TryHackMe W1seGuy Writeup: Cracking Repeating-Key XOR

Challenge Info

• Platform: TryHackMe
• Room name: W1seGuy
• Difficulty: Easy
• Goal: Grab flag1 and flag2
• Link: https://tryhackme.com/room/w1seguy
• Note: unlike most writeups, this one is mostly about explaining the underlying concepts

Overview

A TCP service runs on port 1337. Every time you connect it hands you an encrypted message and asks you to crack the key. The challenge ships a plaintext source file source-1705339805281.py that you can study first, and there are two flags to obtain.

Initial Recon

Connecting to the service, you see:

└─$ nc 10.201.99.19 1337
This XOR encoded text has flag 1: 1d7f020e1c7856231b180c4f3b34183d032c1e0f08593d460d257b361d393b433645193b4f000711
What is the encryption key?

🔍 Identifying the Encoding

How do we know it's hexadecimal (HEX)?

Look at the characteristics of the ciphertext:

1. Character range: only 0-9 and a-f, nothing else
2. Length property: the total length is even (every 2 digits represent 1 byte)

Side-by-side example:

HEX  → decimal → ASCII char
54   → 84      → 'T'
48   → 72      → 'H'
4D   → 77      → 'M'
7B   → 123     → '{'

Key Findings

From the source file source-1705339805281.py provided with the challenge, we can observe:

• The key length is fixed at 5 characters
• The key is made up of random letters and digits
• It uses repeating-key XOR encryption (the key is reused)
• The flag follows the standard THM{...} format

How XOR Encryption Works

The Basics

The most important property of XOR (exclusive or) is that it is reversible:

If A ⊕ B = C
then C ⊕ B = A
and also C ⊕ A = B

A Repeating-Key Example

Let me illustrate with a simple example:

plaintext: THM{OK}  (7 characters)
key:       ABC      (3 characters)

encryption process:
position:  0   1   2   3   4   5   6
plaintext: T   H   M   {   O   K   }
key:       A   B   C   A   B   C   A  (repeating)
           ⊕   ⊕   ⊕   ⊕   ⊕   ⊕   ⊕
ciphertext:?   ?   ?   ?   ?   ?   ?

Attack Method: Known-Plaintext Attack

The Core Idea

Since we know:

• Every flag starts with THM{ (4 characters)
• Every flag ends with } (1 character)
• The key length is 5

We can exploit XOR's reversibility:

key = ciphertext ⊕ plaintext

Cracking Steps in Detail

Step 1: Handle the HEX ciphertext

raw ciphertext: 122939363f...
group in pairs: 12 29 39 36 3f ...
convert to bytes: 0x12, 0x29, 0x39, 0x36, 0x3f ...

Step 2: Compute the key

known plaintext start: "THM{"
matching ASCII: T(0x54), H(0x48), M(0x4D), {(0x7B)

calculate:
Key[0] = 0x12 ⊕ 0x54 = ?
Key[1] = 0x29 ⊕ 0x48 = ?
Key[2] = 0x39 ⊕ 0x4D = ?
Key[3] = 0x36 ⊕ 0x7B = ?
Key[4] = last ciphertext byte ⊕ '}'(0x7D)

Step 3: Why can we use the last character?

• Assume the flag length is 41
• Position 40 uses Key[40 % 5] = Key[0]
• The position of the trailing } tells us Key[4]

Grabbing Both Flags

Flag 1: The Decryption Reward

1. Use the 5-character key you cracked
2. XOR-decrypt the flag 1 ciphertext
3. You get Flag1: THM{Redacted}

Flag 2: Proof of Automation

1. Send the correct key back to the server
2. Once the server verifies it, it hands the flag straight to you
3. You get Flag2: THM{Redacted}

