DTMF - Writeup

Step 1 — Extract DTMF Tones

DTMF tones correspond to digits pressed on a phone keypad.
We can decode them using multimon-ng.

Command

multimon-ng -t wav -a DTMF message.wav

Output

This produced a sequence of digits representing keypad presses, which corresponded to binary values.

---

Step 2 — Convert Binary → Text

The extracted digits formed a binary string.

Using CyberChef:

1. Input the binary string

2. Apply From Binary

3. Result → Base64 string

---

Step 3 — Decode Base64

Applying From Base64 in CyberChef revealed the ciphertext:

0rmgj{Tu1m1_b4h_isc5_vntr}

This clearly resembles a flag but does not match the expected format.

Known flag format:

0xfun{...}

So the string is encrypted.

---

Step 4 — Inspect File Metadata

Always check metadata in forensic challenges.

Command

exiftool message.wav

Important Output

Comment : uhmwhatisthis

This unusual string is likely a cryptographic key.

---

Step 5 — Identify Cipher

Compare ciphertext prefix with expected flag prefix:

Cipher: 0 r m g j { Target: 0 x f u n {

Observations:

• Numbers and symbols unchanged

• Letters substituted

• Not a fixed shift → Not Caesar

• Likely polyalphabetic substitution → Vigenère Cipher

The metadata comment is a perfect candidate for the key:

Key: uhmwhatisthis

---

Step 6 — Decrypt Using Vigenère

Non-alphabet characters are ignored during decryption.

Python Solver

def solve_vigenere(ciphertext, key):
    key = key.lower()
    plaintext = []
    key_index = 0

    for char in ciphertext:
        if char.isalpha():
            # Determine shift based on key character
            shift = ord(key[key_index % len(key)]) - ord('a')
            
            # Handle uppercase
            if char.isupper():
                base = ord('A')
                decrypted_char = chr((ord(char) - base - shift) % 26 + base)
            # Handle lowercase
            else:
                base = ord('a')
                decrypted_char = chr((ord(char) - base - shift) % 26 + base)
            
            plaintext.append(decrypted_char)
            key_index += 1
        else:
            # Non-alpha characters (0, 1, 4, 5, {, }, _) are passed through
            plaintext.append(char)

    return "".join(plaintext)

cipher = "0rmgj{Tu1m1_b4h_isc5_vntr}"
key_phrase = "uhmwhatisthis"

print(f"Flag: {solve_vigenere(cipher, key_phrase)}")

---

Step 7 — Final Result

Decrypted text:

0xfun{Mu1t1_t4p_plu5_dtmf}

---

Final Flag

0xfun{Mu1t1_t4p_plu5_dtmf}

---