riceteacatpanda.wtf 1/2019

What's the Password: Revisited

1. Analyze

• As usual, i put that file into IDA and read it.
  

• Like another CTF, the first challenge is easy.

• Line 10: a copy of "off_201670" is "v5", "v5" is "rtcp{".

• Line 13: in address "v5 + 5", 8 character from "src" is added. Now, "v5" is equal to "rtcp{fL492_r_".

• Next, user input is save as "input" (v6). And i saw a loop changing the "input".

• The loop said that if my changed input is equal to byte_201020, it's a right password.

byte_201020

• By selecting and decoding, I found the last part of the flag.

Flag: rtcp{fL492_r_50m371m32_5Pr34D_0U7}

BambooCTF 2019

REV

How2decompyle

• According to the decription, i found out that the file is .pyc

• It's easy to read that script, just use "uncompyle6" to decompile,

• According to the script, i have:
• 'Restrictions' has 26 element.
• Length of flag equal to len of restrictions[0] (equal to 33).
• Character must be lower alphabet and '_'.
• With each 'flag[f]', it not be allowed be in any position 'f' of whole element of  'Restrictions'.
• In some position ('capital'), flag will upper that character.

• Because there are 26 strings in 'Restrictions' and there are 27 characters (lower alphabet and '_'), we sure that 'flag[f]' is the rest of them.

• Solution:

Source

• Flag: BambooFox{You_Know_Decompyle_And_Do_Reverse}

PRO

Don't be an ida dog or ida cat or ida mouse or ......

• After take a look at 'main', i knew that script need 3 argument.
• password, clearly is '98416'
• key
• flag

• It's not hard to understand, key will be involve to 12 bytes of byte_201020; s1 will be changed and compare with flag. So, i had s1 and just read byte_201020 to reverse into flag.

•  But, 

• It's not a function!
• I am confuse in 10 minutes, try and try to download, check out that what mistake i had.
• I realize that assembly is become from hex code.
• After several minutes, i found website allowed me for Disassambler.

• But, it is not enough. Segmentation fault error and illegal instruction error appeared via couple of key, function is wrong. I remember that key is involved to byte_201020. 

• Now, everything is clear. I have to find a key to correct the function, and the key is only a byte from 0x00 to 0xFF.

• After couple minutes try to write a script allowed brute-force the key to avoid 'segmentation fault' and 'illegal instruction'. I give up and write by my hand.

• Luckily, when key equal to 50, I can decode 's1' to 'flag'.

Source

• Flag: BambooFox{dyn4mic_1s_4ls0_gr34t}