Author:
Shad3

Language:
C/C++

Upload:
8:49 PM 05/17/2020

Download

Platform
Unix/linux etc.

Difficulty:
1.0

Quality:
4.7

Arch:
x86-64

Description

BE CAREFUL PLAYING WITH THIS IT CAN ENCRYPT YOUR FILES. As long as you run it on an isolated folder or a VM you should be fine. The purpose of the challenge is to introduce people to the concept of reverse engineering a baby randomware. The main target of the challenge is to write a decryptor using the language of your choice. P.S. This is for EDUCATIONAL and DEMONSTRATION purposes only, the creator carries no responsibilities if your files get encrypted.

• Comments
• Solutions

Shad3 on 1:11 PM 05/24/2020: The bitcoin address is there for demonstration purposes only (if you want to donate to it feel free to) , it belongs to the Free Software Foundation and it was taken from here : https://bitcoinwhoswho.com/blog/2016/02/29/bitcoin-donation-address-rankings/

x0r19x91 on 11:17 AM 05/27/2020: https://paste.ubuntu.com/p/nNm3p2qYMQ/

zed-zahir on 4:58 PM 05/27/2020: the solution I came up with, is you will create one file with null bytes, something like 10 or less, then you let the crypto-ransomware crypt it then you check the encrypted file because when you xor a file with null byte it will give you the key, which here in our situation is '\' 0x5C hex this technique is called null byte attack

js-on on 4:01 PM 05/31/2020: When running it twice, you'll get file.corona.corona files which are completely unencrypted.

zed-zahir on 10:04 PM 06/05/2020: js-on, good point, I didn't think about it!!

sherhack on 2:29 AM 06/24/2020: Fun crackme, looked for you encrytion code and reversed the XoR operation along with the 0xdeadbeef seed

panzo on 7:12 PM 03/30/2021: Fun to do but the fact that the operation used to crypt can be reverse just by re-iterate is not cool :0

jimsktsmith on 4:21 PM 12/29/2021: Solu : Create txt - simple word like 'a' or 'ab' Text xor 92

bsausaff on 11:48 AM 05/31/2022: is erythromycin safe during pregnancy https://erythromycinn.com/#

www.candipharm.com on 5:43 AM 12/13/2022: canadian weight loss pills http://www.candipharm.com

You must me logged to submit a solution