<- CRYPTO

Ebola Virus

12 minutes to read

We are given these two files:

$ cat key.txt
CTGAAATGTTCCGCGAGCCGAACCGATTCACCGCCTAGAAACGTATTGTGCTGGTGTGCGGCGGTTAGAGATATTAGGTAGCGCCGTTACTCTAACATTTCGAATCAACCTTTCAGGGGAGTCACTGCCATCGTAAGTAGAGTACTTAGCATCGATGGCCATGCCTACTAATTACAGGCTGAATGACACTAAACCTTAGTTCACTGACCCGTTTTGTCATGTACTCTTGTGGTATGGGTCTTCAAATTGATCTGATTGGGAAGATAGAAAAACGGCTCTATCCTGGGTCGAGCCTCCCATGAAGCAGTCAAGGGGCCGCGAGGACTTCGATACTTGCCCTGCTCGAGCACATTTTAAAGCTTATTCCACATACTAGACTTACCCCCCGGCGTGTCGTACTGGAAGGTTAAACCTCTTGAGTTGATCTGACAACCTAGACGCGTGCCACGTTGTGTGGGATAGGTCACTCTCATTTCCACGAGGGACCAGAACCTTTGGCAATCCAGTTATTCTGCACTCGTGGCCGCCTCTCCTGGCAGGGGACCGGTAAGTTTGCGTATTCGCCGGGGAGTGGAGACGGATCGTCGTACACTGTTTCGAAAATTTTTGAGGATGGAGAGCAGAGCTATTGGATAAACGCTTGTACAGGTTCAATACTATTAGCAACGTGCCACCGGCACAGCTATCTCTGTTTCGCATGAAAGAGCCGTTAATCACGACGTTTAATCGAAACACATACCGATGGTCTACGAATATTATATCCGATACTAAGTCGGCCGCCGCAGTCCAGACGCCATATCGCTTTGAAGACCCCAAGGCGAACATTAACCGGTACGAGCAACTGCGGAGTGCCCTGCAATAGTCCGTCTGTAAAGGGCCCAGGCTAGGGCAAATAGTCCCTAAAACTAGAGATGGTCAACCGCTATGTGGGGCATTCTCCGTGAGACTCAGCCGTATTACAGTGAGCGTATTCCCAAACTCCCCTTCTGTGTATGACCAGTGTCGCTGCAAATGGACCGAGCAG  

