~/

PwnMe CTF quals 2025 - Easy diffy, My ZED and My BetterZED writeups [crypto]

Here are writeups for crypto challenges Easy diffy, my ZED and my BetterZED from PwnME CTF quals 2025

Easy diffy

Difficulty : Intro

Source files

Description : I managed to generate strong parameters for our diffie-hellman key exchange, i think my message is now safe.

Author : wepfen (me ofc)

TL;DR

  • notice that $ g \equiv p-1 \equiv -1 \mod p $

  • And when this happens, modular arithmetic tell us that $g^{k} \equiv (-1)^{k} \mod p$ which is either 1 or -1

  • So the shared key is actually g-1, decrypt the flag with it

Introduction

For this challenge we have a python script generating diffie hellman parameters and use the shared secret sha256 hash as a AES key to encrypt the flag.

I made this challenge so everyone can solve a challenge and have its shot of dopamine <3.

Code analysis

Here’s the python script.

source.py 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

from Crypto.Util.number import getPrime, long_to_bytes
from Crypto.Util.Padding import pad, unpad
from Crypto.Cipher import AES
from hashlib import sha256

import os

# generating strong parameters

flag = b"REDACTED" 

p = getPrime(1536)
g = p-1

a = getPrime(1536)
b = getPrime(1536)

A = pow(g, a, p)
B = pow(g, b, p)

assert pow(A, b, p) == pow(B, a, p)

C = pow(B, a, p)

# Encrypting my message

key = long_to_bytes(C)
key = sha256(key).digest()[:16]

cipher = AES.new(key, AES.MODE_ECB)
ciphertext = cipher.encrypt(pad(flag, AES.block_size))

print(f"{p = }")
print(f"{g = }")
print("ciphertext =", ciphertext.hex())

And the output :

output.txt 
1
2
3

p = 1740527743356518530873219004517954317742405916450945010211514630307030225825627940655848700898186119703288416676610512180281414181211686282526701502342109420226095690170506537523420657033019751819646839624557146950127906808859045989204720555752289247833349649020285507405445896768256093961814925065500513967524214087124440421275882981975756344900858314408284866222751684730112931487043308502610244878601557822285922054548064505819094588752116864763643689272130951
g = 1740527743356518530873219004517954317742405916450945010211514630307030225825627940655848700898186119703288416676610512180281414181211686282526701502342109420226095690170506537523420657033019751819646839624557146950127906808859045989204720555752289247833349649020285507405445896768256093961814925065500513967524214087124440421275882981975756344900858314408284866222751684730112931487043308502610244878601557822285922054548064505819094588752116864763643689272130950
ciphertext = f2803af955eebc0b24cf872f3c9e3c1fdd072c6da1202fe3c7250fd1058c0bc810b052cf99ebfe424ce82dc31a3ba94f

Diffie Hellman reminder

Before reading the code, here’s a quick recap of diffie hellman key exchange.

We got two person Alice and Bob who want to talk securely by encrypting their message with the same key. But they can’t scream this key in front of everyone, because some eavesdroppers can steal this key to decrypt their conversation.

So instead, they exchange the key using mathematics.

Two public variables are selected and shared by Alice and Bob : g and p. p is a prime number and g is used to generate public keys.

$$A \equiv g^{a} \mod p$$

Then Bob does the same with it’s private key b and send its public key B to Alice and receive Alice’s public key.

Then they compute the shared secret s that will be the symmectric key to encrypt their communication :

$$ s \equiv A^{b} \equiv (g^{a})^{b} \equiv g^{ab}\mod p $$$$ s \equiv B^{a} \equiv (g^{b})^{a} \equiv g^{ba}\mod p $$

DHKE wikipedia

Actually reading the code

  1. First a prime p is randomly generated and the generator g is equal to $p-1$
1
2

p = getPrime(1536)
g = p-1

A generator is, as his name suggest, used to generate a group of number by computing $g^{k} \mod p$. So if wrongly chosen, the group of number can be small and so it can compromise the robustness of the key exchange.

  1. The private keys a and b are randomly chosen
1
2

a = getPrime(1536)
b = getPrime(1536)
  1. The public keys A and B are computed using the generator and the private keys
1
2

A = pow(g, a, p)
B = pow(g, b, p)
  1. The shared secret is computed
1
2
3

assert pow(A, b, p) == pow(B, a, p)

C = pow(B, a, p)
  1. Finally the shared secret is used as a key and the flag is encrypted with it
1
2
3
4
5

key = long_to_bytes(C)
key = sha256(key).digest()[:16]

cipher = AES.new(key, AES.MODE_ECB)
ciphertext = cipher.encrypt(pad(flag, AES.block_size))

One may think it is a classic diffie hellman key exchange but by quickly looking at the DHKE wiki page, we can understand that the chosen generator is uncommon.

Knowing a little bit of modular arithmetic (or just testing out the code), we can figure out that using $g = p-1$ makes every power of g equal to 1 or -1 mod p.

So, the public keys A and B, which are a power of g,are either 1 or -1 :

$$ g \equiv p-1 \mod p $$$$ g \equiv -1 \mod p $$$$ (-1)^{k} \equiv \pm 1 \mod p$$

It is equal to 1 if k is even. And it is equal to 1 if k is odd.

$$ (-1)^k=\begin{cases} -1 & k=\text{odd} \\ 1 & k=\text{even } \end{cases} $$

But as the private keys are prime numbers, they are odd :

$$ g^{a} \equiv g^{b} \equiv -1 \equiv p-1 \mod p $$

So the shared secert is actually $p-1$.

gmodp barney

And a topic about this : https://crypto.stackexchange.com/questions/77868/for-diffie-hellman-why-is-a-g-value-of-p%e2%88%921-not-a-suitable-choice.

Solving

As we stated that the private key is p-1, we can reuse the g from the output.txt as the private key.

solve.py 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
from Crypto.Util.number import long_to_bytes
from hashlib import sha256

p = 1740527743356518530873219004517954317742405916450945010211514630307030225825627940655848700898186119703288416676610512180281414181211686282526701502342109420226095690170506537523420657033019751819646839624557146950127906808859045989204720555752289247833349649020285507405445896768256093961814925065500513967524214087124440421275882981975756344900858314408284866222751684730112931487043308502610244878601557822285922054548064505819094588752116864763643689272130951

ciphertext =  bytes.fromhex("f2803af955eebc0b24cf872f3c9e3c1fdd072c6da1202fe3c7250fd1058c0bc810b052cf99ebfe424ce82dc31a3ba94f")

shared_secret = p - 1

key = long_to_bytes(shared_secret)
key = sha256(key).digest()[:16]

cipher = AES.new(key, AES.MODE_ECB)

message = unpad(cipher.decrypt(ciphertext), 16)
print(message)

FLAG : PWNME{411_my_h0m13s_h4t35_sm411_Gs}

My ZED

Difficulty : Easy

Source files

Description : Tried to make an opensource zedencrypt in 2 weeks but i got doubts about it …

Author : wepfen (me again)

TL;DR

  • Decompress ciphertext with zlib

  • Get IV which is prepended to the cipertext

  • Intended way :

    1. The IV is made of the concatenation of the username and the password, so it has a part of the password used to generate the key

    2. So we can get the 13 first characters of the password and we need to bruteforce the three lasts

    3. Decrypt the ciphertext

  • Unintended way :

    1. Decode the hash in the metadata from hex

    2. Get the first 16 bytes and decrypt the ciphertext with it

Introduction

For this challenge, we have got a custom lib that can encrypt files given an username, a password and a filename.

It then generate a ciphertext, prepend it by a magic bytes and the metadata in JSON format and write it to a file with “OZED” extension.

The plaintext is compressed with zlib before getting encrypted with AES-CBC-ZED, a mix of AES-CBC and AES-CFB.

