{"id":186,"date":"2020-05-06T10:50:49","date_gmt":"2020-05-06T08:50:49","guid":{"rendered":"https:\/\/blog.caturday-lovers.fr.nf\/?p=186"},"modified":"2020-12-27T17:45:45","modified_gmt":"2020-12-27T16:45:45","slug":"les-chatons-ont-la-reponse-fcsc-2020-tarte-tatin","status":"publish","type":"post","link":"https:\/\/blog.caturday-lovers.fr.nf\/?p=186","title":{"rendered":"Les chatons ont la r\u00e9ponse \u2013 FCSC 2020 \/\/ Tarte Tatin"},"content":{"rendered":"\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"499\" height=\"543\" src=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h06_12-1.png\" alt=\"\" class=\"wp-image-188\" srcset=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h06_12-1.png 499w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h06_12-1-276x300.png 276w\" sizes=\"auto, (max-width: 499px) 100vw, 499px\" \/><figcaption>Et un peu de sucre en poudre !<\/figcaption><\/figure><\/div>\n\n\n\n<!--more-->\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-4-3 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Le Pudding \u00e0 l&#039;Arsenic (1968)\" width=\"500\" height=\"281\" src=\"https:\/\/www.youtube.com\/embed\/-G3MLjqicC8?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><figcaption>Recette pour un d\u00e9fi r\u00e9ussi !<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Intro<\/h2>\n\n\n\n<p>Non, je n&rsquo;ai pas le courage de vous faire le writeup de la m\u00eame fa\u00e7on que la chanson ! <br><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Recette<\/h2>\n\n\n\n<p>Dans notre shell, commen\u00e7ons par ex\u00e9cuter le programme, il attend une entr\u00e9e de notre part, qui \u00e0 moins d&rsquo;un coup de chance ph\u00e9nom\u00e9nal sera fausse.<br><br>J&rsquo;aime bien chercher si un code est hardcod\u00e9 dans le programme, donc nous allons commencer avec strings :<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"530\" src=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h02_02-1024x530.png\" alt=\"\" class=\"wp-image-189\" srcset=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h02_02-1024x530.png 1024w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h02_02-300x155.png 300w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h02_02-768x398.png 768w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h02_02.png 1035w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption>La partie surlign\u00e9e me titille \u2026 <\/figcaption><\/figure><\/div>\n\n\n\n<p>En esp\u00e9rant que ce ne soit pas avec la string juste au-dessus, mais on va passer sous xxd pour essayer de retrouver notre cible :<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"605\" height=\"193\" src=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h03_10.png\" alt=\"\" class=\"wp-image-190\" srcset=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h03_10.png 605w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h03_10-300x96.png 300w\" sizes=\"auto, (max-width: 605px) 100vw, 605px\" \/><figcaption>On la retrouve bien, mon instinct de chat me dit que c&rsquo;est pas mal<\/figcaption><\/figure><\/div>\n\n\n\n<p>Assez de supposition, c&rsquo;est l&rsquo;heure de lancer radare2 :<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1920\" height=\"1040\" src=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h04_15-1.png\" alt=\"\" class=\"wp-image-192\" srcset=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h04_15-1.png 1920w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h04_15-1-300x163.png 300w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h04_15-1-1024x555.png 1024w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h04_15-1-768x416.png 768w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h04_15-1-1536x832.png 1536w\" sizes=\"auto, (max-width: 1920px) 100vw, 1920px\" \/><figcaption>Oh la chance !!!!<\/figcaption><\/figure><\/div>\n\n\n\n<p>On regarde plus en profondeur ?<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1023\" height=\"95\" src=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h19_58.png\" alt=\"\" class=\"wp-image-193\" srcset=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h19_58.png 1023w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h19_58-300x28.png 300w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h19_58-768x71.png 768w\" sizes=\"auto, (max-width: 1023px) 100vw, 1023px\" \/><figcaption>Oh wait !!!!!