$ xxd encrypted.bin
00000000: f3d3 8309 0748 15ee b309 8144 5dea a409  .....H.....D]...
00000010: 26b3 eaa4 83a4 09b3 6e09 b326 ea75 8323  &.......n..&.u.#
00000020: 09a4 835d 4415 eaa4 0944 eeee 6e83 a4a4  ...]D....D..n...
00000030: 0967 d344 26d3 0944 a409 154f 7583 6e09  .g.D&..D...Ou.n.
00000040: 4fb3 75b3 ee09 444f 09ea 6e75 5d83 b375  O.u...DO..nu]..u
00000050: 83c3 f009 0748 15ee b309 8144 5dea a409  .....H.....D]...
00000060: c344 a483 b3a4 8309 5007 60b7 dc09 4f44  .D......P.`...OD
00000070: 5da4 7509 b32f 2f83 b35d 83c3 0944 6e09  ].u..//..]...Dn.
00000080: bf28 ab91 0944 6e09 df09 a444 d8ea ee75  .(...Dn....D...u
00000090: b36e 8315 eaa4 0915 ea75 485d 83b3 88a4  .n.......uH]....
000000a0: 2309 156e 8309 446e 0967 d3b3 7509 44a4  #..n..Dn.g..u.D.
000000b0: 096e 1567 2309 ae85 b35d b323 094a 15ea  .n.g#....].#.J..
000000c0: 75d3 094a eac3 b36e 2309 b36e c309 75d3  u..J...n#..n..u.
000000d0: 8309 1575 d383 5d09 446e 09c2 b3d8 48ea  ...u..].Dn....H.
000000e0: 88ea 2309 b783 d815 265d b375 4426 09f9  ..#.....&].uD&..
000000f0: 832f ea48 ee44 2609 154f 09d6 156e e615  ./.H.D&..O...n..
00000100: f009 f3d3 8309 eeb3 7575 835d 0915 2626  ........uu.]..&&
00000110: ea5d 5d83 c309 446e 09b3 0981 44ee eeb3  .]]...Dn....D...
00000120: e683 096e 83b3 5d09 75d3 8309 0748 15ee  ...n..].u....H..
00000130: b309 f944 8183 5d23 094f 5d15 d809 67d3  ...D..]#.O]...g.
00000140: 4426 d309 75d3 8309 c344 a483 b3a4 8309  D&..u....D......
00000150: 75b3 8883 a409 4475 a409 6eb3 d883 f0da  u.....Du..n.....
00000160: daed 7509 44a4 0975 d315 eae6 d375 0975  ..u.D..u.....u.u
00000170: d3b3 7509 4f5d ea44 7509 48b3 75a4 0915  ..u.O].Du.H.u...
00000180: 4f09 75d3 8309 cb75 835d 152f 15c3 44c3  O.u....u.]./..D.
00000190: b383 094f b3d8 44ee 1f09 b35d 8309 6eb3  ...O..D....]..n.
000001a0: 75ea 5db3 ee09 0748 15ee b309 8144 5dea  u.]....H.....D].
000001b0: a409 d315 a475 a4f0 0907 4815 eeb3 0944  .....u....H....D
000001c0: a409 446e 755d 15c3 ea26 83c3 0944 6e75  ..Dnu]...&...Dnu
000001d0: 1509 75d3 8309 d3ea d8b3 6e09 2f15 2fea  ..u.......n././.
000001e0: eeb3 7544 156e 0975 d35d 15ea e6d3 0926  ..uD.n.u.].....&
000001f0: ee15 a483 0926 156e 75b3 2675 0967 4475  .....&.nu.&u.gDu
00000200: d309 75d3 8309 48ee 1515 c323 09a4 8326  ..u...H....#...&
00000210: 5d83 7544 156e a423 0915 5de6 b36e a409  ].uD.n.#..]..n..
00000220: 155d 0915 75d3 835d 0948 15c3 44ee 1f09  .]..u..].H..D...
00000230: 4fee ea44 c3a4 0915 4f09 446e 4f83 2675  O..D....O.DnO.&u
00000240: 83c3 09b3 6e44 d8b3 eea4 09a4 ea26 d309  ....nD.......&..
00000250: b3a4 0926 d344 d82f b36e 8583 83a4 2309  ...&.D./.n....#.
00000260: e615 5d44 eeee b3a4 2309 4f5d ea44 7509  ..]D....#.O].Du.
00000270: 48b3 75a4 2309 d815 6e88 831f a423 094f  H.u.#...n....#.O
00000280: 155d 83a4 7509 b36e 7583 ee15 2f83 09b3  .]..u..nu.../...
00000290: 6ec3 092f 155d 26ea 2f44 6e83 a409 4f15  n../.]&./Dn...O.
