DEV Community

wireless90
wireless90

Posted on

IvyFinal CTF (Crypto 2) - HeadCracker 300 - points

#security #cybersecurity

The file can be downloaded here.

HeadCracker - 300 points

The best tool to crack this custom cipher with is your head. Just don't literally crack your head.

Let's Begin

Let's first see what type of file we are dealing wih

┌──(razali㉿razali)-[~/Documents/Ivy/Finals/crypto]
└─$ file flag.enc          
flag.enc: data

It seems like a gibberish file.                                                                                                                                                                                                                                             
┌──(razali㉿razali)-[~/Documents/Ivy/Finals/crypto]
└─$ cat flag.enc           
���>����`

AJW:�AW��J�`����

>ϩ��                                                                                                                                                                                                                                             
┌──(razali㉿razali)-[~/Documents/Ivy/Finals/crypto]
└─$ xxd flag.enc 
00000000: cfe4 4108 c73e 8bcf 06ea 9c60 0a0a 4106  ..A..>.....`..A.
00000010: 4a57 3a9c 0641 579a ea06 4a9c 6086 06cf  JW:..AW...J.`...
00000020: 1606 16c7 cf0a 0a06 3ecf a99c d7         ........>....
Enter fullscreen mode Exit fullscreen mode

Since the question wants us to manually crack the file, i'm pretty sure its either rot based cipher or perhaps
a substitution cipher.

I know that the flag has the format of ivyctf{...}.

Lets look at the hex position of {, it has a value of 8b.
The position of } has the value of d7. Thus its definitely not a rot based cipher as i expected them to be 1 byte apart but 8b and d7 are too far apart.

So I did a script to guess the flag using substitution cipher.

Firstly, to open the file


file = open('flag.enc', 'rb').read()
Enter fullscreen mode Exit fullscreen mode

Next I converted it to hex.


bytes_list = []
for byte in file:
    value = ord(byte)
    hex_value = hex(value)[2:]
    hex_value = hex_value if len(hex_value) == 2 else '0'+hex_value
    bytes_list.append(hex_value)
Enter fullscreen mode Exit fullscreen mode

I also wanted to know the number of occurances of each hex value, just to get an overall
understanding of which character appears the most.

occurances = {}

for byte in bytes_list:
    if byte in occurances:
        occurances[byte] = occurances[byte] + 1
    else:
        occurances[byte] = 1


import pprint

pprint.pprint(occurances)
Enter fullscreen mode Exit fullscreen mode

Finally, I created a loop to allow me to replace hex values to thier guessed letter.

while True:
    print("The flag is now ")
    print(''.join(bytes_list))
    byte = raw_input("Which byte do you want to replace: ")
    replacement = raw_input("What is the replacement character? [a-z_{}]: ")
    bytes_list = [b if b != byte else replacement for b in bytes_list]
Enter fullscreen mode Exit fullscreen mode

Let's run the script. It first displays the occurances.

┌──(razali㉿razali)-[~/…/Ivy/Finals/crypto/headcracker]
└─$ python cracker.py
{'06': 7,
 '08': 1,
 '0a': 4,
 '16': 2,
 '3a': 1,
 '3e': 2,
 '41': 3,
 '4a': 2,
 '57': 2,
 '60': 2,
 '86': 1,
 '8b': 1,
 '9a': 1,
 '9c': 4,
 'a9': 1,
 'c7': 2,
 'cf': 5,
 'd7': 1,
 'e4': 1,
 'ea': 2}
Enter fullscreen mode Exit fullscreen mode

Since the flag starts with ivyctf{...}, the ... could be [a-z] and underscore.
Thus i predicted the highest occurance to be an underscore.

The flag is now 
cfe44108c73e8bcf06ea9c600a0a41064a573a9c0641579aea064a9c608606cf160616c7cf0a0a063ecfa99cd7
Which byte do you want to replace: 06
What is the replacement character? [a-z_{}]: _
The flag is now 
cfe44108c73e8bcf_ea9c600a0a41_4a573a9c_41579aea_4a9c6086_cf16_16c7cf0a0a_3ecfa99cd7
Enter fullscreen mode Exit fullscreen mode

Then i proceeded to fill in ivyctf{}.

