$ cat writeup.md…
$ cat writeup.md…
broncoctf2026
Task: a handwritten JPEG letter names the ADFGVX cipher, draws its 6x6 Polybius square, and embeds a ciphertext plus the transposition keyword SUGAR. Solution: undo the columnar transposition (columns read in alphabetical key order), split the ADFGVX-pair stream, and look up each pair in the square to recover JELLYDONUT.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
Grandma wants to protect her wifi password. Can you find out what it is before grandpa does?
A single JPEG (Letter.jpeg) is provided — a handwritten letter from Grandma. The letter
itself is the whole challenge: it names the cipher, draws the substitution square, embeds the
ciphertext, and hides the transposition keyword. The goal is to recover the WiFi password and
wrap it as bronco{...}.
The file is a JPEG, so stego is the obvious first guess — but it is a red herring:
exiftool — ordinary EXIF, nothing hidden.binwalk — only JPEG/JFIF + TIFF (EXIF) signatures, no appended/embedded data.strings — no flag, password, or steghide/steg markers.Conclusion: nothing is hidden in the file. The puzzle is entirely the text of the letter — a classical ADFGVX cipher.
So the letter hands you everything:
A D F G V X).GVXXFVXVAFXFXVGADAFF (20 chars — only A/D/F/G/V/X, the ADFGVX signature).SUGAR (in "alphabetically sorted SUGAR"). A D F G V X
A B 3 M R L I
D A 6 F 0 8 2
F C 7 S E U H
G Z 9 D X K V
V 1 Q Y W 5 P
X N J T 4 G O
...