000002a0: ea6e c309 44ee ee09 155d 09c3 83b3 c309  .n..D....]......
000002b0: 155d 0944 6e09 75d3 8309 5db3 446e 4f15  .].Dn.u...].DnO.
000002c0: 5d83 a475 f0da da07 4815 eeb3 0975 d383  ]..u....H....u..
000002d0: 6e09 a42f 5d83 b3c3 a409 75d3 5d15 eae6  n../].....u.]...
000002e0: d309 d3ea d8b3 6ed7 7515 d7d3 ead8 b36e  ......n.u......n
000002f0: 0975 5db3 6ea4 d844 a4a4 4415 6e09 8144  .u].n..D..D.n..D
00000300: b309 c344 5d83 2675 0926 156e 75b3 2675  ...D].&u.&.nu.&u
00000310: 0950 75d3 5d15 eae6 d309 485d 1588 836e  .Pu.].....H]...n
00000320: 09a4 8844 6e09 155d 09d8 ea26 15ea a409  ...Dn..]...&....
00000330: d883 d848 5db3 6e83 a4dc 0967 4475 d309  ...H].n....gDu..
00000340: 75d3 8309 48ee 1515 c323 09a4 8326 5d83  u...H....#...&].
00000350: 7544 156e a423 0915 5de6 b36e a409 155d  uD.n.#..]..n...]
00000360: 0915 75d3 835d 0948 15c3 44ee 1f09 4fee  ..u..].H..D...O.
00000370: ea44 c3a4 0915 4f09 446e 4f83 2675 83c3  .D....O.DnO.&u..
00000380: 092f 8315 2fee 8323 09b3 6ec3 0967 4475  ./../..#..n..gDu
00000390: d309 a4ea 5d4f b326 83a4 09b3 6ec3 09d8  ....]O.&....n...
000003a0: b375 835d 44b3 eea4 0950 83f0 e6f0 0948  .u.]D....P.....H
000003b0: 83c3 c344 6ee6 2309 26ee 1575 d344 6ee6  ...Dn.#.&..u.Dn.
000003c0: dc09 2615 6e75 b3d8 446e b375 83c3 0967  ..&.nu..Dn.u...g
000003d0: 4475 d309 75d3 83a4 8309 4fee ea44 c3a4  Du..u.....O..D..
000003e0: f09b 83b3 ee75 d3d7 26b3 5d83 0967 155d  .....u..&.]..g.]
000003f0: 8883 5da4 09d3 b381 8309 4f5d 8329 ea83  ..].......O].)..
00000400: 6e75 ee1f 0948 8383 6e09 446e 4f83 2675  nu...H..n.DnO.&u
00000410: 83c3 0967 d344 ee83 0975 5d83 b375 446e  ...g.D...u]..uDn
00000420: e609 2fb3 7544 836e 75a4 0967 4475 d309  ../.uD.nu..gDu..
00000430: a4ea a42f 8326 7583 c309 155d 0926 156e  .../.&u....].&.n
00000440: 4f44 5dd8 83c3 0907 60b7 f009 f3d3 44a4  OD].....`.....D.
00000450: 09d3 b3a4 0915 2626 ea5d 5d83 c309 75d3  ......&&.]]...u.
00000460: 5d15 eae6 d309 26ee 15a4 8309 2615 6e75  ].....&.....&.nu
00000470: b326 7509 6744 75d3 092f b375 4483 6e75  .&u.gDu../.uD.nu
00000480: a409 67d3 836e 0944 6e4f 8326 7544 156e  ..g..n.DnO.&uD.n
00000490: 0926 156e 755d 15ee 092f 5d83 26b3 ea75  .&.nu].../].&..u
000004a0: 4415 6ea4 09b3 5d83 096e 1575 09a4 755d  D.n...]..n.u..u]
000004b0: 4426 75ee 1f09 2f5d b326 7544 2683 c3f0  D&u.../].&uD&...
000004c0: 4dea 5d44 b3ee 0926 835d 83d8 156e 4483  M.]D...&.]...nD.
000004d0: a409 75d3 b375 0944 6e81 15ee 8183 09c3  ..u..u.Dn.......
000004e0: 445d 8326 7509 2615 6e75 b326 7509 6744  D].&u.&.nu.&u.gD
000004f0: 75d3 0975 d383 0948 15c3 1f09 154f 0975  u..u...H.....O.u
00000500: d383 09c3 8326 83b3 a483 c309 26b3 6e09  .....&......&.n.
00000510: b3ee a415 0926 156e 755d 4448 ea75 8309  .....&.nu]DH.u..
00000520: 446e 0975 d383 0975 5db3 6ea4 d844 a4a4  Dn.u...u].n..D..
00000530: 4415 6e09 154f 0907 4815 eeb3 f009 cb83  D.n..O..H.......
