Xorxorxor

Technical Walkthrough

Writeup

Challenge

• Name: xorxorxor
• Category: Hardware
• Difficulty: Easy
• Mode: file

Summary

The provided Python script encrypts the flag with a 4-byte repeating XOR key generated from os.urandom(4). The ciphertext is provided in output.txt. Since the flag format is known to start with standard HTB flag prefix, the entire 4-byte key can be recovered from the first four ciphertext bytes, then reused to decrypt the rest of the message.

Artifact Inventory

Reference analysis/artifact-inventory.json and summarize the relevant files or remote surface.

• files/a12c7393-6f23-4166-821e-c31c1ec785fe.zip: original HTB archive.
• analysis/extracted/challenge.py: encryption script.
• analysis/extracted/output.txt: ciphertext output.
• analysis/challenge-source.txt: copied script content for analysis.
• analysis/output-hexdump.txt: hex view of the output file.
• solve/solve.py: reproducible decoder.

Analysis

1. challenge.py creates a random 4-byte key with os.urandom(4).
2. Encryption XORs every plaintext byte with key[i % 4].
3. The same function is used for decryption because XOR is symmetric.
4. output.txt contains the encrypted flag as hex.
5. HTB flags start with standard HTB flag prefix, so the first four plaintext bytes are known.
6. XORing the first four ciphertext bytes with standard HTB flag prefix recovers the full repeating key.
7. Applying the recovered key across the ciphertext produces the plaintext flag.

Solve

Run:

python3 Hardware/xorxorxor/solve/solve.py

The script reads output.txt, derives the 4-byte XOR key from the known prefix, decrypts the ciphertext, and prints the HTB-format flag for harness capture.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• Repeating XOR with a key as long as the known prefix is fully broken by a single known-plaintext block.
• For challenge flags, the standard standard HTB flag prefix prefix is enough to recover short repeating XOR keys.
• Even random keys are ineffective if the mode repeats a short key over predictable plaintext.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: xorxorxor
• Category: Hardware
• Difficulty: Easy
• Mode: file
• Remote instance: none
• Start time: 2026-06-10T11:29:35Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• The archive contains challenge.py and output.txt.
• challenge.py uses a random 4-byte key and repeats it across the whole flag with XOR.
• output.txt stores the ciphertext as hex after the label Flag:.
• Because HTB flags start with standard HTB flag prefix, the 4-byte XOR key is recovered by XORing the first four ciphertext bytes with standard HTB flag prefix.
• solve/solve.py derives the key, decrypts the ciphertext, and prints the HTB-format plaintext for harness capture.
• The harness captured the raw flag into loot/flag.txt.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Hardware
• Challenge: xorxorxor
• Difficulty: Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1. Extract the challenge archive and inspect the provided Python script plus output file.
2. Identify encryption as repeating XOR with a 4-byte random key.
3. Use the known standard HTB flag prefix flag prefix as four bytes of known plaintext.
4. Recover the 4-byte key by XORing the first four ciphertext bytes with the known prefix.
5. Repeat the recovered key across the full ciphertext to decrypt it.
6. Capture the decoded HTB-format flag through the harness.

Reusable Lessons

• Repeating XOR is vulnerable to known plaintext when the key length is short.
• A known flag prefix can be enough to recover the full key if the key length is less than or equal to the prefix length.
• Random key generation does not help when the encryption mode leaks the key through repetition.

Dead Ends

• No dead ends. The provided source fully defined the transform.

Tool Quirks

• No special hardware tooling was required; this challenge was solved from the provided Python transform and ciphertext.

Evidence Paths

• analysis/extracted/challenge.py
• analysis/extracted/output.txt
• analysis/challenge-source.txt
• analysis/output-hexdump.txt
• solve/solve.py
• loot/flag.txt

Ingestion Decision

• Proposed for LightRAG: yes
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches

Memory Summary

approval_required: true

Sanitized Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Hardware
• Challenge: xorxorxor
• Difficulty: Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1. Extract the challenge archive and inspect the provided Python script plus output file.
2. Identify encryption as repeating XOR with a 4-byte random key.
3. Use the known standard HTB flag prefix flag prefix as four bytes of known plaintext.
4. Recover the 4-byte key by XORing the first four ciphertext bytes with the known prefix.
5. Repeat the recovered key across the full ciphertext to decrypt it.
6. Capture the decoded HTB-format flag through the harness.

Reusable Lessons

• Repeating XOR is vulnerable to known plaintext when the key length is short.
• A known flag prefix can be enough to recover the full key if the key length is less than or equal to the prefix length.
• Random key generation does not help when the encryption mode leaks the key through repetition.

Dead Ends

• No dead ends. The provided source fully defined the transform.

Tool Quirks

• No special hardware tooling was required; this challenge was solved from the provided Python transform and ciphertext.

Evidence Paths

• analysis/extracted/challenge.py
• analysis/extracted/output.txt
• analysis/challenge-source.txt
• analysis/output-hexdump.txt
• solve/solve.py
• loot/flag.txt

Ingestion Decision

• Proposed for LightRAG: yes
• Requires user approval before ingestion: yes

Notes

Notes

Scope

• Challenge: xorxorxor
• Category: Hardware
• Difficulty: Easy
• Mode: file
• Remote instance: none
• Start time: 2026-06-10T11:29:35Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• The archive contains challenge.py and output.txt.
• challenge.py uses a random 4-byte key and repeats it across the whole flag with XOR.
• output.txt stores the ciphertext as hex after the label Flag:.
• Because HTB flags start with standard HTB flag prefix, the 4-byte XOR key is recovered by XORing the first four ciphertext bytes with standard HTB flag prefix.
• solve/solve.py derives the key, decrypts the ciphertext, and prints the HTB-format plaintext for harness capture.
• The harness captured the raw flag into loot/flag.txt.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.