blob: 9ea4f806434dcc6347d169b902f3b687b88fa064 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
|
# scarymaze
"I tried to get to level 489, but I was too scared."
I was hoping that the strings from OpenSSL would make it fairly easy to
determine the behavior of the following function, but that was not the case. No
one had solved the challenge until it was re-released with symbols included.
```rust
fn my_encrypt(packet: &[u8]) -> Vec<u8> {
let mut rng = rand::thread_rng();
let mut iv = [0 as u8; 16];
rng.fill_bytes(&mut iv);
let cipher = Cipher::aes_128_cbc();
let key = AES_KEY.as_bytes();
let mut data = encrypt(cipher, key, Some(&iv), packet).unwrap();
let mut ciphertext = Vec::from(iv);
ciphertext.append(&mut data);
ciphertext
}
```
Once you realized that the network traffic was being encrypted with AES-128-CBC,
you could capture packet traces and decrypt it. The packet format was designed
to be simple enough that be reverse engineered from packet traces and client
interaction alone.
Then, you were to write your own client which would solve the mazes for you. The
server would give you the flag when you had reached level 489.
Solving mazes can be done with an
[algorithm](https://en.wikipedia.org/wiki/Depth-first_search) usually introduced
within the first month of a university computer science program.
|
