Neon Core

Technical Walkthrough

Writeup

Challenge

• Name: Neon-Core
• Category: Crypto
• Difficulty: Medium
• Mode: hybrid

Summary

Neon Core is a source-backed remote crypto challenge. The provided server.py encrypts a padded 16-byte block by applying a known byte-wise S-box and then a fixed affine matrix transformation over GF(257). Because the same keyed transform is used for attacker-chosen messages and the encrypted blueprint, the transform can be learned and inverted.

Artifact Inventory

The artifact is a <password redacted> HTB ZIP:

• files/a12c7356-7a56-47fb-b6e7-ed9b1812452c.zip
• extracted source: files/extracted/crypto_neon_core/server.py

The remote service is <TARGET>:31023. The source audit is recorded in analysis/source-audit.md.

Analysis

The source defines:

C = K * S(M) * L + T
S(x) = x^3 over GF(257)
S_inv(x) = x^171

Flattened into a 16-element vector, this is an affine map:

vec(C) = A * vec(S(M)) + vec(T)

The chosen-plaintext oracle gives enough equations to recover A and the offset. The solver uses a one-block calibration strategy:

• baseline: 15 A characters, so the final byte is PKCS#7 padding 0x01
• positions 0-14: replace one A with B to recover each column
• position 15: compare a 14-byte message, where the last two bytes become padding 0x02, then subtract the known position-14 contribution

The deployed service had a protocol quirk: repeated interactive queries on the same connection closed unexpectedly, but pre-sending all menu choices in one connection worked and kept the same random matrices for all calibration queries and the blueprint request.

The ciphertext encoder also has an edge case: field element 256 is serialized as 100, while normal byte-sized values are two hex characters. The solver parses mixed-width candidates and accepts the candidate that decrypts to valid PKCS#7 and the expected HTB flag format.

Solve

The reproducible solver is:

python3 Crypto/Neon-Core/solve/solve.py --host <TARGET> --port 31023 --workspace Crypto/Neon-Core

It records redacted run metadata in analysis/solve-run-redacted.json and stores the raw flag in loot/flag.txt.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• A known nonlinear layer followed by a fixed affine layer is still vulnerable to chosen-plaintext linearization.
• Source-provided finite-field ciphers should be modeled exactly; no floating-point math is needed.
• Remote service behavior may differ from the source loop. If keys are per process, batching menu inputs can preserve one keyed session.
• Encoding field elements as variable-width hex needs explicit parsing.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: Neon-Core
• Category: Crypto
• Difficulty: Medium
• Mode: hybrid
• Remote instance: <TARGET>:31023
• Start time: 2026-06-11T12:45:17Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• The archive is the standard HTB <password redacted> ZIP and extracts to crypto_neon_core/server.py.
• server.py uses Sage-style GF(257) matrices. Each plaintext block is transformed as C = K S(M) L + T, where S(x)=x^3.
• Since gcd(3, 256)=1, the S-box is invertible over GF(257) with S_inv(x)=x^171.
• The block transform is affine in the vector of S-box outputs. Chosen plaintext encryption lets us recover the full 16x16 affine map.
• The deployed service closes when used interactively for repeated follow-up actions, but it processes a pre-sent batch of menu inputs in one keyed process. The final solver uses this batch behavior.
• solve/solve.py sends 17 calibration encryption requests plus the blueprint request in one connection, learns the affine map, handles 256 -> "100" mixed-width ciphertext encoding, decrypts the blueprint, and writes the raw flag to loot/flag.txt.
• RAG had no matching Neon Core guidance. The solve is based on direct source audit plus local fallback notes about exact algebraic inversion.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Crypto
• Challenge: Neon-Core
• Difficulty: Medium
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1. Extracted the HTB ZIP and audited server.py.
2. Identified encryption as C = K S(M) L + T over GF(257), with S(x)=x^3.
3. Reframed the block cipher as a 16-dimensional affine map after an invertible S-box.
4. Used 17 chosen plaintext blocks in one keyed remote session to recover the affine transform.
5. Inverted the transform, applied S_inv(x)=x^171, removed PKCS#7 padding, and recovered the HTB-format flag.

Reusable Lessons

• For source-backed custom ciphers, flatten matrix operations and look for affine structure.
• Chosen plaintext often turns nonlinear-looking constructions into exact linear algebra if the nonlinear layer is known and invertible.
• If a service uses per-process random keys and closes after one interactive action, test pre-sending all menu inputs in one connection.
• When GF(257) values are serialized as hex, handle the 256 -> "100" variable-width token.

Dead Ends

• Initial interactive solver assumed the service loop allowed repeated live prompts. The deployed wrapper closed after a single action, so the solver was changed to batch all inputs.
• RAG did not contain useful Neon Core-specific guidance.

Tool Quirks

• sage and sympy were unavailable locally, but pure Python modular arithmetic and Gauss-Jordan inversion over modulus 257 were enough.
• The remote output marker differed slightly from the provided source: deployed service used Encrypted configuration (hex):.

Evidence Paths

• analysis/source-audit.md
• analysis/instrumentation-plan.md
• analysis/solve-run-redacted.json
• solve/solve.py
• loot/flag.txt

Ingestion Decision

• Proposed for LightRAG: yes, sanitized only
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches