## [Original/Source Writeup](https://bigpick.github.io/TodayILearned/articles/2020-10/b01lersbootcamp#totem)
We’re also given a template to get started, but I didn’t bother using that, since I’m not a total n00b.
Connecting to the endpoint, we get a game that gives us the encryption method, and the ciphertext, and asks us for the original plaintext:
```nc chal.ctf.b01lers.com 2008Method: rot13Ciphertext: jbeyqInput: worldMethod: Base64Ciphertext: c3Vycm91bmQ=Input: c3Vycm91bmQ=Hm that doesn't seem quite right we must be awake.```
After playing around manually to try to find all possible encryptions, I found the following to be possible:
1. [ROT13](https://rot13.com/)2. [base64](https://www.base64decode.org/)3. [atbash](https://en.wikipedia.org/wiki/Atbash)4. [Baconian](https://en.wikipedia.org/wiki/Bacon%27s_cipher)
From the template, we can expect there to be 1000 total rounds. With this knowledge, we can code something up in Python that just repeatedly receives and then solves the challenge (creds for the baconian/atbash cipher in comments):
```python#!/usr/bin/env python3.8from pwn import *import sysfrom base64 import b64decode
atbash_cipher = {'A': 'Z', 'a': 'z', 'B': 'Y', 'b': 'y', 'C': 'X', 'c': 'x', 'D': 'W', 'd': 'w', 'E': 'V', 'e': 'v', 'F': 'U', 'f': 'u', 'G': 'T', 'g': 't', 'H': 'S', 'h': 's', 'I': 'R', 'i': 'r', 'J': 'Q', 'j': 'q', 'K': 'P', 'k': 'p', 'L': 'O', 'l': 'o', 'M': 'N', 'm': 'n', 'N': 'M', 'n': 'm', 'O': 'L', 'o': 'l', 'P': 'K', 'p': 'k', 'Q': 'J', 'q': 'j', 'R': 'I', 'r': 'i', 'S': 'H', 's': 'h', 'T': 'G', 't': 'g', 'U': 'F', 'u': 'f', 'V': 'E', 'v': 'e', 'W': 'D', 'w': 'd', 'X': 'C', 'x': 'c', 'Y': 'B', 'y': 'b', 'Z': 'A', 'z': 'a', ' ': ' ', '.': '.', ',': ',', '?': '?', '!': '!', '\'': '\'', '\"': '\"', ':': ':', ';': ';', '\(': '\)', '\)': '\)', '\[': '\[', '\]': '\]', '\-': '\-', '1': '1', '2': '2', '3': '3', '4': '4', '5': '5', '6': '6', '7': '7', '8': '8', '9': '9', '0': '0'}
def rot_alpha(n):    from string import ascii_lowercase as lc, ascii_uppercase as uc    lookup = str.maketrans(lc + uc, lc[n:] + lc[:n] + uc[n:] + uc[:n])    return lambda s: s.translate(lookup)
# https://stackoverflow.com/a/45717802/13158274# -- Jérômeclass AtBash:
   def __init__(self):       self.alphabets = ' ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789~!@#$%^&*()_+|:"<>-=[];,.?/`'       self.alphabets = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}'
   def encode(self, plaintext):       cipher = ""       for i in plaintext:           index = self.alphabets.index(i)           cipher += self.alphabets[abs(len(self.alphabets) - index - 1) % len(self.alphabets)]       return cipher
   def decode(self, ciphertext):       return self.encode(ciphertext)
# https://www.geeksforgeeks.org/baconian-cipher/def decrypt_bacon(message):    lookup = {'A':'aaaaa', 'B':'aaaab', 'C':'aaaba', 'D':'aaabb', 'E':'aabaa',        'F':'aabab', 'G':'aabba', 'H':'aabbb', 'I':'abaaa', 'J':'abaab',        'K':'ababa', 'L':'ababb', 'M':'abbaa', 'N':'abbab', 'O':'abbba',        'P':'abbbb', 'Q':'baaaa', 'R':'baaab', 'S':'baaba', 'T':'baabb',        'U':'babaa', 'V':'babab', 'W':'babba', 'X':'babbb', 'Y':'bbaaa', 'Z':'bbaab'}
    decipher = ''    i = 0
    # emulating a do-while loop    while True :        # condition to run decryption till        # the last set of ciphertext        if(i < len(message)-4):            # extracting a set of ciphertext            # from the message            substr = message[i:i + 5]            # checking for space as the first            # character of the substring            if(substr[0] != ' '):                '''                This statement gets us the key(plaintext) using the values(ciphertext)                Just the reverse of what we were doing in encrypt function                '''                decipher += list(lookup.keys())[list(lookup.values()).index(substr)]                i += 5 # to get the next set of ciphertext
            else:                # adds space                decipher += ' '                i += 1 # index next to the space        else:            break # emulating a do-while loop
    return decipher
def main():    r = remote('chal.ctf.b01lers.com', 2008)    i = 0    while 1 < 2:        print("=== ", i)        method = r.recvline().decode().strip().split()[-1]        ct = r.recvline().decode().strip().split()[-1]        plaintext = ""        if method == "atbash":            for char in ct:                plaintext += atbash_cipher[char]            r.sendafter('Input: ', plaintext+'\n')        elif method == "rot13":            r.sendafter('Input: ', rot_alpha(13)(ct)+'\n')        elif method == "Base64":            r.sendafter('Input: ', b64decode(ct).decode()+'\n')        elif method == "bacon":            r.sendafter('Input: ', decrypt_bacon(ct.lower()).lower()+'\n')        i += 1        if i == 1000:            print(r.stream())            sys.exit(0)
if __name__ == '__main__':    main()```
Which after running, gives us the flag:
```...===  993===  994===  995===  996===  997===  998===  999We must be dreaming, here's your flag: ctf{4n_313g4nt_s01ut10n_f0r_tr4cking_r341ity}b"We must be dreaming, here's your flag: ctf{4n_313g4nt_s01ut10n_f0r_tr4cking_r341ity}\n"```
Flag is `ctf{4n_313g4nt_s01ut10n_f0r_tr4cking_r341ity}`.
