Writeup

Decrypt Message 2

Open file with IDA

Program will generate ascii random key, and length of key will divide by 5. Then program converts flag and key into arrays, xor them together with modulo 5.

After xoring, we are given encrypt flag, but with shuffled index (v14 is the index array)

We need to find correct permutation of encrypt flag. We are given 5 first characters of flag is BrU7e.

To solve this challenge, we can bruteforce to find correct permutation of encrypted flag. After found correct one, we can calculate key by xoring correct permutation of encrypted flag and known plaintext BrU7e. When we have key, everything is easy.

After understand how to reverse, I use python to write script

from itertools import *
from pwn import *
ct = list(bytes.fromhex("446709213550020f3b28696533183206631e030743394d4531"))
known = list(b"BrU7e")

def real_dec(ct, v14, key):
    ans = b""
    for i in range(0, len(ct), 5):
        for j in range(5):
            ans += bytes([ct[v14[j] + i] ^ key[j]])
    return ans

for v14 in permutations(range(5)):
    ctt = []
    for i in range(5):
        ctt.append(ct[v14[i]])
    key = xor(ctt, known)
    print(real_dec(ct, v14, key))

flag: BrU7e_fORcE_l5_p0w3rFu1i!

Decrypt Message 1

Compile source code with IDA and we have this

Look into _encryption function and we have

Let me explain how encrypt function works:

• We divide input into chunks, each chunk has 2 elements
• After divided, each chunk will go to encryption function

• Because each chunk is encrypted seperately, so we can bruteforce each chunk to get flag

Here is my script in python to find flag

from pwn import *
import string
from tqdm import *

enc = "188d1f2f13cd5b601bd6047f4496ff74496ff74496ff7"
alphabet = string.printable
flag = ""
enc_parts = []
flag_parts = []
enc_check = ""
for c1 in alphabet:
    for c2 in alphabet:
        inp = c1 + c2
        io = process(["./encrypt", inp])
        enc_part = io.recvline().strip().decode()[len("Encrypted data in hexadecimal format: "):]
        io.close()
        enc_parts.append(enc_part)
        flag_parts.append(inp)


while len(enc_check) != len(enc):
    for enc_part in tqdm(enc_parts):
        if enc.startswith(enc_part):
            enc_check += enc_part
            flag += flag_parts[enc_parts.index(enc_part)]
            enc = enc[len(enc_part):]
            print(flag)
            break

flag: GODGPT!!!