Storytime| BlueHens CTF 2026
This is a misc challenge that revolves around interpreting hints and thinking through a sequence of transformations. At first glance, it may seem a bit confusing, but with a structured approach, it becomes much more manageable. The key is to stay patient and follow the logic behind each step.
The challenge came with two files: storytime.txt and ciphertext.txt, which were used throughout the analysis process.
After opening the first file, story.txt, I found the following text:
“Here’s the average day of the life of me, your average UD student! First thing I do is wake up in the morning and get ready the day ahead. I talk to my roommate and just randomly blurt out, “The position of my first plus one times the position of my second equals the position of my third!”. I sincerely apologized to him and explained that I got cursed a few years back. Next, I played a little bit of Minecraft with him, but we had to end a little early, and our base was just 4 chunks away! Next, I head over to the gym to get a quick workout in. Ever since I became UD’s mascot, I’ve been able to exorcise a lot more! It’s nice having lenience from my classes. I continue to work on a project that I’ve been working on for a little less than two weeks. It’s really been rotting my social battery. I started to walk back to my dorm when I saw these two people who I have some bad blood with. Let’s just say they stabbed me in the back before. When I got back to my dorm after a long day, I realized I’m still nowhere near finished with my project. At some points, it feels like I’m bashing my head into a wall. After everything is done, I take a shower, do my nightly routine and head to sleep. And that’s my day!”
After opening the second file, cipher.txt, I found an encrypted text that appeared to be the main ciphertext for the challenge. The content was not directly readable and clearly required further analysis and decoding.
4e5451315954517a4e5751315a6a55794e5749774d4455314e5451304d6a42694e5755314d6a55344e4745314e5455354e4459314e6a566d4d474531596a41774e5455314e4451774e544131596a55304e5467304e5455304d444d304d7a45304e5759314e6a566a4e4449314d54566d4e4449784e44566c4e574d3d
At the beginning, while reading the storytime file, I was able to extract several hints that helped guide the solution process and eventually led to decrypting the ciphertext.
Hint 1
“The position of my first plus one times the position of my second equals the position of my third! I sincerely apologized to him and explained that I got cursed a few years back.”
This hint indicates that the positions of certain parts of the ciphertext are important. It suggests a relationship between different positions within the encoded data, pointing to the use of a structured encoding method. The mention of being “cursed” is a subtle reference to hexadecimal format.
From this hint, we can deduce that Hex decoding is applied at specific positions in the cipher chain, namely positions 1, 2, and 6.
This is derived from the sentence:
“The position of my first plus one times the position of my second equals the position of my third”, which implies a relationship between specific indexed parts of the data. When combined with the mention of being “cursed,” it points toward hexadecimal formatting, confirming that these referenced positions correspond to Hex-encoded segments that need to be decoded.
Hint 2
“Next, I played a little bit of Minecraft with him, but we had to end a little early, and our base was just 4 chunks away!”
This hint refers to Minecraft mechanics, where one chunk equals 16×16 blocks. Therefore, 4 chunks correspond to 64 units. This directly points toward Base64 encoding.
From this, we can conclude that the second stage in the cipher chain requires Base64 decoding, as the value 4 chunks is a clear reference to the number 64 used in Base64 representation.
We notice that after applying Base64 decoding, the output was not yet in its final usable form. Instead, it still appeared as another layer of encoded data. This is why we applied Hex decoding once again to properly convert the result into readable bytes before moving to the next step in the decryption process.
Hint 3
“Ever since I became UD’s mascot, I’ve been able to exorcise a lot more!”
This hint is a wordplay on the term “exorcise”, which sounds like “XOR”, indicating that this step involves an XOR operation.
Get Z3DX’s stories in your inbox
Join Medium for free to get updates from this writer.
The reference to the university mascot is used to determine the key, which is “bluehens”.
When applying XOR, the operation is performed on the UTF-8 encoded data, meaning the text must first be interpreted as bytes in UTF-8 format rather than Hex. This is important because XOR operates at the byte level, not on hexadecimal strings directly.
Therefore, the correct process at this stage is:
- Convert data to UTF-8 bytes
- Apply XOR using the key bluehens
Hint 4
“I continue to work on a project that I’ve been working on for a little less than two weeks. It’s really been rotting my social battery.”
This hint refers to the word “rotting”, which suggests the use of ROT cipher. The mention of “a little less than two weeks” points to the number 13 (since two weeks is 14 days), which directly indicates ROT13.
From this, we deduce that this step requires applying ROT13 decoding to the data.
However, we notice again that after applying the XOR operation, the resulting output is still not directly readable. Instead, it appears as another layer of encoded data.
This indicates that the data was not fully decoded yet, and an additional Hex decoding step is required to properly convert the XOR output into a readable format before continuing with the next stage of the chain.
Hint 5
“I started to walk back to my dorm when I saw these two people who I have some bad blood with. Let’s just say they stabbed me in the back before.”
This hint refers to the historical event of Julius Caesar being betrayed and stabbed, which is associated with Caesar ciphers. The mention of “two people” also suggests a structural shift in the encoding process.
From this, we deduce that this step uses a Caesar Box Cipher with a shift of 2 to rearrange the characters and reveal the hidden message.
Hint 6
“At some points, it feels like I’m bashing my head into a wall.”
This hint directly refers to the idea of reflection or inversion. The phrase “bashing my head into a wall” suggests a mirrored or reversed transformation, which is a clear reference to the Atbash cipher.
Atbash is a substitution cipher where each letter is mapped to its opposite in the alphabet (A ↔ Z, B ↔ Y, etc.). This means the entire message is transformed by flipping the alphabet, effectively reversing the character mapping.
From this hint, we conclude that the final step of the decryption process is applying the Atbash cipher to obtain the final readable output.
So The Flag Is : udctf{c1ph3rs_ar3_Fun!}
See you in the next hack 🔐🚀
