Ctf Crypto

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:11 AM UTC
• Version: 1.0.0

Overview

This is a transparent CTF cryptography reference, but it includes directly reusable account-token, password-cracking, request-flooding, and unsafe install/code examples without enough authorization or isolation boundaries.

Install only if you intend to use it for authorized CTFs, labs, or systems you own or are explicitly allowed to test. Run its tools in a disposable virtual environment or container, review any target-facing requests before execution, avoid using it against real accounts or services without permission, and pin or verify external dependencies before installing them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: prng.md:94
• Finding: Arbitrary Code Execution Through Unsafe Evaluation of External Data<![CDATA[ ## Vulnerability Details **File Location**: `prng.md:94-98` **Vulnerability Type**: Unsafe deserialization and dynamic code evaluation **Risk Level**: High ### Vulnerable Code ```python import random, gzip, hashlib # Load precomputed GF(2) magic matrix (from github.com/fx5/not_random) f = gzip.GzipFile("magic_data", "r") magic = eval(f.read()) f.close() ``` ### Technical Analysis The example passes decompressed file content directly to Python's `eval`. Unlike a data parser, `eval` accepts arbitrary Python expressions and executes them with the privileges of the current Python process. The `magic_data` file is described as originating from an external GitHub project, but the example does not authenticate its source, verify a checksum, validate its structure, or constrain evaluation. A malicious or replaced file could therefore contain expressions that import modules, execute commands, read local files, or initiate network connections. Although this is documentation code rather than automatically executed Skill code, users or agents following the example would expose their environment to arbitrary code execution. ### Attack Path 1. An attacker compromises or impersonates the source from which `magic_data` is obtained, or places a malicious file with that name in the working directory. 2. A user or agent follows the documented example. 3. `gzip.GzipFile` decompresses the attacker-controlled content. 4. `eval(f.read())` interprets that content as Python code rather than inert matrix data. 5. The payload executes with the Python process's filesystem, network, and operating-system permissions. For example, an expression using `__import__` could invoke operating-system functionality while still returning a value that appears compatible with the expected data. ### Impact Assessment Successful exploitation provides arbitrary code execution under the account running the example. The attacker could: - Read challenge data, source files, environment ...[truncated 448 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace `eval` with a non-executable serialization format such as JSON, MessagePack, or a documented binary matrix format. - If the upstream file is necessarily represented as Python literals, use `ast.literal_eval` instead: ```python import ast import gzip with gzip.open("magic_data", "rt", encoding="utf-8") as f: magic = ast.literal_eval(f.read()) ``` - Validate the parsed object before use, including: - Expected top-level container type. - Exact dimensions. - Permitted element types. - Numeric bounds and maximum input size. - Publish and verify a cryptographic checksum for the expected data file. - Obtain the file only from a pinned, reviewed upstream revision. - Run CTF tooling in a non-privileged container or isolated virtual machine with no unrelated credentials mounted. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17
• Finding: Unpinned Python Dependencies Installed From Mutable Package Releases<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17-20` **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash pip install pycryptodome z3-solver sympy gmpy2 hashpumpy fpylll py_ecc ``` ### Technical Analysis The installation command does not specify package versions or verify distribution hashes. It therefore installs whichever releases and transitive dependencies the package index resolves at execution time. This prevents reproducible review and leaves the effective dependency set mutable after the Skill itself has been audited. Python packages may execute code during build or installation and will execute package-controlled code when imported. The package names appear relevant to the declared cryptography functionality, so their use is justified. The risk arises from the absence of version constraints, integrity verification, environment isolation, and a reviewed dependency lock file. ### Attack Path 1. An upstream package, release artifact, maintainer account, or transitive dependency is compromised. 2. A user or agent runs the documented `pip install` command. 3. The package index resolves the compromised or otherwise unsafe current release. 4. Malicious code executes during package build, installation, or a later import. 5. The code gains the permissions of the account running the installation or cryptographic tooling. ### Impact Assessment A compromised dependency could execute arbitrary code with the invoking user's privileges. Depending on the environment, this could permit: - Access to local challenge files and working-directory content. - Theft of environment variables, package-index credentials, or other accessible secrets. - Modification of the Python environment or user files. - Network-based payload retrieval or data exfiltration. - Persistent compromise of the environment through altered installed packages. The command does not explicitly request administrator priv ...[truncated 126 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin every direct dependency to a reviewed version. - Generate a lock file that includes all transitive dependencies. - Require package hashes, for example through `pip install --require-hashes -r requirements.txt`. - Install packages inside a dedicated virtual environment or disposable container. - Prefer prebuilt, verified wheels from trusted indexes and disable unexpected source builds where practical. - Periodically scan the locked dependency set for known vulnerabilities. - Avoid running installation commands as root or against the system Python environment. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32
• Finding: RsaCtfTool Retrieved From an Unpinned Git Repository<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:32-34` **Vulnerability Type**: Mutable source dependency without revision or integrity verification **Risk Level**: Medium ### Vulnerable Code ```markdown **Manual install:** - SageMath — Linux: `apt install sagemath`, macOS: `brew install --cask sage` - RsaCtfTool — `git clone https://github.com/RsaCtfTool/RsaCtfTool` (automated RSA attacks) ``` ### Technical Analysis The command clones the repository's current default branch without pinning a reviewed tag or commit and without verifying a signed release or checksum. Consequently, the code subsequently executed as RsaCtfTool can differ from the version present when the Skill was reviewed. The repository domain and project are consistent with the declared CTF cryptography purpose. No evidence of a malicious URL was found. Nevertheless, a mutable Git dependency is a supply-chain risk because compromise of the upstream repository or maintainer account can alter the downloaded tool. ### Attack Path 1. The upstream repository, its maintainer account, or its default branch is compromised or receives an unsafe change. 2. A user or agent runs the documented `git clone` command. 3. Git downloads the changed repository without checking an expected commit identifier. 4. The user runs `RsaCtfTool.py` as recommended elsewhere in the Skill. 5. Repository-controlled Python code executes with the user's privileges. ### Impact Assessment A malicious repository revision could: - Execute arbitrary Python code. - Read or modify files available to the invoking user. - Access challenge keys, ciphertexts, or other supplied artifacts. - Retrieve further payloads or exfiltrate local information if network access is available. - Modify the cloned working tree or Python environment. The clone operation alone does not execute the repository's Python code, but execution is an intended next step in the documented workflow. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the repository to a specific reviewed commit SHA: ```bash git clone https://github.com/RsaCtfTool/RsaCtfTool cd RsaCtfTool git checkout --detach EXPECTED_COMMIT_SHA ``` - Document the expected commit SHA and verify it before execution. - Prefer a signed upstream release and verify its signature or published archive checksum. - Review the pinned revision and its dependency files. - Execute the tool in a disposable, non-privileged container with only the required challenge files mounted. - Restrict network access after installation unless the specific challenge requires it. ]]>