Which byte do you want to replace: cf
What is the replacement character? [a-z_{}]: i
The flag is now 
ie44108c73e8bi_ea9c600a0a41_4a573a9c_41579aea_4a9c6086_i16_16c7i0a0a_3eia99cd7
Which byte do you want to replace: e4
What is the replacement character? [a-z_{}]: v
The flag is now 
iv4108c73e8bi_ea9c600a0a41_4a573a9c_41579aea_4a9c6086_i16_16c7i0a0a_3eia99cd7
Which byte do you want to replace: 41
What is the replacement character? [a-z_{}]: y
The flag is now 
ivy08c73e8bi_ea9c600a0ay_4a573a9c_y579aea_4a9c6086_i16_16c7i0a0a_3eia99cd7
Which byte do you want to replace: 08
What is the replacement character? [a-z_{}]: c
The flag is now 
ivycc73e8bi_ea9c600a0ay_4a573a9c_y579aea_4a9c6086_i16_16c7i0a0a_3eia99cd7
Which byte do you want to replace: c7
What is the replacement character? [a-z_{}]: t
The flag is now 
ivyct3e8bi_ea9c600a0ay_4a573a9c_y579aea_4a9c6086_i16_16ti0a0a_3eia99cd7
Which byte do you want to replace: 3e
What is the replacement character? [a-z_{}]: f
The flag is now 
ivyctf8bi_ea9c600a0ay_4a573a9c_y579aea_4a9c6086_i16_16ti0a0a_fia99cd7
Which byte do you want to replace: 8b
What is the replacement character? [a-z_{}]: {
The flag is now 
ivyctf{i_ea9c600a0ay_4a573a9c_y579aea_4a9c6086_i16_16ti0a0a_fia99cd7
Which byte do you want to replace: d7
What is the replacement character? [a-z_{}]: }
The flag is now 
ivyctf{i_ea9c600a0ay_4a573a9c_y579aea_4a9c6086_i16_16ti0a0a_fia99c}
Enter fullscreen mode Exit fullscreen mode

Notice the i16, since its only 2 letters, it should either be is or it.
Let's try is.

Which byte do you want to replace: 16
What is the replacement character? [a-z_{}]: s
The flag is now 
ivyctf{i_ea9c600a0ay_4a573a9c_y579aea_4a9c6086_is_sti0a0a_fia99c}
Enter fullscreen mode Exit fullscreen mode

Notice sti0a0a, its a 4 letter word sti** where the last 2 character are the same. I guessed it as still.

Which byte do you want to replace: 0a
What is the replacement character? [a-z_{}]: l
The flag is now 
ivyctf{i_ea9c60lly_4a573a9c_y579aea_4a9c6086_is_still_fia99c}
Enter fullscreen mode Exit fullscreen mode

Next i noticed the 4 letter word which starts with y, y579aea. I guessed it as your.

Which byte do you want to replace: 57
What is the replacement character? [a-z_{}]: o
The flag is now 
ivyctf{i_ea9c60lly_4ao3a9c_yo9aea_4a9c6086_is_still_fia99c}
Which byte do you want to replace: 9a
What is the replacement character? [a-z_{}]: u
The flag is now 
ivyctf{i_ea9c60lly_4ao3a9c_youea_4a9c6086_is_still_fia99c}
Which byte do you want to replace: ea
What is the replacement character? [a-z_{}]: r
The flag is now 
ivyctf{i_r9c60lly_4ao3a9c_your_4a9c6086_is_still_fia99c}
Enter fullscreen mode Exit fullscreen mode

Next I noticed the 6 letter word, r9c60lly, which looks like really.

Which byte do you want to replace: 9c
What is the replacement character? [a-z_{}]: e
The flag is now 
ivyctf{i_re60lly_4ao3ae_your_4ae6086_is_still_fia9e}
Which byte do you want to replace: 60
What is the replacement character? [a-z_{}]: a
The flag is now 
ivyctf{i_really_4ao3ae_your_4aea86_is_still_fia9e}
Enter fullscreen mode Exit fullscreen mode

Next I noticed 4aea86. *ea*. Since the title of the excercise is HeadCracker, i guessed it as head.

Which byte do you want to replace: 4a
What is the replacement character? [a-z_{}]: h
The flag is now 
ivyctf{i_really_ho3ae_your_hea86_is_still_fia9e}
Which byte do you want to replace: 86
What is the replacement character? [a-z_{}]: d
The flag is now 
ivyctf{i_really_ho3ae_your_head_is_still_fia9e}
Enter fullscreen mode Exit fullscreen mode


.

With that the rest of it is pretty much self explanatory.

Which byte do you want to replace: 3a
What is the replacement character? [a-z_{}]: p
The flag is now 
ivyctf{i_really_hope_your_head_is_still_fia9e}
Which byte do you want to replace: a9
What is the replacement character? [a-z_{}]: n
The flag is now 
ivyctf{i_really_hope_your_head_is_still_fine}
Enter fullscreen mode Exit fullscreen mode

This was fun to solve!

Top comments (0)

Read next

ad1s0n profile image

Reverse engineering TP-Link Tapo's REST API - part 1

ad1s0n -

cicubeteam profile image

Top 11 CI/CD Tools for 2024

CiCube -

aldoportillo profile image

Fetch External APIs in Next.js

Aldo Portillo -

carrie_luo1 profile image

The Beginner's Guide to Install and Deploy SafeLine WAF

Carrie -