Skip to main content

#IceCTF - Substituted

It's one of very easy cryptographic tasks. We have to decrypt message:

Lw!

Gyzvecy ke WvyVKT!

W'zz by reso dsbdkwksky tzjq teo kly ujr. Teo keujr, gy joy dksurwmq bjdwv vorakeqojalr jmu wkd jaazwvjkwemd. Vorakeqojalr ljd j zemq lwdkeor, jzklesql gwkl kly juxymk et vecaskyod wk ljd qekkym oyjzzr vecazwvjkyu. Decy dwcazy ezu vwalyod joy kly Vjydjo vwalyo, kly Xwqymyoy vwalyo, kly dsbdkwkskwem vwalyo, glwvl wd klwd emy, jmu de em. Jzcedk jzz et klydy vwalyod joy yjdwzr boeiym keujr gwkl kly lyza et vecaskyod. Decy myg ymvorakwem cykleud joy JYD, kly vsooymk dkjmujou teo ymvorakwem, jzemq gwkl ODJ. Vorakeqojalr wd j xjdk twyzu jmu wd xyor wmkyoydkwmq klesql. De iwvi bjvi, oyju sa em decy veez vwalyod jmu ljxy tsm!

El jmu teo reso oyveoud cr mjcy wd WvyVKT{jzgjrd_zwdkym_ke_reso_dsbdkwksky_tzjqd}.

We already know that every flag in this CTF, starts witch "IceCTF{" phrase, so there's no problem with first six substitutions. Then it's even easier. Here's the code to decode the message anyway:



#include 
#include 
#include 

using namespace std;

char sub(char input)
{
 if (input == 'C') return 'M';   if (input == 'c') return 'm';
 if (input == 'E') return 'O'; if (input == 'e') return 'o';
 if (input == 'G') return 'W'; if (input == 'g') return 'w';
 if (input == 'L') return 'H'; if (input == 'l') return 'h';
 if (input == 'T') return 'F'; if (input == 't') return 'f';
 if (input == 'V') return 'C'; if (input == 'v') return 'c';
 if (input == 'W') return 'I'; if (input == 'w') return 'i';
 if (input == 'Y') return 'E'; if (input == 'y') return 'e';
 if (input == 'Z') return 'L'; if (input == 'z') return 'l';
 if (input == 'K') return 'T'; if (input == 'k') return 't';
 if (input == 'J') return 'A'; if (input == 'j') return 'a';
 if (input == 'D') return 'S'; if (input == 'd') return 's';
 if (input == 'Q') return 'G'; if (input == 'q') return 'g';
 if (input == 'R') return 'Y'; if (input == 'r') return 'y';
 if (input == 'S') return 'U'; if (input == 's') return 'u';
 if (input == 'X') return 'V'; if (input == 'x') return 'v';
 if (input == 'O') return 'R'; if (input == 'o') return 'r';
 if (input == 'M') return 'N'; if (input == 'm') return 'n';
 if (input == 'U') return 'D'; if (input == 'u') return 'd';
 if (input == 'A') return 'P'; if (input == 'a') return 'p';
 if (input == 'I') return 'K'; if (input == 'i') return 'k';
}

char x = 0;

int main(void)
{
 ifstream plik;
 plik.open("message.txt");

 while ( (x = plik.get()) != EOF)
 {
  x = sub(x);
  printf("%c", x);
 }

 plik.close();
 cout << endl;
 return 0;
}

Comments

Popular posts from this blog

#LabyREnth CTF - Windows track no. 1 - AntiD.exe

In this task we have to reverse file called 'AntiD.exe'. After first examination of this, it looks to be simple PE32 executable, packed with UPX. Unfortunately we can't decompress it using UPX tool, so I started to unpack it manually. First thing to notice is that in PE Optional Header - DllCharasteristics is set to 8140, which means that DLLs in this executable can move around a bit (I'm usually using programs like 'CFF Explorer' or something similar to check this things out). I've changed this header to 8100, what actually terminated this behaviour ;) To decompress this .exe I personally used x64dbg and Scylla, but the tool doesn't matter at all - it could be any runtime debugger and I mp Rec I suppose. What we need to do is stop program execution at Entry Point of AntiD.exe, and run exactly one instruction : pushal - in my case, as you can see on image below (but You can also see this as PUSHAD in OllyDbg, or any other debugger). Aft...

#IceCTF - Strong Feeling

You can download ELF here: ------------------------> link To get a flag in this one, easiest way I think is to bruteforce it! After quick look of executable in decompiler we can see that program outputs different strings every time we input a proper flag character to it. The best way to check that (knowing that flags in that CTF looks like "IceCTF{xxx}") is to  input 'I' first, then "Ic", then "Ice", etc. The strings in ELF aren't obfuscated, so we can just count it to figure out number of characters in the flag. The only thing that has to be done now is bruteforcer itself. I wrote something like that: #include &ltstdio.h&gt #include &ltstdlib.h&gt #include &ltcstring&gt using namespace std; int main(void) { char *flag = new char[32]; char *path = new char[128]; char *buffer = new char[128]; char *buf2 = new char[128]; FILE *plik; for (int i = 0; i < 32; i++) for (char j = 0x21; j < 0x7f; j++) ...

#LabyREnth CTF - Windows track no. 2 - BabbySay.exe

This task is really very simple one. We are provided with .NET application named: "BabbySay.exe", wchich is a simple app that spawns a piano window for us. We can play some tunes by clicking black and white keys. I've started by its decompilation with "ILSpy", which is nice tool to do that . After quick examination in ILSpy we can clearly see the function responsible for printing the flag for us, w i thout any doubt h as to be:  key_click(object, EventArgs): // BabbySay.Form1 public void key_click(object sender, EventArgs args) { KeyButton keyButton = sender as KeyButton; keyButton.player.Play(); if (keyButton.number == 16 && keyButton.is_black && this.dat_state == 0) { this.dat_state = 1; this.thangs[3] = " _|| || | |_ ___ `. | || | _ | || | \\_ `. " + this.thangs[3]; this.thangs[10] = this.thangs[10] + " '----------------' '----------------' '----------------' '...