Simple Encryptor

Technical Walkthrough

Writeup

Challenge

• Name: Simple-Encryptor
• Category: Reversing
• Difficulty: Very Easy
• Mode: file

Summary

The binary stores a 4-byte Unix time seed at the start of flag.enc, then uses glibc's rand() stream twice per plaintext byte: first to XOR the byte with rand() & 0xff, then to rotate the result left by rand() & 7. Replaying the same glibc PRNG sequence and reversing the operations (ROR then XOR) decrypts the flag deterministically.

The encrypted file starts with a 4-byte Unix timestamp seed. The encrypt binary uses that seed with libc srand(), then for each plaintext byte XORs with rand() & 0xff and rotates left by rand() & 7. Replaying the same PRNG and applying the inverse operations (ROR then XOR) decrypts the flag deterministically.

Artifact Inventory

• files/a12c7354-6ee3-4584-912e-2f8b1c122ecf.zip — original encrypted archive.
• analysis/<password redacted> — successful archive decryption validation.
• analysis/extracted/rev_simpleencryptor/encrypt — ELF encryptor binary.
• analysis/extracted/rev_simpleencryptor/flag.enc — encrypted flag blob.
• analysis/objdump-disasm.txt — disassembly used to reconstruct the transform.
• analysis/solve-result.txt — recovered flag before harness capture.
• solve/solve.py — deterministic decryptor.

• files/a12c7354-6ee3-4584-912e-2f8b1c122ecf.zip — original encrypted archive.
• analysis/<password redacted> — successful archive decryption validation.
• analysis/extracted/rev_simpleencryptor/encrypt — ELF encryptor binary.
• analysis/extracted/rev_simpleencryptor/flag.enc — encrypted flag blob.
• analysis/objdump-disasm.txt — disassembly used to reconstruct the transform.
• analysis/solve-result.txt — recovered flag before harness capture.
• solve/solve.py — deterministic decryptor.

Reference analysis/artifact-inventory.json and summarize the relevant files or remote surface.

Analysis

main() opens the input file, reads it into memory, calls time(NULL) and srand(seed), writes the 4-byte seed to the start of the output file, and then for each plaintext byte calls rand() twice: once to obtain the XOR byte and a second time to derive the rotate-left amount via & 7. The output byte is therefore ROL(plain ^ (rand1 & 0xff), rand2 & 7). Decryption must replay the exact glibc random() stream from the stored seed, then apply ROR(cipher, rand2 & 7) ^ (rand1 & 0xff).

main() opens flag, reads it fully, seeds srand(time(NULL)), and writes the seed as the first four bytes of flag.enc. It then iterates each plaintext byte, XORing it with rand() & 0xff, stores that intermediate byte, calls rand() again, masks the result with 7, and rotates the byte left by that count. To decrypt, read the seed prefix, replay the same libc PRNG sequence, rotate each ciphertext byte right by the second random value, and XOR with the first random value.

Solve

The solver reads the first four bytes of flag.enc as a little-endian Unix timestamp seed, reconstructs glibc's additive random() sequence, and for each ciphertext byte applies a right rotate by the second random value and then XORs with the first random value. The resulting plaintext is the HTB flag.

The solver reads the first four bytes of flag.enc as a little-endian Unix timestamp seed, initializes libc rand() with srand(seed), and for each encrypted byte computes plain = ROR(cipher, rand() & 7) XOR (previous rand() & 0xff). The resulting plaintext is the HTB flag.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

For Linux binaries, be careful not to assume the host platform's libc PRNG matches the target. The first attempt using macOS libc failed; the correct decryptor had to reproduce glibc's random() algorithm exactly before the byte-wise inverse transform produced the flag.

When an encryptor stores its PRNG seed alongside ciphertext, reversing often reduces to reconstructing the exact byte transform and replaying the same RNG. Pay close attention to operation order—here it was XOR first, then rotate-left—because the inverse must unwind that sequence exactly.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: Simple-Encryptor
• Category: Reversing
• Difficulty: Very Easy
• Mode: file
• Remote instance: none
• Start time: 2026-06-07T09:30:02Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

-

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Scenario

On our regular checkups of our secret flag storage server we found out that we were hit by ransomware. The original flag data is nowhere to be found, but luckily we not only have the encrypted file but also the encryption program itself.

Operator Question

Analyze the provided reversing challenge artifacts, reverse the encryption program, decrypt flag.enc reproducibly, and capture the HTB flag.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Reversing
• Challenge: Simple-Encryptor
• Difficulty: Very Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches

Memory Summary

approval_required: true

Sanitized Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Reversing
• Challenge: Simple-Encryptor
• Difficulty: Very Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Notes

Notes

Scope

• Challenge: Simple-Encryptor
• Category: Reversing
• Difficulty: Very Easy
• Mode: file
• Remote instance: none
• Start time: 2026-06-07T09:30:02Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

-

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Scenario

On our regular checkups of our secret flag storage server we found out that we were hit by ransomware. The original flag data is nowhere to be found, but luckily we not only have the encrypted file but also the encryption program itself.

Operator Question

Analyze the provided reversing challenge artifacts, reverse the encryption program, decrypt flag.enc reproducibly, and capture the HTB flag.