Ransomware Patch
Last updated
Description
You've captured a communication containing a patch for the source code of a well-known ransomware program. It contains an update for a library the program uses, as well as an interesting file named
key. Can you crack this ZIP and figure out the contents ofkey?*made with 7ZIP deflate on "Normal" settings
Solution
We could use 7z l -slt ransomware-final.zip to list detailed information about the ZIP file.
The first observation to be made is that we can find the files listed in the archive online.
By Googling some of the file names, we find that the files under the AES directory are from this GitHub repository.
In the detailed information, we find that the file we want to decrypt, key, was encrypted using the ZipCrypto Store algorithm. This is a legacy method that is vulnerable to a known plaintext attack.
This attack can be performed using the bkcrack tool below.
One complication, though, is that all of the other files in the archive are encrypted using ZipCrypto Deflate, which makes the cracking much harder - well, all but one! The test.cpp file was similarly encrypted using the vulnerable ZipCrypto Store.
We could thus use the plaintext of this file, which we can find from the GitHub repository, to crack the keys: ./bkcrack -C ransomware-final.zip -c "AES/test.cpp" -p test.cpp
This gives us the keys: a71f05f4 18438c7b 1cf62c29
Using these, we can crack the key file: ./bkcrack -C ransomware-final.zip -c key -k a71f05f4 18438c7b 1cf62c29 -d key.out
The key is MetaCTF{license_is_hard_to_spell}.
