---
description: find plain text
---

# ACS 2023: rustarm

## TL;DR

> Simple string encryptor written in Rust with known character set and XOR key.

## Challenge Overview

For this challenge, we are given a Rust binary and an encoded secret that may potentially be our encrypted flag.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2F3rMOJ5sqQV8x4Tbj0iNh%2Fimage.png?alt=media&#x26;token=7df87448-ece7-4524-83b1-d250161dcca5" alt=""><figcaption></figcaption></figure>

After playing around with the output, we observed the following behaviour:

1. If user input does not start the flag format, an error message `Invalid input format` is thrown.&#x20;
2. The Rust program encounters a length error whenever our input length is <5 characters.
3. When there are no characters between the curly brackets, no encrypted text is outputted.&#x20;

Based on the observations above, it's safe to deduce that our flag length is 23 characters (excluding flag format) since there are 23 hex values in the provided `enc` file.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2Fg2N3jB83FU8qhLKJsy8e%2Fimage.png?alt=media&#x26;token=6b7eb31e-eaad-4a8e-91e0-7be7923ddf4a" alt=""><figcaption></figcaption></figure>

## **Solution 1: Decoding Values Manually**

### Validating Input Format

At the start of the main function, there is a nested if statement that checks local\_58 against the flag format `ACS{}`. Based on this, we know that local\_58 is our user-controlled input.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FuqBNudY68MwMzXNoAuJi%2Fimage.png?alt=media&#x26;token=eff99eb4-f43c-481f-8006-3caa7f929905" alt=""><figcaption></figcaption></figure>

Furthermore, this portion of code in the main function shifts our user input forward by 4 bytes, which explains why the starting flag format `ACS{`  is not included in the encryption. At this point, we can also safely assume that the ending bracket `}` will be excluded from the encryption.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FpIHB0XywnUwX3QxCy49l%2Fimage.png?alt=media&#x26;token=d80e9515-e19d-46a3-b64a-ab5a60c1ea0f" alt=""><figcaption></figcaption></figure>

### Non-Null Terminated Strings

Next, we can find a bunch of strings that are not null-terminated in Rust.&#x20;

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FGKQtdwKH934cR9p7uDSa%2Fimage.png?alt=media&#x26;token=cf544105-c1ca-454a-a268-a57770421178" alt=""><figcaption></figcaption></figure>

To clear these up for better readability. We can undefine all these data sections with `Right Click -> Clear Code Bytes`, then redefine them in a character array of their respective size like char\[23].

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FzSf9jWfjqNGCjhWlk2YB%2Fimage.png?alt=media&#x26;token=71734af6-bbe3-4f5a-a8cf-518997a76fe2" alt=""><figcaption></figcaption></figure>

### XOR Operation

Further down, we find a suspicious XOR operation that involves 2 operands. To understand where the operands originated from, we will trace the variables using Ghidra's Slice Highlighting feature.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FwCJ86aJAS0ydmPQ2ZVyM%2Fimage.png?alt=media&#x26;token=1dd22def-f565-49fb-a138-b98e72a6f6e3" alt=""><figcaption></figcaption></figure>

#### Tracing Operand 1: uVar3

Right Click -> Highlight -> Forward Operator Slice

uVar3 -> local\_a8

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FDPAz7RLm82pVupPs7qGa%2Fimage.png?alt=media&#x26;token=e15195e1-58ac-46b3-937e-4cc8a427b9b7" alt=""><figcaption></figcaption></figure>

Right Click -> Highlight -> Backward Operator Slice

local\_a8 -> local\_e8

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FyjXqLw8gzMgOegQVyPpY%2Fimage.png?alt=media&#x26;token=7bbe4597-f1c9-4087-abed-77941bd00e79" alt=""><figcaption></figcaption></figure>

From this, we know that the first XOR operand is the 23-long string `ACSISACEANCYBERSECURITY`.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FW998fAPJ6zY0xVnNpRBD%2Fimage.png?alt=media&#x26;token=d0b84937-ed1f-4963-a945-120985a88367" alt=""><figcaption></figcaption></figure>

#### Tracing Operand 2: uVar4

Right Click -> Highlight -> Forward Operator Slice

uVar4 -> local\_158

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2Fgqvv9kmlu1ROL0LWrcp0%2Fimage.png?alt=media&#x26;token=dd96dce8-3dea-4b33-9500-89b287b55231" alt=""><figcaption></figcaption></figure>

Right Click -> Highlight -> Backward Operator Slice

local\_158 -> local\_58 (Recall that we have previously identified local\_58 as our user-controlled input)

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FRTvHDmmaawTRXgb1ICbW%2Fimage.png?alt=media&#x26;token=79691629-aa3d-462e-92c9-c35970330dd3" alt=""><figcaption></figcaption></figure>

### Hypothesis 1

The fact that the string `ACSISACEANCYBERSECURITY` is the same length as our flag makes it a good candidate for the XOR encryption key. A classic way to verify this is by having the key XOR itself; and if the result is all zeroes, we know that the key is valid.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FFE0slwANvaT88VZBOyL9%2Fimage.png?alt=media&#x26;token=18cb8553-5daa-4ba0-a258-781b5c2ef59d" alt=""><figcaption></figcaption></figure>

Based on that, we now know that the program is doing a simple character-by-character XOR like the following pseudocode:

```python
for i in range(23):
    output[i] = input[i] ^ key[i]
```

However, when attempting to reverse this logic, we get several corrupted characters - Perhaps there's more twist to it?

