1 of 5

Crypto

Common Mistake

Common Mod, DIfferent e

In this challenge, we are given two sets of $N$ , $e$ and $c$ .

The plaintext encrypted to give $c$ is the same, and we can observe that the choice of $N$ is also the same, meaning the only difference is in the choice of $e$ . Here we can use some cool maffs with $e_1$ and $e_2$ to retrieve the original plaintext $m$ .

Firstly, if the greatest common divisor of $e_1$ and $e_2$ is $1$ , then there exists $a$ and $b$ such that

ae_1 + be_2 = 1

To calculate this, we can use the Extended Euclidean Algorithm. But why is this helpful?

Well if we know that $c_1 \equiv m^{e_1} \mod N$ and $c_2 \equiv m^{e_2} \mod N$ and we know $a,b$ such that $ae_1 + be_2 = 1$ , we can then use this to calculate like this:

In practise is likely to be negative, and in modular arithmetic we use negative powers using the . Luckily, Sage can do this for us by default, so we can do even less steps:

And we get the flag as HTB{c0mm0n_m0d_4774ck_15_4n07h3r_cl4ss1c}.

Missing Reindeer

Cube Root Attack

In this challenge, we get a message.eml file containing an email:

Hello Mr Jingles,

We got the reindeer as you requested. There is a problem though. Its nose is so red and bright and makes it very hard to hide him anywhere near north pole. We have moved to a secret location far away. I have encrypted this information with your public key in case you know who is watching.

Applications such as Outlook block downloading the file due to it's "malicious nature", but we can open the .eml file in VS Code easily and extract two things:

Firstly, there is a secret.enc file with base64-encoded ciphertext:

Secondly, there is a pubkey.der file containing an RSA public key:

Analysing the Public Key

We can easily import the public key in Python and read the values for and using the Pycryptodome:

We can throw into FactorDB to see if the factors are known, but they are not. The more notable observation is that , which allows us to perform a on the ciphertext.

The logic here is simple: because the message is quite short and the public modulus is quite large, a small value of such as may make it such that . This makes the modulus ineffective as and we can simply take the th root of the ciphertext to recover the plaintext.

Recovering c

We'll use the gmpy2 iroot() function to calculate the cube root:

And bingo bango, we get the flag as HTB{w34k_3xp0n3n7_ffc896}.

Xmas Spirit

We get given challenge.py and encrypted.bin. Analysing challenge.py:

It calculates two random values, $a$ and $b$ . For every byte $k$ in the plaintext file, it then calculates

ak + b \mod 256

And appends the result of that as the encrypted character in encrypted.bin.

Analysis

The plaintext file appears to be letter.pdf, and using this we can work out the values of and because we know the first 4 bytes of every PDF file are %PDF. We can extract the first two bytes of encrypted.bin and compare to the expected two bytes:

Gives us

So we can form two equations here using this information:

We subtract (2) from (1) to get that

And we can multiply both sides by the modular multiplicative inverse of 43, i.e. , which is , to get that

And then we can calculate :

Solution

So now we have the values for and , it's simply a matter of going byte-by-byte and reversing it. I created a simple Sage script to do this with me, and it took a bit of time to run but eventually got the flag.

And the resulting PDF has the flag HTB{4ff1n3_c1ph3r_15_51mpl3_m47h5} within.

Meet Me Halfway

Meet-in-the-middle attack on AES

We are given challenge.py, which does the following:

Creates two keys
- Key1 is cyb3rXm45!@# + 4 random bytes from 0123456789abcdef
- Key2 is 4 random bytes from 0123456789abcdef + cyb3rXm45!@#
Encrypts the flag with Key1 using AES-ECB
Encrypts the encrypted flag with Key2 using AES-ECB

We can use a meet-in-the-middle attack to retreive both keys. The logic here is simple. Firstly, there are 16 possible characters for each of the 4 random bytes, which is easily bruteforceable ().

We can also encrypt a given input and get the result - I choose to send 12345678 as the hex-encoded plaintext and receive . For these keys, the encrypted flag is given as:

The Attack

Now we have a known plaintext and ciphertext, we can use both one after the other and bruteforce possible keys. Note that the encryption looks like this:

We do not know what the intermediate value x is, but we can use brute force to calculate it by

Looping through all possibilities for key1 and saving the encrypted version of 12345678
Looping through all possibilities for key2 and saving the decryption of 449e2eb...

