Onion (Cryptography) - Writeup

Challenge Overview

"Our old sysadmin loved stacking things - layer after layer, like he was trying to make you cry before you got to the middle. We found this on a decommissioned box. Peel it back."

The name and description give away the theme: the flag is wrapped in several layers of encoding, and we have to strip them off one at a time.

---

Step 1: Looking at the File

Opening chall.enc in Notepad shows nothing but groups of eight ones and zeroes separated by spaces. That's a clear sign of binary-encoded bytes, with each 8-bit group representing one character.

---

Step 2: Peeling the Encoding Layers with CyberChef

CyberChef is the Swiss Army knife of cybersecurity: a browser-based tool for encoding, decoding, encrypting and analysing data. When you aren't sure how many layers of encoding you're dealing with, its Magic operation is a good first move. It tries different decoders automatically and ranks the results by how readable they look.

I pasted the contents of chall.enc into the input and added Magic to the recipe, with a depth of 3. It found this chain:

1. From Binary turns the ones and zeroes into text.
2. From Base64 decodes the Base64 string that comes out.
3. From Hex converts the hex output back to readable characters.

After three layers we get something that looks like a flag:

PKNT_XGU{k33o_gs3_o4b3ih_o1p3_4m_0m10m}

It isn't quite right, though. The flag format should start with KPMG_CTF, and the text inside the braces is still gibberish. The underscores, braces and digits survived untouched, and the word lengths look like real words. That pattern points to a letter-substitution cipher as the last layer.

---

Step 3: Identifying the Cipher

To work out which substitution was used, I ran the string through dCode's Cipher Identifier. It analyses the text and suggests likely ciphers.

The top suggestion was Atbash Cipher.

How Atbash Works

Atbash is one of the oldest known ciphers. It was originally used with the Hebrew alphabet, and the idea is to reverse the alphabet: the first letter swaps with the last, the second with the second-to-last, and so on.

Plain:  A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
Cipher: Z Y X W V U T S R Q P O N M L K J I H G F E D C B A

So K → P, P → K, M → N, G → T. A few properties make it easy to spot:

• There's no key. The mapping is always the same, so it gives no real security.
• It's its own inverse. Applying Atbash a second time decrypts it.
• It only touches letters. Digits, underscores and braces pass through unchanged, which matches what we saw.

A quick check confirms it: PKNT under Atbash becomes KPMG.

---

Step 4: Decrypting the Final Layer

Using dCode's Atbash decoder with the standard A–Z alphabet:

The last layer comes off and gives the flag:

KPMG_CTF{p33l_th3_l4y3rs_l1k3_4n_0n10n}

---

Summary

Key Takeaways

• Read the challenge name. "Onion" told us there would be several layers before we'd even opened the file.
• CyberChef's Magic is great for triage, but it only handles encodings. When the output looks almost right but is still scrambled, think about a classical cipher.
• Check the flag format. Comparing PKNT_XGU with the expected KPMG_CTF and seeing the length and symbols line up is a strong hint that the remaining layer is a letter substitution.
• Encoding isn't encryption. Base64, hex and binary only change how data is represented, and Atbash has no key, so none of these layers protect anything.

Flag: KPMG_CTF{p33l_th3_l4y3rs_l1k3_4n_0n10n}