Python – PETIR CYBER SECURITY

November 5, 2019

[KKSI 2019] – siapGRAAK

Posted in Reverse Engineering by Jason Theopilus 2 Comments

Soal ini dapat kalian download disini Pada kita diberikan soal berupa ELF 64-bit.

root@kali:~# file siapGRAAK 
siapGRAAK: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=a8680e08d2a4cd7f23306ac67459036c1f914f7e, not stripped

1 2	root@kali:~# file siapGRAAK siapGRAAK: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=a8680e08d2a4cd7f23306ac67459036c1f914f7e, not stripped

kita coba jalankan program ini terlebih dahulu,

root@kali:~# ./siapGRAAK 
Flag nya apa nih Kang ?:
iWantThatFLagg
SALAH NIH

root@kali:~# ./siapGRAAK

Flag nya apa nih Kang ?:

iWantThatFLagg

SALAH NIH

kita coba lihat program ini menggunakan IDA pro 64-bit, dan pada mainnya terdapat psudeocode seperti ini,

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int result; // eax
  size_t i; // [rsp+0h] [rbp-C0h]
  size_t v5; // [rsp+8h] [rbp-B8h]
  char s2[8]; // [rsp+10h] [rbp-B0h]
  __int64 v7; // [rsp+18h] [rbp-A8h]
  __int64 v8; // [rsp+20h] [rbp-A0h]
  int v9; // [rsp+28h] [rbp-98h]
  __int16 v10; // [rsp+2Ch] [rbp-94h]
  char s[136]; // [rsp+30h] [rbp-90h]
  unsigned __int64 v12; // [rsp+B8h] [rbp-8h]

  v12 = __readfsqword(0x28u);
  *(_QWORD *)s2 = -821479746076235608LL;
  v7 = -4697167109371201534LL;
  v8 = -6839456764105678448LL;
  v9 = 1520982160;
  v10 = 61;
  puts("Flag nya apa nih Kang ?:");
  fgets(s, 128, stdin);
  s[strlen(s) - 1] = 0;
  v5 = strlen(s);
  for ( i = 0LL; i < v5; ++i )
    s[i] = get_tbl_entry((unsigned int)s[i]);
  if ( v5 == 29 )
  {
    if ( !strncmp(s, s2, 0x1EuLL) )
    {
      puts("YESSS BERHASIL");
      result = 0;
    }
    else
    {
      puts("SALAH NIH");
      result = 1;
    }
  }
  else
  {
    puts("SALAH NIH");
    result = 1;
  }
  return result;
}

int __cdecl main(int argc, const char **argv, const char **envp)

{

int result; // eax

size_t i; // [rsp+0h] [rbp-C0h]

size_t v5; // [rsp+8h] [rbp-B8h]

char s2[8]; // [rsp+10h] [rbp-B0h]

__int64 v7; // [rsp+18h] [rbp-A8h]

__int64 v8; // [rsp+20h] [rbp-A0h]

int v9; // [rsp+28h] [rbp-98h]

__int16 v10; // [rsp+2Ch] [rbp-94h]

char s[136]; // [rsp+30h] [rbp-90h]

unsigned __int64 v12; // [rsp+B8h] [rbp-8h]

v12 = __readfsqword(0x28u);

*(_QWORD *)s2 = -821479746076235608LL;

v7 = -4697167109371201534LL;

v8 = -6839456764105678448LL;

v9 = 1520982160;

v10 = 61;

puts("Flag nya apa nih Kang ?:");

fgets(s, 128, stdin);

s[strlen(s) - 1] = 0;

v5 = strlen(s);

for ( i = 0LL; i < v5; ++i )

s[i] = get_tbl_entry((unsigned int)s[i]);

if ( v5 == 29 )

{

if ( !strncmp(s, s2, 0x1EuLL) )

{

puts("YESSS BERHASIL");

result = 0;

}

else

{

puts("SALAH NIH");

result = 1;

}

else

{

puts("SALAH NIH");

result = 1;

}

return result;

}

dapat dipahami bahwa inputan kita dilakukan pengolahan pada fungsi get_tbl_entry() pada setiap char inputan kita. Mari kita lihat isi […]

