silent-oracle

Updated 20 Sep 2026

•
Attribution
- •
  Solved by Fauzi Ismail during the competition. These are rn’s study notes based on the teammate’s documented solve, not an independent rn solve.
•
What it asked
- •
  Correlate SSH configuration and logs to construct the exact token accepted by an offline vault tool.
•
Approach
- •
  The policy required five fields in order: login user, host label, port, key fingerprint, and session marker.
- •
  ssh_config supplied label journal-archive and port 2222; auth.log supplied user analyst, the full SHA256: fingerprint, and session marker.
- •
  The label is the Host alias, not the HostName IP, and the fingerprint prefix is part of the token.

Solution

token='analyst|journal-archive|2222|SHA256:nBd5IzwQuIKUjmNd6swse3c4j9fmZfUeCMeDAtM8cUs|7e3a-91c4-b0f2'
python3 open_vault.py --token "$token"

•
Verification
- •
  The document records that this exact token opened the supplied vault. The ZIP itself was not attached here for a new replay.
•
Concepts
- •
  SSH artifact correlation; exact token serialization; counter-mode SHA-256 keystreams; silent verification oracles.
•
Source
- •
  Source: team document KMIPNVIII-unintended.docx, titled “Writeup unintended KMIPN 8 Final”. Page numbers refer to the rendered document. Rendered pp. 28–32.
- •
  Flag: KMIPN8{ssh_artifacts_unlock_silent_oracle}.