A paper from Camille Mougey at sstic 2024 gave me the idea of this challenge. We can find AES CBC ZED at section 2.5

Code analysis

Here’s the challenge script :

challenge.py 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

from openzedlib import openzed
import os
import zlib

from flag import FLAG


file = openzed.Openzed(b'zed', os.urandom(16), 'flag.txt', len(FLAG))

file.encrypt(FLAG)

file.generate_container()

with open(f"{file.filename}.ozed", "wb") as f:
	f.write(file.secure_container)

Which relies on openzed.py :

openzed.py 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77

from openzedlib.aes_cbc_zed import AES_CBC_ZED 
from hashlib import sha256

import json
import zlib


class Openzed:

	def __init__(self, user=b"user", password=b"OpenZEDdefaultpasswordtochangebeforedeployinproduction", filename="file", size=0):
		self.user = user
		self.password = password
		self.filename = filename
		self.size = size
		self.generate_metadata()

	"""Metadata 
	format : {"size": 0, "filename": "", "user": "", "password_hash": ""}+padding

	(size = 300 bytes and formatted in json)
	
	header ("OZED") -> 4
	size -> 4
	filename -> 112
	user -> 32
	password_hash -> 64
	json size -> 60
	"""

	def generate_metadata(self):
		
		metadata = {}
		metadata["user"] = self.user.decode()
		metadata["password_hash"] = sha256(self.password).hexdigest()
		metadata["filename"] = self.filename
		metadata["size"] = self.size

		self.metadata = json.dumps(metadata).encode()

		self.padding_len = 300-len(self.metadata)
		self.metadata += self.padding_len*b"\x00"
		
		return self.metadata
	
	def encrypt(self, data):
	
		cipher = AES_CBC_ZED(self.user, self.password)
		self.encrypted = cipher.encrypt(data)
		self.encrypted = zlib.compress(self.encrypted) # just for the lore
		
		return self.encrypted

	def decrypt(self, ciphertext):

		cipher = AES_CBC_ZED(self.user, self.password)
		ciphertext = zlib.decompress(ciphertext)
		self.decrypted = cipher.decrypt(ciphertext)
		
		return self.decrypted

	def generate_container(self):
		self.secure_container = b'OZED' + self.metadata + self.encrypted
		return self.secure_container

	def decrypt_container(self, container):

		self.read_metadata()
		filename = self.parsed_metadata["filename"]
		
		ciphertext = container[304:]

		plaintext = self.decrypt(ciphertext)
		return {"data":plaintext, "filename":filename}

	def read_metadata(self):
		self.parsed_metadata = json.loads(self.secure_container[4:300-self.padding_len+4])
		return self.parsed_metadata

Which relies on aes_cbc_zed.py :

aes_cbc_zed.py 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89

from Crypto.Cipher import AES
from hashlib import sha256

import os

def xor(a: bytes, b: bytes) -> bytes:
	return bytes(x^y for x,y in zip(a,b))

class AES_CBC_ZED:
	def __init__(self, user, password):
		self.user = user
		self.password = password
		self.derive_password()
		self.generate_iv()

	def encrypt(self, plaintext: bytes):
		iv = self.iv
		ciphertext = b""
		ecb_cipher = AES.new(key=self.key, mode=AES.MODE_ECB)
		
		
		for pos in range(0, len(plaintext), 16):
			chunk = plaintext[pos:pos+16]
			
			# AES CFB for the last block or if there is only one block
			if len(plaintext[pos+16:pos+32]) == 0 :
				#if plaintext length <= 16, iv = self.iv
				if len(plaintext) <= 16 :
					prev=iv
				# else, iv = previous ciphertext
				else:
					prev=ciphertext[pos-16:pos]
					
				prev = ecb_cipher.encrypt(prev)
				ciphertext += xor(chunk, prev)
			
			# AES CBC for the n-1 firsts block
			elif not ciphertext:
				xored = bytes(xor(plaintext, iv))
				ciphertext += ecb_cipher.encrypt(xored)
				
			else:
				xored = bytes(xor(chunk, ciphertext[pos-16:pos]))
				ciphertext += ecb_cipher.encrypt(xored)

		return iv + ciphertext


	def decrypt(self, ciphertext: bytes):
		# TODO prendre un iv déjà connu en paramètre ?
		plaintext = b""
		ecb_cipher = AES.new(key=self.key, mode=AES.MODE_ECB)
		iv = ciphertext[:16]
		ciphertext = ciphertext[16:]
		
		for pos in range(0, len(ciphertext), 16):
			chunk = ciphertext[pos:pos+16]
			
