\n\nThis page has been machine-translated from the original page.
\n
I participated in TJCTF 2023, which started on 5/26, as part of 0nePadding.
\nWe placed 71st out of 1,047 teams.
\nThis time I got the chance to solve a Crypto challenge for the first time in a while, and it reminded me that I need to keep working on categories I’m weak at too.
\nAs usual, I’ll write up the challenges that taught me something.
\n\n\n\noops, i think my siblings messed with the line order a little. The first three lines are given
\n
The challenge provided the following Python script.
\nRunning this code should recover the flag, but unfortunately every line after the third has been randomly shuffled, so it can no longer be executed correctly.
\n#first 3 lines are given\nimport random\nseed = 1000\nrandom.seed(seed)\n\n#unscramble the rest\ndef recur(lst):\nl2[i] = (l[i]*5+(l2[i]+n)*l[i])%l[i]\nl2[i] += inp[i]\nflag = \"\"\nflag+=chr((l4[i]^l3[i]))\nreturn flag\nl.append(random.randint(6, 420))\nl3[0] = l2[0]%mod\nfor i in range(1, n):\ndef decrypt(inp):\nfor i in range(n):\nassert(len(l)==n)\nreturn lst[0]\nl = []\nmain()\ndef main():\nl4 = [70, 123, 100, 53, 123, 58, 105, 109, 2, 108, 116, 21, 67, 69, 238, 47, 102, 110, 114, 84, 83, 68, 113, 72, 112, 54, 121, 104, 103, 41, 124]\nl3[i] = (l2[i]^((l[i]&l3[i-1]+(l3[i-1]*l[i])%mod)//2))%mod\nif(len(lst)==1):\nassert(lst[0]>0)\nfor i in range(1, n):\nfor i in range(n):\nreturn recur(lst[::2])/recur(lst[1::2])\nprint(\"flag is:\", decrypt(inp))\nl2[0] +=int(recur(l2[1:])*50)\nl2 = [0]*n\nflag_length = 31\nmod = 256\nprint(l2)\nn = len(inp)\ninp = [1]*flag_length\nl3 =[0]*nFirst, I inferred the scope of each line from its variable names and organized them into the code for each function.
\nI then rearranged the lines within each function so that the logic behaved as intended.
\nThe final code looked like this, and running it recovered the flag.
\nimport random\nseed = 1000\nrandom.seed(seed)\n\ndef recur(lst):\n if(len(lst)==1):\n assert(lst[0]>0)\n return lst[0]\n return recur(lst[::2])/recur(lst[1::2])\n\ndef decrypt(inp):\n mod = 256\n n = len(inp)\n l = []\n\n for i in range(n):\n l.append(random.randint(6, 420))\n assert(len(l)==n)\n\n l2 = [0]*n\n l3 =[0]*n\n l4 = [70, 123, 100, 53, 123, 58, 105, 109, 2, 108, 116, 21, 67, 69, 238, 47, 102, 110, 114, 84, 83, 68, 113, 72, 112, 54, 121, 104, 103, 41, 124]\n\n for i in range(1, n):\n l2[i] = (l[i]*5+(l2[i]+n)*l[i])%l[i]\n l2[i] += inp[i]\n\n print(l2)\n \n l2[0] += int(recur(l2[1:])*50)\n l3[0] = l2[0]%mod\n\n for i in range(1, n):\n l3[i] = (l2[i]^((l[i]&l3[i-1]+(l3[i-1]*l[i])%mod)//2))%mod\n\n flag = \"\"\n for i in range(n):\n flag+=chr((l4[i]^l3[i]))\n\n return flag\n \ndef main():\n flag_length = 31\n inp = [1]*flag_length\n print(\"flag is:\", decrypt(inp))\n\nmain()\n\nMy cow keeps eating all my flags…
\n
When I ran the provided ELF and entered an arbitrary string, it printed the result of some transformation as shown below.
\nI located the relevant transformation in Ghidra’s decompilation and cleaned it up, which showed that it was implemented as follows.
