Skip to content

Commit b44dc2e

Browse files
awengarawengar
committed
Added rev100 task UglyBinary
1 parent 71453f5 commit b44dc2e

File tree

11 files changed

+368
-0
lines changed

11 files changed

+368
-0
lines changed

‎UglyBinary/a.i64

208 KB
Binary file not shown.

‎UglyBinary/a.out

13.6 KB
Binary file not shown.

‎UglyBinary/create/make.sh

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
#!/bin/bash
2+
g++ -o rev100 rev100.cpp

‎UglyBinary/create/rev100

13.6 KB
Binary file not shown.

‎UglyBinary/create/rev100.cpp

+143
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
#include <stdio.h>
2+
#include <string.h>
3+
#include <sys/socket.h>
4+
#include <resolv.h>
5+
#include <arpa/inet.h>
6+
#include <unistd.h>
7+
#include <stdlib.h>
8+
#include <math.h>
9+
#include <sys/time.h>
10+
char flagg [] ={92,119,33,133,29,67,61,152,200,235,211,84,239,183,203,170,0};
11+
double getTemp (){
12+
int s, error;
13+
struct sockaddr_in addr;
14+
if((s = socket(AF_INET,SOCK_STREAM,0))<0){
15+
//cout<<"Error 01: creating socket failed!\n";
16+
close(s);
17+
return 0;
18+
}
19+
20+
addr.sin_family = AF_INET;
21+
addr.sin_port = htons(80);
22+
inet_aton("146.185.151.176",&addr.sin_addr);
23+
24+
error = connect(s,(sockaddr*)&addr,sizeof(addr));
25+
if(error!=0) {
26+
//cout<<"Error 02: conecting to server failed!\n";
27+
close(s);
28+
return 0;
29+
}
30+
31+
char msg[] = "GET /data/2.5/weather?q=Saint-Petersburg&units=metric http/1.1\nHOST: api.openweathermap.org\n\n";
32+
char answ[1024];
33+
//cin.getline(&msg[0],256);
34+
35+
send(s,msg,sizeof(msg),0);
36+
37+
if (recv(s,answ,1024,0)!=0){
38+
close(s);
39+
char * pos1 = strstr(answ,"temp");
40+
if (pos1 !=0){
41+
char * pos2 = strstr(pos1,",");
42+
if (pos2 !=0){
43+
char * res = new char [10];
44+
memcpy(res,pos1+6,pos2-pos1-6);
45+
float resd;
46+
sscanf(res,"%f",&resd);
47+
return resd-273.15;
48+
}
49+
else
50+
return 0;
51+
}
52+
else
53+
return 0;
54+
}
55+
else{
56+
close(s);
57+
return 0;
58+
}
59+
}
60+
long long int GetTime(){
61+
struct timeval tv;
62+
gettimeofday(&tv, NULL);
63+
double time_in_mill = (tv.tv_sec) * 1000 + (tv.tv_usec) / 1000 ;
64+
long long int rrr = time_in_mill;
65+
return time_in_mill;
66+
}
67+
unsigned char S[ 256 ];
68+
unsigned int i, j;
69+
/* ключевое расписание */
70+
void rc4_init( char* key, int key_length ){
71+
unsigned char temp;
72+
73+
for( i = 0; i != 256; ++i )
74+
S[ i ] = i;
75+
76+
for( i = j = 0; i != 256; ++i )
77+
{
78+
j = ( j + key[ i % key_length ] + S[ i ] ) % 256;
79+
temp = S[ i ];
80+
S[ i ] = S[ j ];
81+
S[ j ] = temp;
82+
}
83+
i = j = 0;
84+
}
85+
unsigned char rc4_output(){
86+
unsigned char temp;
87+
i = ( i + 1 ) % 256;
88+
j = ( j + S[ i ] ) % 256;
89+
temp = S[ j ];
90+
S[ j ] = S[ i ];
91+
S[ i ] = temp;
92+
return S[ ( temp + S[ j ] ) % 256 ];
93+
}
94+
95+
int main (){
96+
double temp = round(getTemp());
97+
if (temp < 40){
98+
printf("It's too cold for me :(\n");
99+
return 0;
100+
}
101+
int proc_count = sysconf(_SC_NPROCESSORS_ONLN);
102+
if (proc_count < 32){
103+
printf("Too slow machine :(\n");
104+
return 0;
105+
}
106+
char buf[17];
107+
buf[16]=0;
108+
109+
printf("Okay, enter you name:");
110+
system("/bin/stty raw");
111+
unsigned int ttt=0;
112+
for(int i=0; i<16; i++){
113+
long long int start = GetTime();
114+
buf[i] = getchar();
115+
long long int elaps = GetTime()-start;
116+
if (elaps < 10)
117+
ttt = ttt | 1;
118+
ttt << 1;
119+
}
120+
system("/bin/stty cooked");
121+
if (ttt ==0){
122+
printf("%s is invalid name\n Oh ... you are too slow :(\n",buf);
123+
return 0;
124+
}
125+
puts("");
126+
char key [32];
127+
//unsigned char flag[]={"AUDACTY7H32DHAPY"};// 42 911
128+
// STCTF#AUDACTY7H32DHAPY#
129+
sprintf(&(key[0]),"%d",42+911);//temp+proc_count
130+
rc4_init((char *)&(key[0]),strlen((char *)&(key[0])));
131+
for (int i=0; i<strlen((char*)buf); i++){
132+
char a = flagg[i];
133+
char b = buf[i] ^ rc4_output();
134+
if (a != b){
135+
printf("Invalid key :(\n");
136+
return 0;
137+
}
138+
}
139+
printf("Okay your flag is STCTF#%s#\n",buf);
140+
141+
142+
return 0;
143+
}

‎UglyBinary/rev100.cpp

+143
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
#include <stdio.h>
2+
#include <string.h>
3+
#include <sys/socket.h>
4+
#include <resolv.h>
5+
#include <arpa/inet.h>
6+
#include <unistd.h>
7+
#include <stdlib.h>
8+
#include <math.h>
9+
#include <sys/time.h>
10+
char flagg [] ={92,119,33,133,29,67,61,152,200,235,211,84,239,183,203,170,0};
11+
double getTemp (){
12+
int s, error;
13+
struct sockaddr_in addr;
14+
if((s = socket(AF_INET,SOCK_STREAM,0))<0){
15+
//cout<<"Error 01: creating socket failed!\n";
16+
close(s);
17+
return 0;
18+
}
19+
20+
addr.sin_family = AF_INET;
21+
addr.sin_port = htons(80);
22+
inet_aton("146.185.151.176",&addr.sin_addr);
23+
24+
error = connect(s,(sockaddr*)&addr,sizeof(addr));
25+
if(error!=0) {
26+
//cout<<"Error 02: conecting to server failed!\n";
27+
close(s);
28+
return 0;
29+
}
30+
31+
char msg[] = "GET /data/2.5/weather?q=Saint-Petersburg&units=metric http/1.1\nHOST: api.openweathermap.org\n\n";
32+
char answ[1024];
33+
//cin.getline(&msg[0],256);
34+
35+
send(s,msg,sizeof(msg),0);
36+
37+
if (recv(s,answ,1024,0)!=0){
38+
close(s);
39+
char * pos1 = strstr(answ,"temp");
40+
if (pos1 !=0){
41+
char * pos2 = strstr(pos1,",");
42+
if (pos2 !=0){
43+
char * res = new char [10];
44+
memcpy(res,pos1+6,pos2-pos1-6);
45+
float resd;
46+
sscanf(res,"%f",&resd);
47+
return resd-273.15;
48+
}
49+
else
50+
return 0;
51+
}
52+
else
53+
return 0;
54+
}
55+
else{
56+
close(s);
57+
return 0;
58+
}
59+
}
60+
long long int GetTime(){
61+
struct timeval tv;
62+
gettimeofday(&tv, NULL);
63+
double time_in_mill = (tv.tv_sec) * 1000 + (tv.tv_usec) / 1000 ;
64+
long long int rrr = time_in_mill;
65+
return time_in_mill;
66+
}
67+
unsigned char S[ 256 ];
68+
unsigned int i, j;
69+
/* ключевое расписание */
70+
void rc4_init( char* key, int key_length ){
71+
unsigned char temp;
72+
73+
for( i = 0; i != 256; ++i )
74+
S[ i ] = i;
75+
76+
for( i = j = 0; i != 256; ++i )
77+
{
78+
j = ( j + key[ i % key_length ] + S[ i ] ) % 256;
79+
temp = S[ i ];
80+
S[ i ] = S[ j ];
81+
S[ j ] = temp;
82+
}
83+
i = j = 0;
84+
}
85+
unsigned char rc4_output(){
86+
unsigned char temp;
87+
i = ( i + 1 ) % 256;
88+
j = ( j + S[ i ] ) % 256;
89+
temp = S[ j ];
90+
S[ j ] = S[ i ];
91+
S[ i ] = temp;
92+
return S[ ( temp + S[ j ] ) % 256 ];
93+
}
94+
95+
int main (){
96+
double temp = round(getTemp());
97+
if (temp < 40){
98+
printf("It's too cold for me :(\n");
99+
return 0;
100+
}
101+
int proc_count = sysconf(_SC_NPROCESSORS_ONLN);
102+
if (proc_count < 32){
103+
printf("Too slow machine :(\n");
104+
return 0;
105+
}
106+
char buf[17];
107+
buf[16]=0;
108+
109+
printf("Okay, enter you name:");
110+
system("/bin/stty raw");
111+
unsigned int ttt=0;
112+
for(int i=0; i<16; i++){
113+
long long int start = GetTime();
114+
buf[i] = getchar();
115+
long long int elaps = GetTime()-start;
116+
if (elaps < 10)
117+
ttt = ttt | 1;
118+
ttt << 1;
119+
}
120+
system("/bin/stty cooked");
121+
if (ttt ==0){
122+
printf("%s is invalid name\n Oh ... you are too slow :(\n",buf);
123+
return 0;
124+
}
125+
puts("");
126+
char key [32];
127+
//unsigned char flag[]={"AUDACTY7H32DHAPY"};// 42 911
128+
// STCTF#AUDACTY7H32DHAPY#
129+
sprintf(&(key[0]),"%d",42+911);//temp+proc_count
130+
rc4_init((char *)&(key[0]),strlen((char *)&(key[0])));
131+
for (int i=0; i<strlen((char*)buf); i++){
132+
char a = flagg[i];
133+
char b = buf[i] ^ rc4_output();
134+
if (a != b){
135+
printf("Invalid key :(\n");
136+
return 0;
137+
}
138+
}
139+
printf("Okay your flag is STCTF#%s#\n",buf);
140+
141+
142+
return 0;
143+
}

‎UglyBinary/solution/solution.html

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<pre>
2+
Для решения нужно удалить проверки температуры и числа процессоров, а также
3+
скорости ввода символов.
4+
Для получения ключа нужно просто извлечь зашифрованную последовательность
5+
и перебрать ключи-числа в RC4 lj 1000. Корректный ключ - строка "953".
6+
В результате получается ключ AUDACTY7H32DHAPY
7+
STCTF#AUDACTY7H32DHAPY#
8+
</pre>

‎UglyBinary/solution/solution.html~

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<pre>
2+
Для решения нужно удалить проверки температуры и числа процессоров, а также
3+
скорости ввода символов.
4+
Для получения ключа нужно просто извлечь зашифрованную последовательность
5+
и перебрать ключи-числа в RC4 lj 1000. Корректный ключ - строка "953".
6+
В результате получается ключ AUDACTY7H32DHAPY
7+
STCTF#AUDACTY7H32DHAPY#
8+
</pre>

‎UglyBinary/summary.yml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
answer_regex: STCTF#AUDACTY7H32DHAPY#
3+
author: awengar
4+
category: reverse
5+
description: |
6+
К нам пришла очень вредная и капризная программа со скверным характером.
7+
Нужно поскорее вытащить из нее верный ключ.
8+
9+
name: UglyBinary
10+
price: 100

‎UglyBinary/summary.yml~

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
answer_regex: STCTF#AUDACTY7H32DHAPY#
3+
author: awengar
4+
category: reverse
5+
description: |
6+
7+
8+
name: UglyBinary
9+
price: 100

‎UglyBinary/task.asm

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
.686
2+
.model flat,stdcall
3+
option casemap:none
4+
5+
include c:\masm32\include\windows.inc
6+
include c:\masm32\include\kernel32.inc
7+
includelib c:\masm32\lib\kernel32.lib
8+
STD_INPUT_HANDLE equ -10
9+
STD_OUTPUT_HANDLE equ -11
10+
STD_ERROR_HANDLE equ -12
11+
12+
ASSUME FS:NOTHING
13+
CSEG segment READ WRITE EXECUTE
14+
conptr dd 0
15+
inptr dd 0
16+
LENS dd 0
17+
buf db 17 dup(0)
18+
res db 64 dup(0)
19+
errmes db "Oh, no ",10,0
20+
hThread dd 0
21+
start:
22+
invoke GetStdHandle,STD_OUTPUT_HANDLE
23+
mov conptr,EAX
24+
invoke GetStdHandle,STD_INPUT_HANDLE
25+
mov inptr,eax
26+
27+
invoke NtCreateThread, addr hThread,THREAD_ALL_ACCESS_VISTA, 0,
28+
29+
; invoke ReadFile, inptr, addr buf, 17, addr LENS, 0
30+
; lea eax, res
31+
; push eax
32+
; lea eax, buf
33+
; push dword ptr [eax+4]
34+
; push dword ptr [eax]
35+
; call real_testkey
36+
; invoke WriteFile, conptr, addr res, 64, addr LENS, 0
37+
; xor eax,eax
38+
ret
39+
real_testkey proc, key_val_1:DWORD, key_val_2:DWORD, resbuf:DWORD
40+
41+
ret
42+
real_testkey endp
43+
CSEG ends
44+
45+
end start

0 commit comments

Comments
 (0)