T08 · Insecure Dependencies

Warning

• Location: modern-ciphers-2.md:503
• Finding: HashClash Retrieved From an Unpinned Git Repository<![CDATA[ ## Vulnerability Details **File Location**: `modern-ciphers-2.md:503-509` **Vulnerability Type**: Mutable source dependency without revision or integrity verification **Risk Level**: Medium ### Vulnerable Code ```bash # Install: git clone https://github.com/cr-marcstevens/hashclash # Generate one collision pair (~minutes on modern CPU): ./fastcol -o suffix1A.bin suffix1B.bin < prefix.bin # Chain: append suffix1A to prefix, run fastcol again for suffix2A/2B, etc. ``` ### Technical Analysis The documentation directs the user to clone the current default branch of HashClash and subsequently execute its `fastcol` binary. No commit, release tag, signature, or checksum is specified. The URL is relevant to the documented MD5 collision technique, and the audit found no indication that the named domain itself is malicious. However, the effective executable remains mutable after Skill review. A compromised source tree or build artifact could introduce arbitrary behavior into `fastcol`. ### Attack Path 1. An attacker compromises the upstream repository, maintainer account, build process, or distribution path. 2. A user follows the unpinned clone instruction and obtains the altered source. 3. The user builds or otherwise obtains `fastcol` from that source. 4. The documented `./fastcol` command executes the compromised binary. 5. The binary runs with the user's local permissions and can perform actions unrelated to collision generation. ### Impact Assessment A compromised native binary could: - Execute arbitrary machine code with the invoking user's privileges. - Read challenge files and other account-accessible data. - Modify or destroy local files. - Establish network connections or retrieve additional payloads. - Exploit additional local weaknesses to increase impact. No automatic execution is present in the Markdown file; exploitation depends on a user or agent following the installation and execution instructions. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin HashClash to a reviewed commit SHA or signed release. - Publish the expected source archive or binary checksum in the documentation. - Build the tool in an isolated container using a reproducible build process. - Run the resulting binary as a non-privileged user with only required input and output directories mounted. - Deny network access during execution unless explicitly required. - Revalidate the pinned revision before updating it. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match

