signed-session-vault

Updated 20 Sep 2026

• •

  Attribution

  • •

    Solved by rn during the competition.

• •

  What it asked

  • •

    Recover the signed-session secret from debug artifacts, forge the exact authorized payload, derive the vault key from its signature, and decrypt vault.enc.

• •

  Approach

  • •

    The token format is body.signature. body is compact, sorted JSON encoded with unpadded Base64url.

  • •

    Signing computes $s=\operatorname{HMAC-SHA256}(K,b)$. Verification uses compare_digest, so the route is to recover $K$, not bypass the comparison.

  • •

    The debug log leaked two Base64 pieces. Decoding and concatenating them gives PNUP-SESSION-KEY-PROD-2026; the guest token provides a known-valid check.

  • •

    The authorized payload is user=auditor, role=admin, scope=flag:read. Sorted canonicalization is required because any byte change produces a different signature.

  • •

    The vault key is $K_v=\operatorname{SHA256}(s\parallel\texttt{:kamsiber-vault})$. The 41-byte ciphertext is decrypted with $p_i=c_i\oplus (K_v)_{i\bmod32}$.

• •

  Solution

  • •

    import base64, hashlib, hmac, json
    
    def b64u(raw):
        return base64.urlsafe_b64encode(raw).decode().rstrip("=")
    
    def unb64u(text):
        return base64.urlsafe_b64decode(text + "=" * (-len(text) % 4))
    
    secret = (
        base64.b64decode("UE5VUC1TRVNT")
        + base64.b64decode("SU9OLUtFWS1QUk9ELTIwMjY=")
    )
    
    # Optional: verify the recovered secret against the supplied guest cookie.
    guest = open("guest_cookie.txt").read().split("session=", 1)[1].strip()
    guest_body, guest_sig = guest.split(".", 1)
    assert hmac.compare_digest(
        hmac.new(secret, guest_body.encode(), hashlib.sha256).digest(),
        unb64u(guest_sig),
    )
    
    payload = {"user":"auditor", "role":"admin", "scope":"flag:read"}
    body = b64u(json.dumps(payload, separators=(",", ":"), sort_keys=True).encode())
    sig = hmac.new(secret, body.encode(), hashlib.sha256).digest()
    admin_token = body + "." + b64u(sig)
    
    key = hashlib.sha256(sig + b":kamsiber-vault").digest()
    ct = open("vault.enc", "rb").read()
    pt = bytes(c ^ key[i % len(key)] for i, c in enumerate(ct))
    print(admin_token)
    print(pt.decode())
    

• •

  Verification

  • •

    The secret reconstruction and guest-cookie check make the derivation traceable. The original vault.enc was not separately attached, so final decryption remains sourced from the team document.

• •

  Concepts

  • •

    HMAC; canonical JSON; Base64url; signed-session forgery after key disclosure; derived-key XOR encryption.

• •

  Source

  • •

    Source: team document KMIPNVIII-unintended.docx, titled “Writeup unintended KMIPN 8 Final”. Page numbers refer to the rendered document. Rendered pp. 51–59.

  • •

    Flag: KMIPN8{forged_signed_session_opens_vault}.

◌ Explore connections in Graph view