fluffy - GoogleCTF 2025

token, pinでsecretを暗号化できるAndroidアプリ

初期状態でsecretが3つあり、これらにflagが保存されていそう

macOSでは動かず、Linuxでは動いた

生成されたfridaのスクリプトを使うと動的解析ができて便利

LLMに生成されたアセンブリにコメントを書いてもらい、その後dartのコードに変換してもらうと読みやすい

tokenは以下のように生成されていた

code:python

import time

import hashlib

def base62_encode(data: bytes) -> str:

_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"

_BASE = 62

if not data:

return ""

number = int.from_bytes(data, 'big')

if number == 0:

result_chars = []

while number > 0:

number, remainder = divmod(number, _BASE)

return "".join(reversed(result_chars))

def generate_token() -> str:

tick = int(time.time())

digest = hashlib.sha1(f"gctf25_{tick}".encode()).digest()

print(generate_token())

暗号化の処理は以下

code:python

def encrypt(pin: int, token_str: str, secret_str: str) -> str:

token = base62_decode(token_str)

secret = bytearray(secret_str.encode())

for round in range(pin):

new_secret = []

for i in range(len(secret)):

new_secret.append(_rotl8(v1, i & 7))

for i in range(len(new_token)):

v1 = ((round & 3) + 1) & 7

v2 = (pin ^ v1) & 7

token = new_token

return base62_encode(bytes(secret))

これを元に復号コードを書いた

code:python

def decrypt(pin: int, token_str: str, enc_str: str) -> str:

init_token = list(base62_decode(token_str))

token = init_token

for rnd in range(pin):

token_states.append(token.copy())

v1 = ((rnd & 3) + 1) & 7

v2 = (pin ^ v1) & 7

secret = list(base62_decode(enc_str))

for rnd in range(pin - 1, -1, -1):

prev = []

for i, b in enumerate(tmp):

x = _rotr8(b, i & 7)

secret = prev

return bytes(secret).decode()

pinとtoken（作成日時からある程度予測できる）が不明なので、これらをbruteforceする必要がある

Rustのコードに変換してもらい、した

code:rust

// -----------------------------------------------------------------------------

// Rust brute‑force tool – BigInt‑based Base‑62 (no external base62 crate)

//

// Cargo.toml:

// sha1 = "0.10"

// rayon = "1.10"

// chrono = "0.4"

// num-bigint = "0.4"

// num-traits = "0.2"

// num-integer = "0.1"

// -----------------------------------------------------------------------------

use chrono::{FixedOffset, NaiveDate, TimeZone};

use num_bigint::BigUint;

use num_integer::Integer;

use num_traits::{FromPrimitive, ToPrimitive, Zero};

use rayon::prelude::*;

const BASE: u32 = 62;

// ------------------------ BigInt Base‑62 ----------------------------------

if data.is_empty() {

return String::new();

}

let mut num = BigUint::from_bytes_be(data);

if num.is_zero() {

return "0".to_string();

}

let base = BigUint::from_u32(BASE).unwrap();

let mut buf = Vec::new();

while !num.is_zero() {

let (q, r) = num.div_rem(&base);

num = q;

}

buf.iter().rev().collect()

}

fn base62_decode(s: &str) -> Vec<u8> {

if s.is_empty() {

return Vec::new();

}

let base = BigUint::from_u32(BASE).unwrap();

let mut num = BigUint::zero();

for &b in s.as_bytes() {

let val = ALPHABET

.iter()

.position(|&c| c == b)

.expect("invalid base62 char") as u32;

num = num * &base + BigUint::from_u32(val).unwrap();

}

num.to_bytes_be()

}

// -------------------------- Helpers ---------------------------------------

fn rotl8(v: u8, n: u8) -> u8 {

((v << n) | (v >> (8 - n))) & 0xFF

}

fn rotr8(v: u8, n: u8) -> u8 {

((v >> n) | (v << (8 - n))) & 0xFF

}

fn generate_token(tick: i64) -> String {

let digest = Sha1::digest(format!("gctf25_{tick}").as_bytes());

}

// ----------------------- Cipher core --------------------------------------

fn encrypt(pin: u16, token_str: &str, secret_str: &str) -> String {

let mut token: Vec<u8> = base62_decode(token_str);

let mut secret: Vec<u8> = secret_str.as_bytes().to_vec();

for round in 0..pin {

// --- secret transformation ---

let mut new_secret = Vec::with_capacity(secret.len());

for (i, &b) in secret.iter().enumerate() {

new_secret.push(rotl8(v1, (i & 7) as u8));

}

secret.clear();

secret.push(*new_secret.last().unwrap());

// --- token transformation ---

let v1 = ((round & 3) + 1) & 7;

let v2 = (pin ^ v1) & 7;

for t in &mut new_token {

*t = rotr8(*t, v2 as u8);

}

token = new_token;

}

base62_encode(&secret)

}

fn decrypt(pin: u16, token_str: &str, enc_str: &str) -> Option<String> {

let init_token = base62_decode(token_str);

let mut token_states: Vec<Vec<u8>> = Vec::with_capacity(pin as usize);

// forward pass – capture token states

let mut token = init_token.clone();

for rnd in 0..pin {

token_states.push(token.clone());

let v1 = ((rnd & 3) + 1) & 7;

let v2 = (pin ^ v1) & 7;

token = tmp.into_iter().map(|t| rotr8(t, v2 as u8)).collect();

}

let mut secret = base62_decode(enc_str);

// reverse pass

for rnd in (0..pin).rev() {

let mut prev = Vec::with_capacity(tmp.len());

for (i, b) in tmp.into_iter().enumerate() {

let x = rotr8(b, (i & 7) as u8);

}

secret = prev;

}

String::from_utf8(secret).ok()

}

// ------------------------- Brute‑force ------------------------------------

struct SecretEntry {

time: (i32, i32, i32, i32, i32), // Y,M,D,h,m (sec is brute‑forced)

ciphertext: &'static str,

}

fn unix_time(t: (i32, i32, i32, i32, i32), sec: u32) -> i64 {

NaiveDate::from_ymd_opt(t.0, t.1 as u32, t.2 as u32)

.unwrap()

.and_hms_opt(t.3 as u32, t.4 as u32, sec)

.unwrap()

.and_utc()

.timestamp()

}

fn crack(entry: &SecretEntry) {

println!("=== ciphertext: {} ===", entry.ciphertext);

(0u32..60).into_par_iter().for_each(|sec| {

println!("sec: {sec}");

let tick = unix_time(entry.time, sec);

let token = generate_token(tick);

(0u16..=9999u16).into_par_iter().for_each(|pin| {

if let Some(plain) = decrypt(pin, &token, entry.ciphertext) {

println!("{sec:02} {pin:04} {} -> {plain}", entry.ciphertext);

}

});

});

}

fn main() {

let secrets = [

SecretEntry {

time: (2023, 8, 4, 13, 37),

ciphertext: "fmMf7mIMbHcPoQmLGx1CO0XVGBmhjTaYhB0",

},

SecretEntry {

time: (2024, 9, 7, 18, 52),

ciphertext: "506WRgCajs3QSTyohnu2hldds18mjkx",

},

SecretEntry {

time: (2025, 3, 3, 22, 7),

ciphertext: "fgv99dOvazsvEESh7DPKbb3k0I3RW",

},

];

for secret in &secrets {

crack(secret);

}

}