Once we find this intersection, we can use that to work back and calculate key1 and key2, which we can then utilise to decrypt the flag.

Solve Script

And we get the flag as HTB{m337_m3_1n_7h3_m1ddl3_0f_3ncryp710n}!

Meet Me Halfway

Meet-in-the-middle attack on AES

We are given challenge.py, which does the following:

Creates two keys
- Key1 is cyb3rXm45!@# + 4 random bytes from 0123456789abcdef
- Key2 is 4 random bytes from 0123456789abcdef + cyb3rXm45!@#
Encrypts the flag with Key1 using AES-ECB
Encrypts the encrypted flag with Key2 using AES-ECB

We can also encrypt a given input and get the result - I choose to send 12345678 as the hex-encoded plaintext and receive . For these keys, the encrypted flag is given as:

The Attack

Now we have a known plaintext and ciphertext, we can use both one after the other and bruteforce possible keys. Note that the encryption looks like this:

We do not know what the intermediate value x is, but we can use brute force to calculate it by

Looping through all possibilities for key1 and saving the encrypted version of 12345678
Looping through all possibilities for key2 and saving the decryption of 449e2eb...

Once we find this intersection, we can use that to work back and calculate key1 and key2, which we can then utilise to decrypt the flag.

Solve Script

And we get the flag as HTB{m337_m3_1n_7h3_m1ddl3_0f_3ncryp710n}!

Common Mistake

Common Mod, DIfferent e

In this challenge, we are given two sets of $N$ , $e$ and $c$ .

{'n': '0xa96e6f96f6aedd5f9f6a169229f11b6fab589bf6361c5268f8217b7fad96708cfbee7857573ac606d7569b44b02afcfcfdd93c21838af933366de22a6116a2a3dee1c0015457c4935991d97014804d3d3e0d2be03ad42f675f20f41ea2afbb70c0e2a79b49789131c2f28fe8214b4506db353a9a8093dc7779ec847c2bea690e653d388e2faff459e24738cd3659d9ede795e0d1f8821fd5b49224cb47ae66f9ae3c58fa66db5ea9f73d7b741939048a242e91224f98daf0641e8a8ff19b58fb8c49b1a5abb059f44249dfd611515115a144cc7c2ca29357af46a9dc1800ae9330778ff1b7a8e45321147453cf17ef3a2111ad33bfeba2b62a047fa6a7af0eef', 'e': '0x10001', 'ct': '0x55cfe232610aa54dffcfb346117f0a38c77a33a2c67addf7a0368c93ec5c3e1baec9d3fe35a123960edc2cbdc238f332507b044d5dee1110f49311efc55a2efd3cf041bfb27130c2266e8dc61e5b99f275665823f584bc6139be4c153cdcf153bf4247fb3f57283a53e8733f982d790a74e99a5b10429012bc865296f0d4f408f65ee02cf41879543460ffc79e84615cc2515ce9ba20fe5992b427e0bbec6681911a9e6c6bbc3ca36c9eb8923ef333fb7e02e82c7bfb65b80710d78372a55432a1442d75cad5b562209bed4f85245f0157a09ce10718bbcef2b294dffb3f00a5a804ed7ba4fb680eea86e366e4f0b0a6d804e61a3b9d57afb92ecb147a769874'}
{'n': '0xa96e6f96f6aedd5f9f6a169229f11b6fab589bf6361c5268f8217b7fad96708cfbee7857573ac606d7569b44b02afcfcfdd93c21838af933366de22a6116a2a3dee1c0015457c4935991d97014804d3d3e0d2be03ad42f675f20f41ea2afbb70c0e2a79b49789131c2f28fe8214b4506db353a9a8093dc7779ec847c2bea690e653d388e2faff459e24738cd3659d9ede795e0d1f8821fd5b49224cb47ae66f9ae3c58fa66db5ea9f73d7b741939048a242e91224f98daf0641e8a8ff19b58fb8c49b1a5abb059f44249dfd611515115a144cc7c2ca29357af46a9dc1800ae9330778ff1b7a8e45321147453cf17ef3a2111ad33bfeba2b62a047fa6a7af0eef', 'e': '0x23', 'ct': '0x79834ce329453d3c4af06789e9dd654e43c16a85d8ba0dfa443aefe1ab4912a12a43b44f58f0b617662a459915e0c92a2429868a6b1d7aaaba500254c7eceba0a2df7144863f1889fab44122c9f355b74e3f357d17f0e693f261c0b9cefd07ca3d1b36563a8a8c985e211f9954ce07d4f75db40ce96feb6c91211a9ff9c0a21cad6c5090acf48bfd88042ad3c243850ad3afd6c33dd343c793c0fa2f98b4eabea399409c1966013a884368fc92310ebcb3be81d3702b936e7e883eeb94c2ebb0f9e5e6d3978c1f1f9c5a10e23a9d3252daac87f9bb748c961d3d361cc7dacb9da38ab8f2a1595d7a2eba5dce5abee659ad91a15b553d6e32d8118d1123859208'}

