Here’s a link to the room: https://tryhackme.com/r/room/w1seguy

TASK [1] Source Code

Yes, it’s me again with another crypto challenge!

Have a look at the source code before moving on to Task 2.

You can review the source code by clicking on the Download Task Files button at the top of this task to download the required file.

Source Code:

import random
import socketserver 
import socket, os
import string
flag = open('flag.txt','r').read().strip()
def send_message(server, message):
    enc = message.encode()
    server.send(enc)
def setup(server, key):
    flag = 'THM{thisisafakeflag}' 
    xored = ""
    for i in range(0,len(flag)):
        xored += chr(ord(flag[i]) ^ ord(key[i%len(key)]))
    hex_encoded = xored.encode().hex()
    return hex_encoded
def start(server):
    res = ''.join(random.choices(string.ascii_letters + string.digits, k=5))
    key = str(res)
    hex_encoded = setup(server, key)
    send_message(server, "This XOR encoded text has flag 1: " + hex_encoded + "\n")
        send_message(server,"What is the encryption key? ")
    key_answer = server.recv(4096).decode().strip()
    try:
        if key_answer == key:
            send_message(server, "Congrats! That is the correct key! Here is flag 2: " + flag + "\n")
            server.close()
        else:
            send_message(server, 'Close but no cigar' + "\n")
            server.close()
    except:
        send_message(server, "Something went wrong. Please try again. :)\n")
        server.close()
class RequestHandler(socketserver.BaseRequestHandler):
    def handle(self):
        start(self.request)
if __name__ == '__main__':
    socketserver.ThreadingTCPServer.allow_reuse_address = True
    server = socketserver.ThreadingTCPServer(('0.0.0.0', 1337), RequestHandler)
    server.serve_forever() 

TASK [2] Get those flags!

Your friend told me you were wise, but I don’t believe them. Can you prove me wrong?

When you are ready, click the Start Machine button to fire up the Virtual Machine. Please allow 3–5 minutes for the VM to start fully.

The server is listening on port 1337 via TCP. You can connect to it using Netcat or any other tool you prefer.

What is the first flag?

Upon connecting, the server sends a message containing an XOR-encoded text. Here is an example of the received message:

To obtain flags 1 and 2, the correct encryption key must be supplied. We will utilize the online tool CyberChef available at https://gchq.github.io/CyberChef/

Given that most TryHackMe flags start with THM{, we can use the XOR operation in CyberChef, starting with the first 4 bytes of the encoded text.

Next, we will use the “From Hex and XOR operation” in CyberChef, incorporating the output key.

Since the source code specifies that the key length is 5 characters, the last character could be any letter or digit. Therefore, you can manually try all possible combinations of letters and digits for the final character.

We got our first flag and the Encryption key.