๋ณธ๋ฌธ ๋ฐ”๋กœ๊ฐ€๊ธฐ

๐Ÿด‍โ˜ ๏ธ CTF ๐Ÿด‍โ˜ ๏ธ/๐Ÿงฎ ์•”ํ˜ธํ•™ ๐Ÿงฎ

[Dream Hack - Crypto] darimchal_001

๋ฐ˜์‘ํ˜•

๋ฌธ์ œ ํ•ด์„

  1. pwd ^ KEY = JOKER ๋ฅผ ๋งŒ์กฑํ•˜๋ฉด ๋ณตํ˜ธํ™”๊ฐ€ ๋œ๋‹ค.

 

์ฝ”๋“œ ํ•ด์„

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

// ์ดˆ๊ธฐํ™”๋œ ๊ฐ’์œผ๋กœ ์ •์˜ํ•œ ๋ฌธ์ž์—ด ์ƒ์ˆ˜๋“ค
#define JOKER "\\x40\\x53\\x06\\x03\\x43\\x52\\x54\\x3b"
#define KEY   "023661dd4\\0"
#define TRUE  1
#define FALSE 0
#define OK    0
#define ERRO -1

// ์†Œํ”„ํŠธ์›จ์–ด ์ด๋ฆ„๊ณผ ์‚ฌ์šฉ ๋ฐฉ๋ฒ•์„ ์ถœ๋ ฅํ•˜๋Š” ํ•จ์ˆ˜
void __print_sw_title (char *sw_name);

// ์ฃผ์–ด์ง„ ๋น„๋ฐ€๋ฒˆํ˜ธ๊ฐ€ ์œ ํšจํ•œ์ง€ ํ™•์ธํ•˜๋Š” ํ•จ์ˆ˜
int __is_valid_pwd (char *pwd);

// ์ฃผ์–ด์ง„ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ํ‚ค๋ฅผ ์ด์šฉํ•ด ๋‚œ๋…ํ™”ํ•˜๋Š” ํ•จ์ˆ˜
char *__obfuscation (char *pwd, char *key);

// ์„ฑ๊ณต ํƒœ๊ทธ ํŒŒ์ผ์„ ์ƒ์„ฑํ•˜๋Š” ํ•จ์ˆ˜
void __create_tag (char *id);

int main (int argc, char *argv[]) {
  if (argc != 2) {
    // ํ”„๋กœ๊ทธ๋žจ ์ด๋ฆ„๊ณผ ์‚ฌ์šฉ ๋ฐฉ๋ฒ•์„ ์ถœ๋ ฅํ•˜๊ณ  ํ”„๋กœ๊ทธ๋žจ ์ข…๋ฃŒ
    __print_sw_title(argv[0]);
    return ERRO;
  }

  if ( __is_valid_pwd(argv[1]) ) {
    // ์ฃผ์–ด์ง„ ๋น„๋ฐ€๋ฒˆํ˜ธ๊ฐ€ ์œ ํšจํ•˜๋ฉด ์„ฑ๊ณต ํƒœ๊ทธ ์ƒ์„ฑ ํ›„ ๋ฉ”์‹œ์ง€ ์ถœ๋ ฅ
    __create_tag(argv[0]);
    printf("\\n +-+ ๋ฌด, ๋ฌด์Šจ... ๋ง๋„ ์•ˆ๋ผ!! ์–ด๋–ป๊ฒŒ ๋ณตํ˜ธํ™” ํ‚ค๋ฅผ...?? +-+ \\n");
  } else {
    // ๋น„๋ฐ€๋ฒˆํ˜ธ๊ฐ€ ์œ ํšจํ•˜์ง€ ์•Š์œผ๋ฉด ์‹คํŒจ ๋ฉ”์‹œ์ง€ ์ถœ๋ ฅ
    printf("\\n ๋„ˆ์˜ ํŒŒ์ผ๋“ค์€ ์ด์ œ ์š”๋‹จ๊ฐ•์„ ๊ฑด๋„ˆ๋‹ค๊ฐ€ ์ €์Šน์‚ฌ์ž์™€ ํ•˜์ดํŒŒ์ด๋ธŒ๋ฅผ ํ•˜๊ฒŒ๋˜์—ˆ๋‹ค! ์œผํ•˜ํ•˜ํ•˜ํ•˜!\\n"); // ใ…‹ใ…‹ใ…‹ใ…‹ใ…‹ใ…‹
  }

