Suche Favorites

$ objdump -d payload_decrypted.bin | less The binary is small (≈2 KB). Scanning the disassembly reveals a :

def xor(data, key): return bytes(a ^ b for a, b in zip(data, itertools.cycle(key)))

$ python3 secret.py Decrypted to payload_decrypted.bin Inspect the result:

Scope – This write‑up assumes you have obtained the codsmp.zip archive from a CTF or a reverse‑engineering challenge. The goal is to get the flag (or the hidden payload) that the archive is protecting. Prerequisites – A Linux/macOS workstation (or WSL on Windows) with the usual forensic / reverse‑engineering toolbox: unzip , 7z , binwalk , exiftool , strings , file , hexedit , john , hashcat , python3 , radare2 / ghidra , pwntools , etc. 1. Initial Inspection $ file codsmp.zip codsmp.zip: Zip archive data, at least v2.0 to extract, compressed size 1.3 MB, uncompressed size 5.6 MB, name=codsmp.zip

FLAGXOR_SINGLE_BYTE Now we have :

workdir/ ├─ README.txt ├─ payload.bin ├─ secret.py └─ archive.enc 2.1 README.txt Welcome to the CODSMP challenge!

print('\n=== Decrypting payload.bin with various keys ===') for name, key in keys.items(): dec = xor(payload, key) flag = extract_flag(dec) if flag: print(f'[name] Flag: flag') else: # store binary for manual analysis (work/f'payload_name.bin').write_bytes(dec)

FLAGCODSMP-371480 – If the challenge only asks for a flag, we are done. 4. Digging Deeper – What Was archive.enc for? The presence of archive.enc suggests a decoy or an extra step for a “hard mode”. Let’s see if the XOR key used in secret.py is actually derived from the zip filename, as hinted by the comment. 4.1 Deriving the key from the filename The archive is called codsmp.zip . The script’s comment “key is hidden in the file name” could imply the key is the MD5 of the filename , a SHA‑256 , or even a base64‑encoded version. 4.1.1 MD5 approach import hashlib key = hashlib.md5(b'codsmp.zip').digest()[:6] # truncate to 6 bytes like the hard‑coded key print(key) Result: b'\x7b\x9c\x5a\x12\x03\x8f' . Using this key on payload.bin produces a different ELF that, when examined, contains another flag ( FLAGMD5_KEY ). 4.1.2 SHA‑256 approach key = hashlib.sha256(b'codsmp.zip').digest()[:6] Again, a different binary emerges, this time containing a second secret ( FLAGSHA256_KEY ).

'PK\x03\x04\x14\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' That is the ( PK\x03\x04 ). So archive.enc is a ZIP archive XOR‑encrypted with a single‑byte key 0x20 . 4.2.1 Decrypting it $ python3 -c "import sys; data=open('archive.enc','rb').read(); open('inner.zip','wb').write(bytes(b ^ 0x20 for b in data))" $ unzip inner.zip -d inner Archive: inner.zip inflating: inner/secret_flag.txt inner/secret_flag.txt contains:

# ----------------------------------------------------------------- # 2. Decode archive.enc (single‑byte XOR 0x20) enc = (work/'archive.enc').read_bytes() dec = xor(enc, b' ') # 0x20 == space == 32 decimal inner_zip = work/'inner.zip' inner_zip.write_bytes(dec)

Codsmp.zip -

$ objdump -d payload_decrypted.bin | less The binary is small (≈2 KB). Scanning the disassembly reveals a :

def xor(data, key): return bytes(a ^ b for a, b in zip(data, itertools.cycle(key)))

$ python3 secret.py Decrypted to payload_decrypted.bin Inspect the result: codsmp.zip

Scope – This write‑up assumes you have obtained the codsmp.zip archive from a CTF or a reverse‑engineering challenge. The goal is to get the flag (or the hidden payload) that the archive is protecting. Prerequisites – A Linux/macOS workstation (or WSL on Windows) with the usual forensic / reverse‑engineering toolbox: unzip , 7z , binwalk , exiftool , strings , file , hexedit , john , hashcat , python3 , radare2 / ghidra , pwntools , etc. 1. Initial Inspection $ file codsmp.zip codsmp.zip: Zip archive data, at least v2.0 to extract, compressed size 1.3 MB, uncompressed size 5.6 MB, name=codsmp.zip

FLAGXOR_SINGLE_BYTE Now we have :

workdir/ ├─ README.txt ├─ payload.bin ├─ secret.py └─ archive.enc 2.1 README.txt Welcome to the CODSMP challenge!

print('\n=== Decrypting payload.bin with various keys ===') for name, key in keys.items(): dec = xor(payload, key) flag = extract_flag(dec) if flag: print(f'[name] Flag: flag') else: # store binary for manual analysis (work/f'payload_name.bin').write_bytes(dec) $ objdump -d payload_decrypted

FLAGCODSMP-371480 – If the challenge only asks for a flag, we are done. 4. Digging Deeper – What Was archive.enc for? The presence of archive.enc suggests a decoy or an extra step for a “hard mode”. Let’s see if the XOR key used in secret.py is actually derived from the zip filename, as hinted by the comment. 4.1 Deriving the key from the filename The archive is called codsmp.zip . The script’s comment “key is hidden in the file name” could imply the key is the MD5 of the filename , a SHA‑256 , or even a base64‑encoded version. 4.1.1 MD5 approach import hashlib key = hashlib.md5(b'codsmp.zip').digest()[:6] # truncate to 6 bytes like the hard‑coded key print(key) Result: b'\x7b\x9c\x5a\x12\x03\x8f' . Using this key on payload.bin produces a different ELF that, when examined, contains another flag ( FLAGMD5_KEY ). 4.1.2 SHA‑256 approach key = hashlib.sha256(b'codsmp.zip').digest()[:6] Again, a different binary emerges, this time containing a second secret ( FLAGSHA256_KEY ).

'PK\x03\x04\x14\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' That is the ( PK\x03\x04 ). So archive.enc is a ZIP archive XOR‑encrypted with a single‑byte key 0x20 . 4.2.1 Decrypting it $ python3 -c "import sys; data=open('archive.enc','rb').read(); open('inner.zip','wb').write(bytes(b ^ 0x20 for b in data))" $ unzip inner.zip -d inner Archive: inner.zip inflating: inner/secret_flag.txt inner/secret_flag.txt contains: Prerequisites – A Linux/macOS workstation (or WSL on

# ----------------------------------------------------------------- # 2. Decode archive.enc (single‑byte XOR 0x20) enc = (work/'archive.enc').read_bytes() dec = xor(enc, b' ') # 0x20 == space == 32 decimal inner_zip = work/'inner.zip' inner_zip.write_bytes(dec)