Hands-On! Cracking the XOR Ciphertext - Step by Step

The Given Ciphertext

1d7f020e1c7856231b180c4f3b34183d032c1e0f08593d460d257b361d393b433645193b4f000711

Step 1: Understand the Data Format

ciphertext (HEX): 1d7f020e1c7856231b180c4f3b34183d032c1e0f08593d460d257b361d393b433645193b4f000711
length: 82 characters = 41 bytes (82÷2)

grouped in pairs:
1d 7f 02 0e 1c 78 56 23 1b 18 0c 4f 3b 34 18 3d 03 2c 1e 0f 08 59 3d 46 0d 25 7b 36 1d 39 3b 43 36 45 19 3b 4f 00 07 11

Step 2: Extract the Key Positions

first 5 bytes: 1d 7f 02 0e 1c
last byte:     11

Step 3: Compute the Key

What We Know

• Plaintext start: THM{
• Plaintext end: }
• Matching ASCII values:

char | ASCII (decimal) | ASCII (hex)
T    | 84              | 0x54
H    | 72              | 0x48
M    | 77              | 0x4D
{    | 123             | 0x7B
}    | 125             | 0x7D

XOR Calculation

Using the formula: key = ciphertext ⊕ plaintext

Key[0] = 0x1d ⊕ 0x54 = ?
Key[1] = 0x7f ⊕ 0x48 = ?
Key[2] = 0x02 ⊕ 0x4D = ?
Key[3] = 0x0e ⊕ 0x7B = ?
Key[4] = 0x11 ⊕ 0x7D = ?

Working Out the XOR by Hand

Key[0] = 0x1d ⊕ 0x54

  0x1d = 0001 1101
⊕ 0x54 = 0101 0100
  ───────────────
       = 0100 1001 = 0x49 = 73 = 'I'

Key[1] = 0x7f ⊕ 0x48

  0x7f = 0111 1111
⊕ 0x48 = 0100 1000
  ───────────────
       = 0011 0111 = 0x37 = 55 = '7'

Key[2] = 0x02 ⊕ 0x4D

  0x02 = 0000 0010
⊕ 0x4D = 0100 1101
  ───────────────
       = 0100 1111 = 0x4F = 79 = 'O'

Key[3] = 0x0e ⊕ 0x7B

  0x0e = 0000 1110
⊕ 0x7B = 0111 1011
  ───────────────
       = 0111 0101 = 0x75 = 117 = 'u'

Key[4] = 0x11 ⊕ 0x7D

  0x11 = 0001 0001
⊕ 0x7D = 0111 1101
  ───────────────
       = 0110 1100 = 0x6c = 108 = 'l'

Step 4: We Have the Key

key = I7Oul

Step 5: Verify (Decrypt the Whole Ciphertext)

Decrypt with the repeating key I7Oul:

pos  | ciph | key  | result
-----|------|------|------
0    | 0x1d | I(49)| 0x1d ⊕ 0x49 = 0x54 = 'T' ✓
1    | 0x7f | 7(37)| 0x7f ⊕ 0x37 = 0x48 = 'H' ✓
2    | 0x02 | O(4F)| 0x02 ⊕ 0x4F = 0x4D = 'M' ✓
3    | 0x0e | u(75)| 0x0e ⊕ 0x75 = 0x7B = '{' ✓
4    | 0x1c | l(6c)| 0x1c ⊕ 0x6c = 0x70 = 'p'
5    | 0x78 | I(49)| 0x78 ⊕ 0x49 = 0x31 = '1'
...(keep decrypting)
40   | 0x11 | I(49)| 0x11 ⊕ 0x6c = 0x7D = '}' ✓

nc 10.201.99.19 1337
This XOR encoded text has flag 1: 1d7f020e1c7856231b180c4f3b34183d032c1e0f08593d460d257b361d393b433645193b4f000711
What is the encryption key? I7Oul
Congrats! That is the correct key! Here is flag 2: THM{Redacted}

Online helper tools:

XOR Calculator Online

Calculate the exclusive or (XOR) with a simple web-based calculator. Input and output in binary, decimal, hexadecimal or ASCII.

Decimal to ASCII Converter (dec to ascii)

PrePost SEO