###### tags: `HackTheBox` `round 2` # CyberSanta Gift Wrapping ``` The elves won't let you into their secret hideout without the password. Luckily, they've given it to you as a gift! But it seems to be wrapped up tight... Эльфы не пустят вас в свое секретное убежище без пароля. К счастью, они подарили его вам! Но вроде закутано плотно ... ``` ## Unpack first ┌──(kali㉿kali)-[~] └─$ upx -d ./giftwrap Ultimate Packer for eXecutables Copyright (C) 1996 - 2020 UPX 3.96 Markus Oberhumer, Laszlo Molnar & John Reiser Jan 23rd 2020 File size Ratio Format Name -------------------- ------ ----------- ----------- 925312 <- 357628 38.65% linux/amd64 giftwrap Unpacked 1 file. ## Analize in Ghidra ┌──(kali㉿kali)-[~] ![](https://i.imgur.com/BTDvaj5.jpg) ### main function ![](https://i.imgur.com/raA95sy.png) ``` алгоритм шифрования - Обычный XOR длина флага: 0x17=23 Один из множителей: 0xf3=243 ``` Второй множитель: ![](https://i.imgur.com/b5zo0hO.png) ## python decoder ``` key = [ 0xbb,0xa7,0xb1,0x88,0x86,0x83,0x8b,0xac,0xc7,0xc2,0x9d,0x87, 0xac,0xc6,0xc3,0xac,0x9b,0xc7,0x81,0x97,0xd2,0xd2,0x8e,0x00 ] print(''.join([chr(i ^ 0xf3) for i in key])) ``` ## flag ``` HTB{upx_41nt_50_h4rd!!} ```