szabolor

Keybase proof

I hereby claim:

I am szabolor on github.
I am szabolor (https://keybase.io/szabolor) on keybase.
I have a public key whose fingerprint is D392 5BC3 FA6B 345E 6899 59C2 7ABE 4272 8FD4 55AD

To claim this, I am signing this object:

Hitcon CTF 2019 Quals -- Lost Key Again [Crypto, 334p, 10 solver]

by alex and szabolor from !SpamAndHex

This crypto challenge is basically an RSA-like encryption service.

First the program prints the encrypted version of the flag prepended by X: and 68 bytes from urandom (thus those have supposedly high-entropy). The encrypted hex-string are always about 1024 bit long.

After the encrypted flag, the challenge let you type in maximum 100 input to be encrypted. The inputs must be in hex-string representation and the maximal length is 15byte (after hex decode). The trick in the encryption is the padding, as all of the inputs are prepended with the X: characters. This effectively means if you input x, then the challenge will process (0x583a20 << (len(x)*8)) + x.

The real twist of the challenge is the fact, that there's no obvious way to obtain even n (the modulus) or e (the public exponent). From the source code it seem like n, e, d are read from a file, but d not used at all (as ther

	/*
	* robotMaze.js
	*
	* The blue key is inside a labyrinth, and extracting
	* it will not be easy.
	*
	* It's a good thing that you're a AI expert, or
	* we would have to leave empty-handed.
	*/

	function setWeatherIcon(condid) {

	switch(condid) {
	case '0': var icon = '<i class="wi-tornado"></i>';
	break;
	case '1': var icon = '<i class="wi-storm-showers"></i>';
	break;
	case '2': var icon = '<i class="wi-tornado"></i>';
	break;
	case '3': var icon = '<i class="wi-thunderstorm"></i>';

	#include <stdio.h>

	int do_original(int num) {
	const int nyolc0 = 100000000;
	unsigned int i;

	for (i = num * 3 + 1; i > 0; --i) {
	//printf(" % *d\ti:%d\n", 12, num, i);
	num = (num % nyolc0) * 10 + num / nyolc0;
	}