Firstly, if the greatest common divisor of $e_1$ and $e_2$ is $1$ , then there exists $a$ and $b$ such that

ae_1 + be_2 = 1

To calculate this, we can use the Extended Euclidean Algorithm. But why is this helpful?

Well if we know that $c_1 \equiv m^{e_1} \mod N$ and $c_2 \equiv m^{e_2} \mod N$ and we know $a,b$ such that $ae_1 + be_2 = 1$ , we can then use this to calculate like this:

In practise is likely to be negative, and in modular arithmetic we use negative powers using the . Luckily, Sage can do this for us by default, so we can do even less steps:

And we get the flag as HTB{c0mm0n_m0d_4774ck_15_4n07h3r_cl4ss1c}.

{'n': '0xa96e6f96f6aedd5f9f6a169229f11b6fab589bf6361c5268f8217b7fad96708cfbee7857573ac606d7569b44b02afcfcfdd93c21838af933366de22a6116a2a3dee1c0015457c4935991d97014804d3d3e0d2be03ad42f675f20f41ea2afbb70c0e2a79b49789131c2f28fe8214b4506db353a9a8093dc7779ec847c2bea690e653d388e2faff459e24738cd3659d9ede795e0d1f8821fd5b49224cb47ae66f9ae3c58fa66db5ea9f73d7b741939048a242e91224f98daf0641e8a8ff19b58fb8c49b1a5abb059f44249dfd611515115a144cc7c2ca29357af46a9dc1800ae9330778ff1b7a8e45321147453cf17ef3a2111ad33bfeba2b62a047fa6a7af0eef', 'e': '0x10001', 'ct': '0x55cfe232610aa54dffcfb346117f0a38c77a33a2c67addf7a0368c93ec5c3e1baec9d3fe35a123960edc2cbdc238f332507b044d5dee1110f49311efc55a2efd3cf041bfb27130c2266e8dc61e5b99f275665823f584bc6139be4c153cdcf153bf4247fb3f57283a53e8733f982d790a74e99a5b10429012bc865296f0d4f408f65ee02cf41879543460ffc79e84615cc2515ce9ba20fe5992b427e0bbec6681911a9e6c6bbc3ca36c9eb8923ef333fb7e02e82c7bfb65b80710d78372a55432a1442d75cad5b562209bed4f85245f0157a09ce10718bbcef2b294dffb3f00a5a804ed7ba4fb680eea86e366e4f0b0a6d804e61a3b9d57afb92ecb147a769874'}
{'n': '0xa96e6f96f6aedd5f9f6a169229f11b6fab589bf6361c5268f8217b7fad96708cfbee7857573ac606d7569b44b02afcfcfdd93c21838af933366de22a6116a2a3dee1c0015457c4935991d97014804d3d3e0d2be03ad42f675f20f41ea2afbb70c0e2a79b49789131c2f28fe8214b4506db353a9a8093dc7779ec847c2bea690e653d388e2faff459e24738cd3659d9ede795e0d1f8821fd5b49224cb47ae66f9ae3c58fa66db5ea9f73d7b741939048a242e91224f98daf0641e8a8ff19b58fb8c49b1a5abb059f44249dfd611515115a144cc7c2ca29357af46a9dc1800ae9330778ff1b7a8e45321147453cf17ef3a2111ad33bfeba2b62a047fa6a7af0eef', 'e': '0x23', 'ct': '0x79834ce329453d3c4af06789e9dd654e43c16a85d8ba0dfa443aefe1ab4912a12a43b44f58f0b617662a459915e0c92a2429868a6b1d7aaaba500254c7eceba0a2df7144863f1889fab44122c9f355b74e3f357d17f0e693f261c0b9cefd07ca3d1b36563a8a8c985e211f9954ce07d4f75db40ce96feb6c91211a9ff9c0a21cad6c5090acf48bfd88042ad3c243850ad3afd6c33dd343c793c0fa2f98b4eabea399409c1966013a884368fc92310ebcb3be81d3702b936e7e883eeb94c2ebb0f9e5e6d3978c1f1f9c5a10e23a9d3252daac87f9bb748c961d3d361cc7dacb9da38ab8f2a1595d7a2eba5dce5abee659ad91a15b553d6e32d8118d1123859208'}

