Sticky Note Security

Challenge Description

While digging through the remains of an employee workstation, you notice something strange. Sticky notes. Everywhere. They all repeat the same phrase: WHAmazonLocked!!. Apparently the engineer responsible for this system really didn't trust their own memory. They also didn't understand cryptography.

Flag: Raptor{WHAM4z0N_th3m_BOTS_n_D4_F4c3!}

The Ciphertext

e9eea3ca2d296e573f8edb5c1596d5b5541b5273a4182712b40de6630273cedff46a4d6591e71b765f0ebbdd93ac58c7

No metadata, no headers, no mode specified. Just raw hex bytes and a story about an engineer who plastered the same phrase on every surface they owned.

Reading the Room

The challenge isn't subtle. Every element of the briefing is pointing at the same thing:

• AES is explicitly called out
• WHAmazonLocked!! appears on the monitor, keyboard, coffee mug, and inside a server rack
• The notes describe someone who was "just making it work" and "didn't understand cryptography"
• The key is described as "human-readable"
• "This is symmetric crypto."

WHAmazonLocked!! is 16 characters, exactly one AES block. That's the key.

The remaining question is the IV. A rushed engineer who reused the same passphrase everywhere and didn't really understand what they were doing would almost certainly not have generated a random IV. The path of least resistance: reuse the key as the IV too. This also falls in line with the note that "this is symmetric crypto".

CyberChef

Recipe: 1. AES Decrypt - Key: WHAmazonLocked!! (Latin1) - IV: WHAmazonLocked!! (Latin1) - Mode: CBC

Output:

Raptor{WHAM4z0N_th3m_BOTS_n_D4_F4c3!}

Why Key = IV Is a Problem

In AES-CBC, the IV (Initialisation Vector) is XOR'd with the first plaintext block before encryption. Its purpose is to ensure that encrypting the same message twice with the same key produces different ciphertext, making the scheme non-deterministic. A random, unpredictable IV is essential to this guarantee.

When the IV is fixed and known, especially when it's identical to the key, an attacker can manipulate the first block of plaintext in predictable ways. More critically here: if the key is guessable from context (a sticky note phrase), and the IV is derived from the same source, both unknowns collapse into one. The "security" of the system reduces entirely to the secrecy of a phrase written on every surface in the room.

Key Takeaways

Always use a randomly generated IV for each encryption operation, stored or transmitted alongside the ciphertext. The IV doesn't need to be secret, it just needs to be unique and unpredictable. A hardcoded or key-derived IV is a significant flaw even when the key itself is strong. Here the key wasn't strong either, which made the whole thing a one-step CyberChef solve.

For CTF purposes: when a challenge gives you a story-heavy hint about a repeated phrase and calls out AES and symmetry, try that phrase as both the key and IV before anything else. Tired engineers take shortcuts.