Off-Ledger
Author: 0xIDA
Summary
PCAP of a gateway bleeding via Heartbleed against vault-internal.corp.local. Recover the RSA private key from fragmented PEM material in the leak (factor n from recovered d), decrypt the attacker's completed TLS_RSA_WITH_AES_256_CBC_SHA256 session, unwrap the AES-256-GCM checkout envelope with app_secret + HKDF, then pull the flag from a dangling git commit inside the exfiltrated audit archive.
Solution
Heartbleed → RSA key → TLS decrypt
External host 203.0.113.47 heartbleeds 10.18.4.21:443 (SNI vault-internal.corp.local, cipher 0x003d = RSA-AES-256-CBC-SHA256). Memory leaks include app_secret_b64, HKDF notes (vault-checkout-v4|vault-internal.corp.local), and fragmented BEGIN RSA PRIVATE KEY material.
Stitch the PEM until PKCS#1 yields full n/e/d, then factor n from d and rebuild the private key. Decrypt the one completed TLS session (PRF-SHA256, explicit IV CBC).
Envelope + dangling commit
The client POSTs /v3/keystore/checkout with an AES-256-GCM envelope (nonce||ct). Decrypt with HKDF-Expand-SHA256 of app_secret. Payload is vault-audit-archive.tar.gz (a bare .git). History on main is clean, but a dangling commit remains:
audit: attestation marker (DO NOT PUSH)
token = FlagY{d82d0689b92048fa72e9d6e6d672ce51}
python3 solve.py off_ledger.pcap
Flag
FlagY{d82d0689b92048fa72e9d6e6d672ce51}