Suninatas Game 27

Posted on Edited on In Views: Disqus: Word count in article: 1.7k Reading time ≈ 6 mins.

challenges

Game 27

1
2
3
NSA has intercepted a chatter between mafia organization members from an IRC server.
investigators are certain that the message has some secret, however they can't find any clue.
your mission is to help the NSA investigators and reveal the secret of this message.

Pruss is my name. I am a member of russian mafia group. we communacate via a secure channel with secure password like.. \(A\)"4kruss password has to be long and it should contain alphabet, number, etc. I added 'russ' at the end because my name is Pruss. and this is our password convention. we must add 'russ' to end.. because it is our code name and we are very bad russian. we use secure communication since FBI monitors our communications on the Internet. we can't use password like DDDDDHHHHHHPDDDDDruss. because these passwords can be easily broken by FBI hackers. even if the password is long enough,(something like @@@@@@@@@@@@@@@@@@@@russ) it is not secure because there is only one repeated character '@'. anyway, using secure password is important... Pruss is actually not only my name, it is also code name of our mafia. we use similar names. one of my friend's name is Druss. Druss is my best friend and a professional killer. but he is not good at security. one day Druss used a password DDDDruss I told him this is very bad and weak password. the FBI will break it very easily. so he changed his password into HHHHHHHHHHHHHHHHHHHHHHHHHHruss. I told him even if password is long, it is weak if there is no combination with number and symbol... he said 'ok Pruss, this time I'll make a very long and secure password which contains number and symbol as well!' and he made '11111DDDDD@@@@@@@@@@PDDDDD@@@@@@@@@@PDDDDDHHHHHHHHHHHHHHHHHHHHruss'!! and asked me if this is secure enough. I told him it is secure, but it is long to remember. he said 'thank you Pruss you always teach me computer security' anyway this was small talk and I will tell you something about mafia life. Druss likes to listen to music, such as rock, pop and jazz... even though he is a tough killer he has sensitive heart.. Druss likes to dressed up with very black jacket with black jean, he thinks it is a cool fashion, but I don't like it.. Druss has high IQ, he is a member of group called MENSA(group of people who h... [truncated]

translate

我叫普鲁斯，是俄罗斯黑手党组织的成员。我们通过安全通道进行通信，使用类似这样的安全密码：\(A\)"4kruss。密码必须足够长，并且包含字母、数字等。我在末尾加了“russ”，因为我的名字是Pruss制。这是我们的密码约定。我们必须在末尾加上“russ”，因为它是我们的代号，而且我们的俄语很差。我们使用安全通信是因为FBI会监控我们在互联网上的通信。我们不能使用像DDDDDHHHHHHPDDDDDruss这样的密码，因为FBI的黑客很容易破解这些密码。即使密码足够长（例如@@@@@@@@@@@@@@@@@@@@russ），它也不安全，因为其中只有一个重复的字符“@”。总之，使用安全密码很重要……Pruss实际上不仅是我的名字，也是我们黑手党的代号。我们使用类似的名字。我的一个朋友的名字是Druss。Druss是我最好的朋友。我的朋友兼职业杀手，但他不太懂安全。有一天，德鲁斯用了一个很弱的密码：DDDDruss。我告诉他，这个密码非常糟糕，FBI 很容易就能破解。于是他把密码改成了 HHHHHHHHHHHHHHHHHHHHHHHHHHHHruss。我又告诉他，即使密码很长，如果没有数字和符号的组合，也是不安全的……他说：“好的，普鲁斯，这次我一定要设置一个非常长、非常安全的密码，里面要包含数字和符号！”他输入了“11111DDDDD@@@@@@@@@@PDDDDD@@@@@@@@@@PDDDDDHHHHHHHHHHHHHHHHHHHHHHruss”！然后问我这样够不够安全。我告诉他很安全，但是有点长，记不住。他说“谢谢你，Pruss，你总是教我电脑安全”。总之，这只是闲聊，接下来我要讲讲黑手党的生活。Druss喜欢听音乐，比如摇滚、流行和爵士……虽然他是个冷酷的杀手，但他有一颗柔软的心。Druss喜欢穿黑色夹克配黑色牛仔裤，他觉得这样很酷，但我并不喜欢。Druss智商很高，他是门萨俱乐部（智商超过150的人组成的组织）的成员，所以他非常非常聪明。Druss有个女朋友，名叫Hruss。她也是我的朋友。她非常非常漂亮，而且还是个杀手（！）。德鲁斯很喜欢赫鲁斯，他们彼此相爱。黑手党成员之间搞暧昧是很常见的。mafia@russia.ru 是我们的服务器。我们的服务器上有很多关于我们犯罪的数据，所以FBI的黑客正在试图入侵mafia@russia.ru，但我们不用担心，因为我们使用了安全的密码（我们之前讨论过），就像我之前说的那样。总之……普鲁斯听起来有点像“Press”（新闻），所以“Press”是我的昵称，虽然有点幼稚，但我认为也挺搞笑的。德鲁斯总是用我的昵称“Press”取笑我，有时我会生气，但我不会表达我的感受，因为德鲁斯是个职业杀手，我不想被枪杀。被黑手党朋友枪杀是有可能的。这种情况发生过一次。多年前，德鲁斯枪杀了一个朋友，他也是黑手党成员。他们吵了一架，然后就……德鲁斯和朋友吵得很凶，结果他开枪打伤了另一个朋友……从那以后，我总是跟他说些好话。其实，德鲁斯之前设置的那个“安全密码”我觉得很蠢。但我还是很客气地跟他说了。谁会设置像“@@PDDDDDPDDDDDHPDDDDD@@@@@PDDDDDPDDDDD@@@PDDDDDruss”这样的密码？没人会觉得这是个密码。在我看来，一个安全的密码应该是这样的……kNz3i!Bs4jP

