$ cat writeup.md…
$ cat writeup.md…
cryptohack
Task: simplified MEGA cloud login protocol where a file is AES-ECB encrypted under a node_key wrapped under the master key, with an RSA-CRT login oracle that returns SID[:-16]. Solution: reproduce the MEGA 'Malleable Encryption Goes Awry' plaintext-recovery attack — recover the RSA private key from a leaked prime, choose SID = u*p, splice node_key_enc into the u-region of share_key_enc (AES-ECB has no integrity), and read node_key out of the recovered u', then AES-ECB-decrypt the file.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
Megalomaniac 3 - Now it is about time to recover the actual data uploaded by a user!
nc socket.cryptohack.org 13410
This is the final part of CryptoHack's "Megalomaniac" series, reproducing the
real-world MEGA "Malleable Encryption Goes Awry" (mega-awry.io) Plaintext
Recovery attack. The goal is to recover a file that a user encrypted under a
per-file node_key, where node_key itself is AES-ECB-encrypted under the
user's master key.
The server derives enc_key/auth_key from a password via PBKDF2(SHA512, 1000
iters) and builds the following encrypted material, sent in the banner:
master_key = random 16 bytes; master_key_enc = AES-ECB(enc_key, master_key)format = len(p)|p | len(q)|q | len(d)|d | len(u)|u | pad16,
each len is 2 bytes big-endian and u = p^{-1} mod q.
share_key_enc = AES-ECB(master_key, privkey_blob)node_key = random 16 bytes; node_key_enc = AES-ECB(master_key, node_key);
file_enc = AES-ECB(node_key, pad(FILE))p of the share key
(recovered_shared_key = (n, e, p)), so the full RSA private key is
recoverable: q = n//p, d = e^{-1} mod (p-1)(q-1), u = inverse(p, q).Client_new_login.login_step2)Attacker-controlled inputs: SID_enc, share_key_enc, master_key_enc. It:
master_key = AES-ECB-dec(enc_key, master_key_enc)priv = unpad(AES-ECB-dec(master_key, share_key_enc)); parse (p, q, d, u)SID = RSA_CRT_decrypt(SID_enc, p, q, d, u); return SID[:-16] (drops the
low 128 bits)RSA-CRT internals:
dp=d%(p-1); dq=d%(q-1); mp=c^dp%p; mq=c^dq%q; t=(mq-mp)%q; h=u*t%q; m=h*p+mp.
...
$ grep --similar