Challenge: Someone sent you a message, that can only be read by finding out the password. There was also a hint alongside the message: What is Christmas about? Note: flag format is as always xmas{flag}

Attached file: christmas.app.zip

Oh no, another OSX app? Anyay, lets load it into ODA and look at it a bit. Not too long and an interesting text pops up.

I did search around a bit more, but this just felt right. I think we are back to “basic building blocks of modern cryptography”. What is Christmas all about? If you are a kid? Well Presents! and qs3t3out just happens to have the same amount of letters. It has to be a substitution cipher. Found this site to help me with figuring out the text, but after a few letters all just fell into place.

Substitution was “bcvuiqsto”->“abuthprsn”.

Flag: xmas{a11_ab0ut_Th3_pr3s3nts}

What did I learn: Good CTFs will leave clues.