8
$\begingroup$

You sent your response. As expected, a few days later, you get another cryptic mail back:

The letter

The text reads

VC5pDze1col/029903nb6laowU1MOScPqa
ZIt6Bhad2swPLj/0McAojIqYhqkQb1scwzQ7
aFyCmoTjQm/RQrNA==

and return address

https://s.bcg.pw/
hostedfiles/location

Hints:

The hex file

The file in the return address seems a bit off

The の text

32 =

Ycz' Eag

It seems two letters are missing here

What should you do?

Some files (2) are stored on my webserver. Not everything on the webserver is related to the puzzle, just the pages linked to by this puzzle here

Improve this question
$\endgroup$
3
  • 2
    $\begingroup$ Hm, just decoding the base-64 doesn't work. $\endgroup$
    – EKons
    Mar 16, 2018 at 13:15
  • $\begingroup$ if you decode it 3 times, you get the number 4 - but probably irrelevant $\endgroup$
    – Stender
    Mar 16, 2018 at 13:35
  • 1
    $\begingroup$ Also, The url downloads a file which contains this, with no embedded comments or anything õóõõòôñòòúóôôôõΩ $\endgroup$
    – Stender
    Mar 16, 2018 at 13:47

4 Answers 4

Reset to default
4
$\begingroup$

Well, to make a start:

The QR code in the top right translates to 5 cents, or a Nickle as it may be known. Perhaps using the RSA Private Key from the last puzzle would be of use? I am completely unaware of how that type of encryption works, and the tools online aren't particularly clear. I'll research it when I can.

Oddly, the bulk text appears to be 88 characters long, as opposed to the required multiple of 3 for text to binary encoding...

Improve this answer
$\endgroup$
4
$\begingroup$

Taking the Base64 from this card and decoding it through the RSA key pair found in the first puzzle, we get this output:

https://pastebin.com/raw/gtSsPHP6

This gives us this message:


X-= Thanks for the info. It's not safe where we are and we've had to move.

W-= Send us back a note in our code (it's on our website) and include the search result, there should only be one. We've encrypted it at the Ycz' Eag and the other letters but have too much to do right now to focus on trying to decrypt it.

- Please send all your messages back to us encrypted. Our public key is:

-----BEGIN PUBLIC KEY-----
MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAI5QHxv0ie0EtOduagv4/xiFCc5ZVgvk
S/z+drJ5E4hE+tpfkf2UUtQV096RQUl8ZPnXeavV33W8RvDVDSF4ejcCAwEAAQ==
-----END PUBLIC KEY-----

Some more findings:

The QR code inside of the existing QR code (found by Vlad) was brought out better by doing 2 hidden bits, and gives this link:

https://pastebin.com/Xwf9uWCb

It's a big list of the numbers 10, 32, 9600, 9604, and 9608 delimited by a と (to) symbol.

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ Could you please explain how you decode it through the rsa key pair? My understanding is that the privaye key is used for decoding what has been encoded through the public key $\endgroup$
    – Mohammad
    Mar 16, 2018 at 21:07
  • 2
    $\begingroup$ @Mhmd I used this website: 8gwifi.org/rsafunctions.jsp, and your understanding of RSA is correct. $\endgroup$
    – Velvet Carrot
    Mar 16, 2018 at 21:10
4
$\begingroup$

We get

enter image description here

by

substituting the chars according to unicode.

This leads to

https://s.bcg.pw/anote/aboutus.pug

which is

html head title Anote - About Us body h1 Thanks for choosing Anote // z> That's a bit misleading, we should change that before sending the letter. // r> Anote chooses you // z> Would we want to tell them though? // r> I guess not h2 Who We Are | Anote is here to help save you, if you cooperate with us // z> we're not saving them are we just trying to lie about this or something // Q> that would make it much easier h2 Where We Are | Our location is always written at our return address or stamp | We move regularly for our saftey // z> we're not even at these locations we're just reading their messages // Q> can you stop it's not that important h2 Why We Exist | We'll tell you more about this later. For now just write messages in our code #104da8 and stay encrypted! // z> do you think it's ob // Q> JUST STOP ALREADY IT'LL BE FINE

Improve this answer
$\endgroup$
3
$\begingroup$

A couple observations:

Using a 5th LSB Decoder, it can be observed that there is another QR code present within the one in the original image.

The locations file downloaded doesn't seem to have a common filetype signature. Instead the Hex of the file is probably another piece of the puzzle.
Hex: 20 19 9b 97 19 9b 1b 9b 1a 98 99 96 16 98 98 9c 97 1b 99 1a 99 99 1a 9b 16 19 18 bd 05

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.