Hack.lu Writeups - Revision history

PhilippeTeuwen: Replaced content with "* Hack.lu 2012 Writeups * Hack.lu 2015 Writeups * Hack.lu 2017 Writeups"

2017-10-20T18:59:37Z

Replaced content with "* Hack.lu 2012 Writeups * Hack.lu 2015 Writeups * Hack.lu 2017 Writeups"

PhilippeTeuwen at 18:57, 20 October 2017

2017-10-20T18:57:35Z

← Older revision		Revision as of 18:57, 20 October 2017
Line 1:		Line 1:
	* [Hack.lu 2012 Writeups]		* [[Hack.lu 2012 Writeups]]
	* [Hack.lu 2015 Writeups]		* [[Hack.lu 2015 Writeups]]
	* [Hack.lu 2017 Writeups]		* [[Hack.lu 2017 Writeups]]

	==2012 CTF by Fluxfingers==		==2012 CTF by Fluxfingers==

PhilippeTeuwen at 18:57, 20 October 2017

2017-10-20T18:57:20Z

← Older revision		Revision as of 18:57, 20 October 2017
Line 1:		Line 1:
			* [Hack.lu 2012 Writeups]
			* [Hack.lu 2015 Writeups]
			* [Hack.lu 2017 Writeups]

	==2012 CTF by Fluxfingers==		==2012 CTF by Fluxfingers==
	It was again a great moment of fun to participate to this year's CTF organised by [http://www.fluxfingers.net/ Fluxfingers] @ Hack.lu 2012		It was again a great moment of fun to participate to this year's CTF organised by [http://www.fluxfingers.net/ Fluxfingers] @ Hack.lu 2012

PhilippeTeuwen: /* 2017 Not My Digest */

2017-10-20T18:47:19Z

2017 Not My Digest

← Older revision		Revision as of 18:47, 20 October 2017
Line 366:		Line 366:
	<br>These rounds are revertible so if we make a guess about the content of the second block, one can compute a, b, c, d values before the processing of the second block = after the processing of the first block.		<br>These rounds are revertible so if we make a guess about the content of the second block, one can compute a, b, c, d values before the processing of the second block = after the processing of the first block.
	<br>This allows to mount a [https://en.wikipedia.org/wiki/Meet-in-the-middle_attack meet-in-the-middle attack]:		<br>This allows to mount a [https://en.wikipedia.org/wiki/Meet-in-the-middle_attack meet-in-the-middle attack]:
	<br>Assume the secret is "XXXXXXXXXXXXX", hash the message "012345678901234567890123456789012345678901234567890123456XXXXXXXXXXXXX". It will be split in two blocks and the secret will be split across the two blocks. ~~Compute~~ ~~all~~ ~~possible~~ first ~~blocks~~ and ~~store~~ the ~~state,~~ ~~then~~ ~~compute~~ backwards the ~~state~~ against all possible second blocks (given the message hash returned by the oracle, which is "be75f49ca582d673346bf85209aba13c" for message "012345678901234567890123456789012345678901234567890123456") and check for a match.		<br>Assume the secret is "XXXXXXXXXXXXX", hash the message "012345678901234567890123456789012345678901234567890123456XXXXXXXXXXXXX". It will be split in two blocks and the secret will be split across the two blocks: 7 chars at the end of the first block and 6 chars at the beginning of the second block. Compute backwards the states against all possible second blocks (given the message hash returned by the oracle, which is "be75f49ca582d673346bf85209aba13c" for message "012345678901234567890123456789012345678901234567890123456") and store these states, then compute all possible first blocks and check for a match.
	<br>This requires quite some RAM, so in practice one can store partial results at the cost of false positives to test and discard in a third phase.		<br>This requires quite some RAM, so in practice one can store partial results at the cost of false positives to test and discard in a third phase.
	<br>The source code is available here. TODO		<br>The source code is available here. TODO

PhilippeTeuwen: /* 2017 Not My Digest */

2017-10-20T15:21:04Z

2017 Not My Digest

← Older revision		Revision as of 15:21, 20 October 2017
Line 370:		Line 370:
	<br>The source code is available here. TODO		<br>The source code is available here. TODO
	<br>At the end, only one candidate is left: <code>candidate: 8spld0srmk4jf</code>		<br>At the end, only one candidate is left: <code>candidate: 8spld0srmk4jf</code>
	<br>Now let's compute <code>MD5_custom("the earth is not flat!8spld0srmk4jf") = 82136dab78e42b520168c6acc0408bf9</code> and forge the message ~~<code>~~the earth is not flat!82136dab78e42b520168c6acc0408bf9~~</code>~~.		<br>Now let's compute <code>MD5_custom("the earth is not flat!8spld0srmk4jf") = 82136dab78e42b520168c6acc0408bf9</code> and forge the message "the earth is not flat!82136dab78e42b520168c6acc0408bf9".
	<br>Verify it. We're greeted with		<br>Verify it. We're greeted with
	<br><code>LIAR! GO AWAY, REPTILIAN AND DON'T COME BACK: FLAG{One_bad_curly_breaks_your_crypto}</code>.		<br><code>LIAR! GO AWAY, REPTILIAN AND DON'T COME BACK: FLAG{One_bad_curly_breaks_your_crypto}</code>.