Content

nds

```bash
# Identify cipher type
python3 -c "from Crypto.Util.number import *; n=<N>; print(f'bits={n.bit_length()}')"

# RSA quick check
python3 -c "from sympy import factorint; print(factorint(<n>))"  # Small factors?
openssl rsa -pubin -in key.pub -text -noout  # Extract n, e from PEM

# Quick factorization tools
python3 RsaCtfTool.py -n <n> -e <e> --uncipher <c>

# XOR analysis
python3 -c "from pwn import xor; print(xor(bytes.fromhex('<hex>'), b'flag{'))"

# Hash identification
hashid '<hash>'
hashcat --identify '<hash>'

# SageMath (for lattice/ECC)
sage -c "print(factor(<n>))"
```

## Classic Ciphers

- **Caesar:** Frequency analysis or brute force 26 keys
- **Vigenere:** Known plaintext attack with flag format prefix; derive key from `(ct - pt) mod 26`. Kasiski examination for unknown key length (GCD of repeated sequence distances)
- **Atbash:** A<->Z substitution; look for "Abashed" hints in challenge name
- **Substitution wheel:** Brute force all rotations of inner/outer al

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match

Content

bc.so.6') for system libc

# Seed at the same second as the binary starts
libc.srand(int(time()))

# Generate the same sequence as the binary's rand() calls
for i in range(16):
    value = libc.rand() & 0xff  # match binary's truncation (e.g., & 0xff for byte)
    print(value)
```

**Decrypting XOR-encrypted data (L3akCTF 2024 chonccfile):**
```python
from ctypes import CDLL
from time import time
from pwn import u32, p32

libc_imp = CDLL('./libc.so.6')
libc_imp.srand(int(time()))

# Binary XORs each 4-byte block with rand() output
encrypted_data = b'...'  # read from heap/memory
result = b''
for i in range(0, len(encrypted_data), 4):
    block = u32(encrypted_data[i:i+4])
    libc_imp.rand()       # skip delay-related rand() call if binary does extra calls
    key = libc_imp.rand()
    block ^= key
    result += p32(block)
```

**Timing considerations:**
- `time(NULL)` has 1-second granularity — start the exploit within the same second as the binary
- Remote targets may have startup

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match

Content

bc.so.6') for system libc

# Seed at the same second as the binary starts
libc.srand(int(time()))

# Generate the same sequence as the binary's rand() calls
for i in range(16):
    value = libc.rand() & 0xff  # match binary's truncation (e.g., & 0xff for byte)
    print(value)
```

**Decrypting XOR-encrypted data (L3akCTF 2024 chonccfile):**
```python
from ctypes import CDLL
from time import time
from pwn import u32, p32

libc_imp = CDLL('./libc.so.6')
libc_imp.srand(int(time()))

# Binary XORs each 4-byte block with rand() output
encrypted_data = b'...'  # read from heap/memory
result = b''
for i in range(0, len(encrypted_data), 4):
    block = u32(encrypted_data[i:i+4])
    libc_imp.rand()       # skip delay-related rand() call if binary does extra calls
    key = libc_imp.rand()
    block ^= key
    result += p32(block)
```

**Timing considerations:**
- `time(NULL)` has 1-second granularity — start the exploit within the same second as the binary
- Remote targets may have startup

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match

Content

bc.so.6') for system libc

# Seed at the same second as the binary starts
libc.srand(int(time()))

# Generate the same sequence as the binary's rand() calls
for i in range(16):
    value = libc.rand() & 0xff  # match binary's truncation (e.g., & 0xff for byte)
    print(value)
```

**Decrypting XOR-encrypted data (L3akCTF 2024 chonccfile):**
```python
from ctypes import CDLL
from time import time
from pwn import u32, p32

libc_imp = CDLL('./libc.so.6')
libc_imp.srand(int(time()))

