# Ransomware
## Task
File: Ransomware.zip
## Solution
We have `flag.enc`:
```703230904e174e26c358bab99598029beb45510803f878d56109cee328b0a2237feb4fcf668cebbc821ff79a9491799b186c4bea62c3cf4f73385267af85374641c0f852703230907032309017e0ea0bb9ac54a1bf515fdabfb6b5c76bed23455e018c743dbd673dfedbf3b098c1a9748d883fc86ff6280754f7ec17510c2ad8fe1d346483e7f69b4c0a60b77032309070323090e9f0da56136d59e6191edb34643309a4b3bc5ffdcdec697aa990545926aca949986c87b924b729f68c8728803a4e21e30e05cf6ed9badb1a829d91cba578adf2703230907032309083077d5bf40f4fd308fc1eb93c87081ae272d6b222a4172e7e258ee5584994d25c22c224ec4789f5cc4c5abcfad1db0445228c53480f6fdecebcc5407dee7c1c7032309070323090c8fb728bed9d756ebb3417e54b598c3785f14157e23bb141e6d10f2c4e851dd5036aa541849c9e97f0fe057b387df683a28c62b9ee97c1e8985914bfb6ec24e2703230907032309093bf4523662ecfea34cb0377210384f91838b449dfd56979a24b2c7904dd1325dde3d1de045985e7e75c02a2506299a96d4e3d16e7331427425af0223c72358c7032309070323090fb6f7bb42da48e274872b8e28fadea4bb8db0e25f858ec7f95a7682dbd4520119f81674f9cb8737034e751a62b321b84d394638ab29dd1c427cf10c1077cba587032309070323090477d78623356e687aec90e173da11db28235442efc40ee35e23ee7af7410b81fae18912458dd96a269a3c857f4915f89de7d164a3d326d8380db44685c7164e570323090703230902d47c7bc766a988367907939450405507227cc9d272120f3a529ddbff61f7a7dcdb7139b29dea09307c3225f043555a4d3447637ef481cfa5a734da900eea58070323090703230903a03d4db2311a18ed5bfa246b1117961f043a5204c8f92e2ce9882605adae8300dad339acfa38b1f6c7c862fdd10147c4aedb9e54889b608c6ccdca3caeefe0b7032309070323090f8ea666ab4890113372c776e2e01180a2b2286054e63ce3884d2b554d0d565e872225f6e766c01ca8236f6f62110dfcc1a909219d089893426f98d2bed9bbdeb70323090703230908daa8b02883790fb38b484777cda22e384c50400f21dc9188f0bcd8244f8aaa01a31b58bc4b7354aa78623a2b9aa9a4f1bb2ec42cc74dd1c42554fdede7c50ef703230907032309003af5a4e9d1b321c2a83bd345a8cccbb2a10282967c9e96c8a4d170a95b1ddae4a187fbdd85157ca0d2eb2e409fc05f84004b86e2033e55135b428843a988a3c703230907032309027fa1dff4a39502ede87dad98a304d34c136fe2abc54c08233c5834ab2a35928a669ac59eb7ae416ab70cb036a1d7ad0486782b9d7761f8457d09f87d85166e07032309070323090969291c04cccd97065722a16eb9c96f12bd8562af2662dd2dfefd03fffd26170a385a2f976254cfdf8686f9139c0893ebb0a3b7b39823fc6299d37a33f2735107032309070323090f9590c29da1b7609c00d144fe34f4c49a737342f336f5cbe574430dffd47295ed84a380c95163eeb401ff2470fc03539c75f8afe5fe5c206117c94315266ff5d703230907032309013abc8956e57ce6be9a2b03184c5619a95022587d3e4c2eb194f1164b0ecbf3352fdcbd91ab0361205c4301d91453f22434d00b6505a536950b12e4819c3ce7d70323090```
And `Ransomware`:
```bash$ file RansomewareRansomeware: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=eee1a1e574a7b7b312c9a2c50a2855d4092e17a3, not stripped```
Let's open it up with `ghidra` and rename all the things:
This is `main`:
```c
/* WARNING: Unknown calling convention yet parameter storage is locked */
int main(void)
{  byte bVar1;  int fd;  int iVar2;  ssize_t bytesRead;  size_t flagStrlen;  time_t epochtime;  size_t randomStrlen;  char *random;  long in_FS_OFFSET;  int counterTwoReverse;  int counter;  int counterTwo;  uchar charZero;  uchar charOne;  uchar flagData [48];  undefined local_1a8 [64];  byte sha512_hash [64];  char sha512_store [128];  char encData [136];  long canary;
  canary = *(long *)(in_FS_OFFSET + 0x28);  bzero(flagData,0x23);  fd = open("./flag.txt",0);  if (fd == -1) {    perror("Error opening the file\n");  }  do {    bytesRead = read(fd,flagData,0x23);  } while (0 < (int)bytesRead);  flagStrlen = strlen((char *)flagData);  close(fd);  epochtime = time((time_t *)0x0);  srand((uint)epochtime);  bzero(local_1a8,0x40);  fd = open("./out.txt",0x41);  if (fd == -1) {    perror("Error opening the file\n");  }  counter = 2;  while ((ulong)(long)counter <= flagStrlen) {    bzero(&charZero,3);    bzero(sha512_hash,0x40);    bzero(sha512_store,0x80);    bzero(encData,0x80);    charZero = flagData[counter + -2];    charOne = flagData[counter + -1];    rand();    rand();    SHA512(&charZero,2,sha512_hash);    counterTwo = 0;    while (counterTwo < 0x40) {      bVar1 = sha512_hash[counterTwo];      randomStrlen = strlen(sha512_store);      sprintf(sha512_store + randomStrlen,"%02x",(ulong)bVar1);      counterTwo = counterTwo + 1;    }    randomStrlen = strlen(sha512_store);    iVar2 = (int)randomStrlen + -1;    counterTwo = 0;    counterTwoReverse = iVar2;    while (counterTwo <= iVar2) {      if (sha512_store[counterTwoReverse] != ' ') {        encData[counterTwo] = sha512_store[counterTwoReverse];        counterTwoReverse = counterTwoReverse + -1;      }      counterTwo = counterTwo + 1;    }    random = genRandom();    randomStrlen = strlen(random);    write(fd,random,randomStrlen);    write(fd,encData,0x80);    random = genRandom();    randomStrlen = strlen(random);    write(fd,random,randomStrlen);    counter = counter + 2;  }  if (canary != *(long *)(in_FS_OFFSET + 0x28)) {                    /* WARNING: Subroutine does not return */    __stack_chk_fail();  }  return 0;}```
So a flag is read from `./flag.txt` and stored in `./out.txt` (our `flag.enc`). There is some PRNG seeding with time that is never used.
There is a loop that iterates over two chars at a time and calculates the `sha512` hash. The second loop then reverses this hash.
After that a value from `genRandom` is written, then the hash, then another value from `genRandom`.
The value returned from `genRandom` is 8 bytes long. So we start of by extracting the real data.
Then we just need to find a two character combination with the correct hash:
```pythonwith open("flag.enc", "r") as f:    d = f.read()
random_size = 8data_size = 0x80block_size = random_size*2 + data_size
import stringfrom hashlib import sha512
out = ""for x in range(0, len(d), block_size):    v = d[x+random_size:x+data_size+random_size][::-1]    for c1 in string.printable:        for c2 in string.printable:            if sha512((c1+c2).encode("ascii")).hexdigest() == v:                out += c1+c2print(out)```
Running it:
```bash$ python rev.pyJISCTF{R3V3Rs1Ng_W1Th_3Nkr3Pt10N}```