00000540: 152f ee83 095d 83d8 b344 6e09 446e 4f83  ./...]...Dn.DnO.
00000550: 2675 4415 eaa4 09b3 a409 ee15 6ee6 09b3  &uD.........n...
00000560: a409 75d3 8344 5d09 48ee 1515 c309 2615  ..u..D].H.....&.
00000570: 6e75 b344 6ea4 0975 d383 0981 445d eaa4  nu.Dn..u....D]..
00000580: f0da daf3 d383 0944 6e26 ea48 b375 4415  .......Dn&.H.uD.
00000590: 6e09 2f83 5d44 15c3 2309 75d3 b375 0944  n./.]D..#.u..u.D
000005a0: a423 0975 d383 0975 44d8 8309 446e 7583  .#.u...uD...Dnu.
000005b0: 5d81 b3ee 094f 5d15 d809 446e 4f83 2675  ]....O]...DnO.&u
000005c0: 4415 6e09 6744 75d3 0975 d383 0981 445d  D.n.gDu..u....D]
000005d0: eaa4 0975 1509 156e a483 7509 154f 09a4  ...u...n..u..O..
000005e0: 1fd8 2f75 15d8 a409 44a4 09df 0975 1509  ../u....D....u..
000005f0: dfbf 09c3 b31f a4f0 099b ead8 b36e a409  .............n..
00000600: b35d 8309 6e15 7509 446e 4f83 2675 4415  .]..n.u.DnO.&uD.
00000610: eaa4 09ea 6e75 44ee 0975 d383 1f09 c383  ....nuD..u......
00000620: 8183 ee15 2f09 a41f d82f 7515 d8a4 f009  ..../..../u.....
00000630: 7744 5da4 7509 a41f d82f 7515 d8a4 09b3  wD].u..../u.....
00000640: 5d83 0975 d383 09a4 eac3 c383 6e09 156e  ]..u........n..n
00000650: a483 7509 154f 094f 8381 835d 094f b375  ..u..O.O...].O.u
00000660: 44e6 ea83 2309 d8ea a426 ee83 092f b344  D...#....&.../.D
00000670: 6e23 09d3 83b3 c3b3 26d3 8309 b36e c309  n#......&....n..
00000680: a415 5d83 0975 d35d 15b3 75f0 09f3 d344  ..]..u.]..u....D
00000690: a409 44a4 094f 15ee ee15 6783 c309 481f  ..D..O....g...H.
000006a0: 0981 15d8 4475 446e e623 09c3 44b3 5d5d  ....DuDn.#..D.]]
000006b0: d315 83b3 2309 5db3 a4d3 2309 a41f d82f  ....#.]...#..../
000006c0: 7515 d8a4 0915 4f09 44d8 2fb3 445d 83c3  u.....O.D./.D]..
000006d0: 0988 44c3 6e83 1f09 b36e c309 ee44 8183  ..D.n....n...D..
000006e0: 5d09 4fea 6e26 7544 156e 2309 b36e c309  ].O.n&uD.n#..n..
000006f0: 446e 09a4 15d8 8309 26b3 a483 a423 0948  Dn......&....#.H
00000700: 1575 d309 446e 7583 5d6e b3ee 09b3 6ec3  .u..Dnu.]n....n.
00000710: 0983 0075 835d 6eb3 ee09 48ee 8383 c344  ...u.]n...H....D
00000720: 6ee6 0950 83f0 e6f0 0915 1585 446e e609  n..P........Dn..
00000730: 4f5d 15d8 0975 d383 09e6 ead8 a423 0948  O]...u.......#.H
00000740: ee15 15c3 0944 6e09 75d3 8309 a475 1515  .....Dn.u....u..
00000750: eea4 dcf0 095c b348 155d b375 155d 1f09  .....\.H.].u.]..
00000760: 4f44 6ec3 446e e6a4 0944 6e26 eeea c383  ODn.Dn...Dn&....
00000770: 09ee 1567 0967 d344 7583 0948 ee15 15c3  ...g.g.Du..H....
00000780: 0926 83ee ee09 b36e c309 2fee b375 83ee  .&.....n../..u..
00000790: 8375 0926 15ea 6e75 a409 b36e c309 83ee  .u.&..nu...n....
000007a0: 8381 b375 83c3 09ee 4481 835d 0983 6e85  ...u....D..]..n.
000007b0: 1fd8 83a4 f0da da9b f34d ac54 bc1b 88ae  .........M.T....
000007c0: 9e67 1bd3 e967 1b75 151b 269e 6ef3 5d9e  .g...g.u..&.n.].
000007d0: ee1b 0748 9eee b251 dada                 ...H...Q..

