Разминка (Warmup)

Platform: hackerlab | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: Windows | Author: XESXOR | Date: 2025-12-25 | Status: Solved Techniques: AES-CBC decryption with hardcoded key/IV, Binary analysis with xxd/strings, .NET metadata analysis (#US heap string extraction), Static data extraction from PE sections

Summary

Task: .NET PE32 executable with AES encryption, find the correct password. Solution: Extract hardcoded AES key/IV from #US heap and encrypted flag from data section, decrypt with AES-CBC.

Разминка (Warmup) — Hackerlab

Description

Simple .NET application reverse engineering task. Need to find the correct password.

Files

• task_rev.exe - .NET PE32 executable (.NET Framework 4.8)
• crpyt.dll - .NET DLL with AES encryption function
• Warmup.txt - text file (red herring with ZWSP steganography)

Analysis

File Type Identification

 bash read-only • copy allowed Copy
file task_rev.exe
# task_rev.exe: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows

Application Logic

The task_rev.exe application:

1. Prompts user for password
2. Encrypts the entered password using AES
3. Compares the result with a hardcoded encrypted value ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Data Extraction from Binary

AES Key (16 bytes)

Found in #US heap at offset 0xABE:

CODEBY__PASSWORD

AES IV (16 bytes)

Found in #US heap at offset 0xAE0:

IV82941840912841

Encrypted Flag (32 bytes)

Static byte array at offset 0xDD8:

5a5a83ad036c8b1565880b23659abfdeb2802dc5dc417a8a12add2801065f74a

Red Herring

In #Strings heap there is a hex string:

CB95D118D46B80B62AA14054FFE9DFB4C4C9F34BB670DF425EA9EE0B8632B219

This is a distraction — this string is not the encrypted flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The Warmup.txt file also contains ZWSP steganography — another red herring.

Solution

Flag Decryption

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from Crypto.Cipher import AES
import binascii

# Data from binary
key = b'CODEBY__PASSWORD'  # 16 bytes - AES-128
iv = b'IV82941840912841'   # 16 bytes
ciphertext = binascii.unhexlify('5a5a83ad036c8b1565880b23659abfdeb2802dc5dc417a8a12add2801065f74a')

# AES-CBC decryption
cipher = AES.new(key, AES.MODE_CBC, iv)
decrypted = cipher.decrypt(ciphertext)

# Remove PKCS7 padding
padding_len = decrypted[-1]
flag = decrypted[:-padding_len].decode('utf-8')
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

print(flag)

Result

CODEBY{REDACTED}

Notes

• .NET metadata stores strings in #US (User Strings) heap
• AES-128 uses a 16-byte key
• AES-CBC requires IV of the same length as the block (16 bytes)
• PKCS7 padding: the last byte indicates the number of padding bytes ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