Obscure Crusher 1

Platform: Tjctf | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-05-15 | Status: Solved Techniques: binary_structure_analysis, file_format_identifier_recognition, key_reconstruction_from_header, xor_known_plaintext_attack

Summary

Task: 169-byte binary file containing three embedded file format identifiers (icns, ttf, lzma) and XOR-encrypted flag data. Solution: known-plaintext XOR attack using flag prefix to recover 16-byte key constructed from the file's non-zero header bytes.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: tjctf | ID: 20260515_tjctf_obscure_crusher_1
• Tags: known_plaintext_attack, lzma, xor_encryption, file_format_analysis, custom_binary_format, icns, ttf
• Indicators: small binary file with multiple file format magic bytes, XOR-encrypted data at known offset, challenge mentions multiple keys needed, file identifies as one format but contains markers for others, flag prefix enables known-plaintext XOR key recovery
• Source: 20260515_tjctf_obscure_crusher_1.md

Foothold

Vulnerability / Misconfiguration

1. binary_structure_analysis
2. file_format_identifier_recognition
3. key_reconstruction_from_header
4. xor_known_plaintext_attack

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• binary_structure_analysis
• file_format_identifier_recognition
• key_reconstruction_from_header
• xor_known_plaintext_attack
• Tags: known_plaintext_attack, lzma, xor_encryption, file_format_analysis, custom_binary_format, icns, ttf

Original Writeup

<details><summary>Click to expand original content</summary>

Description

What if I make it so you need 3 keys to unlock the flag...

A 169-byte binary file (chall.bin) is provided. The file command identifies it as "Mac OS X icon (icns)" but the file is actually a custom binary container embedding three file format identifiers as the "3 keys" to decrypt the flag.

Analysis

File Structure

Hex dump analysis reveals the binary has a carefully crafted structure:

Key Discovery via Known-Plaintext Attack

The XOR encryption key was recovered using the known flag prefix tjctf{:

1. XOR the first 6 encrypted bytes (at offset 129) with tjctf{
2. The resulting bytes are: i, c, n, s, \x01, t
3. These match the beginning of the file's non-zero content sequence: icns...ttf...lzma...
4. The full 16-byte repeating key is the concatenation of the three format identifiers with their structural separator bytes

XOR Key

Key (hex): 69 63 6e 73 01 74 74 66 02 78 79 6c 7a 6d 61 4b
Key (ascii): icns\x01ttf\x02xylzmaK

The key is literally built from the non-zero bytes of the file header — the three file format identifiers (icns, ttf, lzma) concatenated with their separator/structural bytes (\x01, \x02, xy, K).

Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""Solve script for Obscure Crusher 1 - TJCTF 2026"""

data = open('chall.bin', 'rb').read()

# Extract 36 bytes of encrypted flag data at offset 129
encrypted = data[129:165]

# XOR key: non-zero bytes from file header = icns + separators + ttf + separators + lzma + K
key = bytes([
    0x69, 0x63, 0x6e, 0x73,  # icns
    0x01,                      # separator
    0x74, 0x74, 0x66,          # ttf
    0x02,                      # separator
    0x78, 0x79,                # xy
    0x6c, 0x7a, 0x6d, 0x61,   # lzma
    0x4b                       # K
])

# Decrypt with repeating XOR
flag = bytes([encrypted[i] ^ key[i % len(key)] for i in range(len(encrypted))])
print(flag.decode())  # tjctf{REDACTED}

Verification

The flag in leet speak reads "obscure crusher: icns, ttf, lzma" — confirming the three file format identifiers are indeed the "3 keys" referenced in the challenge description.

</details>

---

signed by XESXOR