Add solutionHEADmaster

7 files changed, 70 insertions, 0 deletions

diff --git a/chall/description b/chall/description
new file mode 100644
index 0000000..6f79f68
--- /dev/null
+++ b/chall/description
@@ -0,0 +1 @@
+What is this non(c/s)ence everyonce is taking about?
diff --git a/chall/intro-crypto-1.zip b/chall/intro-crypto-1.zip
new file mode 100644
index 0000000..142791a
--- /dev/null
+++ b/chall/intro-crypto-1.zip
diff --git a/solve/.gitignore b/solve/.gitignore
new file mode 100644
index 0000000..bee8a64
--- /dev/null
+++ b/solve/.gitignore
@@ -0,0 +1 @@
+__pycache__
diff --git a/solve/flag b/solve/flag
new file mode 100644
index 0000000..d6ca992
--- /dev/null
+++ b/solve/flag
@@ -0,0 +1 @@
+CSCG{CTR_A3S_Br0ken!???N0pe,it's_C4ll3d_number_used_once_f0r_a_r3as0n}
diff --git a/solve/main.py b/solve/main.py
new file mode 100755
index 0000000..68e2417
--- /dev/null
+++ b/solve/main.py
@@ -0,0 +1,41 @@
+#!/usr/bin/env pypy3
+
+import os
+from pydoc import plain
+from sys import byteorder
+from Crypto.Cipher import AES
+from Crypto.Util import Counter
+import hashlib
+
+# Create a secret.py file with a variable `FLAG` for local testing :)
+from secret import FLAG
+
+secret_key = os.urandom(16)
+
+def encrypt(plaintext, counter):
+    m = hashlib.sha256()
+    m.update(counter.to_bytes(8, byteorder="big"))
+
+    alg = AES.new(secret_key, AES.MODE_CTR, nonce=m.digest()[0:8])
+    ciphertext = alg.encrypt(plaintext)
+
+    return ciphertext.hex()
+
+
+def main():
+    print("DES is broken, long live the secure AES encryption!")
+    print("Give me a plaintext and I'll encrypt it a few times for you. For more security of course!")
+
+    try:
+        plaintext = bytes.fromhex(input("Enter some plaintext (hex): "))
+    except ValueError:
+        print("Please enter a hex string next time.")
+        exit(0)
+    
+    for i in range(0, 255):
+        print(f"Ciphertext {i:03d}: {encrypt(plaintext, i)}")
+    
+    print("Flag:", encrypt(FLAG.encode("ascii"), int.from_bytes(os.urandom(1), byteorder="big")))
+
+if __name__ == "__main__":
+    main()
diff --git a/solve/secret.py b/solve/secret.py
new file mode 100644
index 0000000..15e7b35
--- /dev/null
+++ b/solve/secret.py
@@ -0,0 +1 @@
+FLAG = "CSCG{CTR_A3S_Br0ken!???N0pe,it's_C4ll3d_number_used_once_f0r_a_r3as0n}"
diff --git a/solve/solve b/solve/solve
new file mode 100755
index 0000000..351a627
--- /dev/null
+++ b/solve/solve
@@ -0,0 +1,25 @@
+#!/usr/bin/env python3
+
+from pwn import *
+from sys import argv
+
+args = argv[1:]
+if args == []:
+    args = ["python3", "main.py"]
+io = process(args)
+
+io.readuntil(b"(hex): ")
+io.sendline(b"00" * 100)
+
+codes = []
+for i in range(255):
+    io.readuntil(f"Ciphertext {i:03}: ".encode())
+    codes.append(bytes.fromhex(io.readline().strip().decode()))
+
+io.readuntil(b"Flag: ")
+flag = bytes.fromhex(io.readline().decode())
+
+for k in range(255):
+    print(bytes([c ^ codes[k][i] for i,c in enumerate(flag)]))
+    print()
+