Challenge Overview#

The Crypto Clock challenge from Nahamcon 2025 provides an encrypted flag and some source code that generates a pseudo-random key using the current timestamp as a seed. The goal is to recover the original flag by replicating the key generation logic.

Initial Analysis#

We are given the following encrypted flag:

alt text

1
>>> flag = "a6717b705265d3b9d810736c72b27bc8bcc5d245e68ccada61f8c16277d5a8bb5655db3cc7d0"
2
>>> print(len(flag))
3
76
4
>>> print(len(flag)/2)
5
38.0

The hex-encoded string is 76 characters long, which corresponds to 38 bytes.

Our task is to replicate the key generation, then XOR it with the ciphertext to retrieve the plaintext flag.

Moving on, lets analyze the source code:

alt text

In the generate_key function, they will generate the same key if the same seed is provided. The seed that they gave was the current time, using python. We need to replicate the same behavior to get the key, than XOR it with the ciphertext to get the flag.

Finally, we created our final exploit.

Exploit#

1
import time
2
import random
3
import socket
4
from pwn import xor
5

6
HOST = 'challenge.nahamcon.com'
7
PORT = 31909
8

9
def bruteKey(size,seed):
10
    """Challenge Function used to generate the key."""
11
    if seed is not None:
12
        random.seed(int(seed))
13
    return bytes(random.randint(0, 255) for _ in range(size))
14

15
with socket.create_connection((HOST, PORT)) as s:
16
    # We retrieve the current time right after connecting to the port.
17
    current_time = int(time.time())
18
    print("Now it is currently:",current_time)
19

20
    # Then we retrieve only the flag part of the output.
21
    data = s.recv(1024).decode()
22
    enc_flag = data[47:123]
23

24
    # Finally, we get the size of the flag and pass it to the function that
25
    # generates the key.
26
    size = (len(enc_flag))
27
    key = bruteKey(size,current_time)
28

29
    # We need to conver the flag to bytes, to xor it with the key(that is already bytes)
30
    flag_bytes = bytes.fromhex(enc_flag)
31

32
    # XOR
33
    final_flag = xor(flag_bytes,key)
34

35
    # Clean the output
36
    flag = final_flag.decode('utf-8',errors='ignore')[:38]
37
    print(flag)

Flag:

1
flag{0e42ba180089ce6e3bb50e52587d3724}

Nahamcon CTF 2025 - Crypto Clock

https://xiaowenjictf.github.io/posts/nahamcon/cryptoclock/

Author

xiaowenji

Published at

2025-09-01

License

CC BY-NC-SA 4.0

Paper - HTB Machine