Untrusted Node — HackTheBox

Description

The challenge simulates an attack on a BB84-like Quantum Key Distribution (QKD) protocol. We play the role of a compromised Trusted Node between Transmitter (Alice) and Receiver (Bob). The goal is to intercept the quantum key, encrypt the command TX|FETCH|SECRET, and send it to the Receiver to obtain the flag.

Protocol

1. Transmitter generates 128 random bits and 128 random bases (gates: 0=Z, 1=X)
2. For each bit, k identical copies of the qubit are created (k = Poisson(λ=2) + 2, i.e., k ≥ 2, average ~4)
3. Qubits are sent through the Trusted Node (us) to the Receiver
4. We can measure any qubits in a chosen basis or pass them through (-1) to the Receiver
5. Receiver measures the received qubits in random bases
6. Basis reconciliation phase: TX compares its bases with the ones we pass (we can substitute them)
7. Where bases match — those bits form the key, hashed with SHA256
8. The key is used for XOR encryption of commands

Source Files

• server.py — TrustedNode: accepts our gates, measures/passes qubits
• transmitter.py — Alice: generates qubits, checks basis matches
• receiver.py — Bob: measures qubits, processes commands, stores FLAG
• util.py — XOR, validate_entropy (≥64 bits, binomial test p > 0.01)

Analysis

Key Vulnerability: Photon Number Splitting (PNS)

In real BB84, each qubit is a single photon, and measurement destroys the state. Here TX creates k ≥ 2 identical copies of each qubit. This is the classic PNS vulnerability — we can take some copies for ourselves while forwarding the rest to Bob without distortion.

Dual Measurement in Both Bases

Since k ≥ 2, we can:

• Measure copy #0 in Z-basis (gate=0) → get result R_Z
• Measure copy #1 in X-basis (gate=1) → get result R_X
• Forward copies #2..k-1 to Bob unchanged

One of our results (R_Z or R_X) is guaranteed to match the original TX bit — the one measured in the correct basis.

Gate Substitution in Reconciliation Phase

In the reconciliation phase, TX looks for the first match of its basis with the passed gates:

for j, g in enumerate(gates_chunk):
    if g == self.gates[i]:
        match_index = j
        break

We send:

• gate=2 (garbage) for positions where we measured → TX will never match (its gates are only 0 or 1)
• Bob's real gates for passthrough positions → TX matches with Bob normally

Key Recovery

When TX reports matches, we know which positions went into the key and which basis TX used (= Bob's gate at the matched position):

• If matched basis = 0 (Z) → take our R_Z
• If matched basis = 1 (X) → take our R_X

Solution

Step 1: Get Sync Signal (k-values)

Connect to the server, receive the k_values array — the number of copies for each of the 128 bits.

Step 2: First Input — Gate Selection for Measurement

For each group of k qubits:

• Position 0: gate=0 (measure in Z-basis)
• Position 1: gate=1 (measure in X-basis)
• Positions 2..k-1: gate=-1 (pass through to Bob)

Step 3: Get TN Results and Bob's Gates

The server returns our measurement results and the gates chosen by Bob.

Step 4: Second Input — Gate Substitution for TX

• For measured positions (0, 1): send gate=2 (garbage, won't match TX)
• For passthrough positions: copy Bob's real gates

Step 5: Recover Key from Matches

TX reports a boolean array of matches. For each matched position, determine TX's basis (= Bob's gate) and take the corresponding result from our measurement.

Step 6: Send Encrypted Command

SHA256(key_bits) XOR "TX|FETCH|SECRET" → send as hex → receive FLAG.

#!/usr/bin/env python3
"""
MITM on BB84-like QKD — Untrusted Node exploit.
Usage: python3 solve.py <ip:port>
"""

import sys
import ast
import hashlib
from pwn import *

context.timeout = 6000


def xor(a: bytes, b: bytes):
    return bytes([x ^ y for x, y in zip(a, b)])


def solve(host, port):
    r = remote(host, port)
    r.recvuntil(b"Sync signal: ")
    sync_data = r.recvline().strip().decode()
    sync_signal = ast.literal_eval(sync_data)
    log.info(f"Sync Signal: {len(sync_signal)} chunks, {sum(sync_signal)} qubits")

    # Phase 1: measure qubit#0 in Z, qubit#1 in X, pass rest
    tn_gates_measure = []
    for k in sync_signal:
        tn_gates_measure.extend([0, 1])       # Z and X measurements
        if k > 2:
            tn_gates_measure.extend([-1] * (k - 2))  # passthrough
    payload_1 = ",".join(map(str, tn_gates_measure))
    r.sendlineafter(b"measurement: ", payload_1.encode())
    log.info("Payload 1 sent. Waiting for quantum simulation...")

    # Get TN results (our measurements)
    r.recvuntil(b"Trusted Node results: ")
    tn_results_data = r.recvline().strip().decode()
    tn_results = ast.literal_eval(tn_results_data)
    log.success(f"TN results: {len(tn_results)}")

    # Parse: 2 results per chunk (Z-measurement, X-measurement)
    chunk_intercepts = []
    res_idx = 0
    for _ in sync_signal:
        val_z = tn_results[res_idx]
        val_x = tn_results[res_idx + 1]
        chunk_intercepts.append({"0": val_z, "1": val_x})
        res_idx += 2

    # Get receiver gates
    r.recvuntil(b"Receiver gates: ")
    rx_gates_data = r.recvline().strip().decode()
    rx_gates = ast.literal_eval(rx_gates_data)

    # Phase 2: garbage(2) for measured positions, copy Bob's gates for rest
    tn_gates_matches = []
    global_idx = 0
    for k in sync_signal:
        tn_gates_matches.extend([2, 2])  # garbage for our measured qubits
        global_idx += 2
        for _ in range(k - 2):
            tn_gates_matches.append(rx_gates[global_idx])  # Bob's real gate
            global_idx += 1
    payload_2 = ",".join(map(str, tn_gates_matches))
    r.sendlineafter(b"intercept receiver gates : ", payload_2.encode())

    # Get matches from TX
    r.recvuntil(b"Transmitter matches: ")
    tx_matches_data = r.recvline().strip().decode()
    tx_matches = ast.literal_eval(tx_matches_data)

    # Recover key: for each matched position, use our measurement in the correct basis
    raw_key_bits = ""
    global_idx = 0
    for chunk_idx, k in enumerate(sync_signal):
        for i in range(k):
            if tx_matches[global_idx]:
                basis_used = rx_gates[global_idx]  # TX basis = Bob's gate at match
                bit = chunk_intercepts[chunk_idx][str(basis_used)]
                raw_key_bits += bit
            global_idx += 1
    log.success(f"Key bits ({len(raw_key_bits)}): {raw_key_bits}")

    # Encrypt command and send
    final_key = hashlib.sha256(raw_key_bits.encode()).digest()
    encrypted_cmd = xor(b"TX|FETCH|SECRET", final_key).hex()
    r.sendlineafter(b"to receiver : ", encrypted_cmd.encode())

    resp = r.recvline().decode().strip()
    log.success(f"Response: {resp}")
    if "Command:" in resp:
        flag = resp.split("Command: ", 1)[1]
        log.success(f"FLAG: {flag}")
    r.close()


if __name__ == "__main__":
    if len(sys.argv) != 2 or ":" not in sys.argv[1]:
        print(f"Usage: {sys.argv[0]} <ip:port>")
        sys.exit(1)
    host, port = sys.argv[1].rsplit(":", 1)
    solve(host, int(port))