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FYc0kWBXoNSiTKzR3eSQZ%2Fimage.png?alt=media&#x26;token=13c311a3-8ae4-4baa-9335-3c727dcef8f6" alt=""><figcaption></figcaption></figure>

### Hypothesis 2&#x20;

Looking back, I realized there's a character set `[0-9a-zA-Z\D\W]` initialized as local\_d0, which has yet to be referenced anywhere.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FFV6YaoaT82uahEBSk3zz%2Fimage.png?alt=media&#x26;token=7eab7afa-00ad-4f4a-b5c6-66df2b3f320f" alt=""><figcaption></figcaption></figure>

At this point, I was wondering what kind of additional manipulation could've been applied to both our user input and the `ACSISACEANCYBERSECURITY` key, which then leads me to the following logic:

```python
for i in range(23):
    output[i] = alphabet.index(input[i]) ^ alphabet.index(key[i])
```

The reason why I knew the `alphabet.index()` function is needed for both the input and key operand, is because it would be impossible to get all zeroes when XORing the key by itself in the case where `alphabet.index()` is applied only on either one of the operands.

Reversing the logic would then give us the following pseudocode:

<pre class="language-python"><code class="lang-python">for i in range(23):
<strong>    input[i] = alphabet[output[i] ^ alphabet.index(key[i])]
</strong></code></pre>

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FX9c6LGln6vYTVSBratl6%2Fimage.png?alt=media&#x26;token=e5be9705-2a4c-46c5-ae5d-e73be434747f" alt=""><figcaption></figcaption></figure>

**Flag:** ACS{cR0s$\_C0mpi1e\_wi7h\_Rust}

### Final Script

```python
#!/usr/bin/python3

alphabet = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz!@#$%^&*()-_=+"
output = bytes.fromhex("2c171c245d43000e3a24202323472130092757002a2b15")
key = [alphabet.index(c) for c in "ACSISACEANCYBERSECURITY"]

assert(len(output) == len(key))

flag = ""
for e, k in zip(output, key):
    flag += alphabet[e ^ k]
print("ACS{" + flag + "}")
```

## **Solution 2: Brute Forcing**

Another behaviour that I noticed was the encryption is performed independently of each position. This means that, unlike in a typical Hash Diffusion scenario, any wrong guesses attempted will not alter other parts of the ciphertext. This behaviour alone reduces the number of guesses (premutations) required to brute force the flag.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FrNzWBq9QliAcTLB7HMqT%2Fimage.png?alt=media&#x26;token=b768becd-a7c5-4a61-929e-5231a7200a7e" alt=""><figcaption></figcaption></figure>

To export the character set with a breeze, I used `convert_to_python_list.py` from LazyGhidra to convert it into a Python list.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2FKt2UoTqlS7Mx9OI8ZRUp%2Fimage.png?alt=media&#x26;token=b85146a4-58ae-4173-a6a0-c86676ee961b" alt=""><figcaption></figcaption></figure>

Then, I wrote a simple brute-force script to compare the results.

<figure><img src="https://80158427-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkoydBBkDRRSxCLl1Wpgr%2Fuploads%2F20lp75bBRBFpCMDzbWQn%2Fimage.png?alt=media&#x26;token=7f7b2a5a-5383-463e-a15a-1528d32aeda0" alt=""><figcaption></figcaption></figure>

**Flag:** ACS{cR0s$\_C0mpi1e\_wi7h\_Rust}

### Final Script

```python
#!/usr/bin/python3

from pwn import *

exe = "./rustarm"
elf = context.binary = ELF(exe, checksec=False)

context.clear(arch="amd64")
context.log_level = 'CRITICAL'
warnings.filterwarnings(action='ignore', category=BytesWarning)

char_set = [
    0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 
    0x47, 0x48, 0x49, 0x4A, 0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 
    0x57, 0x58, 0x59, 0x5A, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 
    0x6D, 0x6E, 0x6F, 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A, 0x21, 0x40, 
    0x23, 0x24, 0x25, 0x5E, 0x26, 0x2A, 0x28, 0x29, 0x2D, 0x5F, 0x3D, 0x2B
]

enc = "2c171c245d43000e3a24202323472130092757002a2b15"
global password
password_length = 23

def main():
    password = "ACS{"

    for i in range(password_length):
        for char in char_set:
            io = elf.process()
            io.recvuntil(b'plain text: ')

            candidate_password = password + chr(char) + chr(125) # closing curly bracket
            io.sendline(candidate_password)
            print("Trying: ", candidate_password)

            io.recvuntil(b'encrypt text: ')
            output = io.recvline()[:-1].decode()

            if enc.startswith(output):
                print("Password Found:", candidate_password)
                password = password + chr(char)
                break

            io.close()
            time.sleep(0.15)

if __name__ == "__main__":
        main()
```
