2023-10-30
00404c13 50 ?? 50h P
00404c14 75 ?? 75h u
00404c15 62 ?? 62h b
00404c16 6c ?? 6Ch l
00404c17 69 ?? 69h i
00404c18 63 ?? 63h c
00404c19 4b ?? 4Bh K
00404c1a 65 ?? 65h e
00404c1b 79 ?? 79h y
00404c1c 54 ?? 54h T
00404c1d 6f ?? 6Fh o
00404c1e 6b ?? 6Bh k
00404c1f 65 ?? 65h e
00404c20 6e ?? 6Eh n
00404c21 3d ?? 3Dh =
00404c22 62 ?? 62h b
00404c23 30 ?? 30h 0
00404c24 33 ?? 33h 3
00404c25 66 ?? 66h f
00404c26 35 ?? 35h 5
00404c27 66 ?? 66h f
00404c28 37 ?? 37h 7
00404c29 66 ?? 66h f
00404c2a 31 ?? 31h 1
00404c2b 31 ?? 31h 1
00404c2c 64 ?? 64h d
00404c2d 35 ?? 35h 5
00404c2e 30 ?? 30h 0
00404c2f 61 ?? 61h a
00404c30 33 ?? 33h 3
00404c31 61 ?? 61h a
iv = bytearray([
1, 35, 69, 103, 137, 171, 205, 239, 254, 220, 186, 152, 118, 84, 50, 16
])
013145674789abcdfe9cba849c744a1050
Successful password found: slutbear
Successful derived 64-character AES key: 6ad37072eb54de6f89fa02f1910c705f90951f36325d1b0c12889017db834286
user/kali 2023.10.30 15:09:08 /mnt/tmp/2023HuntressCTF/blackcat2/victim-files$ cat [13.py](http://13.py/)
import hashlib
import binascii
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
def generate_aes_key_from_password(password):
salt = b"KnownSaltValue"
iterations = 10000
dklen = 32
key = hashlib.pbkdf2_hmac('sha256', password.encode(), salt, iterations, dklen=dklen)
return binascii.hexlify(key).decode()
def decrypt_file(cipher_text, key, iv):
cipher = AES.new(bytes.fromhex(key), AES.MODE_CFB, iv)
try:
plain_text = unpad(cipher.decrypt(cipher_text), AES.block_size)
return plain_text
except ValueError:
return None
victim_file_path = '/mnt/tmp/2023HuntressCTF/blackcat2/victim-files/Wanderer_above_the_Sea_of_Fog_by_Caspar_David_Friedrich_large.jpg.encry'
iv = bytearray([
1, 35, 69, 103, 137, 171, 205, 239, 254, 220, 186, 152, 118, 84, 50, 16
])
with open(victim_file_path, 'rb') as file:
ciphertext = file.read()
jpg_header = b'\xFF\xD8'
wordlist_path = '/usr/share/wordlists/rockyou.txt'
with open(wordlist_path, 'r', errors='replace') as file:
for line in file:
password = line.strip()
aes_key = generate_aes_key_from_password(password)
print(f"Trying password: {password}")
print(f"Derived AES key: {aes_key}")
decrypted_text = decrypt_file(ciphertext, aes_key, iv)
if decrypted_text and decrypted_text.startswith(jpg_header):
print(f"Successful password found: {password}")
print(f"Successful derived 64-character AES key: {aes_key}")
# Save the decrypted file if it has a valid JPG header
with open('decrypted_flag.jpg', 'wb') as jpg_file:
jpg_file.write(decrypted_text)
with open(victim_file_path.replace('.encry', '.decry'), 'wb') as dec_file:
dec_file.write(decrypted_text)
break
user/kali 2023.10.30 15:30:43 /mnt/tmp/2023HuntressCTF/blackcat2/victim-files$ xxd -d decrypted_flag.jpg| head
00000000: ffd8 09c0 4d9a bd8b fbfe d43d c6c6 e796 ....M......=....
00000016: 200d 0ffa cf3a 9647 57f1 e432 4d7f 1ab6 ....:.GW..2M...
00000032: 3308 e0eb 3464 5191 7bbd 89c5 b86d 1eeb 3...4dQ.{....m..
00000048: 7456 31da 8c92 72b7 cc22 e49a b26b 29df tV1...r.."...k).
00000064: 27c5 ef6f 2f96 4d51 3543 20c7 ee14 bb30 '..o/.MQ5C ....0
00000080: 19d2 7288 775b 538f 1ab3 39af a644 7706 ..r.w[S...9..Dw.
00000096: 33bd 7a79 beaa 3755 f5f0 aca9 0598 7fb8 3.zy..7U........
00000112: 7f89 fd08 cdc2 3217 3d6b f8a1 252d a158 ......2.=k..%-.X
00000128: ef67 06d1 9748 5f5a acc7 6251 496c 96fb .g...H_Z..bQIl..
00000144: b5de b8a7 0203 6d2b 22ab eb78 2f0e 4b11 ......m+"..x/.K.