Забытый (Forgotten)

Platform: hackerlab | Category: Crypto | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2025-12-24 | Status: Solved Techniques: Key pattern recognition, Python escape sequence decoding, XOR known-plaintext attack

Summary

Task: XOR-encrypted ciphertext with Python escape sequences. Solution: Known-plaintext attack using flag format prefix to recover repeating 4-byte key.

Забытый (Forgotten) — hackerlab

Description

Я решил попробовать шифрование XOR-ом, но забыл секретный ключ...

Files: forgotten.zip → cyphertext.txt

Analysis

1. Examining the ciphertext

The file cyphertext.txt contains Python-style escape sequences:

+\x7ft1*iK\x1c[Io\x16\x1a\x00o\x1aYS\x03+\x10\x00B\t

2. Decoding escape sequences

Convert escape sequences to bytes:

 python read-only • copy allowed Copy
raw = b'+\x7ft1*iK\x1c[Io\x16\x1a\x00o\x1aYS\x03+\x10\x00B\t'
print(raw.hex())
# 2b7f74312a694b1c5b496f161a006f1a5953032b10004209

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

We get 24 bytes of ciphertext.

3. Known-Plaintext Attack

Knowing the flag format CODEBY{, XOR the first 7 bytes of ciphertext with the known plaintext:

 python read-only • copy allowed Copy
ciphertext = bytes.fromhex('2b7f74312a694b1c5b496f161a006f1a5953032b10004209')
known_prefix = b'CODEBY{'

# Recover part of the key
key_fragment = bytes([c ^ p for c, p in zip(ciphertext[:7], known_prefix)])
print(key_fragment)  # b'h00th00'

4. Determining the key

We see a repeating pattern: h00th00 → key is h00t (4 bytes).

Solution

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
XOR Known-Plaintext Attack
Task: Забытый (Forgotten) - hackerlab
"""

# Ciphertext (decoded escape sequences)
ciphertext = bytes.fromhex('2b7f74312a694b1c5b496f161a006f1a5953032b10004209')

# Known flag prefix
known_prefix = b'CODEBY{'

# Recover the key via XOR with known plaintext
key_fragment = bytes([c ^ p for c, p in zip(ciphertext[:7], known_prefix)])
print(f"Key fragment: {key_fragment}")  # b'h00th00'

# Determine the full key (repeating pattern)
key = b'h00t'
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Decrypt
def xor_decrypt(data, key):
    return bytes([data[i] ^ key[i % len(key)] for i in range(len(data))])

plaintext = xor_decrypt(ciphertext, key)
print(f"Flag: {plaintext.decode()}")

Theory

XOR Known-Plaintext Attack

XOR has the property: C = P ⊕ K → K = C ⊕ P

If plaintext P and ciphertext C are known, key K is recovered trivially.

Repeating-Key XOR

When using a short key, it repeats cyclically:

• plaintext[0] ⊕ key[0]
• plaintext[1] ⊕ key[1]
• ...
• plaintext[n] ⊕ key[n % len(key)] ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Knowing len(key) bytes of plaintext, the entire key can be recovered.

References

• XOR Cipher
• Known-plaintext attack ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