Added chals

chals/crypto/easy_rsa/chal.py

@@ -0,0 +1,9 @@
+from Crypto.PublicKey import RSA
+from Crypto.Cipher import PKCS1_v1_5
+import sympy
+
+e = 65539
+n = 4462776610810429874302099425257433084349                     # It seems that n is very small...
+c = [b'\x06\x86\xbc}\x0f\xfc\xac\x80\x90&S\x98\xa1!+F>',         # List of messages for you to decrypt
+     b'\x04\xe9%7\xeb\xdd\xf6\xcd\x9e\x7f\xa2Z\x81\x16,\x9fh', 
+     b"\x00\xa3\x19lP'\x04\x02\xb1\xe0\x89p-\x99\xcc\xf1@"]

chals/crypto/safe_cracker/challenge.yml → chals/crypto/easy_rsa/challenge.yml

@@ -1,4 +1,4 @@
-name: "Safe Cracker"
+name: "Easy RSA"
 author: Sophia
 category: Crypto
 description: |-
@@ -11,27 +11,23 @@ description: |-
   2. The public key consists of n, which calculated by multipling p and q, and e (which is typically set to 65537).
   3. The private key contains the modulus n and d, a private exponent. 
   4. The private exponent d is calculated as the modular multiplicative inverse of e modulo (p-1)x(q-1).
-  Read more here: https://en.wikipedia.org/wiki/RSA_(cryptosystem)
+  Read more [here](https://en.wikipedia.org/wiki/RSA_(cryptosystem)).
 
-  We found an encrypted safe combination. There are apparently many valuable items such as an invisibility cloak, an Amazon giftcard, salmon, and so much more...
-  Can you please help us recover the original combination? 
-  Tip: Once you have the correct pass code, submit it to safe.py to retrieve the flag.
+  TODO: some description
 
   **author**: Sophia
-value: 150
+value: 250
 type: dynamic
-tags:
+tags: 
   - easy
 extra:
-  initial: 150
+  initial: 250
   decay: 50
   minimum: 50
 flags:
-  - sigpwny{why_does_the_safe_contain_fish}
+  - sigpwny{rsA_FtW:P}
 files:
-  - values.txt
+  - chal.py
+  - gen.py
 hints:
-  - We need to execute a certain type of a md5 hash collision attack.
-  - Look for a tool to pull off a "md5 same prefix hash collision" attack.
-  - Use [HashClash](https://github.com/cr-marcstevens/hashclash)
-state: hidden
+  - I noticed a [library](https://pycryptodome.readthedocs.io/en/latest/src/public_key/rsa.html) included in the source code...

chals/crypto/easy_rsa/gen.py

@@ -0,0 +1 @@
+#add later

chals/crypto/easy_rsa/sol.py

@@ -0,0 +1,19 @@
+from Crypto.PublicKey import RSA
+from Crypto.Cipher import PKCS1_v1_5
+import sympy
+
+e = 65539
+n = 4462776610810429874302099425257433084349                     # It seems that n is very small...
+c = [b'\x06\x86\xbc}\x0f\xfc\xac\x80\x90&S\x98\xa1!+F>',         # List of messages for you to decrypt
+     b'\x04\xe9%7\xeb\xdd\xf6\xcd\x9e\x7f\xa2Z\x81\x16,\x9fh', 
+     b"\x00\xa3\x19lP'\x04\x02\xb1\xe0\x89p-\x99\xcc\xf1@"]
+
+#-----SOLUTION-------
+
+totn = int(sympy.totient(n))
+d = pow(e,-1,totn)
+for i in c:
+    priv = RSA.construct((n,e,d))
+    ciph = PKCS1_v1_5.new(priv)
+    plaintext = ciph.decrypt(i, None)
+    print(plaintext.decode("utf-8"))

