ACECTF Write-up

Yoyo Shih

• 3 min read
Share

Super Secure Encryption

from Crypto.Util import Counter
from binascii import unhexlify

known_plaintext = b'This is just a test message and can totally be ignored.'
encrypted_msg = "d71f4a2fd1f9362c21ad33c7735251d0a671185a1b90ecba27713d350616 7ca7052aa8bad60466b83041e6c02dbfee738c2a3"
encrypted_flag = "c234661fa5d63e627bef28823d052e95f65d59491580edfa19273 69986859a3"  # 在 msg.txt 中找到的第二行密文

encrypted_msg_bytes = unhexlify(encrypted_msg)
encrypted_flag_bytes = unhexlify(encrypted_flag)

keystream = bytes([p ^ c for p, c in zip(known_plaintext, encrypted_msg_bytes)])

decrypted_flag = bytes([c ^ k for c, k in zip(encrypted_flag_bytes, keystream)])

print("Recovered flag:", decrypted_flag.decode())

執行結果：

PS D:\project> & "C:/Program Files/Python39/python.exe" d:/project/ACECTF/SuperSecureEncryption/decrypt.py
Recovered flag: ACECTF{n07h2n6_15_53cur3_1n_7h15_w0rld}

Sanity Check

在 Discord 輸入以下指令：

/channelinfo channel: #rules

Custom Encoding Scheme

t1 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
t = "I TOLD YOU THAT BASE64 DECODING IS NO GOOD"
output = [
    'SU', 'IB', 'VE', 'Tz', 'TE', 'RF', 'IE', 'WT', 'T1', 'VU',
    'IE', 'VG', 'SH', 'Qb', 'VD', 'IH', 'Qm', 'QY', 'Uz', 'RU',
    'Nj', 'NH', 'IF', 'RP', 'RX', 'Q3', 'Tz', 'RE', 'ST', 'Tl',
    'R1', 'IP', 'SW', 'Uz', 'ID', 'Tg', 'Tz', 'IA', 'R2', 'T8',
    'T3', 'RN',
]
b = ""

for x, y in enumerate(t):
    z = f"{ord(y):08b}"
    if x < 42:
        a = z[:6]
        d = output[x][1]
        e = t1.index(output[x][0])
        g = t1.index(output[x][1])
        b += f"{g:06b}"[-4:]  # 將後 4 位加入到 b 中
    else:
        pass

print("b:", b)

執行結果：

PS D:\project> & "C:/Program Files/Python39/python.exe" "d:/project/ACECTF/Custom Encoding Scheme/decrypt.py"
b: 010000010100001101000101010000110101010001000110011110110011011101101000001101000011011101011111011101110011010000110101010111110110001100110000001100000110110001111101

Flag-Fetcher

GET /a HTTP/1.1
Host: 34.131.133.224
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Accept: */*
Referer: http://34.131.133.224/Flag-Fetcher/
Accept-Encoding: gzip, deflate, br
Connection: keep-alive

GET /c HTTP/1.1
Host: 34.131.133.224
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Accept: */*
Referer: http://34.131.133.224/Flag-Fetcher/
Accept-Encoding: gzip, deflate, br
Connection: keep-alive

以此類推。

Cryptic Pixels

先 binwalk 圖片，取得一個加密 zip：

┌──(yoyo@kali)-[~/Downloads/_1.png.extracted]
└─$ zip2john B8103.zip > zip.hash
ver 1.0 efh 5455 efh 7875 B8103.zip/flag.txt PKZIP Encr: 2b chk, TS_chk, cmplen=38, decmplen=26, crc=49DE1393 ts=1897 cs=1897 type=0

┌──(yoyo@kali)-[~/Downloads/_1.png.extracted]
└─$ cat zip.hash
B8103.zip/flag.txt:$pkzip$1*2*2*0*26*1a*49de1393*0*42*0*26*1897*aeb6677771adf0183e07d66cb64afc78fcde6601915eab09850c6c1198193b1677a163c248b0b0*$/pkzip$:flag.txt:B8103.zip::B8103.zip

┌──(yoyo@kali)-[~/Downloads/_1.png.extracted]
└─$ john zip.hash --wordlist=john.lst
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
qwertyuiop        (B8103.zip/flag.txt)
1g 0:00:00:00 DONE (2025-02-28 14:52) 50.00g/s 177300p/s 177300c/s 173300C/s 12356..sss
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

flag.txt 內容為：

JLNLCO{q4q4_h0d'a3_5v4a7}

經過 ROT 還原就是 flag 了。

Feedback Form

Webrypto

https://chal.acectf.tech/Webrypto/?tom[]=a&jerry[]=b

Insanity Check