BreizhCTF 2019: CrazyLooper
Challenge details
| Event | Challenge | Category | Points | Solves |
|---|---|---|---|---|
| BreizhCTF 2019 | CrazyLooper | Programming | 150 | 2 |
Challenge: chall md5sum : 339457087fe3c986e45937eaf26cbfea
TL;DR
We had a file recursively encoded with multiple algorithms. Each algorithm was given at the beginning of the decoded file. We wrote a program that recursively decode the first file until we got the last clear text.
Methodology
First look at the file
The file command gave us only “data” but a deeper look at the head of the file gave us more information:
xxd chall | head -n 1
00000000: 786f 725f 4a3a 3225 3815 0170 637b 335e xor_J:2%8..pc{3^
We saw that the file start with “xor_J:” which means that we need to decode the file by xoring with the “J” letter.
with open("chall","rb") as f:
c = f.read()
algo,content = c.split(":",1)
out = ""
for l in content:
out += chr(ord(l)^ord("J")) # Xor content with "J"
with open("challoutput","wb") as f2:
f2.write(out)
xxd challoutput | head -n 1
00000000: 786f 725f 4b3a 2931 7914 2824 2f2e 2871 xor_K:)1y.($/.(q
We got a second xor with another letter.
Time to script
Here is my final script. Note that we got multiple algorithm (not only xor but also base32, base64, uuencode, bzip2, …). You can also notice that, sometimes, xor key is given as an integer.
cp chall chall0
import bz2
import base64
import zlib
def isInt(s):
try:
int(s)
return True
except ValueError:
return False
n = 0
while 1:
with open("chall"+str(n),"rb") as f:
l = f.read()
algo,content = l.split(":",1)
if "xor" in algo:
key = algo.replace("xor_","")
if not isInt(key):
key = ord(key)
else:
key = int(key)
out = ""
for l in content:
out += chr(ord(l)^key)
with open("chall"+str(n+1),"wb") as f:
f.write(out)
elif "base16" in algo:
with open("chall"+str(n+1),"wb") as f:
f.write(base64.b16decode(content))
elif "base32" in algo:
with open("chall"+str(n+1),"wb") as f:
f.write(base64.b32decode(content))
elif "base64" in algo:
with open("chall"+str(n+1),"wb") as f:
f.write(base64.b64decode(content))
elif "uu_codec" in algo:
with open("chall"+str(n+1),"wb") as f:
f.write(content.decode("uu"))
elif "bz2_codec" in algo:
with open("chall"+str(n+1),"wb") as f:
f.write(bz2.decompress(content))
elif "zlib_codec" in algo:
with open("chall"+str(n+1),"wb") as f:
f.write(zlib.decompress(content))
else:
print(algo)
n += 1
The program crash for the chall149 file.
cat chall149
breizhctf{crazy_encodings_looperz}
Flag
breizhctf{crazy_encodings_looperz}