rene-d · January 25, 2021 22:31
diff --git a/README.md b/README.md
diff --git a/blowfish.png b/blowfish.png
diff --git a/getfiles.sh b/getfiles.sh
 #!/bin/sh

 wget -nc -nv http://challengecybersec.fr/d3d2bf6b74ec26fdb57f76171c36c8fa/message.pdf
 wget -nc -nv http://challengecybersec.fr/d3d2bf6b74ec26fdb57f76171c36c8fa/secrets.zip
diff --git a/htmlalert.png b/htmlalert.png
diff --git a/nuke.c b/nuke.c
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>

 typedef unsigned int uint;
 typedef unsigned char byte;

 int checkpassword(char *param_1)
 {
  int i;
  uint local_78 [12];
  uint local_48 [14];

  local_78[0] = 2;
  local_78[1] = 4;
  local_78[2] = 9;
  local_78[3] = 0xc;
  local_78[4] = 1;
  local_78[5] = 2;
  local_78[6] = 9;
  local_78[7] = 3;
  local_78[8] = 2;
  local_78[9] = 1;
  local_78[10] = 0xd;
  local_48[0] = 0x54;
  local_48[1] = 0x52;
  local_48[2] = 0x4f;
  local_48[3] = 0x4c;
  local_48[4] = 0x4f;
  local_48[5] = 0x4c;
  local_48[6] = 0x4f;
  local_48[7] = 0x4c;
  local_48[8] = 0x4f;
  local_48[9] = 0x4c;
  local_48[10] = 0x4f;

  i = 0;
  while (i < 0xb) {
    local_48[i] = local_48[i] ^ local_78[i];
    i = i + 1;
  }

  return 0;
 }



 int main(void)
 {
  size_t len;
  byte *password;
  long in_FS_OFFSET;
  char buffer [24];

  puts("Operation Soleil Atomique");
  printf("Entrez le mot de passe : ");
  fgets(buffer,0x10,stdin);
  len = strlen(buffer);
  password = (byte *)malloc(len + 1);
  strcpy((char *)password,buffer);
  checkpassword((char *)password);
  if (((((((password[1] ^ *password) == 0x69) && ((password[2] ^ password[1]) == 0x6f)) &&
        ((password[3] ^ password[2]) == 0x38)) &&
       (((password[4] ^ password[3]) == 0x56 && ((password[5] ^ password[4]) == 0x50)))) &&
      (((password[6] ^ password[5]) == 0x57 &&
       (((password[7] ^ password[6]) == 0x50 && ((password[8] ^ password[7]) == 0x56)))))) &&
     (((password[9] ^ password[8]) == 6 && (password[9] == 0x34)))) {
    puts("Bravo");
    exit(0);
  }
  puts("Mauvais mot de passe");

  return 0;
 }
diff --git a/nuke.png b/nuke.png
diff --git a/nuke.py b/nuke.py
 #!/usr/bin/env python3

 import os
 import re
 from pathlib import Path
 from Crypto.Cipher import Blowfish


 #
 # step 1: extraire les fichiers de l'archive protégée par mot de passe
 #

 os.system("unzip -q -o -P finenuke secrets.zip")


 #
 # step 2: extraire les textes de message.pdf
 #

 # chargement du fichier
 pdf = Path("message.pdf").read_bytes()

 # recherche des textes <hexa hexa....> Tj
 print("Info dans pdf:")
 for m in re.findall(rb"<((?:[0-9a-f]{2} ?)+)> Tj", pdf):
    t = "".join(map(lambda x: chr(int(x, 16)), m.decode().split()))
    print(t)
    print()

 # zone HTML
 print("Info dans page html:")
 m = re.search(rb"flag = \[((?:\d{2},?)+)\]", pdf)
 m = m.group(1)
 t = "".join(map(chr, map(int, m.decode().split(","))))
 print(t)
 print()


 #
 # step 3: déchiffrer le fichier message.pdf
 #

 # cf. info.txt
 key = b"\xce]`^+5w#\x96\xbbsa\x14\xa7\x0ei"
 iv = b"\xc4\xa7\x1e\xa6\xc7\xe0\xfc\x82"

 enc = Blowfish.new(key, Blowfish.MODE_CBC, iv)
 Path("nuke.jpg").write_bytes(enc.encrypt(Path("message.pdf").read_bytes()))


 #
 # step 4: extraire le binaire ELF de l'image nuke.jpg
 #

 Path("nuke.bin").write_bytes(Path("nuke.jpg").read_bytes()[72613:])


