You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+56Lines changed: 56 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,6 +20,34 @@ Flags, in contrast, are random character strings with no inherent semantics. To
20
20
21
21
Because a leaky endpoint exposes these embeddings, an attacker can download the embedding of any document (potentially one containing a flag), replicate the same encoding process locally, and use the resulting lookup table to recover every character of the flag.
22
22
23
+
### Attack Flow Chart
24
+
25
+
```mermaid
26
+
flowchart TD
27
+
A["🎯 Start: Get flag hint session ID"] --> B["👤 Register new attacker user"]
28
+
B --> C["🔐 Login as attacker"]
29
+
C --> D["📥 Import shared session containing flag"]
30
+
D --> E["🔍 Create search query with random characters"]
31
+
E --> F["📊 Search collection for documents"]
32
+
F --> G["🔤 Build character embedding lookup table<br/>by embedding all ASCII characters"]
33
+
G --> H["📄 For each found document:"]
34
+
H --> I["📊 Extract embedding vector and norm"]
35
+
I --> J["🧩 Reconstruct flag character by character<br/>using nearest neighbor matching"]
36
+
J --> K{"🚫 Does flag end with 'FAKE'?"}
37
+
K -->|Yes| L["⏭️ Skip this document"]
38
+
K -->|No| M["✅ Unformat and return flag"]
39
+
L --> N{"📝 More documents?"}
40
+
N -->|Yes| H
41
+
N -->|No| O["❌ No flag found"]
42
+
M --> P["🏁 Success: Flag recovered"]
43
+
44
+
style A fill:#ffcccb
45
+
style P fill:#90EE90
46
+
style O fill:#ffcccb
47
+
style K fill:#FFE4B5
48
+
style G fill:#E6E6FA
49
+
```
50
+
23
51
## Cryptographic Handshake Bypass (All-Zero IV Vulnerability)
24
52
This vulnerability exists in the custom MCP (Model Context Protocol) authentication handshake mechanism for personal AI-agents. The service implements a challenge-response authentication system using AES CFB8 encryption, but contains a critical flaw in its cryptographic implementation.
25
53
@@ -41,6 +69,34 @@ The attacker can repeatedly attempt the handshake by:
41
69
3. Eventually succeeding in authentication due to the deterministic nature of the encryption with known inputs
42
70
4. Once authenticated, gaining access to the MCP interface to read chat sessions and retrieve flags
43
71
72
+
### Attack Flow Chart
73
+
74
+
```mermaid
75
+
flowchart TD
76
+
A["🎯 Start: Get user ID and session ID<br/>from attack info"] --> B["🔢 Create all-zero client challenge<br/>(8 bytes of 0x00)"]
77
+
B --> C["🔄 Start handshake attempts<br/>(up to 5000 tries)"]
78
+
C --> D["📤 Send zero-byte client challenge<br/>to server"]
79
+
D --> E["📥 Receive server challenge,<br/>memory key, and IV"]
80
+
E --> F["⚠️ IV is all-zero due to vulnerability:<br/>var iv = new byte[16]"]
81
+
F --> G["🔐 Attempt authentication with<br/>zero-byte client credentials"]
82
+
G --> H{"✅ Authentication successful?"}
83
+
H -->|No| I{"🔄 More attempts left?"}
84
+
H -->|Yes| J["🎟️ Receive JWT token"]
85
+
I -->|Yes| D
86
+
I -->|No| K["❌ Attack failed after 5000 attempts"]
87
+
J --> L["🤖 Connect to MCP interface<br/>using JWT token"]
88
+
L --> M["📖 Read messages from<br/>target chat session"]
89
+
M --> N["🏴 Extract flag from messages<br/>(message[1]['content'])"]
0 commit comments