HackVent 2023 - [HV23.11] unsanta

Difficulty: Medium

Category: Cryptography

Author: kuyaya

To train his skills in cybersecurity, Grinch has played this year’s SHC qualifiers. He was inspired by the cryptography challenge unm0unt41n (can be found here) and thought he might play a funny prank on Santa. Grinch is a script kiddie and stole the malware idea and almost the whole code. Instead of using the original encryption malware from the challenge though, he improved it a bit so that no one can recover his secret! Luckily, Santa had a backup of one of the images. Maybe this can help you find the secret and recover all of Santa’s lost data…?

To recover the random seed of python’s Mersenne Twister, we can use the code from RNGeesus to recover the seed:

from test_mersenne import *
from Crypto.Util.number import long_to_bytes

with open('./backup/a.jpg', 'rb') as f:
    c1 = f.read()

with open('./memes/a.jpg', 'rb') as f:
    c2 = f.read()

cenc = b"".join([bytes([c1[i] ^ c2[i]]) for i in range(len(c1))])

s = []
for b in range((len(c1) + 3) // 4):
    s.append(int.from_bytes(cenc[b*4:b*4+4], 'big'))

outputs = s[:624]
b = BreakerPy()
recovered_seeds = b.get_seeds_python_fast(outputs)
print(long_to_bytes(array_to_int(recovered_seeds)))

The flag is: HV23{s33d_r3c0very_1s_34sy}