Download the two files from hackropole website. Download the rockyou wordlist from github
wget https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt
Python script to brute the code with the IV, then decrypt using rockyou:
import json
from Crypto.Hash import HMAC, SHA256
# Charger les données de output.txt
with open("output.txt", "r") as f:
data = json.load(f)
target_hmac = data["h"] # HMAC à retrouver
# Ouvrir le fichier rockyou.txt (assurez-vous de l'avoir)
with open("rockyou.txt", "r", encoding="latin-1") as f:
for password in f:
password = password.strip().encode() # Nettoyer et encoder le mot de passe
# Générer l'HMAC avec le mot de passe testé
h = HMAC.new(password, digestmod=SHA256)
h.update(b"FCSC2022")
if h.hexdigest() == target_hmac:
print(f"[✅] Mot de passe trouvé : {password.decode()}")
break
else:
print("[❌] Aucun mot de passe trouvé dans rockyou.txt.")
┌──(myenv)─(kali㉿kali)-[~/hack]
└─$ python3 script01.py
[✅] Mot de passe trouvé : omgh4xx0r
Once done, delete output.txt and redownload the original. Use another python script to decypher the flag with the code we got:
import json
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
from Crypto.Hash import SHA256
# Load the encrypted data
with open("output.txt", "r") as f:
data = json.load(f)
password = "omgh4xx0r".encode() # Use the recovered password
# Recompute the AES key
k = SHA256.new(password).digest()
iv = bytes.fromhex(data["iv"])
ciphertext = bytes.fromhex(data["c"])
# Decrypt
cipher = AES.new(k, AES.MODE_CBC, iv)
decrypted_data = cipher.decrypt(ciphertext)
# Debug: Print raw decrypted data
print(f"[🔍] Raw Decrypted Data: {decrypted_data}")
try:
flag = unpad(decrypted_data, 16).decode()
print(f"[🏴☠️] Flag: {flag}")
except ValueError as e:
print(f"[❌] Padding error: {e}")
print(f"IV from output.txt: {data['iv']}")
print(f"Ciphertext from output.txt: {data['c']}")
print(f"Computed AES Key: {k.hex()}")
──(myenv)─(kali㉿kali)-[~/hack]
└─$ python3 script02.py
[🔍] Raw Decrypted Data: b'FCSC{5bb0780f8af31f69b4eccf18870f493628f135045add3036f35a4e3a423976d6}\n\n\n\n\n\n\n\n\n\n'
[🏴☠] Flag: FCSC{5bb0780f8af31f69b4eccf18870f493628f135045add3036f35a4e3a423976d6}
IV from output.txt: ea425b2ea4bb67445abe967e3bd1b583
Ciphertext from output.txt: 69771c85e2362a35eb0157497e9e2d17858bf11492e003c4aa8ce1b76d8d3a31ccc3412ec6e619e7996190d8693299fc3873e1e6a96bcc1fe67abdf5175c753c09128fd1eb2f2f15bd07b12c5bfc2933
Computed AES Key: f1f249a82f2201b69220d7ea04aa4a19d2890eac81087c00cf8096791998b986