# TLDR All challenge i have done so far on CryptoHack.org ## Finding Flags Just copy and paste ```= Flag: crypto{y0ur_f1rst_fl4g} ``` ## Great snakes Just run the download file and you will get the flag this challenge will help you understand how to use `chr` in python this function will convert number into character ```= Flag: crypto{z3n_0f_pyth0n} ``` ## Network attacks Download the file and change from `clothes` into `flag` run the file and you got the flag ```= Flag: crypto{sh0pp1ng_f0r_fl4g5} ``` ## ASCII ```= ASCII is a 7-bit encoding standard which allows the representation of text using the integers 0-127. Using the below integer array, convert the numbers to their corresponding ASCII characters to obtain a flag. [99, 114, 121, 112, 116, 111, 123, 65, 83, 67, 73, 73, 95, 112, 114, 49, 110, 116, 52, 98, 108, 51, 125] ``` I write a python code inorder to retrieve flag ```= lst = [99, 114, 121, 112, 116, 111, 123, 65, 83, 67, 73, 73, 95, 112, 114, 49, 110, 116, 52, 98, 108, 51, 125] print("".join(chr(item) for item in lst)) ``` Run the file and get the flag ```= Flag: crypto{ASCII_pr1nt4bl3} ``` ## Hex ```= When we encrypt something the resulting ciphertext commonly has bytes which are not printable ASCII characters. If we want to share our encrypted data, it's common to encode it into something more user-friendly and portable across different systems. Hexadecimal can be used in such a way to represent ASCII strings. First each letter is converted to an ordinal number according to the ASCII table (as in the previous challenge). Then the decimal numbers are converted to base-16 numbers, otherwise known as hexadecimal. The numbers can be combined together, into one long hex string. Included below is a flag encoded as a hex string. Decode this back into bytes to get the flag. 63727970746f7b596f755f77696c6c5f62655f776f726b696e675f776974685f6865785f737472696e67735f615f6c6f747d ``` I write this code and then get the flag ```= encode = "63727970746f7b596f755f77696c6c5f62655f776f726b696e675f776974685f6865785f737472696e67735f615f6c6f747d" print(bytes.fromhex(encode)) ``` We got the flag ```= Flag: crypto{You_will_be_working_with_hex_strings_a_lot} ``` ## Base64 ```= Another common encoding scheme is Base64, which allows us to represent binary data as an ASCII string using an alphabet of 64 characters. One character of a Base64 string encodes 6 binary digits (bits), and so 4 characters of Base64 encode three 8-bit bytes. Base64 is most commonly used online, so binary data such as images can be easily included into HTML or CSS files. Take the below hex string, decode it into bytes and then encode it into Base64. 72bca9b68fc16ac7beeb8f849dca1d8a783e8acf9679bf9269f7bf ``` Code to solve this challenge ```= import base64 hex_string = "72bca9b68fc16ac7beeb8f849dca1d8a783e8acf9679bf9269f7bf" bytes_input = bytes.fromhex(hex_string) encoded_base64 = base64.b64encode(bytes_input) print(encoded_base64) ``` Run it and get flag ```= Flag: crypto/Base+64+Encoding+is+Web+Safe/ ``` ## Xor-starter ![image](https://hackmd.io/_uploads/rJeOdRiJR.png) Code ```= encode = "label" flag = "crypto{" for item in encode: flag += chr(ord(item) ^ 13) print(flag + "}") ``` Flag ```= Flag: crypto{aloha} ``` ## Bytes and Big Integers ![image](https://hackmd.io/_uploads/H1oC50i1A.png) Code ```= from Crypto.Util.number import * encode = 11515195063862318899931685488813747395775516287289682636499965282714637259206269 