			# AES CFB for the last block or if there is only one block
			if len(ciphertext[pos+16:pos+32]) == 0 :
				
				#if plaintext length <= 16, iv = self.iv
				if len(ciphertext) <= 16 :
					prev=iv
				# else, iv = previous ciphertext
				else:
					prev=ciphertext[pos-16:pos]

				prev = ecb_cipher.encrypt(prev)
				plaintext += xor(prev, chunk)
				
			# AES CBC for the n-1 firsts block
			elif not plaintext:
				xored = ecb_cipher.decrypt(chunk)
				plaintext += bytes(xor(xored, iv))
				
			else:
				xored = ecb_cipher.decrypt(chunk)
				plaintext += bytes(xor(xored, ciphertext[pos-16:pos]))
				
		return plaintext
			
	
	def derive_password(self):
		for i in range(100):
			self.key = sha256(self.password).digest()[:16]

	def generate_iv(self):
		self.iv = (self.user+self.password)[:16]

So, in challenge.py, a Openzed intance is created with the username zed, a random password and the filename “flag.txt”.

file = openzed.Openzed(b'zed', os.urandom(16), 'flag.txt', len(FLAG))

It’s encrypted with the method encrypt() and a generate the secure container.

Let’s dig in the openzed object to see what happens here.

Openzed

First, the initialization of the class :

1
2
3
4
5
6
7
8

class Openzed:

	def __init__(self, user=b"user", password=b"OpenZEDdefaultpasswordtochangebeforedeployinproduction", filename="file", size=0):
		self.user = user
		self.password = password
		self.filename = filename
		self.size = size
		self.generate_metadata()

The default variable values are unused because they are overwriten in challenge.py.

A function is called, generate_metadata() :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

def generate_metadata(self):
		
		metadata = {}
		metadata["user"] = self.user.decode()
		metadata["password_hash"] = sha256(self.password).hexdigest()
		metadata["filename"] = self.filename
		metadata["size"] = self.size

		self.metadata = json.dumps(metadata).encode()

		self.padding_len = 300-len(self.metadata)
		self.metadata += self.padding_len*b"\x00"
		
		return self.metadata

Which put the username, the password hash in sha256, the filename and the size in a JSON and store it in metadata attribute. It adds padding at the end of it by substracting the length of the metadata with 300. So the metadata length is maximum 300 characters.

Now looking at the encrypt() function in openzed:

1
2
3
4
5
6
7

def encrypt(self, data):
	
		cipher = AES_CBC_ZED(self.user, self.password)
		self.encrypted = cipher.encrypt(data)
		self.encrypted = zlib.compress(self.encrypted) # just for the lore
		
		return self.encrypted

It calls aes_cbc_zed python file, encrypt the data with the latter and compress the result with zlib (for the lore of the ‘secure’ compressed container).

Let’s dive in aes_cbc_zed.py.

AES CBC ZED

At initialization:

1
2
3
4
5
6

class AES_CBC_ZED:
	def __init__(self, user, password):
		self.user = user
		self.password = password
		self.derive_password()
		self.generate_iv()

It sets the specified username and password, generate a key using derive_password and generate an iv.

Let’s derive_password()

1
2
3

def derive_password(self):
	for i in range(100):
		self.key = sha256(self.password).digest()[:16]

Well, I badly messed up my code resulting in using the password hash as the key and having at the same time, the password hash in the metadata. Thanks to dolipr4necrypt0 who noticed that.

It was supposed to hashes the password 100 times in a row taking the 16 first bytes each times , and store the result in self.key. But i messed up, and actually it just hash the password one time.

It should have been that :

1
2
3
4

def derive_password(self):
  self.key = self.password
	for i in range(100):
		self.key = sha512(self.key).digest()[:16]

I use sha512 so that the player cannot recover the the key with the sha256 hash of the password in the metadata.

And what about generate_iv() :

1
2

def generate_iv(self):
	self.iv = (self.user+self.password)[:16]

Well, it leaks a pretty useful part of the password, we miss the last three characters, which allow us to bruteforce 256**3 == 16777216 possiblities (doable). And usually, the IV is supposed safe to share and is necessary to decrypt files, so it is given.

Reading encrypt(), we see that that the return value is iv + ciphertext.