\nif ((input[i] < 'a') || ('z' < input[i])) {\n if ((input[i] < 'A') || ('Z' < input[i])) {\n if ((input[i] < '0') || ('4' < input[i])) {\n if ((input[i] < '5') || ('9' < input[i])) {\n if ((input[i] != '{') && (input[i] != '}')) {\n puts(\"wtmoo is this guess???\");\n printf(\"%c\\n\",(ulong)(uint)(int)input[i]);\n uVar3 = 1;\n goto LAB_00401427;\n }\n }\n else {\n input[i] = input[i] + -0x15;\n }\n }\n else {\n input[i] = input[i] + '+';\n }\n }\n else {\n input[i] = input[i] + ' ';\n }\n}\nelse {\n input[i] = input[i] + -0x3c;\n}\ni = i + 1;\n} while( true );I also found that if the transformed input ultimately matches \"8.\\'8*{;8m33[o[3[3[%\\\")#*\\\\}\", the program prints the correct flag.
This transformation is applied to the input one character at a time, and there is no swapping between characters, so I could brute-force from the beginning with the following solver script to recover every character of the flag.
\nans = \"8.\\'8*{;8m33[o[3[3[%\\\")#*\\\\}\"\n\nfor i in range(len(ans)):\n for c in range(256):\n if (c < ord(\"a\")) or (ord(\"z\") < c):\n if (c < ord(\"A\")) or (ord(\"Z\") < c):\n if (c < ord(\"0\")) or (ord(\"4\") < c):\n if (c < ord(\"5\")) or (ord(\"9\") < c):\n if chr(c) == \"{\" or chr(c) == \"}\":\n print(chr(c),end=\"\")\n break\n else:\n if chr(c-0x15) == ans[i]:\n print(chr(c),end=\"\")\n break\n else:\n if chr(c+0x2b) == ans[i]:\n print(chr(c),end=\"\")\n break \n else:\n if chr(c+0x20) == ans[i]:\n print(chr(c),end=\"\")\n break\n else:\n if chr(c-0x3c) == ans[i]:\n print(chr(c),end=\"\")\n breakAfter entering the recovered flag characters, the program printed the correct flag as shown below.
\nReading the code shows that applying the recursive The implementation of If the byte string has only one element, it simply returns that value. I initially got stuck trying to invert each Therefore, by using only the correct flag length and brute-forcing characters from the beginning so that the final output matched, I was able to recover the flag. In the end, I recovered the flag with the following solver. A fever dream, truly.\nnc tjc.tf 31500 Decompiling the provided ELF in Ghidra yields the following code. From this code, we can see that the binary accepts multiple inputs in sequence and only returns the flag if every check succeeds. The first two checks are simple string comparisons, so you can pass them by sending the following embedded strings in order. The next checks were implemented as follows. More specifically, we need to find Values satisfying the first two conditions can be found easily by brute force, but brute-forcing values that satisfy the third condition is computationally impractical. So, based on the prime factorization of In the end, the following solver identified In the final check, the program updates However, the number of times you can enter a string is limited to Finding the shortest input sequence itself was not particularly difficult; I worked it out using a greedy approach and a calculator. The final input sequence was as follows. Sending this to the remote server returned the flag. One of my friends has gotten into neo-feudalism recently. He says that society should be more like a feudalist one, with unequal rights, legal protections, and wealth distribution. I found this weird photo on his computer; can you find a flag? The challenge provided the following PNG file. Since it was a PNG file, I analyzed it with Reference: Stego Tricks - HackTricks smol e The provided challenge files were the following Sage file and text file. It appears