| MMC2 |
[Click to reveal]this is a CTF challange, nke found a "bug" (i call that a feature) that sometimes password can be accepted but the flag won't be correctly decrypted, so the correct solution is to get the decrypted flag.
|
2026-08-02 07:59 |
| CrackmesForBeginners (CFB) #10 |
[Click to reveal]1. find the original PUBLICKEYBLOB, ImportKeyPair cbInput site, key LEA, and CAPIPUBLICBLOB string
2. .rdata pad RW and plant RSAPUBLICBLOB at img RVA 0x2723d (RIP-relative LEA works)
3. retarget the key LEA and set cbInput 0x94 to 0x9b
4. rename blob type CAPIPUBLICBLOB to RSAPUBLICBLOB
5. restore page protections
D:\Crackmes\MT-crackmes>build\Release\mtcrack.exe launch Crackmes-2\CFB\CFB10.exe --bypass-all --patch Crackmes-2\CFB\cfb10.mts
[*] script id=1 (78 stmt, line 4)
[*] starting...
[*] script id=1 trigger=entry (78 stmt, line 4)
[*] anti-anti-debug modules active (universal)
[*] script armed va 0x7ff7326e6b3c
[script] id=1 hit#$hit=1 (78 stmt)
[scan] count=1 first=0x7ff73270287b
[script] CFB10 markers present
[scan] count=1 first=0x7ff732702420
[script] original PUBLICKEYBLOB @0x7ff732702420 rva=0x22420
[scan] count=1 first=0x7ff7326e291a
[script] cbInput site @0x7ff7326e291a rva=0x291a
[script] key LEA @0x7ff7326e290a rva=0x290a
[scan] count=1 first=0x7ff732702718
[script] CAPIPUBLICBLOB @0x7ff732702718 rva=0x22718
[script] blob dest @0x7ff73270723d rva=0x2723d
[protect] 0x7ff73270723d size=0xa0
[script] planted RSAPUBLICBLOB len=0x9b
[protect] 0x7ff73270723d size=0xa0
[protect] 0x7ff7326e290a size=0x20
[script] LEA rel32 low32=0x2492c
[protect] 0x7ff7326e291a size=0x10
[script] cbInput = 0x9b
[protect] 0x7ff7326e290a size=0x20
[protect] 0x7ff7326e291a size=0x10
[protect] 0x7ff732702718 size=0x20
[script] blob type -> RSAPUBLICBLOB
[protect] 0x7ff732702718 size=0x20
[dump] @0x7ff73270723d len=32 "RSA1" hex 52 53 41 31 0 4 0 0 3 0 0 0 80 0 0 0 0 0 0 0 0 0 0 0 1 0 1 d0 69 d0 89 41
[script] USER=lvhatpurple
[script] SIG=6b7d830966e09a93a18a31bca0c9e0cc1d81256a62426df9dc7f17ae2a090bbd8437f60990f5fbfecad508dffc21463211f4f5df713ed5aed1e38edc856680458ac55ce6295e1ee8488c1fc7f5c1578068a91725c2933d6185a89ff51d898310b13dfa5757155d0acc76c20b09d721ef3e43c7deb3c1869ba7b1b4c410e108c5
===================================================
Crackme #10
[+] by pwn.by [+]
--> pwned.space <--
===================================================
[*] Welcome to CFB10 - The Keymaster's Sigil.
[*] System protected by RSA-1024 Asymmetric Cryptography.
[?] Enter Username: lvhatpurple
[?] Enter Digital Signature (Hex): 6b7d830966e09a93a18a31bca0c9e0cc1d81256a62426df9dc7f17ae2a090bbd8437f60990f5fbfecad508dffc21463211f4f5df713ed5aed1e38edc856680458ac55ce6295e1ee8488c1fc7f5c1578068a91725c2933d6185a89ff51d898310b13dfa5757155d0acc76c20b09d721ef3e43c7deb3c1869ba7b1b4c410e108c5
[*] Verifying cryptographic signature against author's Public Key...
===================================================
[+] ACCESS GRANTED! Congratulations!
You have successfully solved CFB10!
You are a true Keymaster!
===================================================
Press Enter to exit...
|
2026-07-20 19:40 |
| CrackmesForBeginners (CFB) #6 |
[Click to reveal]pwn{6_st4g3_m3m0ry_p4tch_g0d}
|
2026-07-20 19:00 |
| Ultimate Ultimate Boss Crackme |
[Click to reveal]https://github.com/LvHatpurple/Crackmes/blob/main/Lacks/UltimateRealBoss.md
1 function in powershell + 4 patches with my tool MTCrack
|
2026-07-20 08:54 |
| Level 10 |
[Click to reveal]password: rccasi_
way too easy for lvl10
|
2026-07-20 08:03 |
| Nebulua Lua Obfuscator Challenge |
[Click to reveal]https://github.com/LvHatpurple/Crackmes/tree/main/NebuluaLuaObfuscator
this is my solution.
|
2026-07-18 17:43 |