Challenge Context#

The challenge provided aes.py. The script reads the flag, uses it as an AES key padded with null bytes, encrypts a 16-byte zero block in ECB mode, and prints the ciphertext.

Reconnaissance#

The important part of the source was:

1
with open("flag.txt", "rb") as f:
2
    flag = f.read().strip()
3

4
key = flag + b"\x00" * (16 - len(flag))
5
cipher = AES.new(key, AES.MODE_ECB)
6
pt = b"\x00" * 16
7
ct = cipher.encrypt(pt)
8

9
print("len(flag): ", len(flag))
10
print("Ciphertext (hex):", ct.hex())

The output told us:

1
len(flag): 9
2
Ciphertext (hex): 489b02c7245f7d5b6221ba7bd7f85c29

Vulnerability / Core Idea#

The flag is the AES key. Because the flag length is 9 and the format is leet{...}, only three bytes are unknown:

1
leet{???}

This is not an AES break. The cryptographic mistake is turning a low-entropy, format-constrained secret into a symmetric key and revealing a known plaintext/ciphertext pair.

Exploitation#

For each candidate leet{XYZ}:

1. Pad it with seven null bytes to produce a 16-byte AES key.
2. Encrypt 00 * 16 under AES-ECB.
3. Compare the output to 489b02c7245f7d5b6221ba7bd7f85c29.

1
from Crypto.Cipher import AES
2
import itertools, string
3

4
target = bytes.fromhex("489b02c7245f7d5b6221ba7bd7f85c29")
5
pt = b"\x00" * 16
6
charset = string.ascii_letters + string.digits + "_!@#$%^&*()-+=[]{}|;:',.<>?/~`"
7

8
for a, b, c in itertools.product(charset, repeat=3):
9
    flag = f"leet{{{a}{b}{c}}}".encode()
10
    key = flag + b"\x00" * 7
11
    if AES.new(key, AES.MODE_ECB).encrypt(pt) == target:
12
        print(flag.decode())
13
        break

Flag#

1
leet{lol}

Lesson Learned#

Known plaintext plus a tiny keyspace turns strong primitives into a dictionary check. The primitive was fine; the key derivation was the bug.

Cover: Wallhaven xelyx3.