RCTF 2017 - Crackme 714 pts Writeup

Crackme 714 pts (9 solves) :

Please submit the flag like RCTF{flag}
Binary download : here

The crackme is an MFC application :

 

We can locate the routine of interest by setting a breakpoint on GetWindowTextW. Keep in mind that the input is in Unicode.

Later on, we find that the program generates two distinct blocks of values. These are generated from hard-coded values independently from the user input, so they're always the same. We call the first one : static_block1 and the second static_block2.

Then, there's the call to the encrypt function which takes static_block1 as an argument.

 

The encrypted block will then be XORed with static_block2.

We also find a reference to the encrypted valid key here, which we can extract easily during runtime :

 

The loop above performs a double-word by double-word comparison of the encrypted user input with the encrypted valid key that already came with the crackme.

In order to solve the challenge we need to reverse engineer the encrypt function and do the exact reverse. We also don't have to forget the XOR that is done with static_block2. For that matter, we supply to the decrypt function (the one we need to write) encrypted_valid_key XOR static_block2.

The script below has my implementation of the decrypt function, it outputs the key to flag.txt :

https://gist.github.com/SouhailHammou/679770ee51a5b79f60dd9a9b5846ba7d

All we need to do now, is provide the decrypted key and the flag will be displayed.

The flag is : RCTF{rtf2017crackmebyw31y1l1n9}

See you again soon

Follow me on Twitter : here