320 words
2 minutes
πŸ” PicoGym - The Numbers

πŸ“‚ Download the challenge file.

Description: The numbers… what do they mean?
Difficulty: Medium
Author: Danny

Summary#

This challenge provides an image containing a sequence of numbers.

The goal is to decode the numbers inside the braces using the Letter-to-Number Cipher to recover the flag.


Analysis#

We are provided with the image the_numbers.png. On this it contains this 16 9 3 15 3 20 6 {20 8 5 14 21 13 2 5 18 19 13 1 19 15 14}

To identify the cipher method, we can use dcode.fr.

dcode.fr

It suggests that the sequence uses a Letter-to-Number Cipher.

What is Letter-to-Number Cipher? Also known as the Number-to-Letter Cipher or A1Z26, this cipher replaces each letter with its position in the alphabet:

LetterABCDEFGHIJKLMNOPQRSTUVWXYZ
Number1234567891011121314151617181920212223242526

How to Encrypt Using A1Z26#

  1. Take the plaintext letter.
  2. Find its position in the alphabet.
  3. Replace the letter with its corresponding number.

For example, β€œA” becomes 1, β€œB” becomes 2, and so on up to β€œZ” = 26.
Decoding is simply the reverse process: convert numbers back into letters to recover the original text.


Now let’s decrypt our flag:

Split into the part before the braces and the part inside:

  • Before braces: 16 9 3 15 3 20 6
  • Inside braces: 20 8 5 14 21 13 2 5 18 19 13 1 19 15 14

Convert each number using A1Z26 (A=1, B=2, …, Z=26):

Before braces

  • 16 β†’ P
  • 9 β†’ I
  • 3 β†’ C
  • 15 β†’ O
  • 3 β†’ C
  • 20 β†’ T
  • 6 β†’ F

Assembled: P I C O C T F β†’ PICOCTF

Inside braces

  • 20 β†’ T
  • 8 β†’ H
  • 5 β†’ E
  • 14 β†’ N
  • 21 β†’ U
  • 13 β†’ M
  • 2 β†’ B
  • 5 β†’ E
  • 18 β†’ R
  • 19 β†’ S
  • 13 β†’ M
  • 1 β†’ A
  • 19 β†’ S
  • 15 β†’ O
  • 14 β†’ N

Assembled: T H E N U M B E R S M A S O N β†’ THENUMBERSMASON

Using the standard flag format, the final flag is: PICOCTF{THENUMBERSMASON}

⚑ Raikiri

πŸŽ‰ Flag pwned! The numeric ciphertext has been decoded successfully.

This can also be solved using online tools like dcode.fr.

πŸ’‘ TL;DR / Lesson Learned

Number-to-Letter (A1Z26) ciphers are simple yet effective for learning about encoding.