KeyBruteForce.cpp

Flag : INTENT{crypt0s_ar3_the_w0rst_but_d4amn_u_g00000d}
```
#include "FlagData.h"
#include <iostream>
#include <Windows.h>

DWORD __cdecl sub_4015B0(BYTE* pbData, DWORD dwDataLen, BYTE* a3)
{
DWORD LastError; // esi
DWORD v5; // esi
DWORD v6; // esi
DWORD pdwDataLen; // [esp+4h] [ebp-Ch] BYREF
HCRYPTPROV phProv; // [esp+8h] [ebp-8h] BYREF
HCRYPTHASH phHash; // [esp+Ch] [ebp-4h] BYREF

LastError = 0;
phProv = 0;
phHash = 0;
pdwDataLen = 20;
if (!CryptAcquireContextW(&phProv, 0, 0, 1u, 0xF0000000))
return GetLastError();
if (CryptCreateHash(phProv, 0x8004u, 0, 0, &phHash))
{
if (CryptHashData(phHash, pbData, dwDataLen, 0))
{
if (!CryptGetHashParam(phHash, 2u, a3, &pdwDataLen, 0))
LastError = GetLastError();
CryptDestroyHash(phHash);
CryptReleaseContext(phProv, 0);
return LastError;
}
else
{
v6 = GetLastError();
CryptReleaseContext(phProv, 0);
CryptDestroyHash(phHash);
return v6;
}
}
else
{
v5 = GetLastError();
CryptReleaseContext(phProv, 0);
return v5;
}
}

BOOL EncryptionData(BYTE * v33, BYTE * tmp, char * num)
{
BYTE pbData[48] = { 0x08, 0x02, 0x00, 0x00,
0x10, 0x66, 0x00, 0x00,
0x20, 0x00, 0x00, 0x00};

void* v10;
memcpy(&pbData[12], v33, 20);
memcpy(&pbData[32], tmp, 16);
for (int i = 0; i < 48; i++)
printf("%02X ", pbData[i]);
puts("");
DWORD pdwDataLen = sizeof(FlagData);
DWORD Size = sizeof(FlagData);
HCRYPTPROV phProv = 0;
HCRYPTKEY phKey = 0;
unsigned char String1[16] = {
0x30, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x33, 0x30, 0x30, 0x30, 0x30,
0x33, 0x30, 0x30, 0x37
};
if (CryptAcquireContextA(&phProv, 0, MS_ENH_RSA_AES_PROV, PROV_RSA_AES, 0xF0000000))
{
if (!CryptImportKey(phProv, pbData, 0x30, 0, 1, &phKey))
CryptReleaseContext(phProv, 0);
if (CryptSetKeyParam(phKey, 1, String1, 0))
{
v10 = calloc(pdwDataLen, 1);
if (v10) {
memcpy(v10, FlagData, pdwDataLen);
char Filename[20] = "output_dec.bin";
strcat_s(Filename, num);
CryptDecrypt(phKey, 0, TRUE, CRYPT_DECRYPT_RSA_NO_PADDING_CHECK, (BYTE*)v10, &pdwDataLen);

std::string findstr("INTENT");
std::string haystack((BYTE *)v10, (BYTE *)v10 + pdwDataLen);
std::size_t n = haystack.find(findstr);
if (n != std::string::npos)
{
HANDLE hHnd2 = CreateFile(Filename, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL);
DWORD NumberOfBytesWritten2;
WriteFile(hHnd2, v10, pdwDataLen, &NumberOfBytesWritten2, 0);
CloseHandle(hHnd2);
return TRUE;
}
}
}
}

return FALSE;
}

int main()
{
BYTE v33[20] = { 0, };
BYTE tmp[16] = { 0xB9, 0xBA, 0xBB, 0xBC, 0xBD, 0xBE, 0xBF, 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0x00, 0x00, 0x00, 0x00 };

for (int i = 0; i <= (0xFF * 5); i++)
{
char num[5];
char Buffer[512] = "YouTakeTheRedPillYouStayInWonderlandAndIShowYouHowDeepTheRabbitHoleGoes0mgisthebestg5642f1266749---";
sprintf_s(num, "%d", i);
strcat_s(Buffer, num);
printf("%s\n", Buffer);
sub_4015B0((BYTE*)Buffer, strlen(Buffer), v33);
if (EncryptionData(v33, tmp, num))
break;
}
system("pause");
}
```