Monday, May 03, 2004 :::
 

Puisqu'on en est a parler cryptographie je vais recaser un tutorial comme ca je n'aurais plus le sentiment de l'avoir ecrit pour rien, non pas que le fait d'ecrire m'ait specialement epuise, mais quand meme pour le principe c'est vexant. Enfin bon ce que j'en dis ...

Dans le cadre d'un wargame sur le net dans ma periode 'l'ordinateur sera une extension de mon corps' avant la phase 'oh et puis merde', j'avais tripe sur la phase de decryptage d'un message... hmmmm. Et puis vu que sur 4 lecteurs il y en 3 qui sont d'office interesses par le sujet (je me compte parmi les trois bien sur, mais je ne le relirai pas ce qui fait quand meme 2 lecteurs sur 4, ce qui, si l'on considere cela en pourcentage, a savoir 50%, est enorme. Vous remarquez quand meme que je fais une parenthese a la Tranxenne, et que bon, un peu comme lui j'essaie de vous amener doucement mais surement en racontant je ne sais pas trop quoi vers la phase finale d'un parenthese, en clair, une parenthese) .


................................................ BOF .................................................................

Pen and Paper, are useful tools indeed | lvdz


This will cover how to decrypt a message that is a part of a game online.

The following hints were available :

- It involves shifting encryption
- It has something to do with ASCII
- The message concerns the path of a program that was installed on a computer.

And the message is :

j]_]\alL



s`c]qwdg[YdweY[`af]tkg^loYj]te?{Š‡‹‡~Œto?†|‡?‹t[?ŠŠ}†Œn}Š‹?‡†tj?†u

:j?†g†{}:U:[Rttoaf\goktt‹‘‹Œ}…KJtte?{Š‡‹‡~Œttj?†g†{}F}?}:


Ok basically http://www.google.com to get infos on shifting encryption, and get an ASCII table with extended ASCII codes, then
get knowledge of Caesar cipher.

As the title suggests, the power of a super computer wont be needed to decrypt the message (although if you can code it's easier).

First thing is to find the key. The idea is to get the ascii code for each message character, then apply the key (shift codes
regarding a certain number). Hell cool but it would be so much easier with a computer. So let's follow one of the hint: The message
concerns the path of a program. We can expect to find something like c:\stuff\superstuff.com .bat .exe or sthg. And we have to
assume that only one key is applied to the message.
If you begin to write down the ascii codes of all message symbol youll notice you wont be able to get some of them like ? .
The solution is to get an hex editor, open the file. The message will look like this :

j]_]\alL......s`c]qwdg[YdweY[`af]tkg^loYj]te.{....~.to..|...t[...}..n}.....tj..u...:j..g.{}:U:[Rttoaf\goktt....}.KJtte.{....~.ttj
..g.{}F}.}:..

With the hex editor you get hx codes as well, as a matter of fact the message can be viewed as :

6A5D5F5D5C616C4C0D0D0A0D0D0A7360635D717764675B59647765595B6061665D746B675E6C6F596A5D7465817B8A878B877E8C746F81867C878F8B745B
8D8A8A7D868C6E7D8A8B818786746A8D86750D0D0A3A6A8D8667867B7D3A553A5B5274746F61665C676F6B74748B918B8C7D854B4A747465817B8A878B877E8C
74746A8D8667867B7D467D907D3A0D0A


The way to find the key is check the message in your hex editor, check out if something could give a hint, like }.} at the end
of the message. Assuming the fact we look for a program the most obvious extension of the file would be .exe . Confirmation with
the ascii table (note that the hx code of the ' . ' is taken from the hex editor, not just checked in the ascii table that gives 2E
although it is 90 for the following, and adopt other codes as well):

Dec Hx Chr

125 7D }
90 .
101 65 e
120 78 x

Note: If you check your ascii table you may not find the hx code 90, because the usual ascii table stops at 7F. This is why you
need extended ascii code. The hx codes follow this rule : 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F 20 21 22 etc.
128 is the first extended dec code; as dec code 127 = hx code 7F, dec code 128 = hx code 80, 129 -> 81 , 138 -> 8A etc.
The hx code 90 is equivalent to the dec code 144.
We then have:

Dec Hx Chr
125 7D }
144 90 .
101 65 e
120 78 x

So } should be a e encrypted and . should be x. Let's substract } dec code with e dec code: 125-101=24. If we do the same
operation with . and x we find 24 too.
There is a good chance that }.} is exe encrypted, and that the key would be -24 ( = the dec values in the original message were
incremented by 24 in order to be encrypted.)

A try at the beginning of the message gives REGEDiT etc, which concerns a regedit key so no need to decrypt this part as we only
need the path, it's better beginning by the end (actually starting from }.} )
The method is to get the hx code of each character with the hex editor, then get the dec value with the ascii table, then substract
24 to get the original character.

The path to be found is : C:\\WINDOWS\\system32\\Microsoft\\RunOnce.exe

As we need the correct form it'd rather be : C:\WINDOWS\system32\Microsoft\RunOnce.exe


Well yeah a pen and a piece of paper are more useful with an ASCII table and an hex editor.


.............................................EOF.........................................................


Ceci dit la cryptographie n'est plus trop a la mode en ce moment, je ne saurais que vous conseillez de vous tourner vers quelquechose de plus social, vu que c'est le printemps.

::: posted by Lapsus van de Zloot at 1:47 AM

Comments: Post a Comment