PoliCTF 2015 - Exorcise (Crypto 50)

Simple challenge involving XORing.

Challenge Description

Points

50

Description

Simple Exorcise. Get the key! Connect to

exorcise.polictf.it:80

Solution

This challenge was really easy. First we connect to the port and see what we get:

$ nc exorcise.polictf.it 80
2e0540472c37151c4e007f481c2a0110311204084f
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2e0541263a1e352928321e70321e32711e32282c312d241e382e341e32292e342d251e292037241e322e2d3724251e1e28351e702f1e741e3224223c272d20263a1e352928321e70321e32711e32282c312d241e382e341e32292e342d251e292037241e322e2d3724251e1e28351e702f1e741e3224223c272d20263a1e352928321e70321e32711e32282c312d241e382e341e32292e342d251e292037241e322e2d3724251e1e28351e702f1e741e3224223c272d20263a1e352928321e70321e32711e32282c312d241e382e341e32292e342d251e292037241e322e2d3724251e1e28351e702f1e741e3224223c272d20263a1e352928321e70321e32711e32282c312d241e382e341e32292e342d251e292037241e322e2d3724251e1e28351e702f1e741e3224223c272d4f473239541106067f50013a53423a120d041e0b452b1106067f1e0d1c060d033a481819107f031d031404063326491533430b3b4c7f140a175d12040447103a0d46493c2b59162d04592c1649191809163a590e073a53021a0618443e4803030b3c1b4f031045133a361b107f53172b502c

Looks like there’s a lot of repeating sequences from our repeated A input, so let’s xor our input with the results:

In [5]: inp = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

In [6]: out = "2e0541263a1e352928321e70321e32711e32282c312d241e382e341e32292e342d251e292037241e322e2d3724251e1e28351e702f1e741e3224223c272d20263a1e352928321e70321e32711e32282c312d241e382e341e32292e342d251e292037241e322e2d3724251e1e28351e702f1e741e3224223c272d20263a1e352928321e70321e32711e32282c312d241e382e341e32292e342d251e292037241e322e2d3724251e1e28351e702f1e741e3224223c272d20263a1e352928321e70321e32711e32282c312d241e382e341e32292e342d251e292037241e322e2d3724251e1e28351e702f1e741e3224223c272d20263a1e352928321e70321e32711e32282c312d241e382e341e32292e342d251e292037241e322e2d3724251e1e28351e702f1e741e3224223c272d4f473239541106067f50013a53423a120d041e0b452b1106067f1e0d1c060d033a481819107f031d031404063326491533430b3b4c7f140a175d12040447103a0d46493c2b59162d04592c1649191809163a590e073a53021a0618443e4803030b3c1b4f031045133a361b107f53172b502c".decode("hex")

In [7]: print "".join([chr(ord(inp[i])^ord(out[i])) for i in range(len(inp))])
oDg{_this_1s_s0_simple_you_should_have_solved__it_1n_5_sec}flag{_this_1s_s0_simple_you_should_have_solved__it_1n_5_sec}flag{_this_1s_s0_simple_you_should_have_solved__it_1n_5_sec}flag{_this_1s_s0_simple_you_should_have_solved__it_1n_5_sec}flag{_this_1s_s0_simple_you_should_have_solved__it_1n_5_sec

And we have recovered our flag :)

Flag: flag{_this_1s_s0_simple_you_should_have_solved__it_1n_5_sec}