August 12, 2019

[HackToday 2019 Qualification] – nani the fuk

Posted in Reverse Engineering by redspiracy Leave a Comment

Diberikan sebuah soal berbentuk binary, binary dapat di download di: https://s.id/6aIo7 Jika binary dieksekusi maka binary akan meminta input, setelah mencoba inputan, ternyata program hanya menerima input 1 karakter, seperti berikut Ketika input yang dimasukan salah maka program akan exit. Program tersebut terlihat seperti akan meminta input 1 karakter sebanyak 20 kali seperti yang […]

August 7, 2019August 7, 2019

[PicoCTF2018] – A Simple Question

Posted in Web Exploitation by Bryan Lee Leave a Comment

Writeup Reference https://github.com/shiltemann/CTF-writeups-public/tree/master/PicoCTF_2018#web-exploitation-650-a-simple-question Challenge Description : There is a website running at http://2018shell1.picoctf.com:36052 (link). Try to see if you can answer its question. Tampilan pertama setelah meng-klik link diatas adalah : Pertama penulis mengecek source code yang tertera :

<!doctype html>
<html>
<head>
    <title>Question</title>
    <link rel="stylesheet" type="text/css" href="//maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css">
</head>
<body>
<div class="container">
    <div class="row">
        <div class="col-md-12">
            <div class="panel panel-primary" style="margin-top:50px">
                <div class="panel-heading">
                    <h3 class="panel-title">A Simple Question</h3>
                </div>
                <div class="panel-body">
                    <div>
                        What is the answer?
                    </div>  
                    <form action="answer2.php" method="POST">
<!-- source code is in answer2.phps -->
                        <fieldset>
                            <div class="form-group">
                                <div class="controls">
                                    <input id="answer" name="answer" class="form-control">
                                </div>
                            </div>

                            <input type="hidden" name="debug" value="0">

                            <div class="form-actions">
                                <input type="submit" value="Answer" class="btn btn-primary">
                            </div>
                        </fieldset>
                    </form>
                </div>
            </div>
        </div>
    </div>
</div>
</body>
</html>

<!doctype html>

<html>

<head>

<title>Question</title>

</head>

<body>

<h3 class="panel-title">A Simple Question</h3>

</div>

<div>

What is the answer?

</div>

</div>

</div>

</fieldset>

</form>

</div>

</body>

</html>

<!– source code is in answer2.phps –> Mari kita buka , didapat

<?php
  include "config.php";
  ini_set('error_reporting', E_ALL);
  ini_set('display_errors', 'On');

  $answer = $_POST["answer"];
  $debug = $_POST["debug"];
  $query = "SELECT * FROM answers WHERE answer='$answer'";
  echo "<pre>";
  echo "SQL query: ", htmlspecialchars($query), "\n";
  echo "</pre>";
?>
<?php
  $con = new SQLite3($database_file);
  $result = $con->query($query);

  $row = $result->fetchArray();
  if($answer == $CANARY)  {
    echo "<h1>Perfect!</h1>";
    echo "<p>Your flag is: $FLAG</p>";
  }
  elseif ($row) {
    echo "<h1>You are so close.</h1>";
  } else {
    echo "<h1>Wrong.</h1>";
  }
?>

<?php

include "config.php";

ini_set('error_reporting', E_ALL);

ini_set('display_errors', 'On');

$answer = $_POST["answer"];

$debug = $_POST["debug"];

$query = "SELECT * FROM answers WHERE answer='$answer'";

echo "<pre>";

echo "SQL query: ", htmlspecialchars($query), "\n";

echo "</pre>";

<?php

$con = new SQLite3($database_file);

$result = $con->query($query);

$row = $result->fetchArray();

if($answer == $CANARY) {

echo "<h1>Perfect!</h1>";

echo "<p>Your flag is: $FLAG</p>";

}

elseif ($row) {

echo "<h1>You are so close.</h1>";

} else {

echo "<h1>Wrong.</h1>";

}

Dari source code tersebut, dapat diketahui […]

July 29, 2019

[BackdoorCTF 2017] – No Calm

Posted in Reverse Engineering by Jason Theopilus Leave a Comment

Soal ini diberikan sebuah ELF 64bit file yang bisa kalian download disini Kemudian coba kita buka file tersebut dalam IDA Pro 64 bit, dan kita lihat psudeocodenya.