Xmas Spirit

We get given challenge.py and encrypted.bin. Analysing challenge.py:

import random
from math import gcd

def encrypt(dt):
	mod = 256
	while True:
		a = random.randint(1, mod)
		if gcd(a, mod) == 1:
			break
	b = random.randint(1, mod)

	res = b''
	for byte in dt:
		enc = (a * byte + b) % mod
		res += bytes([enc])
	return res


dt = open('letter.pdf', 'rb').read()

res = encrypt(dt)

f = open('encrypted.bin', 'wb')
f.write(res)
f.close()

It calculates two random values, $a$ and $b$ . For every byte $k$ in the plaintext file, it then calculates

ak + b \mod 256

And appends the result of that as the encrypted character in encrypted.bin.

Analysis

Gives us

So we can form two equations here using this information:

We subtract (2) from (1) to get that

And we can multiply both sides by the modular multiplicative inverse of 43, i.e. , which is , to get that

And then we can calculate :

Solution

And the resulting PDF has the flag HTB{4ff1n3_c1ph3r_15_51mpl3_m47h5} within.

Missing Reindeer

Cube Root Attack

In this challenge, we get a message.eml file containing an email:

Hello Mr Jingles,

We got the reindeer as you requested. There is a problem though. Its nose is so red and bright and makes it very hard to hide him anywhere near north pole. We have moved to a secret location far away. I have encrypted this information with your public key in case you know who is watching.

Applications such as Outlook block downloading the file due to it's "malicious nature", but we can open the .eml file in VS Code easily and extract two things:

Firstly, there is a secret.enc file with base64-encoded ciphertext:

Secondly, there is a pubkey.der file containing an RSA public key:

Analysing the Public Key

We can easily import the public key in Python and read the values for and using the Pycryptodome:

We can throw into FactorDB to see if the factors are known, but they are not. The more notable observation is that , which allows us to perform a on the ciphertext.

Recovering c

We'll use the gmpy2 iroot() function to calculate the cube root:

And bingo bango, we get the flag as HTB{w34k_3xp0n3n7_ffc896}.

Crypto

Common Mistake

Missing Reindeer

Contents

Analysing the Public Key

Recovering c

Xmas Spirit

Contents

Analysis

Solution

Meet Me Halfway

Contents

The Attack

Solve Script

Meet Me Halfway

Contents

The Attack

Solve Script

Common Mistake

Xmas Spirit

Contents

Analysis

Solution

Crypto

Missing Reindeer

Contents

Analysing the Public Key

Recovering c

Crypto

Common Mistake

Missing Reindeer

hashtagContents

hashtagAnalysing the Public Key

hashtagRecovering c

Xmas Spirit

hashtagContents

hashtagAnalysis

hashtagSolution

Meet Me Halfway

hashtagContents

hashtagThe Attack

hashtagSolve Script

Meet Me Halfway

hashtagContents

hashtagThe Attack

hashtagSolve Script

Common Mistake

Xmas Spirit

hashtagContents

hashtagAnalysis

hashtagSolution

Crypto

Missing Reindeer

hashtagContents

hashtagAnalysing the Public Key

hashtagRecovering c

Contents

Analysing the Public Key

Recovering c

Contents

Analysis

Solution

Contents

The Attack

Solve Script

Contents

The Attack

Solve Script

Contents

Analysis

Solution

Contents

Analysing the Public Key

Recovering c