Recover complete flag from AES CTR with XOR Operation

97 views Asked by At

I have two variables that contain AES CTR encryption of two different messages with the same password and IV, named "encFlag" and "encText." I also have the unencrypted content of "text."

The size of "text" is smaller than that of "flag."

Using XOR, I can retrieve the initial characters of the flag, but not the rest. How can I recover the remaining characters?

this is my actual code, the idea is pretty simple i xored the ciphers between them, and then with the plaintext, but i got only the first len(text) characters.

def XOR_two_blocks(x, y):
    return bytes(a ^ b for a, b in zip(x, y))

def main():
  # iv = 7c642365e47f720f460558bd3dc7b105
  # blockSize = 16
  
  text = b"Hello the world !"

  b64_encFlag = "KB44ZAl8E0ZgWg0gaUsjW1jU8ZF+alr/nazHZeD3Q+c/GxC6gSqw2JqRjfYJPSdQb7GbxzbdQMb3DY5mB1OK1dGFJH+yH502Q5VO1n+IuqJ2SrdxImApUCSBWWs+qahZuW5pb8vYaU/r6klDQ8z+14yEGtfTNHSj5a73stxXIgsrAwsZOyJ6QgpDo4Dd75XUDk365ARZE6cSV5h8xWg9f7ifNfWYgKmmOYwZZtr/oEoWN5hJz6EYXcOvi8zZJ2yw41ezS5H9D7V2AXv2B01n2X5neDJCxo77oGsQJjZD7AAUbE8ub3NqHkz29C4yh9CI"
  b64_encText = "LBQmbQt8Dl52Dxdvf0grFAv7jfcFRTSd99fkSoyXIps="

  encFlag = binascii.unhexlify(base64.b64decode(b64_encFlag).hex())
  encText = binascii.unhexlify(base64.b64decode(b64_encText).hex())

  print(f"\n========= Encrypted data =========\n")

  print(f"{encFlag=}\n")
  print(f"{encText=}\n")

  print(f"\n========= Decrypt =========\n")
  blob = XOR_two_blocks(encFlag, encText)
  flag = XOR_two_blocks(blob, text)

  # i got only "Lorem ipsum dolor" but not the rest of my text
  print(f"{flag=}")

main()
0

There are 0 answers