1
2
3
4
5
6
7
8

	def encrypt(self, plaintext: bytes):
		iv = self.iv
		ciphertext = b""
		ecb_cipher = AES.new(key=self.key, mode=AES.MODE_ECB)
		
    [ ... ]

		return iv + ciphertext

And decrypt() function extract IV from the cipertext:

1
2
3
4
5
6
7
8
9

def decrypt(self, ciphertext: bytes):
	plaintext = b""
	ecb_cipher = AES.new(key=self.key, mode=AES.MODE_ECB)
	iv = ciphertext[:16]
	ciphertext = ciphertext[16:]

  [ ... ]

  return plaintext

So, we can recover the part of the password from there and bruteforce the 3 last bytes.

Solving

So knowing that, we can extract the ciphertext from the output file flag.txt.ozed.

Remember that the file is made of the ‘OZED’ magic byte followed by 300 bytes of metadata and then, the ciphertext which is composed of the IV followed by the ciphertext.

Then to get the IV we can read from the ozed file and get 16 bytes after 304 bytes:

1
2
3
4

container_file = open("flag.txt.ozed", "rb").read()
ciphertext = zlib.decompress(container_file[304:])

iv = ciphertext[:16]

Intended (by bruteforcing the 3 remaining bytes of the password)

We extracted the IV we can get the first 13 bytes of the password :

1

part_password = iv[3:16]

Now we got two solutions:

  • naive : bruteforce the three lasts bytes of the password and try to decrypt each time until we find PWNME in the plaintext. (10 minutes to solve)
  • less naive : bruteforce the three lasts bytes of the password, hash the candidates and compare it with password_hash in the metadata. (10 sec to solve). Doing that, we only derive the password (which take a lot of ressources), only if we know we got the correct password.

Try to guess which one I first implemented.

clueless

example of script :

solve.py 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

#! /usr/bin/env python3

import zlib
import itertools
import hashlib
import re
import json

from tqdm import tqdm
from openzedlib.aes_cbc_zed import AES_CBC_ZED 


container_file = open("flag.txt.ozed", "rb").read()
ciphertext = zlib.decompress(container_file[304:])

# Manually read the ozed file and copy the json in the metadata

metadata = json.loads(re.search(b"{(?:[^{}])*}", container_file).group(0))
password_hash = metadata["password_hash"]

# we got user = "zed" et part_password = iv[3:16]

def bruteforce_password(ciphertext):

	iv = ciphertext[:16]
	ct = ciphertext[16:]

	user = iv[:3]
	password = iv[3:16]
	
	cipher = AES_CBC_ZED(user, password)
	
	# get all bytes possibilities
	bytes_possibilities = list(itertools.product(range(256), repeat=3))
	
	for suffix in tqdm(bytes_possibilities):
		candidate_password = password+bytes(suffix)
		hashed = hashlib.sha256(candidate_password).hexdigest()

		if hashed == password_hash:
			cipher.password = candidate_password
			cipher.derive_password()
			plaintext = cipher.decrypt(ciphertext)
			print(plaintext)
			break

if __name__ == "__main__":
	bruteforce_password(ciphertext) # about 10 sec to solve

FLAG : PWNME{49e531f28d1cedef03103af6cec79669_th4t_v3Ct0r_k1nd4_l3aky} 7

Unintended (using the hash)

For this one, we just have to decode the password hash from hex which is in the metadata, and take the first 16 bytes, and decrypt everything.

solve-unintended.py 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

import zlib

from hashlib import sha256
from openzedlib.aes_cbc_zed import AES_CBC_ZED

container_file = open("flag.txt.ozed", "rb").read()
ciphertext = zlib.decompress(container_file[304:])

key = bytes.fromhex("b3a97eb583db5a940c0705e6450b81f4d702a9122d7342a25768e3d75be739be")[:16]

cipher = AES_CBC_ZED(b"", b"")
cipher.key = key
cipher.iv = ciphertext[:16]
plaintext = cipher.decrypt(ciphertext)
print(plaintext)

And it works perfectly : b'PWNME{49e531f28d1cedef03103af6cec79669_th4t_v3Ct0r_k1nd4_l3aky}'

My BetterZED

Difficulty : Easy

Source files

Description : Patched OpenZed an made it more secure.

Author : wepfen (still me)

TL;DR

  • When requesting the flag, the key doesn’t change, only the IV does.

