CyberKavach QuestCon Series: The Cipher Breach

-

 

The Cipher Breach

Author: Radhika Suryavanshi

Welcome to the CyberKavach QuestCon write-up series by PCCOE OWASP Student Chapter! In this post, we explore a challenging three-part cryptographic puzzle designed to test your understanding of real-world vulnerabilities and cryptanalysis.


Challenge Details

  • Category: Cryptography

  • Difficulty: Medium

  • Description: Recover pieces of the final flag by exploiting three common cryptographic vulnerabilities, one each in ECDSA usage, PRNG state recovery, and AES encryption misuse.

  • Flag Format: questCON{part1-part2-part3}


Stage 1: ECDSA Nonce Leakage Vulnerability

ECDSA relies on a secret nonce kkk per signature. This challenge provides ECDSA signatures where the top 12 bits of the nonce are leaked—a catastrophic information leak.

Attack Overview

  • Goal: Brute force the unknown bits of the nonce to recover the full nonce.

  • Using two signatures, guess nonce bits, calculate a potential private key candidate, and verify using the second signature's leaked bits.

Process

  • Load the provided list of signatures.

  • For each nonce guess, calculate the private key and check validity.

  • Once the key is found, derive the first part of the flag by hashing the key.


Stage 2: Mersenne Twister MT19937 State Cloning

The Mersenne Twister PRNG (MT19937) is not cryptographically secure. If you can observe 624 consecutive outputs, you can recover its internal state.

Attack Overview

  • Recover the internal state by untempering 624 outputs from mtobservations.bin.

  • Seed a local MT19937 PRNG with this state.

  • Predict the next four outputs to form the AES key.

  • Decrypt the provided ciphertext encryptedblob.bin with the predicted key.

Implementation Steps

  • Read and untemper outputs.

  • Predict AES key and decrypt ciphertext.

  • Extract second part of the flag from the decrypted data.


Stage 3: AES-CTR Keystream Reuse Vulnerability

When AES is used in CTR mode, reusing the same key and nonce results in keystream reuse, allowing attackers to decrypt messages with known plaintext.

Attack Overview

  • Several ciphertexts and related known plaintexts are given.

  • Extract known plaintext from images through LSB steganography.

  • XOR known plaintext with ciphertext to recover keystream.

  • Use this keystream to decrypt the target ciphertext.

Solution Highlights

  • Extract LSB encoded hints from images.

  • Compute keystream and decrypt flagged message.

  • Retrieve third part of the flag.


Final Assembly: The Complete Flag

By combining the three recovered parts, the final flag looks like:

text

questCON{<part1>-<part2>-<part3>}


Where each part corresponds to the respective stage's recovered secret.


This challenge bridges multiple core cryptographic concepts and highlights real vulnerabilities from ECDSA nonce reuse, insecure PRNGs, to improper use of AES in CTR mode. Understanding these flaws and exploiting them in a controlled environment is invaluable for budding cybersecurity professionals.

Stay tuned for more write-ups from CyberKavach QuestCon!


Comments

Post a Comment

Popular posts from this blog

CyberKavach QuestCon Series: Upside-Down Vault

-
Image
  🧩 CTF Write-Up: Upside-Down Vault Author: Sai Veer Flag Format: QUESTCON{...} Challenge Type: Multi-Layer Crypto + Stego + Web Service Difficulty: Medium–Hard 🗃️ Files Provided encrypted_flag.bin layer1_puzzle.json layer2_blob.json layer2.enc privkey.enc vault.py vault_pub.pem vault_secret.png 🧠 Challenge Overview The challenge consists of: 3 cryptographic layers 1 steganographic HMAC extraction 1 server verification stage The flag is revealed only after: Extracting the hidden HMAC secret from vault_secret.png . Solving all cryptographic layers. Using the recovered secrets to correctly sign and “seal” a request to the local server ( vault.py ). Finally, retrieving the decrypted flag from /sealed . 🧩 Step-by-Step Walkthrough Step 1 — Extract HMAC Secret from PNG The image vault_secret.png hides an HMAC key in its LSBs. Why The server expects this secret in ctf_secret/secret_mac . It’s later used to generate HMAC signatures for ...
Read more

From Open Networks to Safe Systems: How Firewalls Block the Hacker’s Doorway

-
Image
From Open Networks to Safe Systems: How Firewalls Block the Hacker’s Doorway   In the digital world, every message, photo, and online payment travels through an invisible web of connections called computer networks. Think of it as a massive postal system where billions of tiny data packets constantly move between devices, routers, and servers, each carrying a specific destination address. Just as houses have numbered addresses, every device on a network has an IP address. But instead of physical doors, computers have virtual ones called ports. These are entry and exit points that decide what kind of data can pass through. Some of these digital doors, like those used for websites or emails, need to stay open. Others, if left unlocked, can become invitations for attackers. That is where firewalls come in. A firewall acts as a vigilant security guard at your network’s gate. It checks who is knocking, what they are carrying, and whether they are allowed inside. Home routers do this qui...
Read more

CyberKavach QuestCon Series: VecNet

-
Image
  VecNet Welcome back to the official write-up series for CyberKavach QuestCon! The PCCOE OWASP Student Chapter is here to analyze one of the most fascinating challenges in our event — VecNet, an LLM Jailbreaking and Prompt Injection challenge inspired by Stranger Things. Category: LLM Jailbreaking / Prompt Injection Author: Chirag Ferwani VecNet is an interactive LLM jailbreak challenge inspired by Stranger Things. Players interact with Eleven’s neural assistant deployed in the Upside Down, attempting to extract a hidden flag through creative prompt engineering. The system looks like a Stranger Things knowledge assistant but secretly hides a flag that challengers must extract. Challenge URL: ( https://vecnet.onrender.com ) When you open the challenge, you see a minimal chat interface with a terminal-style monospace font, real-time messaging without chat history, a dark Stranger Things aesthetic, and an input field with a send button. Testing the basic functionality shows that the ...
Read more