Rating: 0

```

REM ***** BASIC *****

REM Provided was a excel file with a bunch

REM of numbers in the cells A2 to A82 and

REM a ton of formulas in the cells B2 to E82

REM

REM cells B1 to E4 were setup to have a random number.

REM in between 1 and 256

REM

REM and there was a frormula in cell G2

REM that provided the check for the input.

REM =IF(AND(E82=1,B1>1,B1<=256,C1>1,C1<=256,D1>1,D1<=256,E1>1,E1<=256,B1-C1=46,E1-D1=119),"Congrats! Here is yout flag: INSA{"&TEXT(B1,"0")&"-"&TEXT(C1,"0")&"-"&TEXT(D1,"0")&"-"&TEXT(E1,"0")&"}","Wrong input")

REM ===============================================

REM

REM

REM I took a look at the formula in the cell G2

REM and a quick peak at some in the range[A2:E82]

REM and i realized that what was going on in the

REM cells in the range [A2:E82] was somthing

REM I did't not wish to spend my time on.

REM =IF(MID($A2,4,1)=TEXT(COLUMN()-1,"0"),IF(MID($A2,1,1)="1",MOD(SUM(INDIRECT(ADDRESS(ROW()-1,1+MID($A2,2,1))),INDIRECT(ADDRESS(ROW()-1,1+MID($A2,3,1)))),256),IF(MID($A2,1,1)="2",MOD(SUM(INDIRECT(ADDRESS(ROW()-1,1+MID($A2,2,1))),-INDIRECT(ADDRESS(ROW()-1,1+MID($A2,3,1)))),256),IF(MID($A2,1,1)="3",MOD(PRODUCT(INDIRECT(ADDRESS(ROW()-1,1+MID($A2,2,1))),INDIRECT(ADDRESS(ROW()-1,1+MID($A2,3,1)))),256),IF(MID($A2,1,1)="4",MOD(MOD(INDIRECT(ADDRESS(ROW()-1,1+MID($A2,2,1))),INDIRECT(ADDRESS(ROW()-1,1+MID($A2,3,1)))),256),IF(MID($A2,1,1)="5",MOD(BITAND(INDIRECT(ADDRESS(ROW()-1,1+MID($A2,2,1))),INDIRECT(ADDRESS(ROW()-1,1+MID($A2,3,1)))),256),IF(MID($A2,1,1)="6",MOD(BITOR(INDIRECT(ADDRESS(ROW()-1,1+MID($A2,2,1))),INDIRECT(ADDRESS(ROW()-1,1+MID($A2,3,1)))),256),IF(MID($A2,1,1)="7",IF(INDIRECT(ADDRESS(ROW()-1,1+MID($A2,2,1)))=INDIRECT(ADDRESS(ROW()-1,1+MID($A2,3,1))),1,0),"X"))))))),B1)REM

REM ===============================================

REM so i focust on cell G2

REM

REM INTERESTING STUFF FROM CELL G2:

REM +-------------------

REM | E82=1 <---- the value of E82 the result of

REM | a ton of formulas in the cells

REM | B1>1, \ [A2:E82]

REM | B1<=256, |

REM | C1>1, |

REM | C1<=256, \ so all the input has to

REM | D1>1, / be in between 1 and 256

REM | D1<=256, |

REM | E1>1, | and there are some more

REM | E1<=256, / restraints down there.

REM |

REM | B1-C1=46, <---1B = 1C+46

REM | E1-D1=119), <--- 1E = 1D+119

REM +---------------------------------------

REM with all these restraints we are well within a accepable

REM Range to brute force the correct input.

REM So within a couple of minutes i whiped up a python script.

REM that printed out all posible inputs within the restraints.

REM

REM the only problem we have now is how are we going to provide

REM this to the spreadsheet. I can not just pipe it to libre office.

REM

REM So i decided to readup a little bit on excel macros (or libre-office macros)

REM and the basic language.

REM

REM And came up with this scipt. :-)

Sub Main

End Sub

REM I was to lazy to lookup how to access a cells text.

REM so i added a cell the formula =IF(G2="Wrong input",1,0) to cell M3

REM ( you know, hackers will hack)

Sub BruteForceTheFlag

sjiet = ThisComponent.sheets.getByName("Feuil1")

B = sjiet.getCellRangeByName("B1")

C = sjiet.getCellRangeByName("C1")

D = sjiet.getCellRangeByName("D1")

E = sjiet.getCellRangeByName("E1")

flag = sjeit.getCellRangeByName("M3")

C.value = 1

B.value = C.value +46

D.value = 1

E.value = D.value+119

Do

C.value = C.value +1

B.value = C.value +46

DO

D.value = D.value+1

E.value = D.value+119

Loop Until D.value > 256 OR E.value > 256 OR flag.value = 0

if E.value > 256 then

D.value = 1

E.value = D.value+119

endif

Loop Until flag.value = 0 OR B.value > 256

End Sub

REM found two flags.

REM INSA{75-29-13-132}

REM INSA{203-157-13-132} <--- this one was the valid one.

REM it was pointed out in the challenge

REM decription that the were two valid inputs.

REM and that the correct flag was the one was the one with the highes sum.

REM ..

REM wich was nice of them to point this out..

REM unlike what happends some time when there are

REM over 60.000 valid inputs, and all you get is a

REM md5sum of the valid one in exchage for 20 point.

REM Not pointing any finger here. *cough* uutCTF.*cough**cough*

```