hellman

hellman

pyshv1 (572)

The challenge contains two modules:

# File: securePickle.py

import pickle, io

whitelist = []

hellman

listcomp ppm (371)

Solve 3 super easy list-comp challenges!!! Short! Shorter!! Shortest!!!

nc easiest.balsnctf.com 9487

UPDATE: the challenge runs by python3.6 UPDATE: the original code should already be list comprehension

Question 1

hellman

In this challenge we see a password-verification program. The password is quite long:

assert 16 < len(passwd) < 70

The first few checks verify md5, sha1 and sha3_224 digests. Due to long password, it is unlikely to use them to recover the password. Then, three transformations applied aiming to "destroy" the password: exponentiation modulo a prime, iterated encryption with DES and AES. Though, it is easy to see that they are trivially invertible. For the final "destroyed" value, the omnihash tool is used, which checks the password using 72 different hash functions, including many CRC variants. We are given the digests of these functions in the hash.json file.

CRC functions are totally not cryptographically secure: they are affine functions. Therefore, we can efficiently use them to deduce information about the hashed value. One may try to use the definition of CRC functions as modular reductions in the ring of polynomials over GF(2) and use the Chinese Remainder Theorem to reconstruct the va

hellman

#!/usr/bin/env python3
'''
time python3 solve.py
35 minutes
'''
import angr
import claripy
import hashlib

# checking functions

hellman

"""
echo pass | TRACE=trace1 time gdb -x script.py -batch ./unconventional >/dev/null
~1 minute
"""
import gdb, re, os

gdb.execute('break *0x40542f')
gdb.execute('run')

f = open(os.environ["TRACE"], "w")

hellman

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <unistd.h>
#include <assert.h>
#include <openssl/aes.h>

/*
gcc -O3 solve.c -L. -lghash_clmul -lcrypto -o solve

hellman

#-*- coding:utf-8 -*-

# python3 adaptation...
from __future__ import print_function, division

from sage.all import *

# begin copy paste ================
import hashlib
f = open('gov_officials_PK.txt','r')

hellman

#-*- coding:utf-8 -*-

from sage.all import *

BITS = 2048
NLEAK = 1024-22
# E = 0x10001
E = next_prime(2**22)
print "E", E

hellman