Secuinside 2012 write up - iu (500)

The "iu" challenge in the Secuinside 2012 CTF was a trivia challenge.

The description:

Hints:

1. hex

2. [-3:]



Challenge text:

-----

the message was decoded:

11111011 11101111 10001110 10000110 00011000 01100001

10000110 00011000 01011000 10100010 11100011 01011010

10111010 00001000 01101101 11001000 00010000 00010010

00010011 10101110 00111110 11111011 10111010 01011110

01100100

First we followed the hint and convert the binary code to hex:

fbef8e861861861858a2e35aba086dc8101213ae3efbba5e64

When we look at the second hint, it looks like python for the last three characters, so we took a look at the last six hex values (one byte = two hex values):

ba5e64

This is a good hint. When we convert the hex to characters and this to base64:

+++OhhhhhhhYouNaughtyBASE64++7peZA==

It looks like a flag. Unfortunately, it wasn't. So we tried to convert the hex values to characters and that to base64 without the last 6 values (remember hint 2):

+++OhhhhhhhYouNaughtyBASE64++w==

Still no flag.


Now we tried a lot but nothing worked. After a while some new hints were released:

\\"inverse\\"


more hints:

1. you have 25 bytes, you work on 22 bytes and 3 bytes separately.
2. flag format = e(22bytes) + e(3bytes)
3. which means d(e(22bytes)) + d(e(3bytes)) must be the same with the binary words. (have you checked this before?
4. it\\\'s base64, there is a possibility that d(x) == d(y)
5. we know you\\\'re confused!

Ok, you have to work seperately on 22 bytes and the last 3 bytes. That's a good hint. The first 22 bytes converted in base64 looks like:

+++OhhhhhhhYouNaughtyBASE64++w==

and the last 3 bytes:

ul5k

For hint two and three we wrote functions that cover it, but we didn't need them. Hint four looks like a collision in base64. After some reading we found out that base64 has collisions in the padding.

Ok, the last 3 bytes didn't have any padding because there are no "=". The first 22 bytes have padding. So we wrote this script:



and got this output:

FOUND: +++OhhhhhhhYouNaughtyBASE64++w==

FOUND: +++OhhhhhhhYouNaughtyBASE64++x==

FOUND: +++OhhhhhhhYouNaughtyBASE64++y==

FOUND: +++OhhhhhhhYouNaughtyBASE64++z==

FOUND: +++OhhhhhhhYouNaughtyBASE64++1==

FOUND: +++OhhhhhhhYouNaughtyBASE64++2==

FOUND: +++OhhhhhhhYouNaughtyBASE64++3==

FOUND: +++OhhhhhhhYouNaughtyBASE64++4==

FOUND: +++OhhhhhhhYouNaughtyBASE64++5==

FOUND: +++OhhhhhhhYouNaughtyBASE64++6==

FOUND: +++OhhhhhhhYouNaughtyBASE64++7==

FOUND: +++OhhhhhhhYouNaughtyBASE64++8==

FOUND: +++OhhhhhhhYouNaughtyBASE64++9==

FOUND: +++OhhhhhhhYouNaughtyBASE64++0==

FOUND: +++OhhhhhhhYouNaughtyBASE64+++==

FOUND: +++OhhhhhhhYouNaughtyBASE64++/==

The found result

+++OhhhhhhhYouNaughtyBASE64+++==

looked good. So we submitted the flag

+++OhhhhhhhYouNaughtyBASE64+++==ul5k

and finally it worked.