This repo contains the crypto files provided at the Derbycon 2016 CTF.
This particular challenge was simple once you figured out what they were doing.
There are 2 encrypted files, with the plaintext of one of the encrypted files.
By opening up classification_guide_utf32le.enc you can see there are certain
sections of the file that repeat the same 8 bytes. This tells you it couldnt
be any encryption mode that was chained together like CBC and actually screams
out that it's actually ECB.
ECB is the simplest method of applying a cipher and also has a huge
vulnerability with plaintext attacks.
The attack is fairly simple:
1. Split the file into 8byte (64bit) chunks
2. Create a lookup table of those chunks
-The key is the encrypted ciphertext from the .eml
-The value is the corresponding plaintext from the .txt
3. Read in the second ciphertext eml and simple replace any section that
matches in the lookup table.
4. Output the "decrypted" text
This method doesnt retrieve 100% of the original plaintext but that doesnt
matter since it's just plain english. You can see at the end of the file
was the flag to submit "lintonCash$" which you submit as "ClintonCash$"
and I got 1,000 points.
The ruby script I wrote could technically be applied to any ECB plaintext
attack in the future. Your mileage may vary since the original plaintext
was UTF32LE encoded, where each character takes up 4 bytes. That coupled
with the 8 byte key length means you needed a much smaller lookup table
than you normally would with something like UTF8 or even UTF16.
In any case, fun challenge, and now I/You know how to break ECB easily.
Example:
$ ruby new_decrypt.rb
Received: from m..clintonmail.com (10.1.10.10) by
clientaccess.clintonmail.com (1.10.1.12) with Microsoft S.P Server (.S).id 15.1.225.. via Mailb. Transport; Th. 1 Sep 2012 12:14:02 -.00
Subject: Good News the Saudi Prince will pay to meet!
To: <Hillar.clintonmail.co.
Date: Thu, 1 Sep 2016 1.14:00 .000
Message-ID: <1.....clintonmail.com.co.
From: Huma .edin <.edin.H.lintonmail.com.MIME.ersion: 1.0
.MS.xchange-Organization.etwork.essage.. 3.02ade-.......-0.....5
.MS.xchange-Organization..tamp.nterprise: 1.0...Exchange.rganization-.thAs: Anonymous
.MS.xchange-Transport-En..nd.tenc. 00:00:01.01..4
Content-type: Text.lain..y ..Its .ma. I have good news, we can a .00.'donation' to the global intitive
if you meet with the Saudi Prince this saturday. I did a little co.ing of
the books over there ahead of time so we should be able launder it and have
it in the campaign war chest by the following Thursday at the latest...ap. to help secure a little more .ag.lintonCash$ ..