Guessing part

The encryption output is very strange. On the one hand, we can identify that all characters in key.txt are A, C, G, T, which are related to the DNA. So, maybe it is a type of encoding. On the other hand, in encrypted.bin we only find raw bytes.

If we research for DNA encoding, we can find this post that shows how we can match each DNA letter to two bits (for example: A: 00, C: 01, G: 10, T: 11).

Frequency analysis

If we count the characters in key.txt, we will see 1024:

$ wc -c key.txt
    1024 key.txt

A character is a byte (8 bits), so we need 4 DNA letters. With 4 letters and 4 positions, there are at most $4^4 = 256$ possible values, and $4 \cdot 256 = 1024$…

Therefore, if we split the key in chunks of 4 characters, we have 256 chunks, obviously:

$ fold -sw 4 key.txt
CTGA
AATG
TTCC
GCGA
GCCG
AACC
GATT
CACC
GCCT
AGAA
ACGT
ATTG
TGCT
GGTG
TGCG
GCGG
TTAG
AGAT
ATTA
GGTA
GCGC
CGTT
ACTC
TAAC
ATTT
CGAA
TCAA
CCTT
TCAG
GGGA
GTCA
CTGC
CATC
GTAA
GTAG
AGTA
CTTA
GCAT
CGAT
GGCC
ATGC
CTAC
TAAT
TACA
GGCT
GAAT
GACA
CTAA
ACCT
TAGT
TCAC
TGAC
CCGT
TTTG
TCAT
GTAC
TCTT
GTGG
TATG
GGTC
TTCA
AATT
GATC
TGAT
TGGG
AAGA
TAGA
AAAA
CGGC
TCTA
TCCT
GGGT
CGAG
CCTC
CCAT
GAAG
CAGT
CAAG
GGGC
CGCG
AGGA
CTTC
GATA
CTTG
CCCT
GCTC
GAGC
ACAT
TTTA
AAGC
TTAT
TCCA
CATA
CTAG
ACTT
ACCC
CCCG
GCGT
GTCG
TACT
GGAA
GGTT
AAAC
CTCT
TGAG
TTGA
TCTG
ACAA
CCTA
GACG
CGTG
CCAC
GTTG
TGTG
GGAT
AGGT
CACT
CTCA
TTTC
CACG
AGGG
ACCA
GAAC
CTTT
GGCA
ATCC
AGTT
ATTC
TGCA
CTCG
TGGC
CGCC
TCTC
CTGG
CAGG
GGAC
CGGT
AAGT
TTGC
GTAT
TCGC
CGGG
GAGT
GGAG
ACGG
ATCG
TCGT
ACAC
TGTT
TCGA
AAAT
TTTT
GAGG
ATGG
AGAG
CAGA
GCTA
TTGG
ATAA
ACGC
TTGT
ACAG
GTTC
AATA
CTAT
TAGC
AACG
TGCC
ACCG
GCAC
AGCT
ATCT
CTGT
TTCG
CATG
AAAG
AGCC
GTTA
ATCA
CGAC
GTTT
AATC
GAAA
CACA
TACC
GATG
GTCT
ACGA
ATAT
TATA
TCCG
ATAC
TAAG
TCGG
CCGC
CGCA
GTCC
AGAC
GCCA
TATC
GCTT
TGAA
GACC
CCAA
GGCG
AACA
TTAA
CCGG
TACG
AGCA
ACTG
CGGA
GTGC
CCTG
CAAT
AGTC
CGTC
TGTA
AAGG
GCCC
AGGC
TAGG
GCAA
ATAG
TCCC
TAAA
ACTA
GAGA
TGGT
CAAC
CGCT
ATGT
GGGG
CATT
CTCC
GTGA
GACT
CAGC
CGTA
TTAC
AGTG
AGCG
TATT
CCCA
AACT
CCCC
TTCT
GTGT
ATGA
CCAG
TGTC
GCTG
CAAA
TGGA
CCGA
GCAG

$ fold -sw 4 key.txt | wc -l  
     256

Let’s use sort -u to get rid of duplicated chunks:

$ fold -sw 4 key.txt | sort -u | wc -l  
     256

So every chunk is unique… And the number of A, C, G, T is uniform:

$ grep -o A key.txt | wc -c  
     512

$ grep -o C key.txt | wc -c
     512

$ grep -o G key.txt | wc -c
     512

$ grep -o T key.txt | wc -c
     512

At this point, we can guess that the key is a list of distinct 256 chunks of DNA letters.

