Posts tagged with aes-ctr

picoCTF 2018 - eleCTRic

Posted on October 13, 2018* in ctf-writeups


"You came across a custom server that Dr Xernon's company eleCTRic Ltd uses. It seems to be storing some encrypted files. Connect with nc 15037. Can you get us the flag?" Source


The title makes a clear reference to AES-CTR. We can see that this mode of AES requires a unique nonce for each encrypted value to remain cryptographically secure. If we look at the problem's source code, we can see that the counter remains constant for all values. This breaks the encryption used and we are able to reveal the keystream and encrypt arbritary data.

class AESCipher(object):
    def __init__(self): = 32
        random =
        self.key =
        self.ctr =

    def encrypt(self, raw):
        cipher =, AES.MODE_CTR, counter=lambda: self.ctr)
        return cipher.encrypt(raw).encode('base64').replace('\n', '')
Continue Reading
Switch to Dark Mode
Switch to Light Mode