no_salt.md

TryHackMe Industrial Intrusion CTF:

Task 19 No Salt, No Shame

Walkthrough by WASP1337 aka CyberWasp

To “secure” the maintenance logs, Virelia’s gateway vendor encrypted every critical entry with AES-CBC—using the plant’s code name as the passphrase and a fixed, all-zero IV. Of course, without any salt or integrity checks, it’s only obscurity, not true security. Somewhere in those encrypted records lies the actual shutdown command.

Passphrase: VIRELIA-WATER-FAC

Download the encrypted log file attached to this task and get the flag!

What we know:

• AES encrypted
• passphrase VIRELIA-WATER-FAC
• all-zero IV

Let’s decrypt it using python:

from Crypto.Cipher import AES  # For AES encryption/decryption
from Crypto.Util.Padding import unpad  # To remove padding after decryption
import hashlib  # To create a hash from the passphrase

# Path to the encrypted file
enc_file_path = "/mnt/data/shutdown.log-1750934543756.enc"
with open(enc_file_path, "rb") as f:
    encrypted_data = f.read()  # Load the binary contents of the encrypted file

# Define constants
passphrase = "VIRELIA-WATER-FAC"  # The passphrase used as the encryption key source
iv = b"\x00" * 16  # Initialization Vector (IV): 16 zero bytes (not secure!)
key = hashlib.sha256(passphrase.encode()).digest()  # Hash the passphrase with SHA-256 to get a 256-bit AES key

# Create an AES cipher in CBC mode using the derived key and fixed IV
cipher = AES.new(key, AES.MODE_CBC, iv)
try:
    # Decrypt the data and remove padding
    decrypted_data = unpad(cipher.decrypt(encrypted_data), AES.block_size)
    # Convert the decrypted bytes into UTF-8 text
    decrypted_text = decrypted_data.decode('utf-8', errors='replace')
except ValueError as e:
    # Handle errors during decryption or padding removal
    decrypted_text = f"Decryption failed: {str(e)}"

# Show the first 2000 characters of the decrypted content for review
decrypted_text[:2000]

As a result you get the FLAG.