0x00SEC CTF - Exercise #7

This weekend I took a dive into 0x00Sec's new bi-monthly CTF.

Note::: NO, I won't be posting the found flag{}, but I will be posting the methods I used.

• CTF Name: Exercise #7
• Resource: 0x00SEC
• Difficulty: Easyish
• Number of Flags: 1

Flag1

• Hint:

  1. "Decode and decrypt the ciphertext using XOR to get the flag!"

• Acquired By:
  This challenge is a Cypher challenge and the phrase to decode and decrypt is "CQQSAhheX1RQTjdYAUgtX19eH1M9FQ=="

  • Step 1: It appears that it is Base64 encoding but that produced nothing that appears to be useful. So, because of the way that XOR works, we need two input to produce an output. Thus, this xor needs a key and we are not given a key or a hint about so this will need to be brute forced.
  • Step 2: To brute force this I need to build a script to decode the ciphertext and then xor "flag{" to try and match it up with the decoded ciphertext. To do this I will use pwnlib tools. First I will base64 decode the ciphertext by b64edCiphertext = b64d("CQQSAhheX1RQTjdYAUgtX19eH1M9FQ=="). This originally gave me an output with a lot of characters that could not be represented but by using the pwnlib tools it now produced "\t\x04\x12\x02\x18^TPN7X\x01H-_^\x1fS=\x15". If we look at these they appear to be hex values for ascii characters, but these ones produce blank spaces if we represent them as text... Ok, let's continue assuming that this will lead somewhere.
  • Step 3: Now that we have the ciphertext decoded and represented we need the key. This is the tricky part. We know that this output will begin with "flag{" so we can use that to represent the first part of the flag. Now, because we know the final output and we know the beginning 5 characters of the string we can xor them together to get the key with xor(b64edCiphertext, cipher_front)[:len(cipher_front)]. This will xor together the base64ed Ciphertext with the front of the cipher, "flag{" and will do this based on the length of the front of the ciphertext. This produces a string of the key.
  • Step 4: Now that we have the key re can reconfigure the xor function to xor together the ciphertext and the key to produce the flag with "xor(b64edCiphertext, candidate_key)"

Note:
The only reason that we can brute force this is because the key is small and because we know part of the expected decrypted text.

Learned

Because I was not confident with XOR I spent a day learning about XORand how it breaks down each character to the bit level and then compares two inputs to get an output. And then a day figuring out the script.
So for example: the string "Wiki" in 8-bit ASCII is 01010111 01101001 01101011 01101001. It can be encrypted with the repeating key 11110011 as:
As you can see in the output, for each 11 the output is 0 and for each 10 the output is 1. This creates a new representation of the input. If a key is used then that is xored on top of the output and a new output has been made.

Happy Hacking

Resources

1. https://ctf.0x00sec.org/
2. https://en.wikipedia.org/wiki/XOR_cipher

Please Note that I am still learning. If something that I have stated is incorrect please let me know. I would love to learn more about what I may not understand fully.