  • Notice that the flag has a length of 16 bytes, and so, is encrypted with AES CFB. The IV is encrypted and then xored with the flag.

  • Request a flag a keep the IV, send 16 bytes with the same IV used for the flag and encrypt it. Compares the resulting ciphertext with the encrypted flag.

  • Or, send 16 null bytes with the same IV, resulting in the IV encrypted and xor it with the encrypted flag.

Introduction

This challenge is as My ZED but with some patches and with a web interface. On the web interface, we can choose to :

  • request an encrypted flag

  • encrypt a file and submit optional username, password and IV

  • decrypt a file by giving username and password

I will just focus on the edited parts since I already explained My ZED.

Code analysis

There is the file running the web application :

app.py 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125

import os
import io
import string

from flask import Flask, render_template, send_file, request
from openzedlib import openzed



app = Flask(__name__, 
			template_folder="./web/templates",
			static_folder="./web/static")
			
FLAG = os.getenv("FLAG", "PWNME{flag_test}")
KEY = os.urandom(16)
USER = b"pwnme"

assert len(FLAG) <= 16

@app.route('/', methods=['GET'])
def home():
    return render_template('index.html')

@app.route('/encrypt_flag/', methods=['GET'])
def encrypt_flag():
	#chiffrer avec des creds random

	file = openzed.Openzed(USER, KEY, 'flag.txt.ozed')
	file.encrypt(FLAG.encode())
	file.generate_container()

	#tricking flask into thinking the data come from a file
	encrypted = io.BytesIO(file.secure_container)

	return send_file(
        encrypted,
        mimetype='text/plain',
        as_attachment=False,
        download_name='flag.txt.ozed'
    )


@app.route('/encrypt/', methods=['POST'])
def encrypt_file():
	
	if request.form["username"] and request.form["password"]:
		username = request.form["username"].encode()
		password = bytes.fromhex(request.form["password"])
	else:
		username = USER
		password = KEY

	if request.form["iv"] :
		try : 
			iv = request.form["iv"]
		except:
			return "Please submit iv hex encoded"
	else:
		iv = None

	if not request.files or not request.files["file"].filename:
		return "Please upload a file"
	

	filename = request.files["file"].filename
	file_to_encrypt = request.files['file']

	data = file_to_encrypt.stream.read()

	file = openzed.Openzed(username, password, filename, iv)
	file.encrypt(data)
	file.generate_container()

	encrypted = io.BytesIO(file.secure_container)

	return send_file(
        encrypted,
        mimetype='text/plain',
        as_attachment=False,
        download_name=filename+".ozed"
    )



@app.route('/decrypt/', methods=['POST'])
def decrypt_file():

	if not request.form["username"] :
		return "Please submit an username"

	if not request.form["password"]:
		return "Please submit a password"

	try : 
		bytes.fromhex(request.form["password"])
	except:
		return "Please submit the password hex encoded"

	if not request.files or not request.files["file"].filename:
		return "Please upload a file"
	
	username = request.form["username"].encode()
	password = bytes.fromhex(request.form["password"])

	filename = request.files["file"].filename
	file_to_decrypt = request.files['file']
	data = file_to_decrypt.stream.read()
		
	file = openzed.Openzed(username, password, filename)
	file.secure_container = data
	
	decrypted = file.decrypt_container(file.secure_container)
	decrypted = io.BytesIO(decrypted["data"])

	return send_file(
        decrypted,
        mimetype='text/plain',
        as_attachment=False,
        download_name=filename+".dec"
    )

# 10 MB = 2**20 * 10
if __name__ == "__main__":
	app.config['MAX_CONTENT_LENGTH'] = 1 * 1024 * 1024
	app.run(debug=False, host='0.0.0.0', port=5000)

I removed the size value from the metadata in openzed.py and added the future to submit an IV at the creation of the instance. If no IV is submitted, then a random one will be chosen.

openzed.py 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

	def generate_iv(self, iv):
		if iv == None:
			self.iv = os.urandom(16)
			return
		
		try:

			iv = bytes.fromhex(iv)
			if len(iv) != 16:
				raise ValueError("IV should have a length of 16")
			self.iv = iv

		except Exception as e:
			raise e

I also removed the size value from the metadata and edited the derive_password function from aes_cbc_zed.py :

aes_cbc_zed.py 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

class AES_CBC_ZED:
	def __init__(
		self, 
		user : str, 
		password : str, 
		iv : bytes
	):
		self.user = user
		self.iv = iv
		self.password = password
		self.derive_password()

