WHY-XOR

Proof of flag 

ctf{79f107231696395c004e87dd7709d3990f0d602a57e9f56ac428b31138bda258}

Summary of the vulnerabilities identified

We have a xored flag and it starts 3 null bytes, so we can assume the key at least starts with “ctf”. And that turns out to be the correct key

Proof of solving

So I started out by reading the challenge description where it clearly says that the flag format is “CTF{sha256}” so of course I tried “CTF” as the key, but that didn’t work so I was really confused for some time.

Then I tried “ctf” and it worked. I was really pleased but also annoyed.

import string
xored = ['\x00', '\x00', '\x00', '\x18', 'C', '_', '\x05', 'E', 'V', 'T', 'F', 'U', 'R',
'B', '_', 'U', 'G', '_', 'V', '\x17', 'V', 'S', '@', '\x03', '[', 'C', '\x02', '\x07', 'C',
'Q', 'S', 'M', '\x02', 'P', 'M', '_', 'S', '\x12', 'V', '\x07', 'B', 'V', 'Q', '\x15', 'S',
'T', '\x11', '_', '\x05', 'A', 'P', '\x02', '\x17', 'R', 'Q', 'L', '\x04', 'P', 'E', 'W',
'P', 'L', '\x04', '\x07', '\x15', 'T', 'V', 'L', '\x1b']
key = ['c', 't', 'f']
rexored = []
for i in range(len(xored)):
rexored.append(chr(ord(xored[i]) ^ ord(key[i % len(key)])))
print("".join(rexored))