to encrypt the flag using RSA. Since However, reading the Sage file used for encryption shows that the first 23 characters of the plaintext are hardcoded. One attack against RSA is Coppersmith’s short-pad attack, which works when the difference between two plaintexts is sufficiently small. In this case, there also seems to be a technique called the stereotyped message attack, which applies Coppersmith’s method when the high-order bits of the plaintext are known and Reference: Security Camp 2021 Participation Report - Qiita Reference: RSA Attack: Stereotyped message attack | gsdt This challenge also satisfied those conditions, so I reused part of the code from the reference article, ran the following solver script in SageMath, and recovered the flag from the decrypted result. This time I solved one Crypto challenge for the first time in quite a while—really quite a while. I’m still not very comfortable with Crypto, but algorithms like AES show up often in Rev as well, so I feel I really need to study it properly.recur() function to the correct flag string yields the byte string res.recur() splits the given byte string into three parts and passes them to op1, op2, and op3 respectively.op function, but a closer look showed that each specific flag element is always processed in the same way, and no swapping occurs between byte positions.ans = b'\\x8c\\x86\\xb1\\x90\\x86\\xc9=\\xbe\\x9b\\x80\\x87\\xca\\x86\\x8dKJ\\xc4e?\\xbc\\xdbC\\xbe!Y \\xaf'\nflag = [\"0\"]*len(ans)\nfor i in range(len(ans)):\n for x in range(256):\n flag[i] = chr(x)\n b = \"\".join(flag)\n b = bytearray()\n b.extend(map(ord, flag))\n res = recur(b)\n # print(chr(x), res[i], ans[i])\n if res[i] == ans[i]:\n print(chr(x),end=\"\")\n breakdream(Rev)
\n\n
\nundefined8 main(void)\n\n{\n int iVar1;\n ulong uVar2;\n ulong uVar3;\n FILE *__stream;\n long in_FS_OFFSET;\n int x;\n int i;\n char input [256];\n char local_118 [264];\n long local_10;\n \n local_10 = *(long *)(in_FS_OFFSET + 0x28);\n setbuf(stdout,(char *)0x0);\n type_text(\"last night, I had a dream...\\ntaylor sw1ft, the dollar store version, appeared!\\n\");\n prompt(\"what should I do? \",input,0x100);\n iVar1 = strcmp(\"sing\",input);\n if (iVar1 != 0) {\n puts(\"no, no, that\\'s a bad idea.\");\n /* WARNING: Subroutine does not return */\n exit(0);\n }\n prompt(\"that\\'s a great idea!\\nI started to sing the following lyrics: \",input,0x100);\n iVar1 = strcmp(\"maybe I asked for too [many challenges to be written]\",input);\n if (iVar1 != 0) {\n puts(\"no, that\\'s a dumb lyric.\");\n /* WARNING: Subroutine does not return */\n exit(0);\n }\n type_text(\"ok... that\\'s a weird lyric but whatever\\n\");\n prompt(\"that leads me to ask... how many challenges did you ask for??? \",input,0x100);\n uVar2 = atol(input);\n if ((((uVar2 * 3 ^ 0xb6d8) % 0x521) * 0x23) % 0x5eb != 0x55a) {\n type_text(\"that\\'s a stupid number.\\n\");\n /* WARNING: Subroutine does not return */\n exit(0);\n }\n prompt(\"ok yeah you\\'re asking too much of everyone; try to lower the number??? \",input,0x100);\n uVar3 = atol(input);\n if ((((uVar3 * 5) % 0x1e61 | 0x457) * 0x23 - 5) % 1000 != 0x50) {\n type_text(\"yeah.\");\n /* WARNING: Subroutine does not return */\n exit(0);\n }\n if ((uVar2 % uVar3 != 0x1344224) || (uVar2 * uVar3 != 0x33d5d816326aad)) {\n type_text(\"ok but they might think that\\'s too much comparatively, duh.\\n\");\n /* WARNING: Subroutine does not return */\n exit(0);\n }\n type_text(\"that\\'s a lot more reasonable - good on you!