chals/crypto/safe-cracking/Dockerfile

@@ -0,0 +1,14 @@
+FROM ubuntu:20.04
+
+RUN apt-get update && apt-get install -y socat python3 python3-pip
+
+RUN adduser chal
+
+RUN mkdir -p /chal
+WORKDIR /chal
+
+COPY server.py ./
+RUN chmod 555 server.py
+USER chal
+
+CMD socat -T60 TCP-LISTEN:1337,fork,reuseaddr EXEC:"python3 -u server.py",stderr

chals/crypto/safe-cracking/challenge.yml

@@ -0,0 +1,24 @@
+name: "Safe Cracking"
+author: Sophia
+category: Crypto
+description: |-
+  We found a magical safe. There are apparently many valuable items in it such as an invisibility cloak, an Amazon giftcard, and more!
+  Can you please help us recover the original combination? 
+
+  `nc chal.cryptoctf.sigpwny.com 7001`
+
+  **author**: Sophia
+value: 150
+type: dynamic
+tags:
+  - easy
+extra:
+  initial: 150
+  decay: 50
+  minimum: 50
+flags:
+  - sigpwny{is_this_r3@lly_the_m0st_s3cure_s@f3_3ver?}
+files:
+hints:
+  - Look up how to perform a Diffie-Hellman key exchange. 
+state: hidden

chals/crypto/safe-cracking/flag.txt

@@ -0,0 +1 @@
+sigpwny{is_this_r3@lly_the_m0st_s3cure_s@f3_3ver?}

chals/crypto/safe-cracking/server.py

@@ -0,0 +1,43 @@
+import time
+import random
+
+FLAG = "sigpwny{is_this_r3@lly_the_m0st_s3cure_s@f3_3ver?}"
+combos = [11, 112, 81] 
+
+def prompt():
+    for i in range(3):
+        try:
+            value = int(input(f"Enter the {['first', 'second', 'third'][i]} value: ").strip())
+            if value != combos[i]:
+                return False
+        except ValueError:
+            print("Please enter a number.")
+            return False
+    return True
+
+def print_notes():
+    print("\nHints to help me remember the combination to my safe (since I always forget it).")
+    print("The shared key of each problem corresponds to one part of the safe combination.")
+    print("1. Anna and Beatrice perform a Diffie-Hellman key exchange where p = 17 and g = 3. Privately, Anna selects 5 and Beatrice chooses 11. What's their shared secret key?")
+    print("2. The two perform another key exchange. Now, p = 157 and g = 2. Anna's new private key is 67, while Beatrice's public key is 73. What is Anna's public key?")
+    print("3. Anna forgot her private key and wants to solve for it. However, we know the following:\n\tTheir shared secret key, s, is equal to xx.\n\tThe values of p and g are 67 and 2, respectively.\n\tThe result of Anna's public key is x.\n") #finish later
+    print("Get ready to start guessing!")
+    time.sleep(1)
+
+def main():
+    print("Welcome to my extremely secure safe!")
+    print("Note to self: Just in case I forget the combination, here's a note that reminds me how to remember it.")
+    view_notes = input("View notes {y/n}: ")
+
+    if (view_notes == "y"):
+        print_notes()
+    else:
+        print("Might want to view the notes...")
+
+    if prompt():
+        print("You have unlocked the safe! Please don't take anything except for this flag:", FLAG)
+    else:
+        print("Incorrect, try again.")
+
+if __name__ == "__main__":
+    main()

chals/crypto/safe-cracking/sol.py

@@ -0,0 +1 @@
+#todo

chals/crypto/secret_salad/challenge.yml

@@ -4,7 +4,7 @@ category: Crypto
 description: |-
   We have intercepted a crucial document via email. It appears to contain a list of usernames and their corresponding passwords for a website.
   If it helps, we have a screenshot of a blog post that our person of interest made. 
-  Can you help us find their password?
+  Can you help us recover their password?
 
   **author**: Sophia
 value: 100

chals/crypto/secret_salad/sol.txt

@@ -0,0 +1,2 @@
+- Based on the blog post image, we can reason that the corresponding username is wanderlust_and_mountains.
+- jhlzhy_pz_tf_mhc_zhshk has been encrypted with a caeser cipher, decrypting it results in the flag.