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int i; // [rsp+1Ch] [rbp-34h]
  char v5; // [rsp+20h] [rbp-30h]
  char v6; // [rsp+21h] [rbp-2Fh]
  char v7; // [rsp+22h] [rbp-2Eh]
  char v8; // [rsp+23h] [rbp-2Dh]
  char v9; // [rsp+24h] [rbp-2Ch]
  char v10; // [rsp+25h] [rbp-2Bh]
  char v11; // [rsp+26h] [rbp-2Ah]
  char v12; // [rsp+27h] [rbp-29h]
  char v13; // [rsp+28h] [rbp-28h]
  char v14; // [rsp+29h] [rbp-27h]
  char v15; // [rsp+2Ah] [rbp-26h]
  char v16; // [rsp+2Bh] [rbp-25h]
  char v17; // [rsp+2Ch] [rbp-24h]
  char v18; // [rsp+2Dh] [rbp-23h]
  char v19; // [rsp+2Eh] [rbp-22h]
  char v20; // [rsp+2Fh] [rbp-21h]
  char v21; // [rsp+30h] [rbp-20h]
  char v22; // [rsp+31h] [rbp-1Fh]
  char v23; // [rsp+32h] [rbp-1Eh]
  char v24; // [rsp+33h] [rbp-1Dh]
  char v25; // [rsp+34h] [rbp-1Ch]
  char v26; // [rsp+35h] [rbp-1Bh]
  char v27; // [rsp+36h] [rbp-1Ah]
  char v28; // [rsp+37h] [rbp-19h]
  char v29; // [rsp+38h] [rbp-18h]
  char v30; // [rsp+39h] [rbp-17h]
  char v31; // [rsp+3Ah] [rbp-16h]
  char v32; // [rsp+3Bh] [rbp-15h]
  char v33; // [rsp+3Ch] [rbp-14h]
  char v34; // [rsp+3Dh] [rbp-13h]
  unsigned __int64 v35; // [rsp+48h] [rbp-8h]

  v35 = __readfsqword(0x28u);
  if ( argc != 31 )
  {
    printf("Usage ./challenge <each byte of flag seperated by spaces>", argv, envp, argv);
    exit(1);
  }
  for ( i = 0; argc - 1 > i; ++i )
    *(&v5 + i) = *argv[i + 1LL];
  if ( v6 + v5 - v7 == 81 )
  {
    if ( v5 - v6 + v7 == 53 )
    {
      if ( v6 - v5 + v7 == 87 )
      {
        if ( v9 + v8 - v10 == 90 )
        {
          if ( v8 - v9 + v10 == 156 )
          {
            if ( v9 - v8 + v10 == 66 )
            {
              if ( v12 + v11 - v13 == 98 )
              {
                if ( v11 - v12 + v13 == 140 )
                {
                  if ( v12 - v11 + v13 == 92 )
                  {
                    if ( v15 + v14 - v16 == 38 )
                    {
                      if ( v14 - v15 + v16 == 170 )
                      {
                        if ( v15 - v14 + v16 == 60 )
                        {
                          if ( v18 + v17 - v19 == 29 )
                          {
                            if ( v17 - v18 + v19 == 161 )
                            {
                              if ( v18 - v17 + v19 == 69 )
                              {
                                if ( v21 + v20 - v22 == 163 )
                                {
                                  if ( v20 - v21 + v22 == 27 )
                                  {
                                    if ( v21 - v20 + v22 == 69 )
                                    {
                                      if ( v24 + v23 - v25 == 147 )
                                      {
                                        if ( v23 - v24 + v25 == 43 )
                                        {
                                          if ( v24 - v23 + v25 == 59 )
                                          {
                                            if ( v27 + v26 - v28 == 146 )
                                            {
                                              if ( v26 - v27 + v28 == 86 )
                                              {
                                                if ( v27 - v26 + v28 == 44 )
                                                {
                                                  if ( v30 + v29 - v31 == 67 )
                                                  {
                                                    if ( v29 - v30 + v31 == 89 )
                                                    {
                                                      if ( v30 - v29 + v31 == 75 )
                                                      {
                                                        if ( v33 + v32 - v34 == 117 )
                                                        {
                                                          if ( v32 - v33 + v34 == 125 )
                                                          {
                                                            if ( v33 - v32 + v34 == 125 )
                                                              success();
                                                            else
                                                              fail();
                                                          }
                                                          else
                                                          {
                                                            fail();
                                                          }
                                                        }
                                                        else
                                                        {
                                                          fail();
                                                        }
                                                      }
                                                      else
                                                      {
                                                        fail();
                                                      }
                                                    }
                                                    else
                                                    {
                                                      fail();
                                                    }
                                                  }
                                                  else
                                                  {
                                                    fail();
                                                  }
                                                }
                                                else
                                                {
                                                  fail();
                                                }
                                              }
                                              else
                                              {
                                                fail();
                                              }
                                            }
                                            else
                                            {
                                              fail();
                                            }
                                          }
                                          else
                                          {
                                            fail();
                                          }
                                        }
                                        else
                                        {
                                          fail();
                                        }
                                      }
                                      else
                                      {
                                        fail();
                                      }
                                    }
                                    else
                                    {
                                      fail();
                                    }
                                  }
                                  else
                                  {
                                    fail();
                                  }
                                }
                                else
                                {
                                  fail();
                                }
                              }
                              else
                              {
                                fail();
                              }
                            }
                            else
                            {
                              fail();
                            }
                          }
                          else
                          {
                            fail();
                          }
                        }
                        else
                        {
                          fail();
                        }
                      }
                      else
                      {
                        fail();
                      }
                    }
                    else
                    {
                      fail();
                    }
                  }
                  else
                  {
                    fail();
                  }
                }
                else
                {
                  fail();
                }
              }
              else
              {
                fail();
              }
            }
            else
            {
              fail();
            }
          }
          else
          {
            fail();
          }
        }
        else
        {
          fail();
        }
      }
      else
      {
        fail();
      }
    }
    else
    {
      fail();
    }
  }
  else
  {
    fail();
  }
  return 0;
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

