> For the complete documentation index, see [llms.txt](https://pikachuuu1436.gitbook.io/re_fun/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pikachuuu1436.gitbook.io/re_fun/ctf-challenges/other-ctf-challenges/sekai-bank.md).
# Sekai Bank
### Challenge Description
{% code overflow="wrap" %}
```
Hi I heard my friend has registered herself for a new bank account! I wonder if the bank system will be secure(I managed to get the program and encrypted account details, but something seems to be missing...)
After decrypting the json file, simply login with the following details:
Username: Mizuki Password: sadge
```
{% endcode %}
### Solution
The following 2 files were provided for the challenge:
bank.json is just full of junk stuff which implies it might be encrypted:
While banky is just an X64 ELF file:
When the executable is first ran, the following error is shown:
As there's nothing more to look around, its time to disassemble the file!
#### Disassembling bank
Here I will be using cutter, a free reverse engineering tool that is built upon radare! Feel free to use any other debugging tools/disassemblers such as IDA to disassemble the executable! Here, I used the aaaa analysis option.
First the entry point is disassembled which shows that libc\_start\_main is being called, with the main function is being passed into the first argument:
From here we can access main, which is at 0x6aa0!
Here the auto analysis auto name a function to sub.bank.json before printint out what looks like the main menu, maybe it does something to the json file before showing the main menu?
#### JSON File Decryption:
The following is the disassembly for the start of sub.bank.json\_5ad0:
The program attempts to open the file with fopen, exiting if it fails
If successful, the program will get the file size of the file and save to file\_size, where a buffer will be created with
```c
calloc(1,file_size)
```
There it will jump to another subroutine sub.fread\_5c0b, as identified on cutter!
When decompiled, it shows that the fread is being used to read from the file into the buffer created:
After the file is read, a suspicious subroutine secret\_key\_35750 is being called with a reference being passed into it. This reference is then passed into EVP\_CIPHER\_CTX\_new\_35a50, where EVP is a popular interface provided by the OpenSSL library to perform cryptographic operation. The buffer and file size is also being passed into this subroutine, which makes it plausible that decryption might take place here! A quick look into the function confirms this:
Here it inits the Cipher Context, and uses AES CBC with a 256 bit key passed from param\_1 with the IV stored in 0x3dc80. The cipher will then be used to decrypt the buffer in param4! This means that the bank.json file is being decrypted from here! Hence the key is being retrieved in secret\_key\_35750!
#### Getting the key:
The following is the decompilation of secret\_key\_35750:
Here the program tries to open secret.key, which will stop the program if unsuccessful which is why our program crashed!
For secret.key, it will read 2 bytes from secret.key and run them through the first byte through a function 16 times and the 2nd byte through another function 16 times(which will be shown below) and the results will be saved to a 32 bytes buffer which will be stored in param1 which will be used as the key for decryption.
Here, these two functions take in an integer which will be run through an algorithm known as a hashing algorithm. This means that the key is generated from 2 bytes which makes it brute forceable!
Here is the bruteforce script:
```python
import subprocess
for i in range(65536):
key = i.to_bytes(2,byteorder="little",signed=False)
with open("secret.key","wb") as f:
f.write(key)
process = subprocess.Popen("./banky", text=True, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
while True:
line = process.stdout.readline()
if not line:
break
print(line)
while True:
try:
line = process.stderr.readline()
if not line:
break
print(line)
except UnicodeDecodeError:
break
if process.returncode == 0:
break
```
Here it runs through 0 - 65535, which is the larges integer 2 bytes can hold and saving it to secret.key and running the program. Once the key is correct, ideally the main menu should pop out instead of "An error occured"
Yayyy, the key is obtained:
With the credentials provided in the description, the flag can be obtained:
Flag:
```
Malaysia{kUch1Ng}
```
