Flare-On 8

[pcmcia]

3 hours ago, kao said:

@pcmcia: VM1 was one-byte XOR. You should be able to recognize xored data after suffering through Challenge #5.

 

VM2 - CPA. Right now I don't have time and energy for a proper writeup but here are rough steps.

Step 1- create file consisting of 1000 zeroes, exfiltrate it. See that there is a pattern repeating every 0x18 chars, something like this:

Such patterns suggest either a block cipher in ECB mode, or weak crypto. Since I'm not aware of any strong crypto with block size of 0x18 bytes, it must be weak crypto!  
Which means - you can create a lookup table for each of 0x18 positions and each of 256 values.

Step 2 - create a file consisting of 0x18 zeroes, followed by 0x18 ones, 0x18 twos and so on. Exfiltrate it.

Step 3 - now you have a lookup table that you can use to decrypt exfiltrated image.

 

Thanks!  That was very helpful.  It seems flare-on is as much as RE challenge and a crypto challenge, evident by ch#5, ch#7 (last part), ch#8, and ch#10.

3 hours ago, kao said:

@pcmcia: VM1 was one-byte XOR. You should be able to recognize xored data after suffering through Challenge #5.

 

VM2 - CPA. Right now I don't have time and energy for a proper writeup but here are rough steps.

Step 1- create file consisting of 1000 zeroes, exfiltrate it. See that there is a pattern repeating every 0x18 chars, something like this:

Such patterns suggest either a block cipher in ECB mode, or weak crypto. Since I'm not aware of any strong crypto with block size of 0x18 bytes, it must be weak crypto!  
Which means - you can create a lookup table for each of 0x18 positions and each of 256 values.

Step 2 - create a file consisting of 0x18 zeroes, followed by 0x18 ones, 0x18 twos and so on. Exfiltrate it.

Step 3 - now you have a lookup table that you can use to decrypt exfiltrated image.

 

Actually, one more question.  Since you are building a look up table of 256 possible values (ie. Byte), does that mean the ciphertext size is 24 times bigger than the plaintext size?  Or do you mean the block size is 0x18? But building a lookup table of that size is massive.

Edited October 25, 2021 by pcmcia

[kao]

@pcmcia: I wouldn't call FLARE-ON a crypto challenge.  Sure, it deals with encrypted data and some basic knowledge of cryptography is very useful - but it doesn't require you to come up with new and innovative ways to solve advanced crypto problems. This year was especially light on crypto problems, you didn't even have to recognize RSA or ElGamal (unlike last year).

 

@all: finally some solutions started to appear online. If you wrote your own solutions or found someone else's writeups, please post a link here! I'm sure we all could learn something new...

• Official solutions by FLARE-ON authors: https://www.mandiant.com/resources/flare-on-8-challenge-solutions
• Eviatar Gerzi - solutions to first 3 problems: https://eviatargerzi.medium.com/flare-on-8-2021-write-ups-fccada046210. Very detailed explanation of #3.
• Pieceofsummer - Ghidra script for Evil (#9) static analysis  https://gist.github.com/pieceofsummer/335cf841ed5fc8155a4067541660ceb6
• Hasherezade - solution for #6 https://hshrzd.wordpress.com/2021/10/23/flare-on-8-task-6/
• Hasherezade - solution for #7 https://hshrzd.wordpress.com/2021/10/23/flare-on-8-task-7/
• Hasherezade - solution for #9 https://hshrzd.wordpress.com/2021/10/23/flare-on-8-task-9/
• ZetaTwo - BinaryNinja deobfuscator for #9: https://github.com/ZetaTwo/binja-experiments/tree/master/script-flareon8-evil
• 0xdf - solution for #1: https://0xdf.gitlab.io/flare-on-2021/credchecker
• 0xdf - solution for #3: https://0xdf.gitlab.io/flare-on-2021/antioch
• 0xdf - solution for #7: https://0xdf.gitlab.io/flare-on-2021/spel
• Bogdan Vennyk - #9: https://bogdanvennyk.medium.com/flare-on-8-task-9-write-up-30d785f1df21
• jk45054 solutions: https://github.com/jk45054/CTF-writeups/tree/main/Flare-On 8
•  

 

 

[Washi]

I just pushed my write-ups for all challenges as well. Could contain some spelling mistakes here and there, but here you go:

https://washi1337.github.io/ctf-writeups/writeups/flare-on/2021/

 

[Kurapica]

2 hours ago, Washi said:

I just pushed my write-ups for all challenges as well. Could contain some spelling mistakes here and there, but here you go:

https://washi1337.github.io/ctf-writeups/writeups/flare-on/2021/

 

Always the best ...