Quantgnome Leap

Difficulty:
Direct link: Quantgnome Leap

Objective

Request

Charlie in the hotel has quantum gnome mysteries waiting to be solved. What is the flag that you find?

Charlie Goldner

Hints

Quantgnome Leap

When you give a present, you often put a label on it to let someone know that the present is for them. Sometimes you even say who the present is from. The label is always put on the outside of the present so the public knows the present is for a specific person. SSH keys have something similar called a comment. SSH keys sometimes have a comment that can help determine who and where the key can be used.

Solution

Charlie asked me to explore the quantgnome server, follow the key trail, and recover the final flag.

The intro message explained the PQC theme and asked me to find and execute the key generation program.

I started by listing files and checking the SSH directory:

ls -a
ls -a .ssh

The SSH directory shows that there is a public key file. Based on the hint I got, there could be useful information as a comment in this file.

Next, I viewed the RSA public key to see the key comment:

cat .ssh/id_rsa.pub

The comment revealed that the public key is associated to the gnome1 account.

I checked the hosts file to find the PQC server IP, and I connected as gnome1:

cat /etc/hosts
ssh gnome1@127.10.10.1

The login succeeded and instructed me to find access for gnome2.

I enumerated the SSH keys and found the ED25519 key for gnome2 same way as for gnome1:

ls
ls -a
ls -a .ssh
cat .ssh/id_ed25519.pub

Using that key, I connected as gnome2:

ssh gnome2@127.10.10.1

After successful connection to gnome2, I was asked to find the information for gnome3.

This time I found a MAYO key, so I pulled the next public key and the gnome4 account name:

ls -a
ls -a .ssh
cat .ssh/id_mayo2.pub

I connected as gnome3, then listed keys and used the hybrid key to connect to gnome4:

ssh gnome3@127.10.10.1
ls -a .ssh
cat .ssh/id_ecdsa_nistp256_sphincssha2128fsimple.pub
ssh gnome4@127.10.10.1

The login to gnome4 succeeded and explained the hybrid key details.

I inspected the next key as requested, and it pointed to the admin account:

ls -a .ssh
cat .ssh/id_ecdsa_nistp521_mldsa87.pub

I connected as admin to reach the final stage:

ssh admin@127.10.10.1

From the admin shell, I searched for the flag using the find command:

find / -name flag

The output revealed the flag path under /opt/oqs-ssh/flag.

I opened the flag file to capture the final value.

After submitting the flag, the objective was added to the achievements list.

Answer

HHC{L3aping_0v3r_Quantum_Crypt0}

Response

Charlie Goldner

That was wild-who knew quantum gnomes could hide so many secrets?