This weekend, I took part in the Nuit du Hack quals. Running over 24 hours (Saturday in my timezone), this CTF was a sobering reminder of the effect of time limits: I easily burned 4 hours (25% of productive time!) on a challenge I wouldn’t realistically solve.
Of this CTF, the most interesting – though barely worth any points – challenge I found was the “invest” forensics challenge – it’s not an area I have any actual experience. The challenge starts off with you being provided a pcap file, and a little few ~words~ about someone having built an encryption system.
Taking the pcap, we quickly notice HTTP objects being retrieved from a web server. We can use Wireshark to quickly dump all the files, and we end up with a stack of “encryptxx” files, as well as a logic gate diagram and “key.txt”:
I didn’t know at first what to do with the “encryptxx” files, so I set them aside and looked at the diagram and key.txt. At a glance, the logic gate setup turns 8 inputs into a single output, and the length of “key.txt” is disivible by 8, and the result is divisible by 8 again (i.e. if we pass it through the logic gates, it should come out as a clean series of bytes). I quickly built a Python representation of this diagram:
Running this provides the key “4Ukz95F2YqPi”. Submitting this didn’t work, so I went back to the encryptxx files.
All the encryptxx files look like they’re base64’ed, so I cat’ed them together (cat * > out.bin works – your shell handles expansion of the wildcard, so everything is already in alphabetical order). Decrypting the resulting file gives this:
Almost there! A quick Google search on the “Salted__” header reveals that this is an OpenSSL encrypted file, and a bit of fiddling around with OpenSSL reveals how to decrypt it:
openssl enc -d -aes-256-cbc -a -salt -in encrypt_total -out file.bin
“file” reveals the output file to be Microsoft Word document, with a picture that you can move aside to reveal the key:
This challenge was a lot of fun, and didn’t get solved by many people until later in the CTF. Props to the Nuit du Hack team for putting this one together, looking forward to next year’s CTF!