\\n\");\n usleep(75000);\n type_text(\"ok, now that we\\'ve got that out of the way, back to the story...\\n\");\n type_text(\"taylor was like, \\\"wow, you\\'re so cool!\\\", and I said, \\\"no, you\\'re so cool!\\\"\\n\");\n type_text(\n \"after that, we kinda just sat in silence for a little bit. I could kinda tell I was losi ng her attention, so \"\n );\n x = 0;\n for (i = 0; i < 0xc; i = i + 1) {\n prompt(\"what should I do next? \",input,0x100);\n iVar1 = strcmp(\"ask her about some flags\",input);\n if (iVar1 == 0) {\n x = x + 1;\n }\n else {\n iVar1 = strcmp(\"ask her about her new album\",input);\n if (iVar1 == 0) {\n x = x * x;\n }\n else {\n iVar1 = strcmp(\"ask her about her tour\",input);\n if (iVar1 != 0) {\n type_text(\"no, that\\'s weird\\n\");\n /* WARNING: Subroutine does not return */\n exit(0);\n }\n x = x + 0x16;\n }\n }\n }\n if (x != 0x92f) {\n type_text(\"taylor died of boredom\\n\");\n /* WARNING: Subroutine does not return */\n exit(0);\n }\n type_text(\n \"taylor got sick and tired of me asking her about various topics, so she finally responde d: \"\n );\n __stream = fopen(\"flag.txt\",\"r\");\n if (__stream == (FILE *)0x0) {\n type_text(\"no flag </3\\n\");\n /* WARNING: Subroutine does not return */\n exit(0);\n }\n fgets(local_118,0x100,__stream);\n type_text(local_118);\n if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {\n /* WARNING: Subroutine does not return */\n __stack_chk_fail();\n }\n return 0;\n}sing\nmaybe I asked for too [many challenges to be written]prompt(\"that leads me to ask... how many challenges did you ask for??? \",input,0x100);\nuVar2 = atol(input);\nif ((((uVar2 * 3 ^ 0xb6d8) % 0x521) * 0x23) % 0x5eb != 0x55a) {\ntype_text(\"that\\'s a stupid number.\\n\");\n /* WARNING: Subroutine does not return */\nexit(0);\n}\nprompt(\"ok yeah you\\'re asking too much of everyone; try to lower the number??? \",input,0x100);\nuVar3 = atol(input);\nif ((((uVar3 * 5) % 0x1e61 | 0x457) * 0x23 - 5) % 1000 != 0x50) {\ntype_text(\"yeah.\");\n /* WARNING: Subroutine does not return */\nexit(0);\n}\nif ((uVar2 % uVar3 != 0x1344224) || (uVar2 * uVar3 != 0x33d5d816326aad)) {\ntype_text(\"ok but they might think that\\'s too much comparatively, duh.\\n\");\n /* WARNING: Subroutine does not return */\nexit(0);\n}uVar2 and uVar3 that satisfy all three of the following conditions.1. (((uVar2 * 3 ^ 0xb6d8) % 0x521) * 0x23) % 0x5eb != 0x55a\n2. ((((uVar3 * 5) % 0x1e61 | 0x457) * 0x23 - 5) % 1000 != 0x50)\n3. ((uVar2 % uVar3 != 0x1344224) || (uVar2 * uVar3 != 0x33d5d816326aad)0x33d5d816326aad (3*3*29*37*409*11071*333667), I first generated pairs of values satisfying uVar2 * uVar3 == 0x33d5d816326aad and then checked whether they also satisfied conditions 1 and 2.uVar2 and uVar3 satisfying all three conditions.# 0x33D5D816326AAD = 3*3*29*37*409*11071*333667\nimport itertools\nprimes = [3,3,29,37,409,11071,333667]\np = set(primes)\ncheck = []\nfor i in range(1, len(primes)):\n comb = itertools.combinations(primes, i)\n for c in comb:\n a = 1\n b = 1\n for x in p.difference(c):\n a *= x\n for y in c:\n b *= y\n if a*b == 0x33D5D816326AAD:\n # print(a,b)\n check.append((a,b))\n\nfor t in check:\n a = t[0]\n b = t[1]\n if (((a * 3 ^ 0xb6d8) % 0x521) * 0x23) % 0x5eb == 0x55a:\n if (35 * ((5 * b % 0x1E61) | 0x457) - 5) % 0x3E8 == 80:\n print(a,b)\n\n a = t[1]\n b = t[0]\n if (((a * 3 ^ 0xb6d8) % 0x521) * 0x23) % 0x5eb == 0x55a:\n if (35 * ((5 * b % 0x1E61) | 0x457) - 5) % 0x3E8 == 80:\n print(a,b)x depending on whether the input string is ask her about some flags, ask her about her new album, or ask her about her