kioubit.dn42 Crypto #2 Part 1 Write-up

At first glance

• api/getSessionForUser?username=guest&is_guest=true

• api/checkSolution?session=...&solution=...

{
  "Captcha": "🐈 + 44455",
  "SessionData": {
    "Encrypted": "tWY4tD...qGb9mdkz7",
    "Metadata": "JmNhcHRjaGFfaW5kZXg9OSZpc192ZXJpZmllZD1mYWxzZQ=="
  },
  "SessionDataHmac": "PGq09Z41GoVbhFr6fsoubxQHrSc7+wAlwubzYXPktCA="
}

&captcha_index=9&is_verified=false

1. try to get a session with is_guest=false.
2. tamper with is_verified in the metadata.
3. replace Captcha with a trivial one.

None of these worked.

1. the server responds with "You are only allowed to create guest sessions using this api endpoint".
2. MAC authentication failed.
3. whether the CAPTCHA is modified or not, the server returns Incorrect captcha solution.

Looking into the encryption scheme

1. The first block was the same for all usernames.
2. Some trailing blocks were identical when username length was the same.
3. Changing a part of the username only affected certain blocks.

prefix | username | suffix

Recovering the suffix

&source=web&solution=12513026260501710149&guest_account=true

Getting on the leaderboard

1. Request a fresh session for the scoreboard name.
2. Submit the value to checkSolution.

OK - Logged in as guest user
Congratulations. You partially solved the challenge!
Username: Iris
Your username has been added to the leaderboard

Edited on 2026-04-08