PhilippeTeuwen: /* 2017 Not My Digest */

2017-10-20T15:19:38Z

2017 Not My Digest

← Older revision		Revision as of 15:19, 20 October 2017
Line 367:		Line 367:
	<br>This allows to mount a [https://en.wikipedia.org/wiki/Meet-in-the-middle_attack meet-in-the-middle attack]:		<br>This allows to mount a [https://en.wikipedia.org/wiki/Meet-in-the-middle_attack meet-in-the-middle attack]:
	<br>Assume the secret is "XXXXXXXXXXXXX", hash the message "012345678901234567890123456789012345678901234567890123456XXXXXXXXXXXXX". It will be split in two blocks and the secret will be split across the two blocks. Compute all possible first blocks and store the state, then compute backwards the state against all possible second blocks (given the message hash returned by the oracle, which is "be75f49ca582d673346bf85209aba13c" for message "012345678901234567890123456789012345678901234567890123456") and check for a match.		<br>Assume the secret is "XXXXXXXXXXXXX", hash the message "012345678901234567890123456789012345678901234567890123456XXXXXXXXXXXXX". It will be split in two blocks and the secret will be split across the two blocks. Compute all possible first blocks and store the state, then compute backwards the state against all possible second blocks (given the message hash returned by the oracle, which is "be75f49ca582d673346bf85209aba13c" for message "012345678901234567890123456789012345678901234567890123456") and check for a match.
			<br>This requires quite some RAM, so in practice one can store partial results at the cost of false positives to test and discard in a third phase.
			<br>The source code is available here. TODO
			<br>At the end, only one candidate is left: <code>candidate: 8spld0srmk4jf</code>
			<br>Now let's compute <code>MD5_custom("the earth is not flat!8spld0srmk4jf") = 82136dab78e42b520168c6acc0408bf9</code> and forge the message <code>the earth is not flat!82136dab78e42b520168c6acc0408bf9</code>.
			<br>Verify it. We're greeted with
			<br><code>LIAR! GO AWAY, REPTILIAN AND DON'T COME BACK: FLAG{One_bad_curly_breaks_your_crypto}</code>.

PhilippeTeuwen: /* 2017 Not My Digest */

2017-10-20T15:01:40Z

2017 Not My Digest

← Older revision		Revision as of 15:01, 20 October 2017
Line 366:		Line 366:
	<br>These rounds are revertible so if we make a guess about the content of the second block, one can compute a, b, c, d values before the processing of the second block = after the processing of the first block.		<br>These rounds are revertible so if we make a guess about the content of the second block, one can compute a, b, c, d values before the processing of the second block = after the processing of the first block.
	<br>This allows to mount a [https://en.wikipedia.org/wiki/Meet-in-the-middle_attack meet-in-the-middle attack]:		<br>This allows to mount a [https://en.wikipedia.org/wiki/Meet-in-the-middle_attack meet-in-the-middle attack]:
			<br>Assume the secret is "XXXXXXXXXXXXX", hash the message "012345678901234567890123456789012345678901234567890123456XXXXXXXXXXXXX". It will be split in two blocks and the secret will be split across the two blocks. Compute all possible first blocks and store the state, then compute backwards the state against all possible second blocks (given the message hash returned by the oracle, which is "be75f49ca582d673346bf85209aba13c" for message "012345678901234567890123456789012345678901234567890123456") and check for a match.
	<br>Assume the secret is "secret1234567"

PhilippeTeuwen: /* 2017 */

2017-10-20T14:52:43Z

2017

← Older revision		Revision as of 14:52, 20 October 2017
Line 362:		Line 362:
	</source>		</source>
	Ha, this is why they removed the indentation, to make it a bit harder to find the bug :)		Ha, this is why they removed the indentation, to make it a bit harder to find the bug :)
			<br>The consequence is that <code>$sum_[abcd]</code> are not applied and updated properly after each intermediate block and only at the very end the MD5 state is added with the initial constants.
			<br>So when getting a 2-block message hash, we can subtract the constants from the hash to get the intermediate values a, b, c, d after the MD5 rounds and the mix with the second message block.
			<br>These rounds are revertible so if we make a guess about the content of the second block, one can compute a, b, c, d values before the processing of the second block = after the processing of the first block.
			<br>This allows to mount a [https://en.wikipedia.org/wiki/Meet-in-the-middle_attack meet-in-the-middle attack]:
			<br>Assume the secret is "secret1234567"

PhilippeTeuwen: /* 2017 Not My Digest */

2017-10-20T13:29:59Z

2017 Not My Digest

← Older revision		Revision as of 13:29, 20 October 2017
Line 349:		Line 349:
	should have been		should have been
	<source lang=php>		<source lang=php>
			$a &= 0xffffffff; // even not required actually
			$b &= 0xffffffff;
			$c &= 0xffffffff;
			$d &= 0xffffffff;
	$a = $sum_a = ($sum_a + $a) & 0xffffffff;		$a = $sum_a = ($sum_a + $a) & 0xffffffff;
	$b = $sum_b = ($sum_b + $b) & 0xffffffff;		$b = $sum_b = ($sum_b + $b) & 0xffffffff;

PhilippeTeuwen: /* 2017 Not My Digest */

2017-10-20T13:29:25Z

2017 Not My Digest

@@ Line 310: / Line 310: @@
 Let's look a bit closer to the custom MD5.
 <br>The obvious customization is highlighted at the beginning:
 <source lang=php>
@@ Line 331: / Line 330: @@
 When comparing with another implementation (and because the [https://github.com/FiloSottile/crypto.py/blob/master/2/md5.py implementation of Filippo] is much easier to read), we noticed a first difference:
-<br>Normally the 8 last characters of the padding are the length of the message in ''bits'': <code>struct.pack('<Q', len(message) * 8)</code>, but in PHP it does <code>pack("ll", $len*8, 0);</code>, so the last 4 bytes are forced to zero. This means
+<br>Normally the 8 last characters of the padding are the length of the message in ''bits'': <code>struct.pack('<Q', len(message) * 8)</code>, but in PHP it does <code>pack("ll", $len*8, 0);</code>, so the last 4 bytes are forced to zero. This means a message of (512Mb*"A" + "B"), when padded, would get the same last padded block as the message "B".