[ ... ]

	def derive_password(self):
		salt = b"LESELFRANCAIS!!!"
		self.key = PBKDF2(self.password, salt, 16, count=10000, hmac_hash_module=SHA256)

Web interface endpoints

Reading app.py :

1
2
3
4
5

FLAG = os.getenv("FLAG", "PWNME{flag_test}")
KEY = os.urandom(16)
USER = b"pwnme"

assert len(FLAG) <= 16

We can understand that the key is defined once, so when requesting the flag multiple times, the same key will be used until we deploy another instance. Also, the user is “pwnme”.

Requesting /encrypt_flag/, we get the flag encrypted with the key generated at the start :

1
2
3
4
5
6
7
8
9

@app.route('/encrypt_flag/', methods=['GET'])
def encrypt_flag():
	#chiffrer avec des creds random

	file = openzed.Openzed(USER, KEY, 'flag.txt.ozed')
	file.encrypt(FLAG.encode())
	file.generate_container()

  return send_file(encrypted, mimetype='text/plain', as_attachment=False, download_name='flag.txt.ozed')

Looking at /encrypt/ :

1
2
3
4
5
6
7
8
9

@app.route('/encrypt/', methods=['POST'])
def encrypt_file():
	
	if request.form["username"] and request.form["password"]:
		username = request.form["username"].encode()
		password = bytes.fromhex(request.form["password"])
	else:
		username = USER
		password = KEY

If one submit an user and a password, the file will be encrypted with it. Else, the user and the key defined at the start of the instance will be used.

And after that, the file will be encrypted and returned to us.

Finally, looking at /decrypt/ :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

@app.route('/decrypt/', methods=['POST'])
def decrypt_file():

	if not request.form["username"] :
		return "Please submit an username"

	if not request.form["password"]:
		return "Please submit a password"

	try : 
		bytes.fromhex(request.form["password"])
	except:
		return "Please submit the password hex encoded"

	if not request.files or not request.files["file"].filename:
		return "Please upload a file"

We must submit an username and a password but not an IV because the IV is supposed to already be inside the ciphertext.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

	
	filename = request.files["file"].filename
	file_to_decrypt = request.files['file']
	data = file_to_decrypt.stream.read()
		
	file = openzed.Openzed(username, password, filename)
	file.secure_container = data
	
	decrypted = file.decrypt_container(file.secure_container)
	decrypted = io.BytesIO(decrypted["data"])

	return send_file(decrypted, mimetype='text/plain', as_attachment=False, download_name=filename+".dec")

Then, it is decrypted with the submitted parameter and returned to us.

Where’s the vulnerability ?

The previous vulnerability from My Zed is not relevant because the password is derived differently and the :

1
2
3

	def derive_password(self):
		salt = b"LESELFRANCAIS!!!"
		self.key = PBKDF2(self.password, salt, 16, count=10000, hmac_hash_module=SHA256

So let’s look deeper at the process of encrypting and decrypting.

To get decrypted/encrypted, a call to encrypt() or decrypt() have to be made to an openzed object :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

	def encrypt(self, data):
	
		cipher = AES_CBC_ZED(self.user, self.password, self.iv)
		self.encrypted = cipher.encrypt(data)
		self.encrypted = zlib.compress(self.encrypted) # just for the lore	

		return self.encrypted

	def decrypt(self, ciphertext):

		cipher = AES_CBC_ZED(self.user, self.password, self.iv)
		ciphertext = zlib.decompress(ciphertext)
		self.decrypted = cipher.decrypt(ciphertext)
		
		return self.decrypted

Which call an underlying function decrypt/encrypt from AES_CBC_ZED object. Let’s look at the encrypt function :

aes_cbc_zed.encrypt 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

def encrypt(self, plaintext: bytes):
		iv = self.iv
		ciphertext = b""
		ecb_cipher = AES.new(key=self.key, mode=AES.MODE_ECB)
		
		
		for pos in range(0, len(plaintext), 16):
			chunk = plaintext[pos:pos+16]
			