int __cdecl main(int argc, const char **argv, const char **envp)

{

int i; // [rsp+1Ch] [rbp-34h]

char v5; // [rsp+20h] [rbp-30h]

char v6; // [rsp+21h] [rbp-2Fh]

char v7; // [rsp+22h] [rbp-2Eh]

char v8; // [rsp+23h] [rbp-2Dh]

char v9; // [rsp+24h] [rbp-2Ch]

char v10; // [rsp+25h] [rbp-2Bh]

char v11; // [rsp+26h] [rbp-2Ah]

char v12; // [rsp+27h] [rbp-29h]

char v13; // [rsp+28h] [rbp-28h]

char v14; // [rsp+29h] [rbp-27h]

char v15; // [rsp+2Ah] [rbp-26h]

char v16; // [rsp+2Bh] [rbp-25h]

char v17; // [rsp+2Ch] [rbp-24h]

char v18; // [rsp+2Dh] [rbp-23h]

char v19; // [rsp+2Eh] [rbp-22h]

char v20; // [rsp+2Fh] [rbp-21h]

char v21; // [rsp+30h] [rbp-20h]

char v22; // [rsp+31h] [rbp-1Fh]

char v23; // [rsp+32h] [rbp-1Eh]

char v24; // [rsp+33h] [rbp-1Dh]

char v25; // [rsp+34h] [rbp-1Ch]

char v26; // [rsp+35h] [rbp-1Bh]

char v27; // [rsp+36h] [rbp-1Ah]

char v28; // [rsp+37h] [rbp-19h]

char v29; // [rsp+38h] [rbp-18h]

char v30; // [rsp+39h] [rbp-17h]

char v31; // [rsp+3Ah] [rbp-16h]

char v32; // [rsp+3Bh] [rbp-15h]

char v33; // [rsp+3Ch] [rbp-14h]

char v34; // [rsp+3Dh] [rbp-13h]

unsigned __int64 v35; // [rsp+48h] [rbp-8h]

v35 = __readfsqword(0x28u);

if ( argc != 31 )

{

printf("Usage ./challenge <each byte of flag seperated by spaces>", argv, envp, argv);

exit(1);

}

for ( i = 0; argc - 1 > i; ++i )

*(&v5 + i) = *argv[i + 1LL];

if ( v6 + v5 - v7 == 81 )

{

if ( v5 - v6 + v7 == 53 )

{

if ( v6 - v5 + v7 == 87 )

{

if ( v9 + v8 - v10 == 90 )

{

if ( v8 - v9 + v10 == 156 )

{

if ( v9 - v8 + v10 == 66 )

{

if ( v12 + v11 - v13 == 98 )

{

if ( v11 - v12 + v13 == 140 )

{

if ( v12 - v11 + v13 == 92 )

