> ## Content Index > Fetch the complete content index at: https://taiwanding.com/llms.txt > Use this file to discover other available public pages before exploring further. # TryHackMe W1seGuy Writeup: Cracking Repeating-Key XOR - URL: https://taiwanding.com/en/tryhackme-w1seguy-writeup/ - Published: 2025-09-18T08:21:54.000Z - Updated: 2026-07-15T02:49:50.000Z - Author: Kevin Chen - Tags: #en, #en-ctf ## Challenge Info - **Platform**: TryHackMe - **Room name**: W1seGuy - **Difficulty**: Easy - **Goal**: Grab flag1 and flag2 - **Link**: [https://tryhackme.com/room/w1seguy](https://tryhackme.com/room/w1seguy?ref=taiwanding.com) - Note: unlike most writeups, this one is mostly about explaining the underlying concepts ## Overview A TCP service runs on port 1337\. Every time you connect it hands you an encrypted message and asks you to crack the key. The challenge ships a plaintext source file `source-1705339805281.py` that you can study first, and there are two flags to obtain. ## Initial Recon Connecting to the service, you see: ``` โ””โ”€$ nc 10.201.99.19 1337 This XOR encoded text has flag 1: 1d7f020e1c7856231b180c4f3b34183d032c1e0f08593d460d257b361d393b433645193b4f000711 What is the encryption key? ``` ### ๐Ÿ” Identifying the Encoding #### How do we know it's hexadecimal (HEX)? Look at the characteristics of the ciphertext: 1. **Character range**: only `0-9` and `a-f`, nothing else 2. **Length property**: the total length is even (every 2 digits represent 1 byte) Side-by-side example: ``` HEX โ†’ decimal โ†’ ASCII char 54 โ†’ 84 โ†’ 'T' 48 โ†’ 72 โ†’ 'H' 4D โ†’ 77 โ†’ 'M' 7B โ†’ 123 โ†’ '{' ``` ## Key Findings From the source file `source-1705339805281.py` provided with the challenge, we can observe: - The key length is fixed at **5 characters** - The key is made up of random letters and digits - It uses **repeating-key XOR** encryption (the key is reused) - The flag follows the standard `THM{...}` format ## How XOR Encryption Works ### The Basics The most important property of XOR (exclusive or) is that it is **reversible**: ``` If A โŠ• B = C then C โŠ• B = A and also C โŠ• A = B ``` ### A Repeating-Key Example Let me illustrate with a simple example: ``` plaintext: THM{OK} (7 characters) key: ABC (3 characters) encryption process: position: 0 1 2 3 4 5 6 plaintext: T H M { O K } key: A B C A B C A (repeating) โŠ• โŠ• โŠ• โŠ• โŠ• โŠ• โŠ• ciphertext:? ? ? ? ? ? ? ``` ## Attack Method: Known-Plaintext Attack ### The Core Idea Since we know: - Every flag starts with `THM{` (4 characters) - Every flag ends with `}` (1 character) - The key length is 5 We can exploit XOR's reversibility: ``` key = ciphertext โŠ• plaintext ``` ### Cracking Steps in Detail #### Step 1: Handle the HEX ciphertext ``` raw ciphertext: 122939363f... group in pairs: 12 29 39 36 3f ... convert to bytes: 0x12, 0x29, 0x39, 0x36, 0x3f ... ``` #### Step 2: Compute the key ``` known plaintext start: "THM{" matching ASCII: T(0x54), H(0x48), M(0x4D), {(0x7B) calculate: Key[0] = 0x12 โŠ• 0x54 = ? Key[1] = 0x29 โŠ• 0x48 = ? Key[2] = 0x39 โŠ• 0x4D = ? Key[3] = 0x36 โŠ• 0x7B = ? Key[4] = last ciphertext byte โŠ• '}'(0x7D) ``` #### Step 3: Why can we use the last character? - Assume the flag length is 41 - Position 40 uses Key\[40 % 5\] = Key\[0\] - The position of the trailing `}` tells us Key\[4\] ## Grabbing Both Flags ### Flag 1: The Decryption Reward 1. Use the 5-character key you cracked 2. XOR-decrypt