Jump to content
Tuts 4 You

Password Keeper


ShockByte

Recommended Posts

  • 2 weeks later...
ShockByte
On 3/15/2020 at 4:22 PM, KSDR said:

 пароль: F * * king_m0rfing 

2020-03-16_09-59-13.png

Good Job xD

Link to post
  • 3 weeks later...
Washi

Nice challenge :)

Quote

Key: f**ck*ng_m0rfing     (replace the * with the obvious, seems the editor censors it)

Flag: shb{Vir7u41_pr073c7_xD}

Approach:

Spoiler

Tools used: x64dbg, ghidra, cyberchef

Open in ghidra, navigate to user main method (FUN_004020b0)

Notice in this code we are executing a function FUN_00401d90 and if it fails, we output check passwords.db file and skips the main program. This must be reading the passwords db that was provided (renamed to read_passwords_db in picture below):

Screenshot_20200423_153959.png.c8b57950532a12a9fb3e652b24857c03.png

Navigate to read_passwords_db, notice strings are obfuscated, but ends with a call to fopen_s, fread_s and some other function FUN_00401850 (in the picture renamed to process_file_contents) that processes the read file contents. Taking a brief look into this function, it seems this function decrypts the contents in some way or another, then returns a newly allocated buffer containing the decrypted file contents. This result is then stored in some global variable DAT_00407828 (in the picture renamed to DECRYPTED_FILE_BUFFER).

Screenshot_20200423_154453.png.c10f35d883e8add012f5fd533005a00f.png

Let's let the program decrypt it for us. Fire up x64dbg, execute till this point, dump contents, a trained eye will see this is x86 code (it starts with a very recognizable function prologue push ebp; mov esp, ebp etc). Open this new file in ghidra, let it analyse it, and long and behold the actual verification code:

Spoiler

Screenshot_20200423_155020.png.9bf785b3fe8a189c91723e042151a4b9.png

We can see the encrypted password is XOR'ed with a key of 0x13, and then compared to the input key. If it fails, the bad message is shown and the program exits. Using cyberchef to decrypt the password results in the correct password string.

Using this as a string will result in the flag being decrypted and shown.

 

Edited by Washi
add censoring to the end result (see edit history)
  • Like 1
Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...