Well someone just beat me to it. Fuck.
Pr0t3ct!on#cyber_security@12*12.2011+
Why? So you can enter it and be redirected to their company website?I don't get it. Whats the answer then?
Why? So you can enter it and be redirected to their company website?
THE RELIEF WILL BE AMAZING!
Do you promise.... I need to see that fucking company website so bad!!
And plz bitch, dickrolling a seasoned dick-roller. Wait that didn't cum out right.
Part 1 is a shellcode that decrypts the base64 string in the header of the PNG. This leads to
http://www.canyoucrackit.co.uk/15b436de1f9107f3778aad525e5d0b20.js
Part 2 you have to complete a virtual machine. This leads to:
http://www.canyoucrackit.co.uk/da75370fe15c4148bd4ceec861fbdaa5.exe
Disassembling the exe now... anyone who knows what he is doing is welcome to join the party.
So did you figure out what the .exe file was all about?
It was on national news tonight.btw...sounds like a good link-bait idea... I will host something like this soon.
Well someone just beat me to it. Fuck.
Pr0t3ct!on#cyber_security@12*12.2011+
Still on it. Exe requests license.txt, which needs to contain a decoded version of a hash. Some russian with rainbow tables bruteforced the hash to resolve to 'cyberwin', while we know that the file must have a header of 'gchq' (hardcoded in the exe, can find by decompiling easily).
The program then takes these values, and reads 12 more bytes from license.txt. It then makes a request to canyoucrackit.co.uk/hqDTK7b8K2rvw/0/0/0/key.txt
Now the /0/0/0/ are incorrect. They are the last 3 DWORDs read from license.txt, encoded via %X. So we're now trying to figure out what those 3 DWORDS are. In the previous problems, there were 3 DWORDS suspiciously left lying around doing nothing. I spent an hour inputting combinations of those, but to no avail.
I'm stuck now. Soon as I figure it out I suspect I'm at the end.
Damn, I got final exams this week![]()