			# AES CFB for the last block or if there is only one block
			if len(plaintext[pos+16:pos+32]) == 0 :
				#if plaintext length <= 16, iv = self.iv
				if len(plaintext) <= 16 :
					prev=iv
				# else, iv = previous ciphertext
				else:
					prev=ciphertext[pos-16:pos]
					
				prev = ecb_cipher.encrypt(prev)
				ciphertext += xor(chunk, prev)
			
			# AES CBC for the n-1 firsts block
			elif not ciphertext:
				xored = bytes(xor(plaintext, iv))
				ciphertext += ecb_cipher.encrypt(xored)
				
			else:
				xored = bytes(xor(chunk, ciphertext[pos-16:pos]))
				ciphertext += ecb_cipher.encrypt(xored)

		return ciphertext

In shorts, if the plaintext as a length of more than 16 :

aes cbc zed encrypt

The first blocks are encrypted with AES CBC and the last with AES CFB.

But when the plaintext has a length below or equal to 16 :

aes cbc zed encrypt

The plaintext is encrypted with AES CFB.

With decrypt(), the process is reproduced but in reverse.

Fast forward, remember the flag has a length of 16 in app.py:18 : assert len(FLAG) <= 16.

So it is encrypted with the CFB part which is :

  • encrypt the IV with the KEY (the key never change)
  • xor it with the plaintext

There are two ways to recover the flag :

  • Send a file of length 16 with only null bytes
  • The result will be the encrypted IV xored with null bytes, so still the IV
  • Then now we got the encrypted IV, we can XOR it with the encrypted flag and get the flag
  • Send 256 files with 16 bytes of value int.from_bytes(i) with i from 0 to 255
  • Send the data one after another with the same IV as the flag
  • See if in the result there are the same byte at the same position on the encrypted file and the encrypted flag
  • recover the flag

betterzed second solution

Solving

Here’s a script for the second solution (2 seconds to solve) :

solve.py 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

from openzedlib import openzed
from tqdm import tqdm

import requests
import re
import io
import zlib

URL = "http://127.0.0.1:5000/"

# request the encrypt file and get the filename

flag_enc = requests.get(URL+"encrypt_flag/")
d = flag_enc.headers['content-disposition']
filename = re.findall("filename=(.+)", d)[0]


# create a openzed object with an user with same length as in the ciphertext, any password, 
# any iv as in the ciphertext and the filename we recovered before

flag_enc_openzed = openzed.Openzed(b"pwnme", b"idk", filename)

# load the flag ciphertext and read it's metadata to get the correct values and recover the IV
# We can also recover the IV manually by reading flag_enc

flag_enc_openzed.secure_container = flag_enc.content
flag_enc_openzed.read_metadata()

iv = flag_enc_openzed.parsed_metadata["iv"]


# Now we can start to craft a payload
# We will encrypt it through /encrypt_file endpoint

flag_ciphertext = flag_enc_openzed.secure_container[304:]
flag = [0] * 16

# trick requests into thinking file.content come from a file by using io.BytesIO
# empty password and username so the oracle KEY and USER get used

for i in tqdm(range(255)):
    payload = [i] * 16

    r = requests.post(URL+"/encrypt/", files={'file': ('file.txt', io.BytesIO(bytearray(payload)))}, data = {"iv" : iv, "username":"", "password":""})

    tmp_ozed = openzed.Openzed(b"pwnme", b"idk", filename, iv)
    tmp_ozed.secure_container = r.content

    # the ciphertext is compressed, openzed.py.openzed.encrypt
    my_ct = zlib.decompress(tmp_ozed.secure_container[304:])
    flag_ct = zlib.decompress(flag_ciphertext)

    for counter, tupl in enumerate(zip(my_ct, flag_ct)):
        if tupl[0] == tupl[1]:
            flag[counter] = i
            print(bytes(flag))


print(bytes(flag))

Flag : PWNME{zEd_15_3z}

Conclusion

With these challenges and the blockchains ones, it was my first time creating challenges.

I learnt a lot during the design stage but made some mistakes resulting in unintended solves.

I will do more challenges for sure but next time, I will try to make more shorter challenge like easy diffy or test more carefully my challenges.

thumb up emoji

Other writeups