{

if ( v15 + v14 - v16 == 38 )

{

if ( v14 - v15 + v16 == 170 )

{

if ( v15 - v14 + v16 == 60 )

{

if ( v18 + v17 - v19 == 29 )

{

if ( v17 - v18 + v19 == 161 )

{

if ( v18 - v17 + v19 == 69 )

{

if ( v21 + v20 - v22 == 163 )

{

if ( v20 - v21 + v22 == 27 )

{

if ( v21 - v20 + v22 == 69 )

{

if ( v24 + v23 - v25 == 147 )

{

if ( v23 - v24 + v25 == 43 )

{

if ( v24 - v23 + v25 == 59 )

{

if ( v27 + v26 - v28 == 146 )

{

if ( v26 - v27 + v28 == 86 )

{

if ( v27 - v26 + v28 == 44 )

{

if ( v30 + v29 - v31 == 67 )

{

if ( v29 - v30 + v31 == 89 )

{

if ( v30 - v29 + v31 == 75 )

{

if ( v33 + v32 - v34 == 117 )

{

if ( v32 - v33 + v34 == 125 )

{

if ( v33 - v32 + v34 == 125 )

success();

else

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

return 0;

}

Kemudian dari hasil Psudeocode ini kita mendapati banyak sekali constraint yang diterapkan pada soal, sehingga ada 2 cara untuk mengerjakannya yakni dengan Angr atau dengan Z3 solver. […]

July 27, 2019July 30, 2019

[TJCTF2019] – Moar Horse 2

Posted in Web Exploitation by EternalBeats Leave a Comment

WriteUp reference : https://github.com/Hong5489/TJCTF-2019/tree/master/moar Pada soal yang ini kita diberikan sebuah website yang memiliki 2 tombol (“Backward”) dan (“Forward”). Bila kita click backward berkali-kali atau forward berkali-kali kita berakhir pada link yang sama yaitu /4b043a01-a4b7-4141-8a99-fc94fe7e3778.html, tetapi bila kita click backward beberapa kali dan kemudian click forward beberapa kali kita mendapatkan link yang berbeda-beda. Kita sepertinya […]

July 26, 2019July 26, 2019

[ISITDTU Quals 2019] – rosegarden

Posted in Web Exploitation by Bryan Lee Leave a Comment

Challenge Description : Rosé is a beautiful singer with a sweet voice, but she is so much busy and she needs more staff to work in her garden. Diberikan web http://45.77.247.11/ . Saat mengakses web, yang pertama terlihat adalah sebuah webpage yang dihias dengan picture/video Rosé Blackpink. Terdapat “home”, dan “Send request” yang melakukan redirect ke […]

July 26, 2019

[Vulnhub] – DC-2

Posted in Pentest by ArkAngels Leave a Comment

Pada kesempatan kali ini, penulis ingin kembali berbagi ilmu yang didapat penulis dari mengerjakan sebuah vulnbox yang bernama DC-2. Box ini merupakan seri lanjutan dari DC-1 yang dimana memperkenalkan kita pada beberapa sudut pandang baru dalam pentest. Langsung saja gaskeun! Seperti biasa, kita mulai dengan mencari IP dari box kita menggunakan netdiscover, berikut syntaxnya: $ […]

June 19, 2019June 19, 2019

[BCACTF19] – basic-pass-3

Posted in Reverse Engineering by ArkAngels Leave a Comment

Challenge description: Hint: Diberikan sebuah service netcat. Mari kita lihat terlebih dahulu dari isi servicenya. Hmm, sepertinya service ini meminta kita memasukan sesuatu lalu dari backend akan di evaluasi. Di beberapa karakter yang di input, salah satu angka 0 yang ada akan berubah menjadi 1. Sepertinya soal ini merupakan soal bruteforce. Setelah fuzzing berikutnya didapatkanlah hasil sebagai berikut: Sepertinya […]

April 29, 2019June 11, 2019

[Vulnhub] – HackInOS: 1

Posted in Pentest by ArkAngels Leave a Comment

Pada kesempatan kali ini, penulis ingin berbagi lagi pengalamannya dalam mengerjakan Vulnhub. Pertama kita lakukan pencarian IP dari vulnbox kita dengan netdiscover: $ sudo netdiscover -i wlp3s0 -r 172.20.10.0/24 Dengan hasil sebagai berikut: Kedua, kita lakukan port-scanning dengan nmap: $ sudo nmap -A -O -v -p1-65535 -T4 172.20.10.14 Dengan hasil sebagai berikut: Dapat kita lihat […]

