gsilvis

candy_machine writeup (8 points)

In candy_machine, there is a server that will decrypt strings for us with a fixed, unknown secret key. If we provide a base64-encoded string that decrypts to "candykey", then the server will return a flag. In all other cases, it returns an error, and (except for the case of no key at all), it's always the same error.

The solution is to do a padding oracle attack via either a timing side-channel or a debugging side-channel.

The encryption scheme is:

1. PKCS.7 pad
2. AES-CBC encrypt, and include the IV at the beginning of the output.
3. PKCS.7 pad

gsilvis

Event: NSEC 2021
Challenge: Zencastle (cryptography)
Team: Skiddies as a Service

challenge description

In Zencastle, we were given access to a server running some Python code. The server allowed users to log in, create tickets, and view tickets they created. We were told that there was at least one existing user, "jester". The protocol was as follows:

gsilvis

from Crypto.PublicKey import RSA
from Crypto.Util import number

import encrypt

def load_data():
  global PUB_KEYS
  global CIPHERTEXTS
  PUB_KEYS = []
  CIPHERTEXTS = [None]  # dummy

gsilvis

#include <cassert>

#include <NTL/mat_GF2.h>
#include <NTL/GF2.h>

using NTL::GF2;
using NTL::mat_GF2;
using NTL::conv;

int g(GF2 x1, GF2 z1, GF2 x2, GF2 z2) {

gsilvis

#!/usr/bin/python

from Crypto.Cipher import AES
from SocketServer import ThreadingMixIn
from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler
import sys

class Hasher:
  def __init__(self):
    self.aes = AES.new('\x00'*16)

gsilvis

package main

import (
        "encoding/binary"
        "fmt"
        "io"
        "math"
        "net"
)

gsilvis

from Crypto.Cipher import AES
import hash

def xor_block(state, block):
  block += '\x00'*6
  result = ""
  for i in range(16):
    result += chr(ord(state[i]) ^ ord(block[i]))
  return result

gsilvis

macro_rules! mdo {
  (let $p: pat = $e: expr ; $( $t: tt )*) => (
    { let $p = $e ; mdo! { $( $t )* } }
  );

  (let $p: ident : $ty: ty = $e: expr ; $( $t: tt )*) => (
    { let $p: $ty = $e ; mdo! { $( $t )* } }
  );

  (bindy $p: pat =<< $e: expr ; $( $t: tt )*) => (

gsilvis

#![feature(prelude_import)]
#![no_std]
#[prelude_import]
use std::prelude::v1::*;
#[macro_use]
extern crate std as std;

gsilvis

use std::env;
use std::io;
use std::io::BufRead;
use std::ops::Deref;

#[derive(Debug)]
enum AST {
  Alternation(Vec<AST>),
  Concatenation(Vec<AST>),
  Star(Box<AST>),