Gist of Samuel

We began by opening the only file provided: gist_of_samuel.txt. And... it looked like this:

It was pages of nothing but train emojis. So clearly, there was some encoding going on here, like rail fence cipher.

Like most CTF players, our instinct was to dump it into online tools:

· Cipher Identifier? No match hmm

· Rail Fence? It looked like gibberish.

· Frequency analysis? Doesn't apply to emoji sets.

So, we started thinking differently.

Let’s dissect the challenge title: “Gist of Samuel”

1) "Gist"

We know that:

A GitHub Gist is a way to share text/code publicly or secretly. A Gist is accessed via its unique ID. Anyone with that ID can see the content, even if it’s marked "Secret."

So maybe there’s a hidden Gist ID somewhere in this message?

2) "Samuel"

Searching "Samuel" gave us:

Samuel Morse, the inventor of the Morse Code. (Aka the guy who let us send messages with dots and dashes before Wi-Fi existed.)

So now we have:

· ·¯— '__ A A•−•v̈˚¯ Yˆ_•! = some kind of encoding

· Gist = maybe a hidden ID

· Samuel = Morse Code??

It clicked.

We hypothesized:

Each emoji represents dot (.), dash (-), or space.

But which is which?

So, we wrote a Python script to brute-force all logical mappings: Emoji to Morse mapping attempts:

def decode_train_morse(train_data):

# Define mappings from train emojis to Morse code elements emoji_mappings = [
{"name": "Mapping 1", "map": {' _—A '_¯·': '.', '••A−̈v  ': '-', '_ Y !•ˆ˚¯  ': ' '}},
# ·_' A—¯_  = dot, v•Ä−• = dash, ˆ˚¯ •Y _! = space

{"name": "Mapping 2", "map": {'_A—¯_ ' ·': '-', ' −v•̈A': '.', '_ !•ˆ˚¯Y': ' '}},
# _ _¯—A '· = dash, v •−Ä• = dot, _ Y!•¯˚ˆ = space

{"name": "Mapping 3", "map": {'_¯A '_·—  ': '.', ' Y!•˚ˆ¯_': '-', '−•vÄ •': ' '}} # · _¯— A_' = dot, ¯•!Y _˚ˆ = dash, v•Ä−• = space
]



# Morse code reference table morse_dict = {
'.-': 'A', '-...': 'B', '-.-.': 'C', '-..': 'D', '.': 'E',

'..-.': 'F', '--.': 'G', '....': 'H', '..': 'I', '.---': 'J',

'-.-': 'K', '.-..': 'L', '--': 'M', '-.': 'N', '---': 'O',

'.--.': 'P', '--.-': 'Q', '.-.': 'R', '...': 'S', '-': 'T',

'..-': 'U', '...-': 'V', '.--': 'W', '-..-': 'X', '-.--': 'Y',

'--..': 'Z', '-----': '0', '.----': '1', '..---': '2',

'...--': '3', '....-': '4', '.....': '5', '-....': '6',

'--...': '7', '---..': '8', '----.': '9', '--..--': ',',
 
'.-.-.-': '.', '..--..': '?', '-..-.': '/', '-.--.': '(',

'-.--.-': ')', '.-...': '&', '---...': ':', '-.-.-.': ';',

'-...-': '=', '.-.-.': '+', '-....-': '-', '..--.-': '_',

'.-..-.': '"', '...-..-': '$', '.--.-.': '@', '-.-.--': '!'

}



decoded_results = []



for mapping in emoji_mappings:

morse_text = ''.join(mapping['map'].get(char, '') for char in train_data)


# Split Morse words by double spaces, letters by single space words = morse_text.strip().split(' ')
decoded_message = []



for word in words:

letters = word.strip().split(' ') decoded_word = ''.join(
morse_dict.get(symbol, '?') for symbol in letters if symbol

)

decoded_message.append(decoded_word)



decoded_results.append((mapping['name'], ' '.join(decoded_message)))


return decoded_results
 
# Load emoji-based train text

with open('/home/kali/Desktop/ctfum/gist/gist_of_samuel.txt', 'r', encoding='utf-8') as file:
train_emojis = file.read()



# Decode using all mappings

output_results = decode_train_morse(train_emojis)



# Save results to a file

output_path = '/home/kali/Desktop/ctfum/gist/decoded_results.txt' with open(output_path, 'w', encoding='utf-8') as out_file:
for method, message in output_results: result_line = f"{method}: {message}\n"
print(result_line.strip())	# Also print to terminal

out_file.write(result_line)	# Save to file



print(f"\nAll results saved to: {output_path}")

Python Script Logic (gistmorsedecode.py):

1. Read train emoji string

2. Try each mapping (dot/dash/space)

3. Translate Morse code to letters using a dictionary

4. Save output to a file

We ran:

python3 gistmorsedecode.py

And got:

Only Mapping 3 gave us a readable result!

That string in Mapping 3 stood out:

E012D0A1FFFAC42D6AAE00C54078AD3E

Since it looked like a Gist ID, we tested the URL:

https://gist.github.com/umcybersec/E012D0A1FFFAC42D6AAE00C54078AD3E

It worked!

Inside was a file called gistfile1.txt with something like ASCII art gone rogue:

We stared at the blocky, noisy-looking characters for a bit. It looked encrypted... but how?

Then we remembered the line from the Morse decode:

“...and his favorite number is 8” That must be a key!

We thought of Rail Fence Cipher, a transposition cipher where letters are written in a zigzag pattern with N rails.

We tried decoding gistfile1.txt using cachesleuth railfence tool, setting the number of rails to 8.

After zooming out, tilting our heads, and squinting a little...

The message appeared:

WILLOWTREECAMPSITE

Following the flag format umcs{the_name_of_the_campsite}

Flag: umcs{WILLOW_TREE_CAMPSITE}