0x4laugh CTF - 2024 Chall

My Vault

Information

Screenshot 2024-12-28 185340.png

diberikan file zip yang ber-isi-kan encrypt.py, encrypted_friend1, 2, dan 3. Berikut isinya :

# encrypt.py

import base64
import hashlib

from cryptography.fernet import Fernet

# Function to generate a key from the password
def generate_key(password):
    # Hash the password to generate a consistent key
    password_bytes = password.encode('utf-8')
    key = hashlib.sha256(password_bytes).digest()  # SHA256 to get a 32-byte key
    return base64.urlsafe_b64encode(key)  # Fernet requires the key to be in base64 format

# Function to encrypt the file
def encrypt_file(file_name, password):
    # Generate a key based on the password
    key = generate_key(password)
    cipher = Fernet(key)

    # Read the original file content
    with open(file_name, 'rb') as file:
        file_data = file.read()

    # Encrypt the data
    encrypted_data = cipher.encrypt(file_data)

    # Save the encrypted content to a new file
    with open(f"encrypted_{file_name}", 'wb') as encrypted_file:
        encrypted_file.write(encrypted_data)

    print(f"File encrypted successfully! Encrypted file saved as 'encrypted_{file_name}'.")

# Main script
def main():
    # Prompt the user for file name and password
    file_name = input("Enter the file name to encrypt: ")
    password = input("Enter the password to use for encryption: ")

    # Encrypt the file
    encrypt_file(file_name, password)

if __name__ == "__main__":
    main()

dari deskripsi, password berbentuk {tahun}{negara}. Nah maka untuk decrypt ini tinggal kita bikin kumpulan password yang mungkin dari nama-nama negara dan tahun.

Source Code Analysis

Kita fokus ke fungsi main, flow nya adalah program minta input nama file untuk di encrypt dan password lalu menjalankan fungsi encrypt_file. di dalam nya password dibuat dengan fungsi generate_key dimana key merupakan hash dari password yang di encode ke suatu base64. selanjutnya data di encrypt dengan Fernet lalu di simpan ke file baru. Nah karena kita tau bentuk passwordnya kita bisa mem-bruteforce semua kemungkinan yaang mungkin.

Solution

kita bisa minta ChatGPT untuk meng-generate list negara yang ada, selanjutnya beikut solvernya :

import base64
import hashlib
from cryptography.fernet import Fernet

country = [
    "Afghanistan", "Albania", "Algeria", "Andorra", "Angola", "Antigua and Barbuda", "Argentina", "Armenia", "Australia", 
    "Austria", "Azerbaijan", "Bahamas", "Bahrain", "Bangladesh", "Barbados", "Belarus", "Belgium", "Belize", "Benin", 
    "Bhutan", "Bolivia", "Bosnia and Herzegovina", "Botswana", "Brazil", "Brunei", "Bulgaria", "Burkina Faso", "Burundi", 
    "Cabo Verde", "Cambodia", "Cameroon", "Canada", "Central African Republic", "Chad", "Chile", "China", "Colombia", 
    "Comoros", "Costa Rica", "Croatia", "Cuba", "Cyprus", "Czech Republic", "Democratic Republic of the Congo", "Denmark", 
    "Djibouti", "Dominica", "Dominican Republic", "Ecuador", "Egypt", "El Salvador", "Equatorial Guinea", "Eritrea", 
    "Estonia", "Eswatini", "Ethiopia", "Fiji", "Finland", "France", "Gabon", "Gambia", "Georgia", "Germany", "Ghana", 
    "Greece", "Grenada", "Guatemala", "Guinea", "Guinea-Bissau", "Guyana", "Haiti", "Honduras", "Hungary", "Iceland", 
    "India", "Indonesia", "Iran", "Iraq", "Ireland", "Israel", "Italy", "Ivory Coast", "Jamaica", "Japan", "Jordan", 
    "Kazakhstan", "Kenya", "Kiribati", "Korea, North", "Korea, South", "Kuwait", "Kyrgyzstan", "Laos", "Latvia", "Lebanon", 
    "Lesotho", "Liberia", "Libya", "Liechtenstein", "Lithuania", "Luxembourg", "Madagascar", "Malawi", "Malaysia", "Maldives", 
    "Mali", "Malta", "Marshall Islands", "Mauritania", "Mauritius", "Mexico", "Micronesia", "Moldova", "Monaco", "Mongolia", 
    "Montenegro", "Morocco", "Mozambique", "Myanmar", "Namibia", "Nauru", "Nepal", "Netherlands", "New Zealand", "Nicaragua", 
    "Niger", "Nigeria", "North Macedonia", "Norway", "Oman", "Pakistan", "Palau", "Panama", "Papua New Guinea", "Paraguay", 
    "Peru", "Philippines", "Poland", "Portugal", "Qatar", "Romania", "Russia", "Rwanda", "Saint Kitts and Nevis", 
    "Saint Lucia", "Saint Vincent and the Grenadines", "Samoa", "San Marino", "Sao Tome and Principe", "Saudi Arabia", "Senegal", 
    "Serbia", "Seychelles", "Sierra Leone", "Singapore", "Slovakia", "Slovenia", "Solomon Islands", "Somalia", "South Africa", 
    "South Sudan", "Spain", "Sri Lanka", "Sudan", "Suriname", "Sweden", "Switzerland", "Syria", "Taiwan", "Tajikistan", 
    "Tanzania", "Thailand", "Timor-Leste", "Togo", "Tonga", "Trinidad and Tobago", "Tunisia", "Turkey", "Turkmenistan", 
    "Tuvalu", "Uganda", "Ukraine", "United Arab Emirates", "United Kingdom", "United States", "Uruguay", "Uzbekistan", 
    "Vanuatu", "Venezuela", "Vietnam", "Yemen", "Zambia", "Zimbabwe", "Holy See (Vatican City)", "Palestine"
]

def generate_key(password):
    # Hash the password to generate a consistent key
    password_bytes = password.encode('utf-8')
    key = hashlib.sha256(password_bytes).digest()  # SHA256 to get a 32-byte key
    return base64.urlsafe_b64encode(key)  # Fernet requires the key to be in base64 format

def decrypt_file(file_name, password):
    # Generate a key based on the password
    key = generate_key(password)
    cipher = Fernet(key)

    # Read the original file content
    with open(file_name, 'rb') as file:
        file_data = file.read()

    # Encrypt the data
    try:
        decrypted_data = cipher.decrypt(file_data)
    except:
        return 0
    print(password)
    # Save the encrypted content to a new file
    with open(f"decrypted_{file_name}", 'wb') as encrypted_file:
        encrypted_file.write(decrypted_data)

    print(f"File decrypted successfully! Decrypted file saved as 'decrypted_{file_name}'.")

for i in range(1950, 2024):
    print(i)
    for j in country:
        passwd = str(i) + j.lower()
        decrypt_file("encrypted_friend1.txt", passwd)
        decrypt_file("encrypted_friend2.txt", passwd)
        decrypt_file("encrypted_friend3.txt", passwd)

diperoleh password untuk part 1 : 2005russia, part 2 : 2016qatar, part 3 : 1988turkey.

FLAG

Capawchino Cafe

Information

Screenshot 2024-12-28 185212.png