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
#!/usr/bin/env python3
"""
x86 Emulation Script using Unicorn Engine
Used to extract flag characters pushed onto the stack during execution.
"""

import sys
from unicorn import *
from unicorn.x86_const import *

# Configuration
CODE_FILE = '../../../Downloads/message.txt'
BASE_ADDRESS = 0x1000000
STACK_ADDRESS = 0x2000000
MEM_SIZE = 2 * 1024 * 1024  # 2MB

# Global storage for the extracted flag
flag_chars = []

def hook_code(uc, address, size, user_data):
    """Optional: Trace instructions for debugging."""
    # eax = uc.reg_read(UC_X86_REG_EAX)
    # print(f">>> Tracing instruction at 0x{address:x}, EAX = 0x{eax:x}")
    pass

def hook_mem_write(uc, access, address, size, value, user_data):
    """
    Monitor memory writes to catch PUSH instructions.
    In many CTF challenges, characters are pushed onto the stack one by one.
    """
    if access == UC_MEM_WRITE:
        try:
            char = chr(value)
            if char.isprintable():
                flag_chars.append(char)
                print(f"[!] Stack Push: '{char}' (0x{value:02x})")
        except Exception:
            pass

def main():
    # Load the shellcode/binary
    try:
        with open(CODE_FILE, 'rb') as f:
            code = f.read()
    except FileNotFoundError:
        print(f"Error: {CODE_FILE} not found.")
        sys.exit(1)

    print(f"Emulating x86 code ({len(code)} bytes)...")

    try:
        # Initialize emulator in x86 32-bit mode
        mu = Uc(UC_ARCH_X86, UC_MODE_32)

        # Map memory for code and stack
        mu.mem_map(BASE_ADDRESS, MEM_SIZE)
        mu.mem_map(STACK_ADDRESS, MEM_SIZE)

        # Write code to memory
        mu.mem_write(BASE_ADDRESS, code)

        # Initialize registers
        mu.reg_write(UC_X86_REG_EAX, 0x0)
        # Set stack pointer to the middle of the mapped stack region
        mu.reg_write(UC_X86_REG_ESP, STACK_ADDRESS + (MEM_SIZE // 2))

        # Add hooks
        mu.hook_add(UC_HOOK_CODE, hook_code)
        mu.hook_add(UC_HOOK_MEM_WRITE, hook_mem_write)

        # Execute the code
        mu.emu_start(BASE_ADDRESS, BASE_ADDRESS + len(code))

    except UcError as e:
        # Emulation often ends with an error when shellcode runs off the end
        # or lacks a proper exit syscall, which is expected.
        print(f"
Emulation stopped: {e}")

    # Output the results
    if flag_chars:
        print("
" + "="*20)
        print(f"Extracted Flag: {''.join(flag_chars)}")
        print("="*20)
    else:
        print("
No printable characters captured from stack writes.")

if __name__ == '__main__':
    main()
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
❯ python x86_emu_stack_extractor.py
Emulating x86 code (3413 bytes)...
[!] Stack Push: 'k' (0x6b)
[!] Stack Push: 'e' (0x65)
[!] Stack Push: 'y' (0x79)
[!] Stack Push: '_' (0x5f)
[!] Stack Push: 'i' (0x69)
[!] Stack Push: 's' (0x73)
[!] Stack Push: '_' (0x5f)
[!] Stack Push: 'a' (0x61)
[!] Stack Push: 'c' (0x63)
[!] Stack Push: 'c' (0x63)
[!] Stack Push: 'b' (0x62)
[!] Stack Push: 'g' (0x67)
[!] Stack Push: 'g' (0x67)
[!] Stack Push: 'j' (0x6a)

Emulation stopped: Invalid memory read (UC_ERR_READ_UNMAPPED)

====================
Extracted Flag: key_is_*******
====================
accbggj