<\/figcaption><\/figure>\n\n\n\n<p>Bon, petite douche froide, apr\u00e8s cette sensation d&rsquo;\u00eatre un Uber cracker, la fonction obj.pass_enc me fait peur \u2026 Notre string a \u00e9t\u00e9 encod\u00e9, il va falloir la reverse \u2026  Reprenons notre souffle, on note cela sur un coin du cahier, et on continue notre deadlisting :<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"47\" src=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h25_16-1-1024x47.png\" alt=\"\" class=\"wp-image-195\" srcset=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h25_16-1-1024x47.png 1024w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h25_16-1-300x14.png 300w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h25_16-1-768x35.png 768w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h25_16-1-1536x71.png 1536w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h25_16-1.png 1779w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption>En PLS le chaton !!!!!<\/figcaption><\/figure><\/div>\n\n\n\n<p>obj.flag_enc \u2026 la longueur du truc nom d&rsquo;un chien ! Je suis en boule sur mon fauteuil, j&rsquo;ai presque envie de pleurer, mais qu&rsquo;est-ce que je fous l\u00e0 moi ?<br>Reprenons-nous, c&rsquo;est un d\u00e9fi \u00e0 20 points, ils ne vont pas sortir les armes lourdes pour le moment, il y a s\u00fbrement plus simple, plus logique.<br>J&rsquo;aime beaucoup sym.transform mes chatons, ce n&rsquo;est pas un call naturel, \u00e7a a donc \u00e9t\u00e9 cr\u00e9\u00e9 par un humain (si l&rsquo;on peut consid\u00e9rer un dev&rsquo; comme un humain), il y a donc une chance pour que nous puissions la reverse.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"703\" height=\"445\" src=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h05_10.png\" alt=\"\" class=\"wp-image-196\" srcset=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h05_10.png 703w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/2020-05-06_10h05_10-300x190.png 300w\" sizes=\"auto, (max-width: 703px) 100vw, 703px\" \/><figcaption>Content le chat !<\/figcaption><\/figure><\/div>\n\n\n\n<p>Je ne sais pas pour vous, mais moi \u00e7a va mieux !  J&rsquo;avoue, c&rsquo;est \u00e0 cause de toutes ces heures pass\u00e9es sur les keygenme que je suis rassur\u00e9. Mais nous allons d\u00e9couper cela ensemble.<br>Dans ce call, nous avons une initialisation, une boucle tant qu&rsquo;il reste des caract\u00e8res, et un RET. <br>Dans la boucle, nous avons la r\u00e9cup\u00e9ration de RDI et la manipulation dessus. <br>Nous savons que RDI c&rsquo;est le flag encrypt\u00e9, mais surtout lors de l&rsquo;ex\u00e9cution, c&rsquo;est l&rsquo;endroit o\u00f9 le soft r\u00e9cup\u00e8re notre saisie !<br>Cette saisie sera ensuite manipul\u00e9e pour retirer -1 \u00e0 la valeur ASCII du caract\u00e8re, c&rsquo;est \u00e0 dire que si notre entr\u00e9e est \u00e9gale \u00e0 23456789 elle passera \u00e0 12345678. <br>Et \u00e0 votre avis mes chatons, que ce passe t&rsquo;il quand on retire 1 \u00e0 <em>NzTfdvs4Q4ttx1se <\/em>?<br><br>Oui bravo \u00e0 toi qui \u00e0 suivi ! Elle se transforme en <em>MySecur3P3ssw0rd<\/em>, qui est le mot de passe pour l&rsquo;application, on va la tester de suite :<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"35\" src=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/image-11-1024x35.png\" alt=\"\" class=\"wp-image-197\" srcset=\"https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/image-11-1024x35.png 1024w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/image-11-300x10.png 300w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/image-11-768x26.png 768w, https:\/\/blog.caturday-lovers.fr.nf\/wp-content\/uploads\/2020\/05\/image-11.png 1216w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<pre class=\"wp-block-preformatted\">FCSC{83f41431c111062d003dd0213cf824d66f770a0be1305e2813f15dd76503a91d}<\/pre>\n\n\n\n<p>Finalement, pas si secure le password si un chaton arrive \u00e0 le reverse ^^<\/p>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":13,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[118,119,120,60,63,61,114,122,117,116,121,115],"class_list":["post-186","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kitensgotanswer","tag-asm","tag-assembleur","tag-assembly","tag-ctf","tag-ecsc","tag-fcsc","tag-france","tag-password","tag-radare2","tag-recette","tag-secure","tag-tarte-tatin"],"_links":{"self":[{"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=\/wp\/v2\/posts\/186","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=186"}],"version-history":[{"count":3,"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=\/wp\/v2\/posts\/186\/revisions"}],"predecessor-version":[{"id":278,"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=\/wp\/v2\/posts\/186\/revisions\/278"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=\/wp\/v2\/media\/13"}],"wp:attachment":[{"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=186"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=186"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.caturday-lovers.fr.nf\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=186"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}