# re06

We get a .exe file (no suprise there), which upon examining it with CFF Explorer tell us it's a nice .NET executable. This makes thing immensely easier. Wecan simply decompile it with [JetBrainers DotPeek](https://www.jetbrains.com/decompiler/).

In the main windows we see there are a few interesting functions, notably this one:

```c#
private void btn_check_Click(object sender, RoutedEventArgs e)
{
if (MainWindow.Enc(this.tb_key.Text, 9157, 41117) == "iB6WcuCG3nq+fZkoGgneegMtA5SRRL9yH0vUeN56FgbikZFE1HhTM9R4tZPghhYGFgbUeHB4tEKRRNR4Ymu0OwljQwmRRNR4jWBweOKRRyCRRAljLGQ=")
{
int num1 = (int) MessageBox.Show("Correct!! You found FLAG");
}
else
{
int num2 = (int) MessageBox.Show("Try again!");
}
}
```

Upon looking through the rest of the file we find the Enc function:

```c#
public static string Enc(string s, int e, int n)
{
int[] numArray1 = new int[s.Length];
for (int index = 0; index < s.Length; ++index)
numArray1[index] = (int) s[index];
int[] numArray2 = new int[numArray1.Length];
for (int index = 0; index < numArray1.Length; ++index)
numArray2[index] = MainWindow.mod(numArray1[index], e, n);
string s1 = "";
for (int index = 0; index < numArray1.Length; ++index)
s1 += (string) (object) (char) numArray2[index];
return Convert.ToBase64String(Encoding.Unicode.GetBytes(s1));
}
```

It's super basic Diffie-Hellmann. With a very small prime at that. The string is broken down in chars, each char is coverted to int, exponentiated and modded, then converted to unicode char. You then join the whole thing and encrpyt it as b64. This is then conmpared to the b64 hardcoded in the btn_check function.

At this point it's quite straightforward: reconvert the hardcoded b64, split in chars, reconvert to int. Then just bruteforce for i in range 255 until we get each original char.

```python
import base64
bibi = 'iB6WcuCG3nq+fZkoGgneegMtA5SRRL9yH0vUeN56FgbikZFE1HhTM9R4tZPghhYGFgbUeHB4tEKRRNR4Ymu0OwljQwmRRNR4jWBweOKRRyCRRAljLGQ'

dbg = 0
n_ = 41117
e_ = 9157
test = 'hello'
def debug(s):
if dbg == 1:
print s

def enc(s,e,n):
numarr = []
modarr = []
finstr = ""
for i in s:
numarr.append(ord(i))
debug(numarr)
for i in numarr:
modarr.append(pow(i,e,n))
debug(modarr)
for j in numarr:
finstr += unichr(i)
return modarr,finstr

soli = []
for h in base64.decodestring(bibi+'=').decode('UTF-16'):
soli.append(ord(h))

print enc(test,9157,41117)

def brute(c,e,n):
for j in range(255):
if enc(chr(j),e,n)[0][0] == c:
return chr(j)

aa = []
for i in soli:
aa.append(brute(i,e_,n_))
''.join(aa)
```
flag is ```WhiteHat{N3xT_t1m3_I_wi11_Us3_l4rg3_nUmb3r}```