print(long_to_bytes(encode)) ``` Flag ```= Flag: crypto{3nc0d1n6_4ll_7h3_w4y_d0wn} ``` ## Encoding challenge This is a good challenge so basically there will be some kind of encode which is `utf-8`, `hex`, `base64`, `rot13`, `bigint` there will be 100 question send in json format and we have to decoded it so i have written some python code to retrive flag Code ```= from pwn import * from Crypto.Util.number import * import json import base64 def b64Decode(text): return base64.b64decode(text).decode('utf-8') def hexDecode(text): return bytes.fromhex(text).decode("utf-8") def rot13Decode(text): result = '' for char in text: if 'a' <= char <= 'z': result += chr((ord(char) - ord('a') + 13) % 26 + ord('a')) elif 'A' <= char <= 'Z': result += chr((ord(char) - ord('A') + 13) % 26 + ord('A')) else: result += char return result def bigIntDecode(text): transform = int(text, 16) return long_to_bytes(transform).decode("utf-8") def utfDecode(lst): return "".join(chr(item) for item in lst) conn = remote("socket.cryptohack.org", "13377") for i in range (0, 101): data = json.loads(conn.recvline()) payload = {} print(data) if data["type"] == "base64": payload["decoded"] = b64Decode(str(data["encoded"])) elif data["type"] == "hex": payload["decoded"] = hexDecode(str(data["encoded"])) elif data["type"] == "rot13": payload["decoded"] = rot13Decode(str(data["encoded"])) elif data["type"] == "bigint": payload["decoded"] = bigIntDecode(str(data["encoded"])) elif data["type"] == "utf-8": payload["decoded"] = utfDecode(data["encoded"]) print(payload) conn.sendline(json.dumps(payload).encode()) ``` Flag ```= Flag: crypto{3nc0d3_d3c0d3_3nc0d3} ``` ## Xor properties ![image](https://hackmd.io/_uploads/ByG8OV3k0.png) This is a easy challenge take the value we have xor with the key and we got the flag Code ```= from Crypto.Util.number import * key1 = int("a6c8b6733c9b22de7bc0253266a3867df55acde8635e19c73313", 16) key2 = int("37dcb292030faa90d07eec17e3b1c6d8daf94c35d4c9191a5e1e", 16) ^ key1 key3 = int("c1545756687e7573db23aa1c3452a098b71a7fbf0fddddde5fc1", 16) ^ key2 flag = int("04ee9855208a2cd59091d04767ae47963170d1660df7f56f5faf", 16) ^ key2 ^ key3 ^ key1 print(long_to_bytes(flag)) ``` Flag ```= Flag: crypto{x0r_i5_ass0c1at1v3} ``` ## Favourite Byte ![image](https://hackmd.io/_uploads/BJzHPNh10.png) So we are given a hex value first i should convert it into integer value then using `long_to_bytes` function to read the content the value return is ```= b"sbi`d\x7fk h! O!%O}iOv$f eb!'#Ori'um" ``` By reading the task i think maybe it has been xor with some value so i try to find what it is and i found out that every character has been xor with 16 so i write some code to decode the value ```= from Crypto.Util.number import * value = long_to_bytes(int("73626960647f6b206821204f21254f7d694f7624662065622127234f726927756d", 16)).decode("utf-8") print("".join(chr(ord(character) ^ 16) for character in value)) ``` And i got the flag ```= Flag: crypto{0x10_15_my_f4v0ur173_by7e} ``` ## You either know, XOR you don't ![image](https://hackmd.io/_uploads/SJCMtrnyA.png) We are given this number we can convert it int to integer but the value is strange so when i read the task again i think may be i should find out what is the key using the flag format which is `crypto{` xor each character with the key i have found then we are able to get the flag Code ```= from Crypto.Util.number import * value = bytes.fromhex("0e0b213f26041e480b26217f27342e175d0e070a3c5b103e2526217f27342e175d0e077e263451150104") flag_format = b'crypto{' key = [s1 ^ s2 for (s1, s2) in zip(value, flag_format)] + [ord("y")] print("The key: " + "".join(chr(item) for item in key)) flag = [] for i in range (len(value)): print(chr(value[i] ^ key[i % len(key)]), end="") ``` Flag ```= The key: myXORkey Flag: crypto{1f_y0u_Kn0w_En0uGH_y0u_Kn0w_1t_4ll} ``` ## Lemur xor ![image](https://hackmd.io/_uploads/HJM8IbaJ0.png) We are given two picture so i decide to use `pillow` in python in order to check the difference between the two picture i have written some code to show me that ```= from PIL import Image, ImageChops image1 = Image.open("flag.png") image2 = Image.open("lemur.png") diff = ImageChops.difference(image1, image2) diff.show() ``` Run it and we got the flag ```= crypto{X0Rly_n0t!} ``` ## Greatest common divisor We are given two number `66528` and `52920` the misson is to find the greatest common divisor between those two the result will be `1512` ## Extended GCD Using the two primes p = 26513, q = 32321, find the integers u,v such that p * u + q * v = gcd(p,q) a pretty hard challenge i use this [website](https://web.archive.org/web/20230511143526/http://www-math.ucdenver.edu/~wcherowi/courses/m5410/exeucalg.html) in order to get the answer or you can search for extended gcd python code as a lazy solution the u and v i found is `10245` and `-8404` submit `-8404` ## Modular Arithmetic 1 ![image](https://hackmd.io/_uploads/Hk2fJYZgA.png) We have a equation `8146798528947 % 17` and we get 4 ## Modular Arithmetic 2 ![image](https://hackmd.io/_uploads/rkR1fq-lC.png) Use fermat's little theorem and the answer is `1` ## Modular Inverting ![image](https://hackmd.io/_uploads/HyACH9Wx0.png) We can use Fermat's little theorem to get the number but instead i wrote a python code in order to bruteforce the solution :> ```= for i in range(1, 1000): if 3 * i % 13 == 1: print(i) ``` Then we get 9 as a solution submit it and challenge solved ## Privacy-Enhanced Mail? ![image](https://hackmd.io/_uploads/rywAskmg0.png) We are given a pem file so i wrote some python code to get the number Code ```= from Crypto.PublicKey import RSA f = open("privacy_enhanced_mail_1f696c053d76a78c2c531bb013a92d4a.pem", mode="r") key = RSA.importKey(f.read()) print(key.d) ``` Output ```= 15682700288056331364787171045819973654991149949197959929860861228180021707316851924456205543665565810892674190059831330231436970914474774562714945620519144389785158908994181951348846017432506464163564960993784254153395406799101314760033445065193429592512349952020982932218524462341002102063435489318813316464511621736943938440710470694912336237680219746204595128959161800595216366237538296447335375818871952520026993102148328897083547184286493241191505953601668858941129790966909236941127851370202421135897091086763569884760099112291072056970636380417349019579768748054760104838790424708988260443926906673795975104689 ``` ## Certainly not ![image](https://hackmd.io/_uploads/SJn_ThJ-C.png) You can read about what is a .der file in [here](https://www.ssl.com/guide/pem-der-crt-and-cer-x-509-encodings-and-conversions/) i use this command in order to get the modulus of that file ```= openssl x509 -inform der -in CERTIFICATE.der -text -noout ``` And i got the result ```= openssl x509 -inform der -in 2048b-rsa-example-cert_3220bd92e30015fe4fbeb84a755e7ca5.der -text -noout Certificate: Data: Version: 1 (0x0) Serial Number: 3580 (0xdfc) Signature Algorithm: sha1WithRSAEncryption Issuer: C = JP, ST = Tokyo, L = Chuo-ku, O = Frank4DD, OU = WebCert Support, CN = Frank4DD Web CA, emailAddress = support@frank4dd.com Validity Not Before: Aug 22 05:27:41 2012 GMT Not After : Aug 21 05:27:41 2017 GMT Subject: C = JP, ST = Tokyo, O = Frank4DD, CN = www.example.com Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) Modulus: 00:b4:cf:d1:5e:33:29:ec:0b:cf:ae:76:f5:fe:2d: c8:99:c6:78:79:b9:18:f8:0b:d4:ba:b4:d7:9e:02: 52:06:09:f4:18:93:4c:d4:70:d1:42:a0:29:13:92: 73:50:77:f6:04:89:ac:03:2c:d6:f1:06:ab:ad:6c: c0:d9:d5:a6:ab:ca:cd:5a:d2:56:26:51:e5:4b:08: 8a:af:cc:19:0f:25:34:90:b0:2a:29:41:0f:55:f1: 6b:93:db:9d:b3:cc:dc:ec:eb:c7:55:18:d7:42:25: de:49:35:14:32:92:9c:1e:c6:69:e3:3c:fb:f4:9a: f8:fb:8b:c5:e0:1b:7e:fd:4f:25:ba:3f:e5:96:57: 9a:24:79:49:17:27:d7:89:4b:6a:2e:0d:87:51:d9: 23:3d:06:85:56:f8:58:31:0e:ee:81:99:78:68:cd: 6e:44:7e:c9:da:8c:5a:7b:1c:bf:24:40:29:48:d1: 03:9c:ef:dc:ae:2a:5d:f8:f7:6a:c7:e9:bc:c5:b0: 59:f6:95:fc:16:cb:d8:9c:ed:c3:fc:12:90:93:78: 5a:75:b4:56:83:fa:fc:41:84:f6:64:79:34:35:1c: ac:7a:85:0e:73:78:72:01:e7:24:89:25:9e:da:7f: 65:bc:af:87:93:19:8c:db:75:15:b6:e0:30:c7:08: f8:59 Exponent: 65537 (0x10001) Signature Algorithm: sha1WithRSAEncryption Signature Value: 40:cb:fe:04:5b:c6:74:c5:73:91:06:90:df:ff:b6:9e:85:73: fe:e0:0a:6f:3a:44:2f:cc:53:73:16:32:3f:79:64:39:e8:78: 16:8c:62:49:6a:b2:e6:91:85:00:b7:4f:38:da:03:b9:81:69: 2e:18:c9:49:96:84:c2:eb:e3:23:f4:eb:ac:68:4b:57:5a:51: 1b:d7:eb:c0:31:6c:86:a0:f6:55:a8:f8:10:d0:42:06:1e:94: a5:e0:68:a7:9f:b6:f3:9c:d0:e1:22:3b:ab:85:3d:a1:27:9b: 50:32:62:b8:ec:7a:fa:d6:7d:2b:29:e6:ad:b2:69:4d:28:b4: f8:0a ``` Convert the modulus to integer and submit that number ```= 22825373692019530804306212864609512775374171823993708516509897631547513634635856375624003737068034549047677999310941837454378829351398302382629658264078775456838626207507725494030600516872852306191255492926495965536379271875310457319107936020730050476235278671528265817571433919561175665096171189758406136453987966255236963782666066962654678464950075923060327358691356632908606498231755963567382339010985222623205586923466405809217426670333410014429905146941652293366212903733630083016398810887356019977409467374742266276267137547021576874204809506045914964491063393800499167416471949021995447722415959979785959569497 ``` ## SSH keys We are given a `.pub` file and have to find the modulus of that file we can use `openssl` command in order to find the modulus but first of all we should convert it from `.pub` file into `.pem` file by using this command ```= ssh-keygen -f bruce_rsa_6e7ecd53b443a97013397b1a1ea30e14.pub -e -m pem -----BEGIN RSA PUBLIC KEY----- MIIBigKCAYEArTy6m2vhhbwx3RVbNVb3ZOenCqqsOXHaJpbtN+OuulLKBSKpIoPB +ZDbDXn0qWkf4lOxtGSgolkUbgG07Lhzfgs+dul4UL84CkwZExmF3Rf1nRv+v7pq Lt2dPsCb02YLxJnhHJb4rQaz2ZM4QCtTOcqYDUeKfLHCaZU4Ekm/OApKrpfw4/0o fn8KOrFN0t4/dqnNuwVRgoaUIhsI47reApB2rs0AP4CggSIi8s6BXCxB4YzgThBK 5760T1giACYQC5MFdq1Gw+INSFmu0CNqt5wdJ5Z4z5448Gke06R+IMtjUiGDQ3Qt T2fK3gWhZxk14M4UNrdETgTW/mQ4B/BcvikxvoBGpKbttG0agfOjTen6wyzpGfcd 8N9rSbaqqyUwC8uDotzFtFzzutVAU9d91TagGzWBhNoMfplwVTns27GOOgv1dn5s QSSSmP0hTbPMDlThysKkR9BiOVbBtWGQpV936pPBgyWERGqMqC9xykLdVHv2Vu05 T0WMwKCAetgtAgMBAAE= -----END RSA PUBLIC KEY----- ``` Store it inside a `.pem` file and use this command to get the modulus ```= openssl rsa -pubin -in key.pem -text -noout Public-Key: (3072 