The secret of a Queen - HackTheBox Challenge Writeup

Challenge Information

Description

In this challenge, we’re given an image file containing encrypted symbols and tasked with decrypting it to reveal the Queen’s secret. The challenge requires identifying the cipher method, extracting visual symbols from the image, and matching them against a known alphabet to decode the message.

Solution Overview

The solution involved three main phases:

1. Identifying the cipher: Recognizing that the symbols correspond to Mary, Queen of Scots’ cipher alphabet
2. Extracting symbols: Parsing the image to isolate individual encrypted characters
3. Decryption: Matching extracted symbols against a reference alphabet to decode the plaintext

Key Steps

Step 1: Challenge Analysis and File Extraction

# Locate and examine the challenge files
find <workdir> -maxdepth 3

# Extract the challenge archive
cd <workdir>
mkdir -p work
unzip -o archive.zip -d work/

# Examine the main image file
file "The secret of a Queen.png"

Step 2: Identifying the Cipher Type

Through research and cross-referencing, we determined the cipher was the Mary Stuart (Mary, Queen of Scots) cipher, also known as the Mary Queen of Scots alphabet. This historical cipher was used during the Babington Plot conspiracy.

# Research the cipher using web resources
# Mary Stuart cipher alphabet reference from dcode.fr and historical sources
curl -sL -A "Mozilla/5.0" "https://www.dcode.fr/mary-stuart-cipher" -o dcode_mary.html

Step 3: Image Processing and Symbol Extraction

We cropped the image to isolate the top section containing the encrypted symbols:

from PIL import Image

# Load and convert the challenge image to grayscale
im = Image.open('The secret of a Queen.png').convert('L')
w, h = im.size

# Crop the top portion containing the cipher text
top = im.crop((0, 0, w, 100))  # Adjust coordinates based on actual image
top.save('work/top.png')

# Further segment the image into individual character regions
# Example segments extracted from analysis
segs = [(72, 208), (208, 288), (292, 354), ...]  # Bounding boxes for each symbol

Step 4: Building the Reference Alphabet

We obtained the Mary Stuart cipher alphabet from dcode.fr and extracted individual character images:

from PIL import Image

# Download the reference alphabet
import urllib.request
urllib.request.urlretrieve(
    "https://www.dcode.fr/tools/mary-stuart/images/alphabet.png",
    "/tmp/dcode_alphabet.png"
)

# Crop and separate individual alphabet characters
im = Image.open('dcode_alphabet.png').convert('RGB')
w, h = im.size

# Extract each letter's symbol representation
row1 = im.crop((0, 0, w, h//2))  # Adjust based on alphabet layout

Step 5: Symbol Matching and Decryption

We compared each extracted symbol from the challenge image against the reference alphabet using binary image matching:

import numpy as np
from PIL import Image

def load_bbox_bin(path, is_dcode=False):
    """Load and binarize an image region"""
    im = Image.open(path).convert('L')
    arr = np.array(im)
    # Binarize with threshold
    binary = (arr > 128).astype(np.uint8)
    return binary

def match_symbol(extracted_symbol, alphabet_dict):
    """Find best matching letter from reference alphabet"""
    best_match = None
    best_score = -1

    for letter, ref_binary in alphabet_dict.items():
        # Calculate similarity using binary correlation
        similarity = np.sum(extracted_symbol == ref_binary)
        if similarity > best_score:
            best_score = similarity
            best_match = letter

    return best_match

# Extract symbols from challenge image
challenge_symbols = []
for bbox in segment_boxes:
    symbol_binary = load_bbox_bin(f'work/ttop_{idx:02d}.png')
    challenge_symbols.append(symbol_binary)

# Match each symbol and build decrypted message
decrypted_message = []
for symbol in challenge_symbols:
    letter = match_symbol(symbol, reference_alphabet)
    decrypted_message.append(letter)

flag = ''.join(decrypted_message)

Step 6: Flag Retrieval

The decrypted message revealed the flag:

HTB{REDACTED}

The flag was saved to the evidence directory upon successful decryption.

Tools Used

Key Learnings

1. Historical Cipher Recognition: The Mary Stuart cipher is a lesser-known historical cipher with distinct visual symbols. Identifying the cipher type is crucial before attempting decryption.

2. Image Processing Techniques: Extracting individual symbols from a composite image requires careful bounding box identification and binary conversion for reliable matching.

3. Template Matching: When dealing with symbol-based ciphers, creating a reference alphabet and using binary correlation for matching is more reliable than attempting character recognition.

4. Research-Driven Approach: Leveraging OSINT tools and web resources to identify cipher types significantly accelerates the challenge-solving process.

5. Binarization for Comparison: Converting grayscale images to binary (black/white) before comparison improves matching accuracy by removing noise and lighting variations.

Conclusion

“The secret of a Queen” challenges solvers to recognize historical ciphers, extract visual data from images, and apply image processing techniques for cryptanalysis. The key to success was identifying the Mary Stuart cipher alphabet and systematically matching extracted symbols against the reference to decrypt the message. This demonstrates the intersection of cryptography, computer vision, and historical knowledge in modern cybersecurity challenges.