 #
 # step 5: décoder le mot de passe dans le binaire nuke.bin
 #

 pwd = ""

 c = 0x34
 pwd = chr(c) + pwd
 c = c ^ 6
 pwd = chr(c) + pwd
 c = c ^ 0x56
 pwd = chr(c) + pwd
 c = c ^ 0x50
 pwd = chr(c) + pwd
 c = c ^ 0x57
 pwd = chr(c) + pwd
 c = c ^ 0x50
 pwd = chr(c) + pwd
 c = c ^ 0x56
 pwd = chr(c) + pwd
 c = c ^ 0x38
 pwd = chr(c) + pwd
 c = c ^ 0x6F
 pwd = chr(c) + pwd
 c = c ^ 0x69
 pwd = chr(c) + pwd

 print("Info dans ELF:")
 print(pwd)
diff --git a/pdfobject7.png b/pdfobject7.png
	#!/bin/sh

	wget -nc -nv http://challengecybersec.fr/d3d2bf6b74ec26fdb57f76171c36c8fa/message.pdf
	wget -nc -nv http://challengecybersec.fr/d3d2bf6b74ec26fdb57f76171c36c8fa/secrets.zip
	#include <stdio.h>
	#include <string.h>
	#include <stdlib.h>

	typedef unsigned int uint;
	typedef unsigned char byte;

	int checkpassword(char *param_1)
	{
	int i;
	uint local_78 [12];
	uint local_48 [14];

	local_78[0] = 2;
	local_78[1] = 4;
	local_78[2] = 9;
	local_78[3] = 0xc;
	local_78[4] = 1;
	local_78[5] = 2;
	local_78[6] = 9;
	local_78[7] = 3;
	local_78[8] = 2;
	local_78[9] = 1;
	local_78[10] = 0xd;
	local_48[0] = 0x54;
	local_48[1] = 0x52;
	local_48[2] = 0x4f;
	local_48[3] = 0x4c;
	local_48[4] = 0x4f;
	local_48[5] = 0x4c;
	local_48[6] = 0x4f;
	local_48[7] = 0x4c;
	local_48[8] = 0x4f;
	local_48[9] = 0x4c;
	local_48[10] = 0x4f;

	i = 0;
	while (i < 0xb) {
	local_48[i] = local_48[i] ^ local_78[i];
	i = i + 1;
	}

	return 0;
	}



	int main(void)
	{
	size_t len;
	byte *password;
	long in_FS_OFFSET;
	char buffer [24];

	puts("Operation Soleil Atomique");
	printf("Entrez le mot de passe : ");
	fgets(buffer,0x10,stdin);
	len = strlen(buffer);
	password = (byte *)malloc(len + 1);
	strcpy((char *)password,buffer);
	checkpassword((char *)password);
	if (((((((password[1] ^ *password) == 0x69) && ((password[2] ^ password[1]) == 0x6f)) &&
	((password[3] ^ password[2]) == 0x38)) &&
	(((password[4] ^ password[3]) == 0x56 && ((password[5] ^ password[4]) == 0x50)))) &&
	(((password[6] ^ password[5]) == 0x57 &&
	(((password[7] ^ password[6]) == 0x50 && ((password[8] ^ password[7]) == 0x56)))))) &&
	(((password[9] ^ password[8]) == 6 && (password[9] == 0x34)))) {
	puts("Bravo");
	exit(0);
	}
	puts("Mauvais mot de passe");

	return 0;
	}
	#!/usr/bin/env python3

	import os
	import re
	from pathlib import Path
	from Crypto.Cipher import Blowfish


	#
	# step 1: extraire les fichiers de l'archive protégée par mot de passe
	#

	os.system("unzip -q -o -P finenuke secrets.zip")


	#
	# step 2: extraire les textes de message.pdf
	#

	# chargement du fichier
	pdf = Path("message.pdf").read_bytes()

	# recherche des textes <hexa hexa....> Tj
	print("Info dans pdf:")
	for m in re.findall(rb"<((?:[0-9a-f]{2} ?)+)> Tj", pdf):
	t = "".join(map(lambda x: chr(int(x, 16)), m.decode().split()))
	print(t)
	print()

	# zone HTML
	print("Info dans page html:")
	m = re.search(rb"flag = \[((?:\d{2},?)+)\]", pdf)
	m = m.group(1)
	t = "".join(map(chr, map(int, m.decode().split(","))))
	print(t)
	print()


	#
	# step 3: déchiffrer le fichier message.pdf
	#

	# cf. info.txt
	key = b"\xce]`^+5w#\x96\xbbsa\x14\xa7\x0ei"
	iv = b"\xc4\xa7\x1e\xa6\xc7\xe0\xfc\x82"

	enc = Blowfish.new(key, Blowfish.MODE_CBC, iv)
	Path("nuke.jpg").write_bytes(enc.encrypt(Path("message.pdf").read_bytes()))


	#
	# step 4: extraire le binaire ELF de l'image nuke.jpg
	#

	Path("nuke.bin").write_bytes(Path("nuke.jpg").read_bytes()[72613:])


	#
	# step 5: décoder le mot de passe dans le binaire nuke.bin
	#

	pwd = ""

	c = 0x34
	pwd = chr(c) + pwd
	c = c ^ 6
	pwd = chr(c) + pwd
	c = c ^ 0x56
	pwd = chr(c) + pwd
	c = c ^ 0x50
	pwd = chr(c) + pwd
	c = c ^ 0x57
	pwd = chr(c) + pwd
	c = c ^ 0x50
	pwd = chr(c) + pwd
	c = c ^ 0x56
	pwd = chr(c) + pwd
	c = c ^ 0x38
	pwd = chr(c) + pwd
	c = c ^ 0x6F
	pwd = chr(c) + pwd
	c = c ^ 0x69
	pwd = chr(c) + pwd

	print("Info dans ELF:")
	print(pwd)