# N0PS CTF 2025 - Key Exchange Writeup

**Category**: CrypTopia
**Challenge Name**: Key Exchange
**Flag**: ✅ `N0PS{d1fFi3_h31lm4n_k3y_XcH4ng3}`
**Author**: algorab

---

## Challenge Description

We’re given a connection endpoint to a secret service belonging to CrypTopia:

```
nc 0.cloud.chals.io 26625
```

The challenge implies that if we manage to speak the right language to this service, it will reward us with the flag. The format is `N0PS{...}`. No additional hints — just the address and an attached Python script.

---

Naturally, I started by connecting to the server using netcat to see what kind of response it gives:

```
nc 0.cloud.chals.io 26625
```

As expected, I was greeted with a screen full of binary garbage. This was a clear sign that the server is expecting a binary-level protocol, not plain text.


. The file was named `main.py` given , and it contained the core logic running on the server.
---

## Code Breakdown

The script performs a Diffie-Hellman key exchange followed by AES encryption of a flag file. Here's a brief summary:

- The server generates a safe prime `p` and a generator `g`.
- It calculates `k_a = g^a mod p` where `a` is a random private key.
- It sends `p`, `g`, and `k_a` to the client.
- The client is expected to respond with `k_b = g^b mod p`.
- Both parties compute the shared secret key `k = g^(ab) mod p`.
- The server uses `SHA-256(k)` as an AES key to encrypt the flag and send it back.

---

## Realization

What we had here was a textbook example of a **Diffie-Hellman key exchange** implemented in a CTF setting. The goal is to mirror the server’s steps, perform the math on our side, and decrypt the flag ourselves.

To solve it, I needed to:

1. Parse the 1024-byte `p`, `g`, and `k_a` values sent by the server.
2. Generate a private `b`, compute `k_b`, and send it back.
3. Receive the AES-encrypted flag.
4. Derive the same shared key and decrypt the ciphertext.

---

## Building the Exploit Script

To automate this, I wrote a Python script using `socket`, `Crypto`, and `hashlib` libraries. One important note: the server sends 1024 **bytes**, not bits — I initially messed this up and got all zeroes for `p`, `g`, and `k_a`.

Once that was corrected, everything lined up.


---

## Decryption & Discovery

After decryption, the data didn't look like text, so I ran:

```
file decrypted_flag.bin
```

And saw this:

```
PNG image data, 4267 x 4267, 8-bit/color RGBA
```

---
converted it to the png file

```
mv decrypted_flag.bin flag.png

```

Bingo. The flag was embedded inside an image.

`decrypted_flag.bin: PNG image data, 4267 x 4267, 8-bit/color RGBA`

I opened the file and found the flag painted on top of a shiny treasure chest.


---

## ? Final Flag

```
N0PS{d1fFi3_h31lm4n_k3y_XcH4ng3}
```

---
Team N0C71S