Rusty

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-03-11 | Status: Solved Techniques: known_plaintext_attack, stream_cipher_exploitation, xor_keystream_recovery

Summary

Task: decrypt a flag encrypted with RC4 stream cipher using a fixed key. Solution: perform a known-plaintext attack by encrypting known text with the binary, XOR-ing with the ciphertext to recover the keystream, then decrypting the original ciphertext.

Rusty — SPB CTF Pwn Season

Description

"Расшифруйте флаг"
(Decrypt the flag)

Binary: rusty — ELF 64-bit x86-64, PIE, stripped
Ciphertext: rusty_ct (data file)
Points: 10

Analysis

RC4 stream cipher with a fixed key. Since RC4 is a stream cipher, XOR ciphertext with known plaintext to recover the keystream.

The flag message "pls no reverse use debuggers" confirms the intended approach was using a debugger (Qira) to observe encryption, not reversing the algorithm.

Solution

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Attack Strategy:

1. Encrypt known plaintext "spbctf{AAA...}" using the binary
2. XOR encrypted output with original ciphertext to get keystream
3. XOR original ciphertext with keystream to get flag

 python read-only • copy allowed Copy
# Read ciphertext
with open('rusty_ct', 'rb') as f:
    ciphertext = f.read()

# Known plaintext (flag format)
known = b'spbctf{' + b'A' * (len(ciphertext) - 8) + b'}'

# Encrypt known plaintext using the binary (via Qira or subprocess)
# encrypted_known = run_binary(known)

# Recover keystream
keystream = bytes(a ^ b for a, b in zip(encrypted_known, known))
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Decrypt original ciphertext
flag = bytes(a ^ b for a, b in zip(ciphertext, keystream))
print(flag.decode())

Alternative approach using Qira:

1. Run binary under Qira debugger
2. Input known plaintext and observe XOR operations
3. Extract keystream directly from memory/registers ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