M0lecon2025beginner | SmallAuth

Introduction#

SmallAuth was a crypto CTF from ## m0leCon 2025 Beginner CTF organized by pwnthem0le.

1
from secret import flag, password
2
import signal
3
from Crypto.Util.number import (
4
    bytes_to_long,
5
    long_to_bytes,
6
    getRandomRange,
7
)
8
from hashlib import sha256
9
import os
10

11
p = 5270716116965698502689689671130781219142402682027195438035167686031865721400130496197382604002325978977917823871038888373085118354500422489134429970793096193438377786459821943518301475690713718745453633483219759953295608491564410082912515903134742148257215875373630412689071144760281744294536079770426517968527527493218935968663682019557492826204481612047410320146277333682801905360248457200458458982939490478875010628228329816347137904546340745621643293109290190631986349878770000332829974864263568375989597228583046155053640478805958492876860588535257030218304135983005840752161675722091031537527270835889607480661582626985375282908187505873350960702103509549729997875801557977556414403796543012974965425751833424162010931383924392626875437842811285456196644742198291857617009931030974156758885265756942730260677252867252555430773014258836269996233420470473918801854039549216620237517053340745984578639983387808534554731327
12
assert len(password) > 64
13

14
def timeout_handler(_1, _2):
15
    raise TimeoutError
16

17

18
class AuthProtocol:
19
    def __init__(self, password: bytes):
20
        super().__init__()
21
        self.p = p
22
        self.g = pow(bytes_to_long(password), 2, self.p)
23

24
    def gen_pub_key(self):
25
        self.a = getRandomRange(2, self.p)
26
        self.A = pow(self.g, self.a, self.p)
27
        return self.A
28

29
    def gen_shared_key(self, B):
30
        assert 1 < B < self.p
31
        k = pow(B, self.a, self.p)
32
        self.s = sha256(long_to_bytes(k)).digest()
33
        return self.s
34

35
    def confirm_key(self):
36
        signal.signal(signal.SIGALRM, timeout_handler)
37
        signal.alarm(5)
38
        try:
39
            challenge = input("Give me the challenge (hex): ").strip()
40
            challenge = bytes.fromhex(challenge.strip())
41
            (opad, ipad, challenge) = challenge[:16], challenge[16:32], challenge[32:]
42
            if challenge == sha256(opad + sha256(ipad + self.s).digest()).digest():
43
                pad = bytes([x^y for x, y in zip(ipad, opad)])
44
                print("Response:", sha256(pad + self.s).hexdigest())
45
            else:
46
                print("Mmm, cannot understand this challenge.")
47
        except TimeoutError:
48
            ipad = os.urandom(16)
49
            opad = os.urandom(16)
50
            print("\nI got bored waiting for your response.")
51
            print("I will start then.")
52
            print(
53
                f"Here is your challenge: {opad.hex()}{ipad.hex()}{sha256(opad + sha256(ipad + self.s).digest()).hexdigest()}"
54
            )
55
            response = input("Response? (hex): ")
56
            try:
57
                response = bytes.fromhex(response.strip())
58
                pad = bytes([x^y for x, y in zip(ipad, opad)])
59
                if response == sha256(pad + self.s).digest():
60
                    return True
61
                else:
62
                    print("Nope sorry.")
63
            except Exception as e:
64
                print("Ops, error")
65
        except Exception as e:
66
            print("Ops, error")
67
        return False
68

69

70
def main():
71
    print(
72
        "Welcome! Please authenticate to get the flag. You should know the password, right?"
73
    )
74
    auth = AuthProtocol(password)
75

76
    print("Here is my public key:", auth.gen_pub_key())
77
    B = int(input("Give me your public key: "))
78
    auth.gen_shared_key(B)
79

80
    if auth.confirm_key():
81
        print("Welcome!", flag)
82

83

84
if __name__ == "__main__":
85
    main()

The server simulates an authentication protocol: first it generates a secret shared key via a modified version of the Diffie-Hellman protocol where the generator isn’t public, then we have a 5 second window where we can interact with the verifier to check our sent challenges, finally it asks for a “challenge” which should be constructed from a sha256 hash involving the previously generated key.

Solution#

Without the generator it seems impossible to generate the secret key but a faulty check in gen_shared_key lets us generate it $50\%$ of the time:

1
def gen_shared_key(self, B):
2
    assert 1 < B < self.p
3
    k = pow(B, self.a, self.p)
4
    self.s = sha256(long_to_bytes(k)).digest()
5
    return self.s

The assert wants to prevent values such as 0 and multiples of self.p, but allows self.p - 1, which once raised to the self.ath power will be 1, when self.a is even, or self.p - 1 when self.a is odd. We can therefore just guess one of the two possibilities and retry until we’re right.

1
from pwn import *
2
from hashlib import sha256
3
from time import sleep
4

5

6
p = 5270716116965698502689689671130781219142402682027195438035167686031865721400130496197382604002325978977917823871038888373085118354500422489134429970793096193438377786459821943518301475690713718745453633483219759953295608491564410082912515903134742148257215875373630412689071144760281744294536079770426517968527527493218935968663682019557492826204481612047410320146277333682801905360248457200458458982939490478875010628228329816347137904546340745621643293109290190631986349878770000332829974864263568375989597228583046155053640478805958492876860588535257030218304135983005840752161675722091031537527270835889607480661582626985375282908187505873350960702103509549729997875801557977556414403796543012974965425751833424162010931383924392626875437842811285456196644742198291857617009931030974156758885265756942730260677252867252555430773014258836269996233420470473918801854039549216620237517053340745984578639983387808534554731327
7

8
def main():
9
    r = remote('smallauth.challs.m0lecon.it', 5102)
10

11
    r.recvuntil(b': ')
12
    A = int(r.recvline().rstrip().decode())
13

14
    B = p - 1
15
    r.sendlineafter(b': ', str(B).encode())
16

17
    s = sha256(b'\1').digest()
18

19
    sleep(5)
20

21
    r.recvuntil(b'challenge: ')
22
    challenge = bytes.fromhex(r.recvline().rstrip().decode())
23

24
    opad = challenge[:16]
25
    ipad = challenge[16:32]
26
    chal = challenge[32:]
27

28
    pad = bytes([x^y for x, y in zip(ipad, opad)])
29
    resp = sha256(pad + s).hexdigest()
30

31
    r.sendlineafter(b'): ', resp.encode())
32

33
    resp = r.recvline()
34
    r.close()
35

36
    if b'Nope' in resp:
37
        main()
38
    else:
39
        print('flag:', resp.rstrip().decode().split(' ')[1])
40

41

42
if __name__ == '__main__':
43
    main()

flag: ptm{y0u_4r3_a_j3d1_0f_pr0t0c0l5}