-1

This is a "CTF Challenge" (a set of online infosec challenges) and I have become stuck.

I noticed in the conversation one person asks for the other person to send the salted password file.

enter image description here

I wanted to grab that data so I right clicked it and copied as printable text:

enter image description here

Salted__ð£s¯H+^1Y®ê-ié«æ×¹½¦þFÐö}×Gþ|vÎ

At this point I think I have the salted password so I save it to file.des3.

In the conversation the dialog is as followed:

Hey, how do you decrypt this file again?
You're serious?
Yeah, I'm serious
sigh openssl des3 -d -salt -in file.des3 -out file.txt -k supersecretpassword123

So I figured this is basically telling me how to do it. So I run the same command:

rasp4@server:/ctf$ openssl des3 -d -salt -in file.des3 -out file.txt -k supersecretpassword123

The following output appears:

*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
bad decrypt
139871006373184:error:0606506D:digital envelope routines:EVP_DecryptFinal_ex:wrong final block length:../crypto/evp/evp_enc.c:599:

I look at the contents of file.txt and see this:

à@ %eõý#Äu´;RTÉÒ…²eèmkúì Øß”Êrâês¸qEG

I'm lost on what to do at this point. What am I supposed to do with that output? Why did I get an error from running the same command as the conversation did? My intuition is telling me something didn't copy from the data on Wireshark properly.

halfer
  • 19,824
  • 17
  • 99
  • 186
Digi Jeff
  • 169
  • 1
  • 4
  • 15
  • Hi Jeff. The problem with the latest edit is that the question now launches into detail without setting out the appropriate context. In the sentence "I noticed in the conversation one person asks for the other person", what conversation is "the conversation", and who the people are, has not been explained. Can you add some introductory material to improve upon this? Questions here are intended for a future audience far into the future, so it is great if they can be made as readable as possible. – halfer Apr 14 '22 at 18:33

1 Answers1

1

Try right-clicking on "Data: 53616..." in the Frame Details window so that you can select "Export Packet Bytes..." Export to a file named "file.des3" then try the decryption command again. Your intuition is right in saying that "something didn't copy from the data on Wireshark properly," because the "Copy" feature tends to add a lot of extra bytes to the data, which simply obfuscates that original hash.

Michael Silva
  • 26
  • 1