MD0

cryptohack

Task: forge a valid MAC sig=hash(key||data) containing admin=True without knowing the 16-byte key, where hash is a Davies-Meyer Merkle-Damgard construction (out=0; per 16-byte block out = AES_ECB(block, out) XOR out, block acting as the AES key). Solution: classic length-extension — the returned signature IS the internal chaining state after hashing key||data, so continue the Davies-Meyer iteration over the glue (pkcs7 padding of key||data) followed by an extension block containing admin=True and the final pkcs7 pad of the new total, all without the key; send the extended message plus the forged state to get the flag (port 13388).