# FireShell CTF 2019 – babycryptoweb
* **Category:** misc* **Points:** 60
## Challenge
> Can you help me recover the flag?>> [https://babycryptoweb.challs.fireshellsecurity.team/](https://babycryptoweb.challs.fireshellsecurity.team/)
## Solution
The challenge shows a web page with the following source code.
```php ```
The evaluated string into `$code` variable is the following.
```php$kkk = 5;$s="e1iwZaNolJeuqWiUp6pmo2iZlKKulJqjmKeupalmnmWjVrI=";$s=base64_decode($s);$res="";for($i=0,$j=strlen($s);$i<$j;$i++) {  $ch=substr($s,$i,1);  $kch=substr($kkk,($i%strlen($kkk))-1,1);  $ch=chr(ord($ch)+ord($kch));  $res.=$ch;};echo $res;```
Trying to understand the source code, following considerations can be made.
`p` and `b` are two parameters of the script.
`p` must be numeric and lesser than the evalued code dimension, i.e. it is a position into that code.
`b` is a char that must be replaced into that code.
The first char of the flag must be a `F`, so the result of `ord($ch)+ord($kch)` operation must be `70` (i.e. the decimal code of the ASCII letter `F`).
The first char of the base64 decoded string is represented by `123` decimal code, i.e. it's a `{`. 
Some considerations can be done about `$kch=substr($kkk,($i%strlen($kkk))-1,1);` instruction:* `$i%strlen($kkk)` will always be equals to `0` because `$kkk` has one char only;* the substring operation will become `substr($kkk,-1,1)` and it will always return the char `5` (i.e. one char from the end of `$kkk` string);* hence `ord($kch)` will be always `53`.
So, if `ord($ch)` for the first char is `123`, `ord($kch)` is always `53` and the result of the operation for the first char must be `70`, the wrong part of the evaluated script is the `+` char of the `$ch=chr(ord($ch)+ord($kch));` operation, because `123 - 53 = 70`.
The position of that char is `201`; you could try to replace it with `-` char.
The following URL can be used to exploit the script.
`https://babycryptoweb.challs.fireshellsecurity.team/?p=201&b=-`
And it will reveal the flag.
```F#{0n3_byt3_ru1n3d_my_encrypt1i0n!}```