RSS
 

Hackvent 2019: Day 12

13 Dec 2019
CTF: Hackvent 2019
Link to challenge: https://academy.hacking-lab.com
Date Completed: 12 December 2019

 

Challenge

HV19.12 back to basic

Resources: HV19.12-BackToBasic.zip

Solution

We download the above zip file and find a Windows PE executable called  BackToBasic.exe.
Upon opening the file we are prompted for some input but our input is always wrong.

Initially, we open this file in IDA Pro and inspect it. Its a smallish executable that was originally written in Visual Basic.
We decide to complete this challenge using only static analysis. We use a combination of IDA Pro and another tool called VB Decompiler.
This decompiler was specifically designed to decompile Visual Basic code so its a good bet!

We get the following decompilation result:

We clean this up a little by working through the variables making sense of it all:

After a while we understand what the code is basically doing.
Our input string is first checked to ensure the first 4 characters equal HV19. If this condition is met, we check that our input string has a length of 33 characters. If this condition is met, we perform a loop from 6 to 32 inclusive. These bounds are interesting as Visual Basic starts indexes at 1 and the first 5 characters of our flag are typically HV19{ and the last character is }. Basically we are looping over the indexes belonging to the flag content. Next, we seem to perform some XOR operation on the ordinal of the character (VB Asc command) and some other unknown value. It took a little time to realise this other value was the current string index (which I named char_counter above). Finally, a check is made with the string  6klzic<=bPBtdvff'yFI~on//N. It is important to note that the string is UTF-16 little endian encoded.

Therefore, we simply have to reverse the operation to get our original flag. In other words, take our comparison string  6klzic<=bPBtdvff'yFI~on//N and XOR it with the corresponding index (6,7,etc).

Psuedocode:

We write a little python script to do this for us which provides us with our flag:

Flag:  HV19{0ldsch00l_Revers1ng_Sess10n}

 
No Comments

Posted in Hackvent 2019

 

Leave a Reply