CrypteraCTF : 2X
category : reverse engineering + cryptography
remote access : 68.210.200.182 9999
info & goal :
The challenge presents a remote service that processes user input and applies multiple transformations before producing an output.
The goal is to analyze the behavior of the service, understand the applied cryptographic operations, and recover the correct key in order to fully decode the data and retrieve the flag.inital analysis :
After connecting to the service, it was clear that the encryption process consists of two XOR layers.
A hint was provided :
If you know you know, find the first, then find the second
Oracle Interaction & Behavior Analysis :
After interacting with the remote service, the XOR oracle behavior became clearer.
Encrypt Input Function :
The service allows user-controlled plaintext encryption.
When sending a long sequence of identical characters (A), the output ciphertext showed a repeating pattern, which is a strong indicator of XOR based encryption with a repeating key.
This confirms that the encryption is deterministic and vulnerable to known plaintext attacks.
Encrypted Flag Observation :
Using the option to display the encrypted flag revealed that:
The flag is encrypted using the same XOR mechanism
Get R3K0’s stories in your inbox
Join Medium for free to get updates from this writer.
The ciphertext ends with the character e, which matches the earlier hint
This suggests that the encryption key (or part of it) is reused between user input and the flag.
and i have tried 20 e and it worked they gave me a token with that info under it .
the token looks like a hex and it could be decrypted , lets try it .
hmmm this looks like a key im gonna save it for later …
for the second key we are going to use these XOR rules
in the first input if we see
we have plaintext & ciphertext and depending on the picture above we can extract the key from them , lets go to cyberchef and get the last key .
oh this also looks like a key but its repeated its looks like the key is “veryhiddenkey” and its a loop
so now we have both keys and the ciphertext of the flag
lets capture it :
BINGO.. we got the flag .
i hope yall learnt somthing from this writeup .
take care.
