Tijori: Unpacking a Five-Stage Vault

Overview

tijori (Hindi for "vault") arrived as a text file. The challenge was to peel back several layers of packaging and then reverse a vault program that assembled the flag across five stages.

Challenge brief

Open the vault.

Analysis

tijori.txt was a hex dump, not text. Its first bytes, 1f 8b 08, are the GZIP magic number — so the dump was converted back to binary and decompressed, then the nested archive unpacked until the tijori executable and its vault files appeared.

1xxd -r -p tijori.txt tijori.gz2gunzip tijori.gz3# keep unpacking until the executable and vault-meta.tij appear

Solution

Reversing the executable revealed a five-stage recovery routine, each stage yielding one fragment of the flag:

Stage 1 exposes the opening fragment directly. Stage 2 XORs encoded bytes from vault-meta.tij with 0xAB. Stage 3 extracts a fragment from an embedded byte table. Stage 4 decrypts a ciphertext with AES-256-CBC, using a key derived from the SHA-256 of the first three fragments.

Because the key is derived from values the program itself reveals, the final stage can be decrypted offline. Concatenating the four fragments gives the flag — and its text points at the bug: a static key.

1from hashlib import sha2562from Crypto.Cipher import AES3 4key = sha256((frag1 + frag2 + frag3).encode()).digest()   # 32 bytes → AES-2565plain = AES.new(key, AES.MODE_CBC, iv).decrypt(ciphertext)

Flag

Redacted. Format: Bsides_Mumbai{…}.

Lessons learned

Encryption only protects data when the key is actually secret. Deriving a key from information the attacker can recover reduces AES-256 to a formality — a pattern worth checking for in real code reviews.