bit) Modulus: 00:ad:3c:ba:9b:6b:e1:85:bc:31:dd:15:5b:35:56: f7:64:e7:a7:0a:aa:ac:39:71:da:26:96:ed:37:e3: ae:ba:52:ca:05:22:a9:22:83:c1:f9:90:db:0d:79: f4:a9:69:1f:e2:53:b1:b4:64:a0:a2:59:14:6e:01: b4:ec:b8:73:7e:0b:3e:76:e9:78:50:bf:38:0a:4c: 19:13:19:85:dd:17:f5:9d:1b:fe:bf:ba:6a:2e:dd: 9d:3e:c0:9b:d3:66:0b:c4:99:e1:1c:96:f8:ad:06: b3:d9:93:38:40:2b:53:39:ca:98:0d:47:8a:7c:b1: c2:69:95:38:12:49:bf:38:0a:4a:ae:97:f0:e3:fd: 28:7e:7f:0a:3a:b1:4d:d2:de:3f:76:a9:cd:bb:05: 51:82:86:94:22:1b:08:e3:ba:de:02:90:76:ae:cd: 00:3f:80:a0:81:22:22:f2:ce:81:5c:2c:41:e1:8c: e0:4e:10:4a:e7:be:b4:4f:58:22:00:26:10:0b:93: 05:76:ad:46:c3:e2:0d:48:59:ae:d0:23:6a:b7:9c: 1d:27:96:78:cf:9e:38:f0:69:1e:d3:a4:7e:20:cb: 63:52:21:83:43:74:2d:4f:67:ca:de:05:a1:67:19: 35:e0:ce:14:36:b7:44:4e:04:d6:fe:64:38:07:f0: 5c:be:29:31:be:80:46:a4:a6:ed:b4:6d:1a:81:f3: a3:4d:e9:fa:c3:2c:e9:19:f7:1d:f0:df:6b:49:b6: aa:ab:25:30:0b:cb:83:a2:dc:c5:b4:5c:f3:ba:d5: 40:53:d7:7d:d5:36:a0:1b:35:81:84:da:0c:7e:99: 70:55:39:ec:db:b1:8e:3a:0b:f5:76:7e:6c:41:24: 92:98:fd:21:4d:b3:cc:0e:54:e1:ca:c2:a4:47:d0: 62:39:56:c1:b5:61:90:a5:5f:77:ea:93:c1:83:25: 84:44:6a:8c:a8:2f:71:ca:42:dd:54:7b:f6:56:ed: 39:4f:45:8c:c0:a0:80:7a:d8:2d Exponent: 65537 (0x10001) ``` Convert the hex number to decimal and the challenge will be solved ```= 3931406272922523448436194599820093016241472658151801552845094518579507815990600459669259603645261532927611152984942840889898756532060894857045175300145765800633499005451738872081381267004069865557395638550041114206143085403607234109293286336393552756893984605214352988705258638979454736514997314223669075900783806715398880310695945945147755132919037973889075191785977797861557228678159538882153544717797100401096435062359474129755625453831882490603560134477043235433202708948615234536984715872113343812760102812323180391544496030163653046931414723851374554873036582282389904838597668286543337426581680817796038711228401443244655162199302352017964997866677317161014083116730535875521286631858102768961098851209400973899393964931605067856005410998631842673030901078008408649613538143799959803685041566964514489809211962984534322348394428010908984318940411698961150731204316670646676976361958828528229837610795843145048243492909 ``` ## Transparency This challenge i can not finish without looking for write up and i found some interesting solution you can use this url to find every possible subdomain `https://crt.sh/?q=cryptohack.org` and and we will be able to access this url to get the flag ```= https://thetransparencyflagishere.cryptohack.org/ ``` Visit that website ```= Flag: crypto{thx_redpwn_for_inspiration} ``` ## Quadratic residue In this challenge we learn about quadratic residue you can see this [video](https://www.youtube.com/watch?v=aBn7BaRxu2g&pp=ygUjcXVhZHJhdGljIHJlc2lkdWVzIGluIG51bWJlciB0aGVvcnk%3D) in another word quadratic residue can be definition as follow let a, n is integer and gcd(a, n) = 1 a is a quadratic residue if `a mod n = x ^ 2` otherwise it will become quadratic non-residue and in this challenge we are given these number ```= p = 29 ints = [14, 6, 11] ``` We need to find the quadratic residue this only require a small brute force algorithm ```= p = 29 ints = [14, 6, 11] flag = 100000 for n in ints: for a in range(1,29): if pow(a,2,p) == n: flag = min(flag,a) print(flag) ``` The pow(a, 2, p) is equal to `a ^ 2 mod p` and the flag will get the smallest result after running the code we got 8 as a flag