QLotto (Quantum Lottery) - HackTheBox

Description

A quantum lottery system called QLotto where players need to predict lottery numbers generated by quantum measurements. The goal is to "rig the jackpot" by exploiting the quantum circuit.

Server Details:

• 2-qubit quantum circuit using Qiskit
• Qubit 0 starts with H gate (superposition)
• Qubit 1 starts in |0>
• Available gates: H, S, T, Z (single qubit), RXX, RYY, RZZ (two-qubit)
• Parameters cannot be 0 (restriction on qubit indices)
• Entropy check: qubit 0 must be ~50/50 (binomial test with p-value >= 0.01)
• 36 measurements taken, grouped into 6 numbers (6 bits each)
• Testing numbers come from qubit 1, lotto numbers from qubit 0
• Condition: testing != lotto (exact equality rejected)
• Win condition: guess lotto numbers exactly

Analysis

Vulnerability 1: Negative Index Bypass

The server validates that qubit indices cannot be 0, but Python's negative indexing allows -2 to map to qubit 0 in a 2-element array:

qubits = [qubit_0, qubit_1]
qubits[-2]  # Returns qubit_0, bypassing the "no 0" check

Vulnerability 2: Bell State Exploitation

The challenge requires:

1. Qubit 0 maintains ~50/50 entropy (passes binomial test)
2. Testing numbers (qubit 1) != Lotto numbers (qubit 0)
3. But we need to predict lotto from testing

Solution: Create an anti-correlated Bell state |Psi+> = (|01> + |10>)/sqrt(2)

In this state:

• When qubit 0 measures |0>, qubit 1 measures |1>
• When qubit 0 measures |1>, qubit 1 measures |0>
• Both qubits maintain 50/50 probability individually
• But they are perfectly anti-correlated!

Quantum Circuit Analysis

Initial state after H on qubit 0:

|psi> = (|00> + |10>)/sqrt(2)

Target state (anti-correlated Bell state):

|Psi+> = (|01> + |10>)/sqrt(2)

The magic sequence H:1;RYY:90,-2,1;H:1;S:1;H:1 transforms the initial state into the target Bell state:

1. H:1 - Apply Hadamard to qubit 1
2. RYY:90,-2,1 - Apply RYY(90 degrees) between qubits 0 and 1 (using -2 to bypass validation)
3. H:1;S:1;H:1 - Phase corrections on qubit 1

The RYY gate creates entanglement, and the subsequent gates adjust phases to achieve perfect anti-correlation.

Anti-correlation Formula

Since testing_bits = NOT(lotto_bits) for each measurement:

For 6-bit numbers (0-63) with mod 42 + 1 mapping:

• If testing <= 22: lotto = 23 - testing
• If testing > 22: lotto = 65 - testing

This formula accounts for the bit-flip relationship and the modular arithmetic used to convert measurements to lottery numbers.

Solution

#!/usr/bin/env python3
"""
QLotto Quantum Lottery Exploit
Exploits negative index bypass and Bell state anti-correlation
"""
from pwn import *
import re

def compute_lotto_from_testing(testing):
    """
    Convert testing numbers to lotto numbers using anti-correlation formula.
    
    The Bell state |Psi+> = (|01> + |10>)/sqrt(2) means:
    - testing_bits = NOT(lotto_bits)
    - After mod 42 + 1 conversion: lotto + testing = 23 or 65
    """
    lotto = []
    for t in testing:
        if t <= 22:
            l = 23 - t
        else:
            l = 65 - t
        lotto.append(l)
    return lotto

# Magic gate sequence that creates anti-correlated Bell state
# Uses -2 to bypass the "no qubit 0" restriction
MAGIC_SEQUENCE = "H:1;RYY:90,-2,1;H:1;S:1;H:1"

def exploit():
    # Connect to server
    r = remote('94.237.63.176', 54841)
    
    # Send the magic gate sequence
    r.recvuntil(b"quantum moves : ")
    r.sendline(MAGIC_SEQUENCE.encode())
    
    # Receive testing numbers (from qubit 1)
    response = r.recvuntil(b"table : ").decode()
    match = re.search(r'Your draws are: \[([0-9, ]+)\]', response)
    testing = [int(x.strip()) for x in match.group(1).split(',')]
    
    print(f"[*] Testing numbers (qubit 1): {testing}")
    
    # Compute lotto numbers using anti-correlation
    predicted_lotto = compute_lotto_from_testing(testing)
    print(f"[*] Predicted lotto (qubit 0): {predicted_lotto}")
    
    # Submit prediction
    guess = ','.join(map(str, predicted_lotto))
    r.sendline(guess.encode())
    
    # Get flag
    result = r.recvall().decode()
    print(result)
    
    r.close()

if __name__ == "__main__":
    exploit()

Lessons Learned

1. Negative Array Indices: Python's negative indexing can bypass naive input validation. -2 in a 2-element array maps to index 0.

2. Bell States for Correlation: The Bell state |Psi+> = (|01> + |10>)/sqrt(2) creates perfect anti-correlation while maintaining 50/50 probability on each qubit individually.

3. RYY Gate for Entanglement: The RYY(theta) gate can create entanglement between qubits. At 90 degrees, combined with proper phase corrections, it can create Bell states.

4. Quantum Gate Decomposition: Understanding how to decompose desired quantum states into available gate operations is crucial for quantum crypto challenges.

References

• Qiskit Documentation
• Bell States
• RYY Gate