> For the complete documentation index, see [llms.txt](https://sayonara.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sayonara.gitbook.io/writeups/ctf/the-cyber-cooperative-ctf-2023/rev/easycrack.md).

# easycrack

<div align="left"><figure><img src="/files/n0k56Ui7rmWyHeReQgyO" alt=""><figcaption></figcaption></figure></div>

{% file src="/files/VzdBIEfuVPhE7BFBUcRG" %}

first let's run the binary

<div align="left"><figure><img src="/files/FoYBhx92arAQmojVuZZM" alt=""><figcaption></figcaption></figure></div>

so we can see that this binary asking for which is the flag let's open the file using ghidra

we have one function called main

<div align="left"><figure><img src="/files/Hze3mi6VqPzg1kskXCuT" alt=""><figcaption></figcaption></figure></div>

1. first thing a user is prompted to enter a key&#x20;
2. The program calculates the sum of ASCII values of characters in the entered key
3. It checks if the sum is equal to `0x539` <mark style="color:green;">(1337)</mark> and if the length of the key is `0xc` <mark style="color:green;">(12)</mark>.
4. If the conditions are met, it prints "Nice key :)" along with the entered key; otherwise, it prints "Bad Key :(" with the entered key.

so we know that the flag starts with `flag{` and ends with `}` so we know 6 characters from the key we need to find the other 6 characters by bruteforcing them and checking if the sum is equal to 1337&#x20;

we know from the previous found flags the flag is always constructed using lowercase characters and numbers and \_

### Exploit :&#x20;

```python
def generate_key():
    # Known prefix and suffix
    prefix = "flag{"
    suffix = "}"

    # Iterate through all ASCII characters for the middle part
    for char1 in 'abcdefghijklmnopqrstuvwxyz_0123456789':
        for char2 in 'abcdefghijklmnopqrstuvwxyz_0123456789':
            for char3 in 'abcdefghijklmnopqrstuvwxyz_0123456789':
                for char4 in 'abcdefghijklmnopqrstuvwxyz_0123456789':
                    for char5 in 'abcdefghijklmnopqrstuvwxyz_0123456789':
                        for char6 in 'abcdefghijklmnopqrstuvwxyz_0123456789':
                            middle_part = f"{char1}{char2}{char3}{char4}{char5}{char6}"

                            # Concatenate the parts to form the complete key
                            generated_key = f"{prefix}{middle_part}{suffix}"

                            # Calculate the sum of ASCII values of characters
                            key_sum = sum(ord(char) for char in generated_key)
                            
                            # Check conditions
                            if key_sum == 0x539 and len(generated_key) == 0xc:
                                return generated_key

# Generate a key and print it
generated_key = generate_key()
print(f"Generated key: {generated_key}")

```

executing the script and waiting for a couple of minutes we get the correct key

<div align="left"><figure><img src="/files/0pjVxwVWwCHjNEGpTFc1" alt=""><figcaption></figcaption></figure></div>

### Flag :&#x20;

```
flag{aawzzz}
```