tour, and verifies that the final result becomes 0x92f.x = 0;\nfor (i = 0; i < 0xc; i = i + 1) {\nprompt(\"what should I do next? \",input,0x100);\niVar1 = strcmp(\"ask her about some flags\",input);\nif (iVar1 == 0) {\n x = x + 1;\n}\nelse {\n iVar1 = strcmp(\"ask her about her new album\",input);\n if (iVar1 == 0) {\n x = x * x;\n }\n else {\n iVar1 = strcmp(\"ask her about her tour\",input);\n if (iVar1 != 0) {\n type_text(\"no, that\\'s weird\\n\");\n /* WARNING: Subroutine does not return */\n exit(0);\n }\n x = x + 0x16;\n }\n}\n}\nif (x != 0x92f) {\ntype_text(\"taylor died of boredom\\n\");\n /* WARNING: Subroutine does not return */\nexit(0);\n}0xc, so I needed to find the shortest valid sequence of inputs.sing\nmaybe I asked for too [many challenges to be written]\n131313131\n111111111\nask her about her tour\nask her about her tour\nask her about some flags\nask her about some flags\nask her about some flags\nask her about some flags\nask her about her new album\nask her about her tour\nask her about her tour\nask her about some flags\nask her about some flags\nask her about some flagsneofeudalism(Forensic)
\n\n
\nzsteg and recovered the flag embedded in the file.zsteg -a image.pnge(Crypto)
\n\n
\nfrom Crypto.Util.number import bytes_to_long\n\np = random_prime(2 ^ 650)\nq = random_prime(2 ^ 650)\nN = p*q\ne = 5\nflag = open(\"flag.txt\", \"rb\").read().strip()\nm = bytes_to_long(b'the challenges flag is ' + flag)\nc = m ^ e % N\nprint(\"N: \", N)\nprint(\"C: \", c)\nprint(\"e: \", e)N: 853008036761402960429244085500226305898326229049062709229066738337581395441559298620215547481097485360068401045559533084692445386310317304293873811639421668853703030998563380404046228010704173349786419154143323587451196441095743638783569173579503503557413613700490069592150975220823978641111437607374483116682547794651693986279540940965888470663234601045413512056249535670198419685119952947\nC: 298700332507654723773580072855784292117810966958600234446114828082727445272393622869719877676272804981941548843479760604983256960593285221389548684954375981617049731866256547635842115184695147132731165168615990125469633018271766466825307769730709868985624843944432541800012321786587028293887532995722347604510229248766961319729482167555605707032678858635163105035385522888663577785577519392\ne: 5e is very small, I first thought a Low Public Exponent Attack might work, but unfortunately the condition M**e < N is not satisfied, so it cannot be decrypted that way.e is very small.# partial_m.sage\nn=853008036761402960429244085500226305898326229049062709229066738337581395441559298620215547481097485360068401045559533084692445386310317304293873811639421668853703030998563380404046228010704173349786419154143323587451196441095743638783569173579503503557413613700490069592150975220823978641111437607374483116682547794651693986279540940965888470663234601045413512056249535670198419685119952947\nc=298700332507654723773580072855784292117810966958600234446114828082727445272393622869719877676272804981941548843479760604983256960593285221389548684954375981617049731866256547635842115184695147132731165168615990125469633018271766466825307769730709868985624843944432541800012321786587028293887532995722347604510229248766961319729482167555605707032678858635163105035385522888663577785577519392\ne=5\n\nprefix=11149651487439933873850349163109051510832664011661210400\nPR.<x> = PolynomialRing(Zmod(n))\nfor i in range(1,2000):\n p = prefix << i\n f = (p + x)^e - c\n diff = f.small_roots(epsilon=1/30)\n if len(diff):\n print(diff)\n breakSummary
\n