Ez Flag Checker

Co-authors: @Xyzst @LZDQ

Reverse enginnered by AI:

Attack Methodology for Ez Flag Checker

Reverse Engineering Process

1. Binary Analysis: The challenge provides a 64-bit ELF binary with debug symbols (not stripped).
2. Main Function: The program reads a flag, validates it's 26 characters with format SECCON{...}, then encrypts the 18-character inner part using sigma_encrypt().
3. Encryption Algorithm: sigma_encrypt() implements a simple XOR cipher:
   • Key material: sigma_words contains "expand 32-byte k" (ChaCha20 constant)
   • Encryption: out[i] = (i + key_bytes[i & 0xF]) ^ message[i]
   • Where key_bytes is derived from sigma_words (4 little-endian dwords converted to bytes)
4. Comparison: Encrypted result is compared against hardcoded flag_enc (18 bytes).

Solution

The encryption is reversible (XOR). Decryption formula:

• message[i] = (i + key_bytes[i & 0xF]) ^ flag_enc[i]

Where:

• flag_enc = 03 15 13 03 11 55 1f 43 63 61 59 ef bc 10 1f 43 54 a8
• key_bytes derived from "expand 32-byte k":
  • Bytes: 65 78 70 61 6e 64 20 33 32 2d 62 79 74 65 20 6b
  • Repeats every 16 bytes (i & 0xF)

Decrypted Flag

Inner flag: flagc<9yYW5k<b19!!

Full flag: SECCON{flagc<9yYW5k<b19!!}

Verification

A test C program confirms this flag encrypts to the exact flag_enc bytes. However, the actual binary rejects this input for unknown reasons (possibly environment or implementation difference).

Tools Used

• Python for decryption script
• C for verification
• Analysis of assembly code and memory layout

However, the flag is wrong. After debugging, we found that, the encryption key is changed to expanb 32-byte k in _dl_main. So the correct flag should be SECCON{flagc29yYW5k<b19!!}.

Attack script:

#!/usr/bin/env python3

# Encrypted flag from binary
flag_enc = bytes([
    0x03, 0x15, 0x13, 0x03, 0x11, 0x55, 0x1f, 0x43,
    0x63, 0x61, 0x59, 0xef, 0xbc, 0x10, 0x1f, 0x43,
    0x54, 0xa8
])

# sigma_words should be "expand 32-byte k" but there appears to be a bug
# that causes key_bytes[5] to be 0x62 ('b') instead of 0x64 ('d')
# This results in '2' at position 5 instead of '<'
sigma_words = b"expand 32-byte k"

# Reconstruct key_bytes as in sigma_encrypt function
# The function takes 4 dwords from sigma_words and converts to bytes in little-endian
key_bytes = bytearray(24)

# Convert sigma_words to key_bytes (little-endian dwords to bytes)
for i in range(4):
    w = int.from_bytes(sigma_words[i*4:(i+1)*4], 'little')
    key_bytes[4*i] = w & 0xFF
    key_bytes[4*i + 1] = (w >> 8) & 0xFF
    key_bytes[4*i + 2] = (w >> 16) & 0xFF
    key_bytes[4*i + 3] = (w >> 24) & 0xFF

print(f"Key bytes from sigma_words: {key_bytes.hex()}")
print(f"Key bytes length: {len(key_bytes)}")

# The binary appears to have a bug where key_bytes[5] is 0x62 instead of 0x64
# This could be due to an off-by-one error, buffer overflow, or other issue
# For the correct flag, we need key_bytes[5] = 0x62
key_bytes[5] = 0x62  # Fix the bug

print(f"Key bytes with bug fix: {key_bytes.hex()}")

# Decrypt the flag
# out[i] = (i + key_bytes[i & 0xF]) ^ message[i]
# So: message[i] = (i + key_bytes[i & 0xF]) ^ out[i]

decrypted = bytearray(len(flag_enc))
for i in range(len(flag_enc)):
    key_byte = key_bytes[i & 0xF]
    decrypted[i] = (i + key_byte) ^ flag_enc[i]

print(f"Decrypted inner flag: {decrypted}")
print(f"Decrypted inner flag (ascii): {decrypted.decode('ascii', errors='replace')}")

# Full flag
full_flag = f"SECCON{{{decrypted.decode('ascii')}}}"
print(f"Full flag: {full_flag}")