Intro

First we notice that color square is added for every three letters in text to encrypt. At the end of image we have n mod 3 two-decimal hex numbers. Also, color of previous squares didn’t change if we add more letters. Knowing that the flag must be in format flag{md5hash} we have tried encrypt flag{x

And we get what we want to. RGB code of the first color was exactly the same as the color of the flag, and also second color had only different blue value in comprasion with the flag. So, it’s brute force time!

Preparing

First, We prepared code for downloading image and changing it to the color values. Every square is 40x40 with some border, so we take pixel at (5, 20). Also, we didn’t analyze the text on the flag, we now that the last character must be }, so it will leave us only one character to guess. Here code comes!

from PIL import Image
import requests
import numpy as np

def download_img(url):
    img = Image.open(requests.get(url, stream=True).raw)
    img = np.array(img.getdata())
    img = np.resize(img, (40, int(len(img)/40), 3))
    return img

def img_to_code(url):
    img = download_img(url)
    length = len(img[0])
    column = 20
    array = []
    while column < length:
        for i in img[5][column]:
            array.append(i)
        column = column + 40
    return array

Brute force

We now that the flag is in the flag{md5hash} format, so we only have to brute force values in [a-fA-F0-9]. To get new square encrypted text must be multiplication of 3. This leaded to not-so-beautiful if statement in our solution, but it works :D

flag_url = "https://cryptoengine.stillhackinganyway.nl/flag"
flag = img_to_code(flag_url)
print(flag)

url = "https://cryptoengine.stillhackinganyway.nl/encrypt?text="
text = "fla"

enc_text = img_to_code(url+text)
possible = "abcdefABCDEF0123456789"

while len(enc_text) < len(flag):
    len_enc = len(enc_text)
    cur_three = ""
    start = 0
    if(text == "fla"):
        cur_three = "g{"
        start = 2
    for i in range(start, 3):
        for x in possible:
            temp = cur_three + x #guess next letter
            temp = temp + "a"*(3-len(temp)) #fill to three letters
            temp_url = url+text+temp #concatenate url
            print(temp_url)
            attempt = img_to_code(temp_url)
            if attempt[len_enc+i] == flag[len_enc+i]: #if guess is correct
                cur_three = cur_three + x
                break
    text = text + cur_three
    enc_text = img_to_code(url+text)

Get the flag

After that we bruteforced by hand last char of md5hash and get the flag! flag{deaf983eb34e485ce9d2aff0ae44f852}

– maverick, PUT CTF team