# Purple Socks (54 solves)
> We found this file hidden in a comic book store. Do you think you can reverse engineer it? We think it's been encrypted but we aren't sure. Author: nadrojisk
We are given an encrypted file. Assuming it is a reverse challenge, it is probably an encrypted executable.
First few bytes:
```31 0B 02 08 4F 4F 4F 00 00 00 00 00 00 00 00 00 4D 00 4D 00 4F 00 00 00 3E 5F 00 00 7A 00 00 00 62 73 00 00 00 00 00 00 7A 00 6E 00 45 00 66 00```
```python>>> elf = '\x7fELF'>>> bin = '\x31\x0b\x02\x08'
>>> for i in range(len(elf)):...   print(chr(ord(elf[i]) ^ ord(bin[i])))...NNNN>>>```
It looks like non zero values are xored with letter `N`. Now we can decrypt it.
```pythonf = open('out', 'wb')
with open('purple_socks', 'rb') as f:    raw = f.read() for i in range(len(raw)):    if raw[i] != 0:        f.write(raw[i] ^ ord('N'))    else:        f.write(chr(raw[i]))f.close()```
main:
```c++int main(int argc, const char **argv, const char **envp){  char v4[8192];  char dest[8192];  int *v6;
  v6 = &arg;;  lp_input = (const char *)&input;  setvbuf(stdout, 0, 2, 0);  puts("Please Login: ");  printf("username: ");  fgets((char *)lp_input, 0x2000, stdin);  remove_newline((char *)lp_input);  strcpy(dest, lp_input);  strcpy(v4, lp_input);  printf("password: ");  fgets((char *)lp_input, 0x2000, stdin);  remove_newline((char *)lp_input);  sprintf(dest, "%s:%s", dest, lp_input);  if ( !strcmp(dest, creds) )  {    printf("Welcome %s\n\n", v4);    commandline();  }  puts("Error: Incorrect login credentials");  return 0;}```
Looks like some kind of service.
The creds are `bucky:longing, rusted, seventeen, daybreak, furnace, nine, benign, homecoming, one, freight car`
Lets log in and check whats up:
```bash$ nc challenges.auctf.com 30049Please Login:username: buckypassword: longing, rusted, seventeen, daybreak, furnace, nine, benign, homecoming, one, freight carWelcome bucky
> [? for menu]: lslscall: lsencentry.shflag.txt> [? for menu]: read flag.txtThis file is password protected ...You will have to enter the password to gain access```
So, in order to get the read the flag we need the password.
Lets find check password function:
```c++int encrypt(){  size_t input_len;  size_t v1;  size_t v2;  char input[8192];  int v5;   _DWORD *out;   unsigned int j;   int v8;   int i; 
  puts("This file is password protected ... \nYou will have to enter the password to gain access");  printf("Password: ");  fgets(input, 0x2000, stdin);  input_len = strlen(input);  out = malloc(4 * input_len);  for ( i = 0; ; ++i )  {    v1 = strlen(input);    if ( v1 <= i )      break;    v5 = i % 5;    out[i] = input[i] ^ seed[i % 5];    seed[v5] = out[i];  }  v8 = 0;  for ( j = 0; ; ++j )  {    v2 = strlen(input);    if ( v2 <= j )      break;    if ( secret[j] != out[j] )      v8 = 1;  }  return v8;}```
### Solution:
```pythonsecret = [    0x0e, 0x05, 0x06, 0x1a,     0x39, 0x7d, 0x60, 0x75,     0x7b, 0x54, 0x18, 0x6a]
seed   = [0x61, 0x75, 0x63, 0x74, 0x66]
def solve():    state = 'auctf'    seed2 = [0 for i in range(5)]    out = ''    for i in range(len(secret)):                for j in range(32, 127):            c = seed[i % len(seed)]             if j ^ c == secret[i]:                out += chr(j)                seed[i % len(seed)] = j ^ c                break    print(out)
if __name__ == "__main__":    solve()```
gives `open_sesame`:
```bashPassword: open_sesameauctf{encrypti0n_1s_gr8t_12921}> [? for menu]:```
