Rating: 5.0

# Flag delivery

![Forensics](https://img.shields.io/badge/Forensics--8700ff?style=for-the-badge) ![Points - 225](https://img.shields.io/badge/Points-225-9cf?style=for-the-badge)

```txt
Our good friend Yeltsa Kcir ordered a flag for us from the renowned flag delivery service. We got their letter today, but we can’t see the flag they sent us. Apparently Yeltsa has been talking with the scientist Odec Esrom. Can you find the flag he hid for us?

- stephencurry396#4738
```

```txt
D ?M6?M6?M6?M6 ?M6D D?M6 D?M6D
D?M6DD DDD ?M6?M6D
?M6?M6D?M6 DDD ?M6D?M6
DDD ?M6D?M6 D?M6?M6 ?M6 ?M6D?M6 ?M6?M6 D?M6 DD?M6
D?M6DD ?M6 ?M6D?M6?M6 D ?M6?M6?M6 ?M6D
D?M6D D?M6D?M6 ?M6?M6 ?M6D?M6 ?M6DDDD?M6 ?M6?M6?M6
?M6?M6D?M6 ?M6D?M6?M6 ?M6D DD?M6
D?M6?M6 ?M6 ?M6D?M6?M6 ?M6?M6 ?M6?M6?M6D ?M6 ?M6D?M6 D?M6DD D?M6D?M6DD
D?M6DD DDD ?M6?M6D ?M6D?M6
?M6?M6D?M6 ?M6D?M6?M6 ?M6D DD?M6
?M6?M6 ?M6?M6?M6
D?M6D?M6 D?M6DD D?M6D?M6 D ?M6?M6D?M6 ?M6D?M6 ?M6?M6?M6DD ?M6DD?M6D?M6 D?M6?M6 ?M6?M6DD?M6D D?M6?M6?M6 ?M6?M6?M6DD D ?M6DD ?M6?M6?M6DD ?M6?M6?M6DD D?M6 ?M6?M6DD?M6D D ?M6?M6?M6?M6 ?M6?M6?M6DD ?M6?M6DD?M6D ?M6D?M6?M6 ?M6DDDD D?M6 ?M6?M6?M6DD ?M6?M6?M6 ?M6D?M6D?M6D
?M6DD ?M6
?M6?M6?M6?M6 DDD ?M6DD?M6 ?M6
D?M6DD DDD ?M6?M6D
?M6D?M6?M6 ?M6?M6 D?M6D ?M6
DDD ?M6?M6D ?M6D?M6
?M6?M6?M6 ?M6 ?M6D?M6 ?M6?M6?M6D ?M6?M6 D?M6D?M6 ?M6
?M6D D?M6 D?M6?M6
D ?M6D?M6 D?M6DD
?M6D DD?M6 ?M6D ?M6?M6 D?M6 ?M6D?M6D?M6D
```

---

`Yeltsa Kcir` is spelling names backwards. It means `rick astley`

So `Odec Esrom` would spell `Morse Cedo` => Morse Code?

After some trial and error, we found out, that `D` is long and `?M6` is short. We wrote a little Python Script [solve.py](./solve.py)

Pasting the output into CyberChef:

```
THANK YOU FOR ORDERING YELTSA KCIR'S FLAG DELIVERY! YOUR FLAG IS
CYCTFR3@D_B3TW33N_TH3_L1N3S. WE HOPE YOU LIKE OUR SERVICE AND TRY AGAIN.
```

`CYCTF{R3@D_B3TW33N_TH3_L1N3S}`

Original writeup (https://github.com/B34nB01z/writeups/blob/master/2020/CYCTF/Flag%20delivery/README.md).