Surprise Factor

Technical Walkthrough

Writeup

Challenge

• Name: Surprise-Factor
• Category: Crypto
• Difficulty: Hard
• Mode: remote

Summary

Artifact Inventory

Reference analysis/artifact-inventory.json and summarize the relevant files or remote surface.

Analysis

Solve

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: Surprise-Factor
• Category: Crypto
• Difficulty: Hard
• Mode: remote
• Remote instance: none
• Start time: 2026-06-15T04:58:42Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• Remote service accepts newline-delimited JSON objects.
• Valid actions are sign and submit; unknown actions return action must be 'sign', or 'submit'.
• sign returns P-256 ECDSA fields: hash, r, s, trace, and fixed public_key.
• The fixed public key sits on NIST P-256 and captured signatures verify locally.
• submit expects private scalar field d; d=1 returns valid: false.
• Message/hash inputs appear ignored; repeated identical sign requests produce different server-chosen hashes.
• trace is currently empty across default signing, common trace/debug/leak flags, multiline connections, and 90 bounded samples.
• Contiguous MT19937 recovery from exposed hash chunks failed with 0/96 held-out word matches in both tested word orders.
• Exact hidden-8 interleaved MT19937 recovery failed across all 624 offsets in both tested word orders.
• Replacement instance <TARGET>:31235 is reachable and returns the same fixed P-256 public key.
• Source archive was provided and extracted under files/extracted/crypto_surprise_factor/.
• Source confirms the real trace-enabling request field is track, not trace, debug, or leak.
• Example: {"action":"sign","track":["scalar_mul","point_double","point_add","p256_quasi_reduce"]} returns non-empty compact symbol traces.
• Reachable-instance schema-error probe produced no non-empty trace, source, or stack leak.
• Mask/noise/security disabling probe tested 162 combinations and still returned trace_len=0.
• Expanded MT19937 recovery also failed for byte-swapped randbytes().hex()-style packings.
• Simple nonce-relation sanity checks found no consistent d for obvious k = hash/r/s, half-hash, byte-swapped hash, xor, add, or subtract variants.
• Local labeled tests show scalar-multiplication p256-reduction segment counts do not predict masked scalar bits better than chance.
• Local binary-division trace count/ngram tests do not predict nonce bit length better than baseline.
• Public research now strongly matches the binary-GCD product-recovery route behind Mbed TLS <secret redacted>: recover unreduced b = nonce_mask * nonce, factor b, enumerate nonce divisors, derive d.
• Local toy validation confirms the challenge's binary-GCD trace can uniquely recover the unreduced product for small moduli, and the pruned symbolic skeleton solver works through 40-bit products.
• Local full-trace residue validation now recovers exact products for toy traces, including a single 32-bit trace, but still caps on P-256 around iteration 17 with 524,288 residue pairs and only about 40 lifted bits.
• Local P-256 validation is not complete: current Python solvers branch too much, and the experimental Z3 solver is too slow/unreliable in its current formulation.
• Current effective state is <secret redacted>; do not attempt submit(d) or lattice/RNG brute modeling without source, non-empty trace, or a narrow leakage hint.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Crypto
• Challenge: Surprise-Factor
• Difficulty: Hard
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches