Skip to main content

inCTF 2021 Reversing

 sundae

use your python skills to finish making the sundae and get the flag
challenge file:

solution:

we are provided with two challenge files one is an ASCII text which has 1's and 0's and other is a .pyc file which is compiles python byte-code.....

when I tries to run the .pyc file I got something like this


So, seeing this first I tried to find strings in the .pyc file and I found a few


I found few interesting like sugar,Chocolate_ice_cream.... but nothing worked.so I stared to find the source code of the .pyc file 

searching around I found this amazing tool online which converts the byte-code to a plain text code....


so using this tool I converted it and volaa!.....

syrup = 4
sauce = [66666, 55555, 44444, 33333]
cream = []
gg = []
mix = []

def cmp(a, b):
    return (a > b) - (a < b)


def Whipped_cream(Butter, key):
    for i in key:
        Butter[3] = (Butter[3] ^ i) - 117

    for i in key:
        Butter[6] = (Butter[6] ^ i) + 43

    for i in key:
        Butter[9] = (Butter[9] ^ i) - 99

    for i in key:
        Butter[12] = (Butter[12] ^ i) - 10

    for i in key:
        Butter[15] = (Butter[15] ^ i) + 115

    for i in key:
        Butter[18] = (Butter[18] ^ i) + 75

    for i in key:
        Butter[21] = (Butter[21] ^ i) - 22

    for i in key:
        Butter[24] = (Butter[24] ^ i) - 118

    for i in key:
        Butter[27] = (Butter[27] ^ i) + 38

    for i in key:
        Butter[30] = (Butter[30] ^ i) + 66

    for i in key:
        Butter[2] = (Butter[2] ^ i) - 117

    for i in key:
        Butter[4] = (Butter[4] ^ i) + 43

    for i in key:
        Butter[8] = (Butter[8] ^ i) - 99

    for i in key:
        Butter[10] = (Butter[10] ^ i) - 10

    for i in key:
        Butter[14] = (Butter[14] ^ i) + 115

    for i in key:
        Butter[16] = (Butter[16] ^ i) + 75

    for i in key:
        Butter[20] = (Butter[20] ^ i) - 22

    for i in key:
        Butter[22] = (Butter[22] ^ i) - 118

    for i in key:
        Butter[26] = (Butter[26] ^ i) + 38

    for i in key:
        Butter[28] = (Butter[28] ^ i) + 66

    return Butter


def Vanilla_Essence():
    for i in range(len(sauce)):
        mix.append(int(bin(sauce[i])[3:], 2) ^ 7)

    return mix


def CoCoAAA(inp):
    for i in range(0, len(inp)):
        cream.append((ord(inp[i]) & 15) >> 4 | ord(inp[i]) << 4)
        gg.append(cream[i] ^ 45)

    return gg


def Chocolate_ice_cream(choco, s):
    result = []
    for i in range(len(choco)):
        char = choco[i]
        if char.isnumeric():
            result.append(chr(ord(char) + 2))
        elif char.isupper():
            result.append(chr((ord(char) + syrup - 65) % 26 + 65))
        elif char.islower():
            result.append(chr((ord(char) + syrup - 97) % 26 + 97))
        else:
            result.append(char)

    return result


def main():
    flag = 0
    sugar = input('Enter ingredient:  ')
    if len(sugar) < 30:
        print 'Did you even check out the code ? lol'
        exit()
    CHOCOLATE_SUNDAE = Whipped_cream(CoCoAAA(Chocolate_ice_cream(sugar, syrup)), Vanilla_Essence())
    bowl = open('book', 'r')
    Chocolate_Wafers = bowl.readlines()
    for i in range(0, len(CHOCOLATE_SUNDAE)):
        if cmp(CHOCOLATE_SUNDAE[i], int(Chocolate_Wafers[i], 2)) == 0:
            flag += 1

    if flag == 31:
        print (
         'Good Work ! \nTake your flag : ', sugar)
    else:
        print 'meh!'


if __name__ == '__main__':
    main()

This code is performing several BITWISE &,| and ^(XOR) and comparing it to the one in the book named file which is the other file I was taking about 

so it can be a little tough to make code to reverse this.so,Lets to brute-forcing of ASCII characters from 1 to }

from this we can say that the length of key is 30 or above:

    if len(sugar) < 30:
        print 'Did you even check out the code ? lol'


and we need to change a little piece of code like:


def main():
    A=[0]*31
    flag = 0
    for j in range(42,127):
       sugar = [chr(j)]*30
       CHOCOLATE_SUNDAE = Whipped_cream(CoCoAAA(Chocolate_ice_cream(sugar, syrup)), Vanilla_Essence())
       bowl = open('book', 'r')
       Chocolate_Wafers = bowl.readlines()
       for i in range(0, len(CHOCOLATE_SUNDAE)):
          if cmp(CHOCOLATE_SUNDAE[i], int(Chocolate_Wafers[i], 2)) == 0:
             A[i]=chr(j)
    print(A)



This change will give you the flag

Comments

Popular posts from this blog

GET STARTED WITH SQLMAP

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. learn more...   So lets know how to use it....... Lets start with installation   FOR WINDOWS:                  In the official website of sqlmap we are provided with a zip file. Download it by clicking on it                 Extract it into a desired directory and you must have gotten a python file named sqlmap.py.                                                              So if you already have python installed in your machine continue and use command line python3  <path_to_sqlmap.py> <required_parameters>                           FOR LINUX:                          Most of the Linux machines already have sqlmap prebuilt                          If not, type in the following command in you terminal                                         $ sudo apt install sqlmap Now we have everything. So lets get into it.....