May 20, 2018June 20, 2019

[picoCTF 2017] – Coffee

Posted in Reverse Engineering by Khallisa Mediana Leave a Comment

Challenge: You found a suspicious USB drive in a jar of pickles. It contains this file. File. File yang diberikan (freeThePickles.class) merupakan class Java yang telah dikompilasi. Kita bisa mendapatkan source code awalnya dengan menggunakan decompiler pada www.javadecompilers.com Hasilnya:

import java.util.Base64.Decoder;

public class problem {
  public problem() {}
  
  public static String get_flag() { String str1 = "Hint: Don't worry about the schematics";
    String str2 = "eux_Z]\\ayiqlog`s^hvnmwr[cpftbkjd";
    String str3 = "Zf91XhR7fa=ZVH2H=QlbvdHJx5omN2xc";
    byte[] arrayOfByte1 = str2.getBytes();
    byte[] arrayOfByte2 = str3.getBytes();
    byte[] arrayOfByte3 = new byte[arrayOfByte2.length];
    for (int i = 0; i < arrayOfByte2.length; i++)
    {
      arrayOfByte3[i] = arrayOfByte2[(arrayOfByte1[i] - 90)];
    }
    System.out.println(java.util.Arrays.toString(java.util.Base64.getDecoder().decode(arrayOfByte3)));
    return new String(java.util.Base64.getDecoder().decode(arrayOfByte3));
  }
  
  public static void main(String[] paramArrayOfString) {
    System.out.println("Nothing to see here");
  }
}

import java.util.Base64.Decoder;

public class problem {

public problem() {}

public static String get_flag() { String str1 = "Hint: Don't worry about the schematics";

String str2 = "eux_Z]\\ayiqlog`s^hvnmwr[cpftbkjd";

String str3 = "Zf91XhR7fa=ZVH2H=QlbvdHJx5omN2xc";

byte[] arrayOfByte1 = str2.getBytes();

byte[] arrayOfByte2 = str3.getBytes();

byte[] arrayOfByte3 = new byte[arrayOfByte2.length];

for (int i = 0; i < arrayOfByte2.length; i++)

{

arrayOfByte3[i] = arrayOfByte2[(arrayOfByte1[i] - 90)];

}

System.out.println(java.util.Arrays.toString(java.util.Base64.getDecoder().decode(arrayOfByte3)));

return new String(java.util.Base64.getDecoder().decode(arrayOfByte3));

}

public static void main(String[] paramArrayOfString) {

System.out.println("Nothing to see here");

}

Kita dapat menulis ulang function get_flag() menggunakan Python:

import base64
str2 = "eux_Z]\\ayiqlog`s^hvnmwr[cpftbkjd"
str3 = "Zf91XhR7fa=ZVH2H=QlbvdHJx5omN2xc"
arrayOfByte1 = str2.encode()
arrayOfByte2 = str3.encode()
arrayOfByte3 = []
i = 0
while i < 32:
    a = arrayOfByte2[(arrayOfByte1[i]-90)]
    i = i + 1
    arrayOfByte3.append(a)

letters = ""
for i in arrayOfByte3:
    letters = letters + chr(i)
flag = base64.b64decode(letters).decode("utf-8")
print(flag)

import base64

str2 = "eux_Z]\\ayiqlog`s^hvnmwr[cpftbkjd"

str3 = "Zf91XhR7fa=ZVH2H=QlbvdHJx5omN2xc"

arrayOfByte1 = str2.encode()

arrayOfByte2 = str3.encode()

arrayOfByte3 = []

i = 0

while i < 32:

a = arrayOfByte2[(arrayOfByte1[i]-90)]

i = i + 1

arrayOfByte3.append(a)

letters = ""

for i in arrayOfByte3:

letters = letters + chr(i)

flag = base64.b64decode(letters).decode("utf-8")

print(flag)

Lalu menjalankannya untuk mendapatkan flag:

nacl@ubuntu:~/Desktop$ python freeThePickles.py
flag_{pretty_cool_huh}

1 2	nacl@ubuntu:~/Desktop$ python freeThePickles.py flag_{pretty_cool_huh}

Flag: flag_{pretty_cool_huh}