Now, the ciphertext is just a list of raw bytes. One option is that each byte maps to a certain DNA chunk. Since there are 256 chunks and 256 possible bytes, it can be true.

Moreover, in encrypted.bin we find a lot of duplicated bytes, which means that only printable characters are being encrypted:

$ xxd -p encrypted.bin | fold -sw 2 | wc -l
    2010

$ xxd -p encrypted.bin | fold -sw 2 | sort -u | wc -l  
      60

Testing decryption

Let’s take the first bytes from encrypted.bin (0xf3, 0xd3, 0x83; 243, 211, 131 in decimal format). These ones should match with:

$ fold -sw 4 key.txt | grep -n . | grep 244  
244:CCCA

$ fold -sw 4 key.txt | grep -n . | grep 212
212:CGGA

$ fold -sw 4 key.txt | grep -n . | grep 132
132:CGCC

Notice that we need to add 1 because grep -n starts from 1 but bytes start from 0x00.

According to the initial mapping (A: 00, C: 01, G: 10, T: 11), we have CCCA: 01010100, CGGA: 01101000 and CGCC: 01100101. And these values form the word The:

$ python3 -q
>>> chr(0b01010100) + chr(0b01101000) + chr(0b01100101)  
'The'

So, it seems that we found the way to decrypt the ciphertext.

Flag

Let’s automate the process with Python to get the flag:

#!/usr/bin/env python3

dna_mapping = {'A': '00', 'C': '01', 'G': '10', 'T': '11'}
chunks = []

with open('key.txt') as key, open('encrypted.bin', 'rb') as encrypted:  
    while (chunk := key.read(4)):
        chunks.append(chunk)

    while (byte := encrypted.read(1)):
        chunk = chunks[ord(byte)]
        binary = ''.join(map(dna_mapping.get, chunk))
        print(chr(int(binary, 2)), end='')

$ python3 solve.py
The Ebola virus causes an acute, serious illness which is often fatal if untreated. Ebola virus disease (EVD) first appeared in 1976 in 2 simultaneous outbreaks, one in what is now, Nzara, South Sudan, and the other in Yambuku, Democratic Republic of Congo. The latter occurred in a village near the Ebola River, from which the disease takes its name.

It is thought that fruit bats of the Pteropodidae family are natural Ebola virus hosts. Ebola is introduced into the human population through close contact with the blood, secretions, organs or other bodily fluids of infected animals such as chimpanzees, gorillas, fruit bats, monkeys, forest antelope and porcupines found ill or dead or in the rainforest.

Ebola then spreads through human-to-human transmission via direct contact (through broken skin or mucous membranes) with the blood, secretions, organs or other bodily fluids of infected people, and with surfaces and materials (e.g. bedding, clothing) contaminated with these fluids.Health-care workers have frequently been infected while treating patients with suspected or confirmed EVD. This has occurred through close contact with patients when infection control precautions are not strictly practiced.Burial ceremonies that involve direct contact with the body of the deceased can also contribute in the transmission of Ebola. People remain infectious as long as their blood contains the virus.  

The incubation period, that is, the time interval from infection with the virus to onset of symptoms is 2 to 21 days. Humans are not infectious until they develop symptoms. First symptoms are the sudden onset of fever fatigue, muscle pain, headache and sore throat. This is followed by vomiting, diarrhoea, rash, symptoms of impaired kidney and liver function, and in some cases, both internal and external bleeding (e.g. oozing from the gums, blood in the stools). Laboratory findings include low white blood cell and platelet counts and elevated liver enzymes.

HTB{W3_kN0w_hOw_to_c0nTr0l_Eb0l4}