CrySyS SecChallenge 2020: Challenge Response Task
We captured a semi-encrypted communication between some clients and servers. Understand what is happening and find the flag!
Categories
Cryptography
Files
Links
Solution
Let’s start off with opening up the capture in Wireshark. Looking at the packets we can see this is a TCP stream between two computers. To get a nicer representation of the communication we can choose to follow the TCP stream (Analyze -> Follow -> TCP Stream):
GET /public_key
28860933218222671315525960901315886566234072447373972508930815711100155296267111836604498381050509895806540860709992914907762012279834082264477001295145744747722222436706005893885463101790500821622029561241186997679994796015365547013401086001743842097689131479588216828882501797965949538143096880022688853909484640202795568631443744338588840728411345495823482630800429116672071239436912989740158059257258980405364896198618753052827082572022677540955035682704012907612254387895975297023387687021449491511122122795930933125928245936795537945019379607688079868062804030787864323284696468208771050492644461832474751469947
3
PUT /secret
NDUxODU3ODQ3MzQzMDE1MDkzNTI3MzI3MTA5MTU0NjMxNDE2ODI4NzIyODI1NDY5ODA2Nzc5Mjk0NzE0Njk0ODY0OTE1NDY4MTIzMjgyNzIwMDI0NDMyNjg5MzcyMDUxMjQ1MjE2MTQ5MDQ0NDQyODc5Mzg1MzA3MzQ1NTc2Nzc0NzAwNzk3OTE3NTI4MDI0Mjc2MzUxMjkzMzkzMTYwMjkwNDI0MDIxNzE2Nzk2NTY1OTMwNjQ4ODMyOTIxMTIzODEzODkzOTI3NDQ4NzQ5MTIwNDU3ODc4NDIxMjE0MjI5NjM4ODIwMjE4NjIyNjk1NTU5NjAwNzQ1Mzk5OTMyODE1ODI0MDA0NTM1MTk4NDM3ODA2NTY1MTYyMTkwODgxNTg3MjgyOTAyNzA0OTI2Mzg1OTgwMDE4NzE5NzM=
It’s hard to not to notice that the second request is some base64’d data. After decoding it we get the following:
45185784734301509352732710915463141682872282546980677929471469486491546812328272002443268937205124521614904444287938530734557677470079791752802427635129339316029042402171679656593064883292112381389392744874912045787842121422963882021862269555960074539993281582400453519843780656516219088158728290270492638598001871973
Hm, yet another number. Time to look for clues in the linked site. On the left sidebar we can easily notice RSA and DSA, which seems to fit to our problem, since we are probably dealing with public keys and secrets, so start off by looking there. Reading the list of challenges we’ll find a particularly interesting one: Bleichenbacher's e=3 RSA Attack. Why is it interesting? Our public_key file also contains a 3 on a separate line. At this point I searched for e=3 rsa crack which turned up RsaCtfTool. Inserting the numbers we got earlier gets us instant results:
$ ./RsaCtfTool.py -n 28860933218222671315525960901315886566234072447373972508930815711100155296267111836604498381050509895806540860709992914907762012279834082264477001295145744747722222436706005893885463101790500821622029561241186997679994796015365547013401086001743842097689131479588216828882501797965949538143096880022688853909484640202795568631443744338588840728411345495823482630800429116672071239436912989740158059257258980405364896198618753052827082572022677540955035682704012907612254387895975297023387687021449491511122122795930933125928245936795537945019379607688079868062804030787864323284696468208771050492644461832474751469947 -e 3 --uncipher 45185784734301509352732710915463141682872282546980677929471469486491546812328272002443268937205124521614904444287938530734557677470079791752802427635129339316029042402171679656593064883292112381389392744874912045787842121422963882021862269555960074539993281582400453519843780656516219088158728290270492638598001871973
[+] Clear text : b'cd20{Y3p_1t_15_th3_Ch1n353_R3m1nd3r_Th30r3m}'