Weak RSA

826B

Weak RSA.zip

archive

Open

Zip Password:

hackthebox

SHA256 HASH for File-->

1cbf890e7a0fe8b404597b565da96c388e5653937631e2dc8710ede9d15bdb7d 

• Download and extract files from zip.

  • Use the password given to unzip.

• We get two files.

  • A ENC and a PUB file.

• Let's check out the PUB file.

cat [Path to key.pub]

-----BEGIN PUBLIC KEY-----
MIIBHzANBgkqhkiG9w0BAQEFAAOCAQwAMIIBBwKBgQMwO3kPsUnaNAbUlaubn7ip
4pNEXjvUOxjvLwUhtybr6Ng4undLtSQPCPf7ygoUKh1KYeqXMpTmhKjRos3xioTy
23CZuOl3WIsLiRKSVYyqBc9d8rxjNMXuUIOiNO38ealcR4p44zfHI66INPuKmTG3
RQP/6p5hv1PYcWmErEeDewKBgGEXxgRIsTlFGrW2C2JXoSvakMCWD60eAH0W2PpD
qlqqOFD8JA5UFK0roQkOjhLWSVu8c6DLpWJQQlXHPqP702qIg/gx2o0bm4EzrCEJ
4gYo6Ax+U7q6TOWhQpiBHnC0ojE8kUoqMhfALpUaruTJ6zmj8IA1e1M6bMqVF8sr
lb/N
-----END PUBLIC KEY-----

• Looks like a simple public RSA key.

• Now let's check out the ENC file.

cat flag.enc

• Looks like we get a bunch of gibberish which makes sense seeing as a .enc file means it was encrypted with some form of software.

  • We'll have to try to figure out how to decrypt the file to see it.

• I'm going to use the openssl tool on kali to try to decrypt it.

openssl enc -aes-256-cbc -d in [Path to flag.enc] -out flag.decrypted

• It asks me for a password so try giving it "password".

• It gives me back, bad magic number which is interesting. From what I know about magic numbers, they are the Hex Signature at the beginning of the binary file.

• Let's open it up the file in hexeditor which should be installed on Kali. If not, you can also use an online resource to inspect the hex.

• Hededitor

• hexed.it

• As you can see the first four sets of hexadecimal are:

01 A2 5F EF

• Unfortunately, doing a quick Google search shows that these are not associated with any well-known set of magic numbers which would make sense if the whole file is encrypted.

• Based on the fact that we were given a public key tells me that this is an asymmetric algorithm. This means that the using openssl above was most likely not going to work since it was using AES256 which is a symmetric algorithm.

• Need to use RsaCtfTool to create a private key from a public RSA key.

git clone https://github.com/RsaCtfTool/RsaCtfTool.git
sudo apt-get install libgmp3-dev libmpc-dev
cd RsaCtfTool
pip3 install -r "requirements.txt"
./RsaCtfTool.py

• Use command below to create RSA private key:

./RsaCtfTool.py --publickey [Path to public key] --private

• Create key.priv and copy over created private key.

• Then we need to run openssl to decrypt the file with the new private key.

openssl pkeyutl -decrypt -in [Path to encrypted file] -out myfile_decrypted.txt -inkey key.priv

• We can then cat the myfile_decrypted.txt for the flag.

cat myfile_decrypted.txt

• The final decrypted key is:

HTB{s1mpl3_Wi3n3rs_4tt4ck}