Weak RSA

Zip Password:
hackthebox
SHA256 HASH for File-->
1cbf890e7a0fe8b404597b565da96c388e5653937631e2dc8710ede9d15bdb7d
Download and extract files from zip.
Use the password given to unzip.

We get two files.
A ENC and a PUB file.
Let's check out the PUB file.
cat [Path to key.pub]

-----BEGIN PUBLIC KEY-----
MIIBHzANBgkqhkiG9w0BAQEFAAOCAQwAMIIBBwKBgQMwO3kPsUnaNAbUlaubn7ip
4pNEXjvUOxjvLwUhtybr6Ng4undLtSQPCPf7ygoUKh1KYeqXMpTmhKjRos3xioTy
23CZuOl3WIsLiRKSVYyqBc9d8rxjNMXuUIOiNO38ealcR4p44zfHI66INPuKmTG3
RQP/6p5hv1PYcWmErEeDewKBgGEXxgRIsTlFGrW2C2JXoSvakMCWD60eAH0W2PpD
qlqqOFD8JA5UFK0roQkOjhLWSVu8c6DLpWJQQlXHPqP702qIg/gx2o0bm4EzrCEJ
4gYo6Ax+U7q6TOWhQpiBHnC0ojE8kUoqMhfALpUaruTJ6zmj8IA1e1M6bMqVF8sr
lb/N
-----END PUBLIC KEY-----
Looks like a simple public RSA key.
Now let's check out the ENC file.
cat flag.enc

Looks like we get a bunch of gibberish which makes sense seeing as a
.enc
file means it was encrypted with some form of software.We'll have to try to figure out how to decrypt the file to see it.
I'm going to use the
openss
l tool on kali to try to decrypt it.
openssl enc -aes-256-cbc -d in [Path to flag.enc] -out flag.decrypted

It asks me for a password so try giving it "
password
".It gives me back, bad magic number which is interesting. From what I know about magic numbers, they are the Hex Signature at the beginning of the binary file.
Let's open it up the file in hexeditor which should be installed on Kali. If not, you can also use an online resource to inspect the hex.
Hededitor


As you can see the first four sets of hexadecimal are:
01 A2 5F EF
Unfortunately, doing a quick Google search shows that these are not associated with any well-known set of magic numbers which would make sense if the whole file is encrypted.
Based on the fact that we were given a public key tells me that this is an asymmetric algorithm. This means that the using
openssl
above was most likely not going to work since it was usingAES256
which is a symmetric algorithm.Need to use RsaCtfTool to create a private key from a public RSA key.
git clone https://github.com/RsaCtfTool/RsaCtfTool.git
sudo apt-get install libgmp3-dev libmpc-dev
cd RsaCtfTool
pip3 install -r "requirements.txt"
./RsaCtfTool.py
Use command below to create RSA private key:
./RsaCtfTool.py --publickey [Path to public key] --private

Create
key.priv
and copy over created private key.Then we need to run
openssl
to decrypt the file with the new private key.
openssl pkeyutl -decrypt -in [Path to encrypted file] -out myfile_decrypted.txt -inkey key.priv
We can then
cat
themyfile_decrypted.txt
for the flag.
cat myfile_decrypted.txt
The final decrypted key is:
HTB{s1mpl3_Wi3n3rs_4tt4ck}

Last updated