BRO64

Proof of flag 

ctf{f38deb0782c0f252090a52b2f1a5b05bf2964272f65d5c3580be631f52f4b3e0}

Summary of the vulnerabilities identified

By connecting with netcat and sending some data you would get an HTTP Bad Request Error.

nc 35.198.183.125 31604
asdf
<head></head>
<title>Error response</title>

<body></body>
<h1>Error response</h1>
Error code 400.
Message: Bad request syntax ('asdf').
Error code explanation: 400 = Bad request syntax or unsupported method.

So the natural thing is to use curl. By using curl you whould get some and weird json data.

curl http://35.198.183.125:31604
{"nonce": "eCBaOam94l8=", "ciphertext": "3juD5kXRubvP3/1fhHZKScGv1f86vMMr49cgtpEQC52j9zURouxYtC/aR1gAVAc8YH0XeM3dC5Hlq6yA3WTnbP4HfQFrs", "key": "Fidel_Alejandro_Castro_Ruz_Cuba!"}

Proof of solving

The algorithm uses a nonce(number-one-used) and a key, The suggestion from the description with Cuba points out to the ChaCha20 algorithm and with a simple python script we can decode this message.

import base64
from Crypto.Cipher import ChaCha20
k = {"nonce": base64.b64decode("eCBaOam94l8="), "ciphertext":
base64.b64decode("3juD5kXRubvP3/1fhHZKScGv1f86vMMr49cgtpEQC52j9zURouxYtC/aR1gAVAc8YH0XeM3dC5
cipher = ChaCha20.new(key=k['key'], nonce=k['nonce'])
print(cipher.decrypt(k['ciphertext']))