Description: We found a leak of a blackmarket website’s login credentials. Can you find the password of the user cultiris and successfully decrypt it? The first user in usernames.txt corresponds to the first password in passwords.txt. The second user corresponds to the second password, and so on.
Difficulty: Medium
Author: Will Hong / LT ‘syreal’ Jones
Summary
This challenge provides a leaked archive containing two files: a list of usernames and a list of passwords. Each username corresponds directly to the password on the same line number. The goal is to locate the user cultiris, find their associated password, and then decrypt it to obtain the flag.
Analysis
We are given a tar archive named leak.tar:
$ file leak.tarleak.tar: POSIX tar archive (GNU)A quick reminder:
tar (Tape ARchive) is a Linux utility used for packaging multiple files into a single archive. It’s commonly used for backups, data transfer, and compressing directory structures. Extracting it will reveal the files inside.
Let’s untar it
Let’s extract the archive:
$ tar -xvf leak.tarleak/leak/passwords.txtleak/usernames.txtStep 1, View the leaked usernames
$ cat usernames.txtengineerrissolesicebuntfruitfultrycelebritypentathlongaloshesopinionfavorboeingbindingcouchentersaladruthlessconfidencecoupleelevatorremoteswordresearchfallalertbornexcitedcoolactressbogusvolcanicramglassesspringfixoutriggerboozerfireworktherapistvigorouswithoutbelgiantreedon’thealobligationvolunteerprofessortweedboilersuitunderwingpalewhirlmolarcrawlrakesandpiperbandturbulentbriskstrippedimminentcroakmufflernetherrackdelayharrascroakleeryspiffymineshaftlevelparagraphswarmhorizongrimacingaheadmeekgrimacingstainanalysttoothmajoritygillettedroopyoatmealcouncilmonsterfencegreektreaclerebelkentishpartialhabitualregardlessoverallglisteningcootnoisevictimscallopedpatienceyawldepictninewidoweveryonesurvivalunlikelyclovestairlardfacecrashmewguitardellminercroquetdroopydrabparcelplatformcancelsutehummusfearlessherringshypresidentdeliverunsightlyswooshdeliciousresistancedistorted...Step 2, Count the usernames
There are many usernames, so let’s count them:
$ wc -l usernames.txt505 usernames.txtStep 3, View the leaked passwords
And I think it will be the same on the password.txt since line N of usernames.txt corresponds to line N of passwords.txt.
$ cat passwords.txtCMPTmLrgfYCexGzJu6TbdGwZaGK73YKE2XD2TEnvJeHRBdfpt2UukmEk5NCPGUSfs5tGWPK26gGkaL36YJtvZMdbTdLuQRx84t85K9gzHFpwF2azPayAUSrcL8fJ9rYrtRbkHvJzPmDwzD6gSDbAE3kfcVXjcFkvNQQPpATErx6eVDdkDrPVvMakUsNd7BvmJtK3ACY4dvDvWjzXNk8WwqEzJ5P2FP5YH86L5w4sH9ZXTCPAa5ExMSPFNhqXFEg8ZasLxQhUYWnhTemgqxhgd7panTqNpUvBXBxpGpcqP9X7Y3KcHyg7kSf6RgX5THyjrw3g1WkHQ78HaKgkcf8bHat9GbTJmjLhY5mfRsaKjaueVhdeHqUrMKpfcdy7jz9VmfPQcuHRnULJvwUffVsT4tJ5ahRUbBp4YEdVAvLtFcLr6pyDpuvQyAda35CdcCsSgkmkY39jWhLQAABWNg7GQQCqhr9JPTeqgHpbTYra2jXn7KLvNXt1BskbdvkHv8Dv9NAgRHJ3uwDG0hD795qgYzpbhXGSYadJRJpRGBWLVn9cV4NL7kZ2WCagP8jV2GcXccQXznLtdWbs6ga24tMEXNfekw6zFzfZvEGk6fxrMNQYUXeXhXgqXaMhG65X4aP6GqadBAYKfsfHfNeGsefznBCnpPvKxVk6au1nb6ErH5LkVNyAD4mggFtdyVqnJ4jyAn9apZSERG52NHsAZPkTJMxFFeMG8GYpqTuFjBgeEZYyMxHrrWkXXrTmmnyTWbSkMp9Ex5RTW9wgrcfu6Ts5g7B52h35rLv996HpneHwr2NkwQTGapdGJ2zHHKbm4VSy5AwC5GJqdB7LyBQjmBnUVsKGwX3aQfQbaVCFJhEEevswtcfmPjPWFtKr2dsJ3xHJTsEffNadeE2VUsZhvrp9jtSwAHLEVBu2RE6MNb6m3fEAB7ybzKYubNFWT6WftJ4DjZaQkTF8g7cfPHJeLb8JZbmgVkkg8Um3M3cgBSJmrXYhx9zD7sDEwrvJDq24hBw6DQ4zpdfMkAccQUFhGtWxtysKFkcBZJ76hxZFrSfUdubQXvRbnKxt8jgSfmGcSdk6xcP5mq5NAXBGNSAx3BZ4spPGgsSddB6tcq974ZrqGJCkPKMTgNJsnjM7ZsDewPJzrVE3xzLHJwbug7YU4cAdRLzxMUtE5ZXeddJmmQVp5te8eMwX93tVFsU4FnhATXdk4TFgscyE4wKhzpAM9bTYDLUpnvWwD3kJG9mRuTNPuN3xNvyPb4XQqqXcteNWSxghvfrLaUyJuuds9VPPC9TrMNmUBhP89UyF5Y35mG6vWbF98QKMa8FVXBapTfdGukHHjbyBGXUZhEA4bBB4Ygeqc22G69eSH5BqLdf6j7XCbq5VVSkwjKdfj8gXHhFzWEGRNeHPLwaGxFDedkznRUnYbztbH2HxJHugn8cXCvsJ9H9AaAGz4Q5seQBQquBJFgVUBWQz2NWxfQedMaaCp4ud4QePyyFe....Step 4, Count the passwords
As expected, the passwords file contains the same number of entries; I was right xD.
$ wc -l passwords.txt505 passwords.txtSolution
Now let’s see if the username cultiris exist on usernames.txt using grep :
$ cat usernames.txt | grep "cultiris"cultirisNice we have it here!
Now let’s locate the target username cultiris:
$ grep -n "cultiris" usernames.txt378:cultirisPerfect, cultiris is on line 378.
I can search manually or by using this:
$ sed -n '378p' passwords.txtcvpbPGS{P7e1S_54I35_71Z3}This looks like a flag, but it’s clearly not decrypted yet. The structure strongly resembles ROT13.
To confirm, we check DCODE’s Cipher Identifier:
It detects ROT13, just as suspected.
We can use this ROT13 Decoder and this gives us the flag :
⚡ Raikiri🎉 Flag pwned!
Flag : picoCTF{C7r1F_54V35_71M3}
💡 TL;DR / Lesson LearnedExtract the tar archive → two files: usernames & passwords.
Line numbers correspond exactly between both files.
Locatecultiris→ line 378.
Retrieve password frompasswords.txtline 378.
Decrypt the ROT13-encoded string → flag appears