Solution de U03 pour Fifty Shades of White (Pinkman)

// param_1: Contient le nom d'utilisateur
// param_2: contient le numéro de série de la licence
//
uint validate(char *param_1,char *param_2) {
  size_t sVar1;
  void *local_38;
  undefined local_2c [4];
  uint local_28;
  uint local_24;
  ulong local_20;
  int local_14;
  int local_10;
  uint local_c;

  sVar1 = strlen(param_2);
  sha256(param_2,sVar1,&local_38,local_2c);
  local_c = 1;
  for (local_10 = 0; local_10 < 3; local_10 = local_10 + 1) {
    local_14 = 0;
    local_20 = (ulong)local_10;
    while( true ) {
      sVar1 = strlen(param_1);
      if (sVar1 <= local_20) break;
      local_14 = local_14 + param_1[local_20];
      local_20 = local_20 + 3;
    }
    local_24 = (local_14 * 0x13 + 0x37) % 0x7f;
    local_28 = ((uint)*(byte *)((long)local_10 + (long)local_38) * 0x37 + 0x13) % 0x7f;
    local_c = local_c & local_24 == local_28;
  }
  CRYPTO_free(local_38);
  return local_c;
}

#!/usr/bin/python3

from Cryptodome.Hash import SHA256

def validate(NAME, SERIAL):

  h = SHA256.new()
  h.update(SERIAL)
  HASH = h.digest()

  local_c = True

  for local_10 in range(0,3):
      local_14 = 0
      local_20 = local_10
      while True:
        sVar1 = len(NAME)
        if (sVar1 <= local_20):
          break
        local_14 = local_14 + NAME[local_20];
        local_20 = local_20 + 3
      local_24 = (local_14 * 0x13 + 0x37) % 0x7f;
      local_28 = (HASH[local_10] * 0x37 + 0x13) % 0x7f;
      local_c = local_c & (local_24 == local_28);

  return local_c

print(validate(b'Walter White Junior', b'1d117c5a-297d-4ce6-9186-d4b84fb7f230'))
print(validate(b'Walter White Junior', b'00000000-297d-4ce6-9186-d4b84fb7f230'))

nom = b"Walter White Junior"
cpt = 0
while True:
  cpt = cpt + 1
  licence = ('-'.join([urandom(4).hex(), urandom(2).hex(), urandom(2).hex(), urandom(2).hex(), urandom(6).hex()])).encode(encoding="ascii")
  if validate(nom, licence) == True:
    break
print(f"cpt: {cpt} / {nom} / {licence}")

#!/usr/bin/python3

from Cryptodome.Hash import SHA256
from os import urandom
import textwrap
import base64
from pwn import *
import re

def validate(NAME, SERIAL):

    h = SHA256.new()
    h.update(SERIAL)
    HASH = h.digest()

    local_c = True

    for local_10 in range(0, 3):
        local_14 = 0
        local_20 = local_10
        while True:
            sVar1 = len(NAME)
            if (sVar1 <= local_20):
                break
            local_14 = local_14 + NAME[local_20]
            local_20 = local_20 + 3
        local_24 = (local_14 * 0x13 + 0x37) % 0x7f
        local_28 = (HASH[local_10] * 0x37 + 0x13) % 0x7f
        local_c = local_c & (local_24 == local_28)
        # print(f"local_c: {local_c} / local_24: {local_24} / local_28: {local_28}")

    return local_c


conn = remote('localhost', 4000)

while True:

    while True:
        x = conn.recvline()
        print(x)
        if re.search(b"FCSC\{", x):
            print(f"FLAG: {x}")

        if r := re.search(b"Give me a valid(.*)?license for username: (.*)", x):
            if r.group(1) == b' admin ':
                type_licence = 1337
            else:
                type_licence = 1
            nom_licence = r.group(2)
            break

    print(f"Licence Type : {type_licence}")
    print(f"Licence Nom  : {nom_licence}")

    while True:
        numero_licence = ('-'.join([urandom(4).hex(), urandom(2).hex(), urandom(2).hex(), urandom(2).hex(), urandom(6).hex()])).encode(encoding="ascii")
        if validate(nom_licence, numero_licence) == True:
            break

    print(f"{nom_licence} / {numero_licence}")

    licence = f"Name: {nom_licence.decode('ascii')}\nSerial: {numero_licence.decode('ascii')}\nType: {type_licence}\n"
    print(licence)
    licence_base64 = '\n'.join(textwrap.wrap(base64.b64encode(licence.encode("ascii")).decode('ascii'), width=27))

    EXPLOIT = f"----BEGIN WHITE LICENSE----\n{licence_base64}\n-----END WHITE LICENSE-----\n"
    print(EXPLOIT)
    conn.send(EXPLOIT.encode("ascii"))
    conn.send(b'\n')

#!/bin/bash

set -e

if [ ! -f docker-compose.yml  ]; then
    wget https://hackropole.fr/challenges/fcsc2024-reverse-fifty-shades-of-white/docker-compose.public.yml  -O docker-compose.yml
fi


docker-compose up -d

while ! nc -z localhost 4000; do sleep 1; done

python3 022_Fifty_shades_of_white_Pinkman.py

docker-compose down