Нулевой шифр (Null Cipher)

Platform: CUSTOM | Category: Crypto | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: Known prefix attack on key derivation, RC4 decryption with recovered key, Base64 decoding, Source code analysis for vulnerability identification

Summary

Walkthrough of the CUSTOM Crypto Нулевой шифр (Null Cipher). Files: - request.txt - HTTP request with encrypted FLAG parameter - sourceCode.txt - Python encryption code

Description

Мы успешно перехватили запрос с компьютера подозреваемого, направленный к одному из ресурсов даркнета, и смогли украсть часть кода с сервера, который используется для зашифрованного общения. Наш криптограф не смог справиться с этой задачей, поэтому мы надеемся на вашу помощь.

Files:

• request.txt - HTTP request with encrypted FLAG parameter
• sourceCode.txt - Python encryption code

Analysis

HTTP Request (request.txt)

GET /?FLAG=lUmU56gHyTe0DabyGJIZEI9mGyx/4NG1tX8yhml1KmQWEdfQ3TNNkU3z1w== HTTP/1.1
Host: 1.3.3.7
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
...

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Encrypted flag: lUmU56gHyTe0DabyGJIZEI9mGyx/4NG1tX8yhml1KmQWEdfQ3TNNkU3z1w==

Source Code (sourceCode.txt)

 python read-only • copy allowed Copy
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend
import base64
import hashlib

def encrypt(key, plaintext):
    FLAG = '******{***********************************}'.encode()
    key = FLAG[:6]  # <-- VULNERABILITY: key = first 6 characters of flag!
    hashed_key = hashlib.sha256(key).digest()[:16]
    cipher = Cipher(algorithms.ARC4(hashed_key), mode=None, backend=default_backend())
    encryptor = cipher.encryptor()
    ct = encryptor.update(plaintext) + encryptor.finalize()
    return base64.b64encode(ct)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Vulnerability

Critical flaw in the code:

1. Encryption key = first 6 characters of the flag
2. Flag format is known: CODEBY{...}
3. Therefore, key = CODEBY (always!)

The name "Null Cipher" is a red herring. In reality, RC4 (ARC4) is used, but with a predictable key.

Encryption Algorithm

plaintext → RC4(SHA256("CODEBY")[:16]) → Base64 → ciphertext

Decryption Algorithm

ciphertext → Base64 decode → RC4(SHA256("CODEBY")[:16]) → plaintext

Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Null Cipher - HackerLab
RC4 decryption with known key prefix attack
"""
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend
import base64
import hashlib

# Encrypted flag from HTTP request
encrypted_b64 = "lUmU56gHyTe0DabyGJIZEI9mGyx/4NG1tX8yhml1KmQWEdfQ3TNNkU3z1w=="

# Decode Base64
encrypted = base64.b64decode(encrypted_b64)

# Key = first 6 characters of flag = "CODEBY" (known format!)
key = b"CODEBY"

# Key derivation: SHA256 → first 16 bytes
hashed_key = hashlib.sha256(key).digest()[:16]

# RC4 decryption (RC4 is symmetric - encrypt = decrypt)
cipher = Cipher(algorithms.ARC4(hashed_key), mode=None, backend=default_backend())
decryptor = cipher.decryptor()
plaintext = decryptor.update(encrypted) + decryptor.finalize()
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

print(plaintext.decode())

Lessons

1. Never use secret data to generate the key — if part of the data is predictable, the key is also predictable
2. RC4 itself is not vulnerable — the problem is in key derivation
3. Task name can be a red herring — "Null Cipher" has nothing to do with null cipher, it's RC4
4. Flag confirms the solution: REDACTED = "easy RC4+Base64 encryption defeated" ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering Known prefix attack on key derivation, RC4 decryption with recovered key, Base64 decoding, Source code analysis for vulnerability identification was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-01-02 • CUSTOM • Нулевой шифр (Null Cipher) • Difficulty: Medium