Understanding the CTF Try Hack Me - W1seGuy Challenge

Capture The Flag (CTF) challenges often test practical cryptography skills, and XOR encryption is a common focus due to its simplicity and prevalence in real-world scenarios. This guide breaks down the W1seGuy challenge from TryHackMe, which requires analyzing an XOR-encoded ciphertext, reconstructing the encryption key, and extracting the plaintext flag. Mastering these techniques builds foundational knowledge for both CTF competitions and cybersecurity applications.

---

Key Concepts

XOR Encryption Basics

• Bitwise Operation: XOR (exclusive OR) compares two bits and outputs 1 if they differ, 0 if they match.
• Reversibility: XOR is symmetric—applying the same operation twice returns the original input:

  (Plaintext ⊕ Key) ⊕ Key = Plaintext

• Use Cases: Common in simple encryption, obfuscation, and cryptographic primitives (e.g., stream ciphers).

How XOR Encryption Works

1. Encryption:
   • Each plaintext character is XORed with a corresponding key character.
   • If the key is shorter than the plaintext, it repeats cyclically.
2. Decryption:
   • XOR the ciphertext with the same key to retrieve the plaintext.

---

Challenge Breakdown: W1seGuy

Challenge Overview

• Objective: Decrypt an XOR-encoded flag using a 5-character key.
• Key Constraints:
  • Generated from string.ascii_letters + string.digits.
  • Applied cyclically (e.g., key character at position i % len(key)).
• Flag Format: Always starts with THM{ and ends with }.

Encryption Logic (Python Example)

import random
import string

flag = 'THM{thisisafakeflag}'
key = ''.join(random.choices(string.ascii_letters + string.digits, k=5))
xored = ''.join([chr(ord(flag[i]) ^ ord(key[i % len(key)])) for i in range(len(flag))])

---

Step-by-Step Solution

1. Initial Setup

1. Download the Source Code: Review the provided script to confirm encryption logic.
2. Launch the VM: Start the TryHackMe machine to access the challenge environment.
3. Retrieve Ciphertext: Connect to http://10.10.87.43:1337/ to fetch the encoded text.

2. Decryption Strategy

Leveraging Known Plaintext

• Use the flag’s prefix (THM{) and suffix (}) to derive partial key bytes:
  • XOR the first 4 ciphertext bytes with THM{ to get the first 4 key bytes.
  • XOR the last ciphertext byte with } to get the final key byte.

Brute-Force Remaining Characters

• If the key length is 5 but only 4 bytes are known, test possible characters for the 5th byte:

  for c in "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789":
      candidate_key = known_key_prefix + c
      decrypted = decrypt(ciphertext, candidate_key)
      if "THM{" in decrypted and decrypted.endswith("}"):
          return candidate_key
  

3. Automated Decryption Script

#!/usr/bin/env python3
import socket
import binascii

def xor_bytes(a, b):
    return bytes([x ^ y for x, y in zip(a, b)])

def derive_key(ciphertext_hex, known_plaintext_start="THM{", known_plaintext_end="}"):
    ciphertext = binascii.unhexlify(ciphertext_hex)
    key_prefix = xor_bytes(ciphertext[:len(known_plaintext_start)], known_plaintext_start.encode())
    key_length = 5
    last_char_pos = len(ciphertext) - 1
    key_last_char = chr(ciphertext[last_char_pos] ^ ord(known_plaintext_end))

    if len(key_prefix) == key_length:
        return key_prefix.decode()
    elif len(key_prefix) == key_length - 1:
        for c in "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789":
            candidate_key = key_prefix.decode() + c
            decrypted = decrypt(ciphertext_hex, candidate_key)
            if "THM{" in decrypted and decrypted.endswith("}"):
                return candidate_key
    return None

def decrypt(ciphertext_hex, key):
    ciphertext = binascii.unhexlify(ciphertext_hex)
    return ''.join([chr(ciphertext[i] ^ ord(key[i % len(key)])) for i in range(len(ciphertext))])

def main():
    host, port = "10.10.87.43", 1337
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
        s.connect((host, port))
        data = s.recv(1024).decode()
        if "This XOR encoded text has flag 1: " in data:
            ciphertext_hex = data.split(": ")[1].strip()
            key = derive_key(ciphertext_hex)
            if key:
                print(f"Derived key: {key}")
                decrypted = decrypt(ciphertext_hex, key)
                print(f"Decrypted flag: {decrypted}")
                s.sendall(key.encode() + b"\n")
            else:
                print("Key reconstruction failed.")
        else:
            print("Unexpected response format.")

if __name__ == "__main__":
    main()

---

Common Pitfalls & Solutions

Issue	Solution
Incorrect key length	Verify the key length (5) from the source code.
Partial key reconstruction	Use the flag’s known structure (THM{...}) to validate candidate keys.
Connection errors	Ensure the TryHackMe VM is running and the IP/port are correct.
Off-by-one errors in indexing	Double-check loop bounds and modulo operations (i % len(key)).

Pro Tip: Test your script locally with a known plaintext/ciphertext pair before running it against the live challenge.

---

Learn More

Deepen Your Knowledge

• XOR Cryptography:
  • Cryptography I (Coursera) – Covers XOR and stream ciphers.
  • Practical Cryptography for Developers – XOR in modern cryptography.
• CTF Strategies:
  • CTFtime – Track upcoming CTF competitions.
  • Hack The Box – Practice cryptography challenges.
• Python for Security:
  • Python socket Module – Network interactions.
  • Pwntools – CTF automation library.

Further Challenges

• XOR Variations:
  • Multi-byte XOR keys (e.g., key = "abcde" vs. key = "a").
  • Repeating-key vulnerabilities (e.g., Vigenère cipher).
• Platforms:
  • picoCTF – Beginner-friendly XOR challenges.
  • CryptoHack – Advanced cryptography puzzles.

---