# Binary XORs each 4-byte block with rand() output
encrypted_data = b'...'  # read from heap/memory
result = b''
for i in range(0, len(encrypted_data), 4):
    block = u32(encrypted_data[i:i+4])
    libc_imp.rand()       # skip delay-related rand() call if binary does extra calls
    key = libc_imp.rand()
    block ^= key
    result += p32(block)
```

**Timing considerations:**
- `time(NULL)` has 1-second granularity — start the exploit within the same second as the binary
- Remote targets may have startup

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match

Content

bc.so.6') for system libc

# Seed at the same second as the binary starts
libc.srand(int(time()))

# Generate the same sequence as the binary's rand() calls
for i in range(16):
    value = libc.rand() & 0xff  # match binary's truncation (e.g., & 0xff for byte)
    print(value)
```

**Decrypting XOR-encrypted data (L3akCTF 2024 chonccfile):**
```python
from ctypes import CDLL
from time import time
from pwn import u32, p32

libc_imp = CDLL('./libc.so.6')
libc_imp.srand(int(time()))

# Binary XORs each 4-byte block with rand() output
encrypted_data = b'...'  # read from heap/memory
result = b''
for i in range(0, len(encrypted_data), 4):
    block = u32(encrypted_data[i:i+4])
    libc_imp.rand()       # skip delay-related rand() call if binary does extra calls
    key = libc_imp.rand()
    block ^= key
    result += p32(block)
```

**Timing considerations:**
- `time(NULL)` has 1-second granularity — start the exploit within the same second as the binary
- Remote targets may have startup

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent/user to run package-manager and system installation commands (`pip`, `apt`, `brew`, `git clone`) that modify the local environment, but it provides no warning, consent gate, or safer alternative. In an agent context with Bash and internet access, this can lead to unreviewed software installation, dependency drift, and execution of third-party code, increasing supply-chain and environment-integrity risk.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The heading and prose claim an ECC public-key weakness, but the code operates on `key.n`, factors moduli into `p` and `q`, and describes decryption with recovered factors—behavior characteristic of RSA modulus compromise, not standard ECC public keys. This is an active contradiction between the documentation and what the example code does.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: This section gives concrete instructions for predicting password reset tokens on a live server by recovering Python MT state from exposed random outputs and forging a reset URL. Even though framed as CTF content, it is directly transferable to real systems and lacks any warning that such actions must be limited to authorized environments, increasing misuse risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The password cracking section provides practical attack sequencing, candidate patterns, and Hashcat modes without any boundary-setting on authorization or the risk of exposing real user credentials. In a skill intended for operational use, this lowers friction for credential attacks outside sanctioned challenge environments.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

flag = pow(c, real_d, n)
```

**Key insight:** `phi(p^2) = p*(p-1)`, NOT `(p-1)^2`. When a server validates RSA parameters but uses `(p-1)*(q-1)` without checking `p != q`, setting `p=q` creates a working key that the server will miscompute the private exponent for, causing decryption failure and error-path data leakage.

---

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

External Transmission

Medium

• Category: Data Exfiltration

Content

def make_request(barrier, modified_sig):
    barrier.wait()  # Synchronize all processes
    requests.post(url, json={"sig": modified_sig})

# Launch 80 processes with unique signature modifications
processes = [Process(target=make_request, args=(barrier, modify_sig(i))) for i in range(80)]

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Low

• Confidence: 92% confidence
• Finding: This document is titled and organized as an elliptic-curve attacks reference, but substantial sections cover plain DSA nonce-reuse, DSA limited-k brute force, and MD5-collision-based DSA key recovery, which are not elliptic-curve attacks. While still broadly cryptographic and arguably within the overall skill manifest, they do not match this file's claimed ECC-specific scope.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: Most of the file is explanatory text and mathematical example code, but this section introduces direct local process execution via `subprocess.run` to invoke `fastcoll`. Spawning external binaries is a materially different capability than documenting or illustrating crypto attack techniques, and it is not clearly warranted by the skill's stated reference-style purpose.

Static analysis

No suspicious patterns detected.