  return OK;
}

// ์ฃผ์–ด์ง„ ๋น„๋ฐ€๋ฒˆํ˜ธ๊ฐ€ ์œ ํšจํ•œ์ง€ ํ™•์ธํ•˜๋Š” ํ•จ์ˆ˜
int __is_valid_pwd (char *pwd) {
  if (! strncmp(JOKER, __obfuscation(pwd, KEY), sizeof(JOKER)) ) {
    return TRUE;
  }
  return FALSE;
}

// ์ฃผ์–ด์ง„ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ํ‚ค๋ฅผ ์ด์šฉํ•ด ๋‚œ๋…ํ™”ํ•˜๋Š” ํ•จ์ˆ˜
char *__obfuscation (char *pwd, char *key) {
  int i;
  for (i = 0; i < strlen(pwd); i++) {
    if(key[i] == '\\0') break;
    pwd[i] = pwd[i] ^ key[i];
  }
  return pwd;
}

// ์†Œํ”„ํŠธ์›จ์–ด ์ด๋ฆ„๊ณผ ์‚ฌ์šฉ ๋ฐฉ๋ฒ•์„ ์ถœ๋ ฅํ•˜๋Š” ํ•จ์ˆ˜
void __print_sw_title (char *sw_name) {
  printf(" ----------- [%s] ----------- \\n", sw_name);
  printf(" ::. ๋ณตํ˜ธํ™” ๋ฐฉ๋ฒ•: %s <๋ณตํ˜ธํ™”ํ‚ค>\\n\\n", sw_name);
}

// ์„ฑ๊ณต ํƒœ๊ทธ ํŒŒ์ผ์„ ์ƒ์„ฑํ•˜๋Š” ํ•จ์ˆ˜
void __create_tag (char *id) {
  FILE *fd;
  char *tag_name = (char *)malloc(24 * sizeof(char));
  memset(tag_name, '\\0', 24);
  snprintf(tag_name,24, "./%s.success", id);
  fd = fopen(tag_name, "w");
  if (fd != NULL) {
    fprintf(fd, "๋ณตํ˜ธํ™”๊ฐ€ ์™„๋ฃŒ๋˜์—ˆ์Šต๋‹ˆ๋‹ค.\\n");
    fclose(fd);
  } else {
    printf("[ }{4k3r m3ss493 ] Hey sussy baka~ 7h3r3 w4s 4n 3rr0r 0p3nin9 7h3 file..\\n");
  }
}

 

ํ’€์ด ์ฝ”๋“œ

#include <stdio.h>

char JOKER[] = {0x40, 0x53, 0x06, 0x03, 0x43, 0x52, 0x54, 0x3b};
char KEY[] = {'0', '2', '3', '6', '6', '1', 'd', 'd', '4', '\\0'};

int main () {
    char pwd[9];

    for(int i = 0; i < 8; i++) {
        pwd[i] = JOKER[i] ^ KEY[i];
    }

    printf("%s", pwd);
}

 

๊ฒฐ๊ณผ

ํ•˜์ง€๋งŒ Dream Hack ์— ์ž…๋ ฅํ• ๋•Œ๋Š” _์ด ๋น ์ง„ ์ƒํƒœ๋กœ pa55uc0 ์ž…๋ ฅํ•ด์•ผ ์ •๋‹ต ์ฒ˜๋ฆฌ ๋œ๋‹ค.

__create_tag ํ•จ์ˆ˜๋Š” ์™œ ์žˆ๋Š”์ง€ ๋ชจ๋ฅด๊ฒ ๋‹ค. ์ถ”๊ฐ€๋กœ ๋ฌธ์ œ๋ฅผ ๋งŒ๋“œ๋ ค๋‹ค๊ฐ€ ์ค‘๋‹จํ•œ ๊ฒƒ ๊ฐ™๋‹ค.

 

๋ฐ˜์‘ํ˜•