{"id":24,"date":"2011-06-09T10:03:05","date_gmt":"2011-06-09T10:03:05","guid":{"rendered":"http:\/\/piratesecurityblog.com\/?p=24"},"modified":"2016-09-28T10:03:32","modified_gmt":"2016-09-28T10:03:32","slug":"gchq-challenge-solution-stage-3","status":"publish","type":"post","link":"http:\/\/piratesecurityblog.com\/?p=24","title":{"rendered":"GCHQ Challenge Solution \u2013 Stage 3"},"content":{"rendered":"

The final stage of the GCHQ challenge was a small (5kB) x86 Windows\/cygwin binary. Analyzing it in IDA Pro, I could see that it expects a 24 byte license file with the following format:<\/p>\n

\n
<\/div>\n
\n\n\n\n
\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n<\/div>\n<\/td>\n
\n
\n
“gchq”\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0: Static header<\/div>\n
Password\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0: Eight character password, matching the DES-hash hqDTK7b8K2rvw (hq=salt)<\/div>\n
Key from stage 1\u00a0\u00a0: 32-bit value<\/div>\n
Keys from stage 2 : Two 32-bit values<\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

The above could be deduced from the following reverse-engineered code:<\/p>\n

\n
<\/div>\n
\n\n\n\n
\n
\n
1<\/div>\n
2<\/div>\n
3<\/div>\n
4<\/div>\n
5<\/div>\n
6<\/div>\n
7<\/div>\n
8<\/div>\n
9<\/div>\n
10<\/div>\n<\/div>\n<\/td>\n
\n
\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>if<\/span> (<\/span>license_buf<\/span>[<\/span>0<\/span>]<\/span> ==<\/span> 0x71686367<\/span>)<\/span> {<\/span> \/* 67 63 68 71 = “gchq” *\/<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>hash<\/span> =<\/span> crypt<\/span>(<\/span>(<\/span>char<\/span> *<\/span>)<\/span> &<\/span>license_buf<\/span>[<\/span>1<\/span>]<\/span>,<\/span> “hqDTK7b8K2rvw”<\/span>)<\/span>;<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>if<\/span> (<\/span>!<\/span> strcmp<\/span>(<\/span>hash<\/span>,<\/span> “hqDTK7b8K2rvw”<\/span>)<\/span>)<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>success<\/span> =<\/span> 1<\/span>;<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>printf<\/span>(<\/span>“loading stage1 license key(s)…\\n”<\/span>)<\/span>;<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>keys<\/span>[<\/span>0<\/span>]<\/span> =<\/span> license_buf<\/span>[<\/span>3<\/span>]<\/span>;<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>printf<\/span>(<\/span>“loading stage2 license key(s)…\\n”<\/span>)<\/span>;<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>keys<\/span>[<\/span>1<\/span>]<\/span> =<\/span> license_buf<\/span>[<\/span>4<\/span>]<\/span>;<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>keys<\/span>[<\/span>2<\/span>]<\/span> =<\/span> license_buf<\/span>[<\/span>5<\/span>]<\/span>;<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>}<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

If a valid license is found, it calls a function that requests the following URI from the specified host (which should obviously still be www.canyoucrackit.co.uk): \/hash\/A\/B\/C\/key.txt<\/p>\n

Where:<\/p>\n