Workers are Exhausted

Challenge Description

You've gained limited access to a WHAMazon warehouse control node. The AI has flagged all on-site workers as nonessential inventory and locked emergency exits. While poking through a forgotten diagnostics service, you discover a blob of encoded data labeled legacy_override. Engineers clearly tried to hide it, but they didn't have time for anything sophisticated. If you can recover the original override phrase, you can inject it back into the system and force a shutdown sequence.

Flag: Raptor{x0r_4in7_G0nn4_Di3}

The Payload

81b2a3a7bca1a8abe3a18ce7babde48c94e3bdbde78c97bae0ae

The notes set expectations clearly: "tired engineers under pressure", "simple obfuscation, not enterprise-grade crypto". That means we're looking at one or two layers of something basic, not a composed cipher chain.

Step 1: Hex Decode

The payload is an unbroken string of hex characters. Into CyberChef:

From Hex →

²£§¼¡¨«ã¡Œçº½äŒ”㽽猗ºà®

Not plaintext, but it's clearly a byte sequence, hex encoding was just the outer wrapper. Something else is going on underneath.

Step 2: XOR Brute Force with a Crib

The challenge tells us the flag format is Raptor{...}. That's a known plaintext, a crib, which we can feed to a single-byte XOR brute force. If the data was XOR'd with a single repeated byte key, trying all 256 possible key values and checking which one produces output starting with Raptor{ will find it immediately.

Adding XOR Brute Force to the CyberChef chain with the crib Raptor{:

Key = d3: Raptor{x0r_4in7_G0nn4_Di3}

One step. One key byte. Flag.

Why This Works

XOR with a single-byte key is the simplest possible symmetric cipher, every byte of plaintext is XOR'd with the same value. Given any known substring of the plaintext (here, the flag prefix), you can recover the key by XOR-ing that known plaintext against the corresponding ciphertext bytes. If the result is consistent across all positions, you've found the key.

ciphertext[0] XOR 'd3' = 'R'  ✓
ciphertext[1] XOR 'd3' = 'a'  ✓
ciphertext[2] XOR 'd3' = 'p'  ✓
...

The flag format Raptor{ existing as a known crib made this a trivial known-plaintext attack, exactly the kind of weakness that comes from using XOR with a short key and a predictable output format.

Key Takeaways

Single-byte XOR is obfuscation not encryption, and barely that. Any known plaintext fragment (flag format, file headers, common strings) trivially recovers the key. Real symmetric encryption requires proper algorithms (AES), appropriate key lengths, and ideally authenticated encryption to prevent tampering.

For CTF purposes: hex blob that doesn't decode to readable text → try XOR brute force. If you know any part of the expected output, use it as a crib. CyberChef's XOR Brute Force operation handles this in seconds.