It is my Birthday 2 Write Up (SHA-1) | Pico CTF

Challenge Overview

In this picoCTF web exploitation challenge titled “bday2,” we’re tasked with creating two different PDF files that share the same SHA1 hash while maintaining the same last 1000 bytes as a provided invitation PDF. This challenge tests our understanding of cryptographic hash functions and their vulnerabilities, specifically focusing on SHA1 collision attacks.

Initial Analysis

The challenge provides us with an invite.pdf file and a web interface where we can upload two PDF files. The requirements are clear:

1. Both PDFs must be different
2. Both must have identical SHA1 hashes
3. Both must share the last 1000 bytes with the original invite.pdf
4. Both must be valid PDF files

The hint directs us to shattered.io, a website that demonstrated the first practical SHA1 collision in 2017. This immediately suggests we're dealing with a known SHA1 collision rather than needing to perform a complex birthday attack.

Understanding SHA1 Collision Vulnerability

SHA1 (Secure Hash Algorithm 1) was designed to produce a unique 160-bit hash for any given input. However, researchers have demonstrated that SHA1 is vulnerable to collision attacks, where two different inputs produce the same hash output.

The fundamental property we exploit here is: If SHA1(A) = SHA1(B), then SHA1(A + C) = SHA1(B + C) for any suffix C.

This property holds because hash functions process data sequentially. Once two different messages produce the same hash, appending identical data to both maintains the collision.

The Shattered.io Breakthrough

In 2017, Google and CWI Amsterdam successfully created two different PDF files with identical SHA1 hashes. These files, known as shattered-1.pdf and shattered-2.pdf, were made publicly available. The researchers exploited mathematical weaknesses in SHA1's compression function to create what's called a "chosen-prefix collision."

The key insight for our challenge is that we can use these pre-computed collision PDFs as our base documents, then append the required 1000-byte suffix from the invitation PDF.

Crafting the Solution

Here’s the step-by-step approach to solving this challenge:

Step 1: Download Required Files

We first obtain the original invite PDF and the shattered collision PDFs:

wget https://challenge-files.picoctf.net/c_wily_courier/.../invite.pdf
wget https://shattered.io/static/shattered-1.pdf
wget https://shattered.io/static/shattered-2.pdf

Step 2: Extract the Required Suffix

We need to extract the last 1000 bytes from the invitation PDF:

tail -c 1000 invite.pdf > suffix.bin

Step 3: Create Collision PDFs

By appending the suffix to both shattered PDFs, we maintain the SHA1 collision:

cat shattered-1.pdf suffix.bin > collision1.pdf
cat shattered-2.pdf suffix.bin > collision2.pdf

Step 4: Verify the Solution

We confirm that:

• Both files have identical SHA1 hashes
• Both end with the same 1000 bytes as the original invite
• Both are valid PDF files

The verification commands:

sha1sum collision1.pdf collision2.pdf
tail -c 1000 collision1.pdf | cmp - suffix.bin
file collision1.pdf collision2.pdf

Why This Works: Technical Explanation

PDF readers typically stop processing when they encounter the %%EOF marker. By appending data after this marker, we don't disrupt the PDF structure while ensuring the files remain different in content.

The shattered PDFs were carefully crafted to:

1. Contain different visual content (different colored backgrounds)
2. Have the exact same SHA1 hash
3. Be valid PDF files that PDF readers can display

When we append the 1000-byte suffix, we’re essentially creating:

• File 1: [Collision Block A] + [1000-byte suffix]
• File 2: [Collision Block B] + [1000-byte suffix]

Since the hash computation of A + suffix and B + suffix will be identical (the internal state after processing A and B is the same, and then we process identical suffix data), the final hash values match.

Uploading and Getting the Flag

Once we have our two collision PDFs, we upload them to the challenge server. The server verifies:

1. The SHA1 hashes match
2. The last 1000 bytes match the original invite.pdf
3. The files are different
4. Both are valid PDFs

Upon successful verification, the server provides the flag.

Security Lessons Learned

1. SHA1 is Broken: This challenge demonstrates why SHA1 should no longer be used for security-critical applications. Major browsers and organizations have deprecated SHA1 since these collision attacks became practical.
2. Cryptographic Agility: Systems should be designed to easily migrate to stronger hash functions as vulnerabilities are discovered.
3. Defense in Depth: Relying solely on hash functions for file integrity or authentication is insufficient. Implement additional security measures like digital signatures with robust algorithms.
4. Real-World Impact: SHA1 collisions have serious implications for digital certificates, document integrity, version control systems (like Git), and any system relying on unique hash values.
5. The Importance of Migration: The security community has moved to SHA-256 and SHA-3 for critical applications. This challenge underscores why such migrations are necessary.

Final Flag

Upon successful upload of the two crafted PDFs, the server returns the flag: picoCTF{h4ppy_b1rthd4y_2_m3_axxxxxxxx}

This flag reinforces the lesson that SHA1 collisions are a serious security concern, not just a theoretical exercise.

Conclusion

This picoCTF challenge provides hands-on experience with real cryptographic vulnerabilities. By leveraging known SHA1 collisions from shattered.io, we learn how theoretical attacks become practical threats. The challenge emphasizes the importance of keeping cryptographic systems up-to-date and understanding the limitations of older algorithms like SHA1.

The techniques demonstrated here have real-world parallels in attacking digital certificates, forged documents, and compromised version control systems — making this not just a CTF challenge, but a lesson in practical cybersecurity.