3

I'm trying to bruteforce a password in a 32bit Windows application (this is challenge 9 of http://www.flare-on.com/files/2015_FLAREOn_Challenges.zip), using the inscount0 pintool (https://software.intel.com/en-us/articles/pin-a-dynamic-binary-instrumentation-tool) and Powershell. This is possible because the password is actually checked letter by letter in the code. If a letter is correct, the program continues to the second letter (and so on), but if a letter is incorrect, the program terminates. The difficulty comes from the fact that the application is interactively prompting a password instead of passing it as an argument to the executable.

I've been able to make it work with the following Powershell script:

add-type -AssemblyName System.Windows.Forms

for($i=32; $i -le 126; $i++){

  # "I" is the first known letter of password
  $pass_guess = "I" + [char]$i + ".........."

  # Launch pin
  Start-Process -FilePath pin.exe -ArgumentList '-t inscount0.dll -- ch9.exe'

  # send user input
  start-sleep -Milliseconds 500
  [System.Windows.Forms.SendKeys]::SendWait("$pass_guess{ENTER}")

  # Read content of count in file
  start-sleep -Milliseconds 500
  Write-Output $pass_guess
  Get-Content .\inscount.out

}

It actually works fine and here is the output that confirmed the 1st letter of the password should by "I":

PS C:\pin> .\myscript.ps1
[removed]
H..........
Count 32890
I..........
Count 32852
J..........
Count 32890
[removed]

Indeed, the check for "I" is performed by the program with a different number of instructions as with other letters.

Anyway, if this script is working, it is obviously not optimized because the script is launching the program in a popup window for each occurrence in the loop.

I would like to know how I could improve this script. Many thanks in advance for your help.

3

in powershell use -NoNewWindow Switch if you do not want the new process to be started in a popup window

Start-process -FilePath ".\XXXXXXX" -ArgumentList "xxxx yyy ddd" -NoNewWindow

btw i read your solution and it seems the challenge doesnt check just one character and proceeds to terminate itself on failure of first it seems to check all of the 41 characters

a simple windbg oneliner below

cdb -c "bp 401a9f \".printf \\\"%c\\\",@al;gc\";g;q" flachal9.exe
0:000> cdb: Reading initial command 'bp 401a9f ".printf \"%c\",@al;gc";g;q'
I have evolved since the first challenge. You have not. Bring it.
Enter the password> abracadabragiligilichoobabygiligilichooyammayammabooo
abracadabragiligilichoobabygiligilichooyaYou are failure
quit:

it xors each of the character with the corresponding bytes as below

cdb -c "bp 401ad5 \".printf \\\"%02x \\\",@ah;gc\";g;q" flachal9.exe
0:000> cdb: Reading initial command 'bp 401ad5 ".printf \"%02x \",@ah;gc";g;q'
I have evolved since the first challenge. You have not. Bring it.
Enter the password> abracadabragiligilichoobabygiligilichooyammayammabooo

46 15 f4 bd ff 4c ef 46 eb e6 b2 eb f1 c4 34 67 39 b5 8e ef 40 1b 74 0d 60 26 45
 a8 4a 96 c9 65 e2 32 60 64 8c 65 e3 8e 9f You are failure
quit:

and rotate-lefts(ROL) the result with the bytes below

cdb -c "bp 401b14 \".printf \\\"%02x \\\",@cl;gc\";g;q" flachal9.exe
0:000> cdb: Reading initial command 'bp 401b14 ".printf \"%02x \",@cl;gc";g;q'
I have evolved since the first challenge. You have not. Bring it.
Enter the password> abracadabragiligilichoobabygiligilichooyammayammabooo

56 f5 ac 1b b5 93 7e b8 23 da 0a f2 01 61 5c c8 4c d6 16 55 67 b8 c1 f8 bc 11 fa
 9b 6b f9 d4 75 87 ca ce be 4e 6e f1 b9 6e You are failure
quit:

and cmpexchg with the bytes below

cdb -c "bp 401b14 \".printf \\\"%02x \\\",by(@ebx+@esp+2c);gc\";g;q" flachal9.exe
0:000> cdb: Reading initial command 'bp 401b14 ".printf \"%02x \",by(@ebx+@esp+2c);gc";g;q'
I have evolved since the first challenge. You have not. Bring it.
Enter the password> abracadabragiligilichoobabygiligilichooyammayammabooo

c3 cc ba 4e f2 eb 27 19 c6 42 06 16 5d 53 55 0e 66 f4 f9 30 9a 77 56 6b f0 8e dc
 2e 50 e1 5a 80 48 5d 53 c2 b8 d2 01 c3 bc You are failure
quit:

with these three arrays it is possible to keygen the key

keygen src

#include <stdio.h>
#include <intrin.h>
unsigned char xorseed[] = {
   70, 21,244,189,255, 76,239, 70,235,230,178,235,241,196, 52,103, 57,181,142,239, 64,
   27,116, 13, 96, 38, 69,168, 74,150,201,101,226, 50, 96,100,140,101,227,142,159,  0
};
//array contains original bytes  % 20
unsigned char rolseed[] = {
  22, 21, 12, 27, 21, 19, 30, 24,  3, 26, 10, 18,  1,  1, 28,  8, 12, 22, 22, 21,  7,
  24,  1, 24, 28, 17, 26, 27, 11, 25, 20, 21,  7, 10, 14, 30, 14, 14, 17, 25, 14,  0  
};
unsigned char cmpseed[] = {
  195,204,186, 78,242,235, 39, 25,198, 66, 06, 22, 93, 83, 85, 14,102,244,249, 48,154,
  119, 86,107,240,142,220, 46, 80,225, 90,128, 72, 93, 83,194,184,210, 01,195,188,  0  
};
unsigned char key[50] ={0};
int main (void) {
  for(int i = 0; i<42;i++) {
   key[i] = _rotr8(cmpseed[i],rolseed[i]) ^ xorseed[i];
  printf("%c",key[i]);
  }
  return 0;  
}
  • Wow! That's impressive! Thank you for this very valuable input. – Sebastien Damaye Sep 30 '15 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.