the flag 1 ciphertext 3. You get Flag1: `THM{Redacted}` ### Flag 2: Proof of Automation 1. Send the correct key back to the server 2. Once the server verifies it, it hands the flag straight to you 3. You get Flag2: `THM{Redacted}` ## Hands-On! Cracking the XOR Ciphertext - Step by Step ## The Given Ciphertext ``` 1d7f020e1c7856231b180c4f3b34183d032c1e0f08593d460d257b361d393b433645193b4f000711 ``` ## Step 1: Understand the Data Format ``` ciphertext (HEX): 1d7f020e1c7856231b180c4f3b34183d032c1e0f08593d460d257b361d393b433645193b4f000711 length: 82 characters = 41 bytes (82รท2) grouped in pairs: 1d 7f 02 0e 1c 78 56 23 1b 18 0c 4f 3b 34 18 3d 03 2c 1e 0f 08 59 3d 46 0d 25 7b 36 1d 39 3b 43 36 45 19 3b 4f 00 07 11 ``` ## Step 2: Extract the Key Positions ``` first 5 bytes: 1d 7f 02 0e 1c last byte: 11 ``` ## Step 3: Compute the Key ### What We Know - Plaintext start: `THM{` - Plaintext end: `}` - Matching ASCII values: ``` char | ASCII (decimal) | ASCII (hex) T | 84 | 0x54 H | 72 | 0x48 M | 77 | 0x4D { | 123 | 0x7B } | 125 | 0x7D ``` ### XOR Calculation Using the formula: `key = ciphertext โŠ• plaintext` ``` Key[0] = 0x1d โŠ• 0x54 = ? Key[1] = 0x7f โŠ• 0x48 = ? Key[2] = 0x02 โŠ• 0x4D = ? Key[3] = 0x0e โŠ• 0x7B = ? Key[4] = 0x11 โŠ• 0x7D = ? ``` ### Working Out the XOR by Hand #### Key\[0\] = 0x1d โŠ• 0x54 ``` 0x1d = 0001 1101 โŠ• 0x54 = 0101 0100 โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ = 0100 1001 = 0x49 = 73 = 'I' ``` #### Key\[1\] = 0x7f โŠ• 0x48 ``` 0x7f = 0111 1111 โŠ• 0x48 = 0100 1000 โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ = 0011 0111 = 0x37 = 55 = '7' ``` #### Key\[2\] = 0x02 โŠ• 0x4D ``` 0x02 = 0000 0010 โŠ• 0x4D = 0100 1101 โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ = 0100 1111 = 0x4F = 79 = 'O' ``` #### Key\[3\] = 0x0e โŠ• 0x7B ``` 0x0e = 0000 1110 โŠ• 0x7B = 0111 1011 โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ = 0111 0101 = 0x75 = 117 = 'u' ``` #### Key\[4\] = 0x11 โŠ• 0x7D ``` 0x11 = 0001 0001 โŠ• 0x7D = 0111 1101 โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ = 0110 1100 = 0x6c = 108 = 'l' ``` ## Step 4: We Have the Key ``` key = I7Oul ``` ## Step 5: Verify (Decrypt the Whole Ciphertext) Decrypt with the repeating key `I7Oul`: ``` pos | ciph | key | result -----|------|------|------ 0 | 0x1d | I(49)| 0x1d โŠ• 0x49 = 0x54 = 'T' โœ“ 1 | 0x7f | 7(37)| 0x7f โŠ• 0x37 = 0x48 = 'H' โœ“ 2 | 0x02 | O(4F)| 0x02 โŠ• 0x4F = 0x4D = 'M' โœ“ 3 | 0x0e | u(75)| 0x0e โŠ• 0x75 = 0x7B = '{' โœ“ 4 | 0x1c | l(6c)| 0x1c โŠ• 0x6c = 0x70 = 'p' 5 | 0x78 | I(49)| 0x78 โŠ• 0x49 = 0x31 = '1' ...(keep decrypting) 40 | 0x11 | I(49)| 0x11 โŠ• 0x6c = 0x7D = '}' โœ“ ``` ```bash nc 10.201.99.19 1337 This XOR encoded text has flag 1: 1d7f020e1c7856231b180c4f3b34183d032c1e0f08593d460d257b361d393b433645193b4f000711 What is the encryption key? I7Oul Congrats! That is the correct key! Here is flag 2: THM{Redacted} ``` ### Online helper tools: [XOR Calculator OnlineCalculate the exclusive or (XOR) with a simple web-based calculator. Input and output in binary, decimal, hexadecimal or ASCII.![](https://taiwanding.com/content/images/icon/favicon-2.ico)](https://xor.pw/?ref=taiwanding.com) [Decimal to ASCII Converter (dec to ascii)![](https://taiwanding.com/content/images/icon/favicon-3.ico)PrePost SEO![](https://taiwanding.com/content/images/thumbnail/decimal-to-ascii.png)](https://www.prepostseo.com/tool/decimal-to-ascii?ref=taiwanding.com)