. Multiple Decryption Methods: Different tools and languages can solve the same problem
4. Brute Force for Simple Ciphers: Caesar cipher has only 26 possibilities, making brute-force trivial
5. Pattern Recognition: Looking for the flag format (picoCTF{...}) helps identify the correct decryption
6. Tool Usage: CyberChef is excellent for layered encoding/decoding challenges

Tools Used

• CyberChef: https://gchq.github.io/CyberChef/
• dcode.fr: https://www.dcode.fr/caesar-cipher
• Python: base64, string manipulation
• Linux: base64, tr commands

Write-up based on: https://sukepaja18.medium.com/picoctf-interencdec-4a1a4cb3439e