Skip to content

Instantly share code, notes, and snippets.

@blueset
Last active July 27, 2022 13:29
Show Gist options
  • Save blueset/1ec2d505a29c6359b91bb53a4a38ddcd to your computer and use it in GitHub Desktop.
Save blueset/1ec2d505a29c6359b91bb53a4a38ddcd to your computer and use it in GitHub Desktop.
#%%
key = open("/Users/blueset/Downloads/key.txt", "r").read()
idx = key.find("3jX8lFiNQ7JHQBVuXAEQXIajamj1EDqa9n34eHZ7y0XbfuxPt7pMj")
key = key[idx - 143:]
# key = key[idx - 200:]
#%%
def vba_decode(sequence, offset, key):
# Input a list and an integer
# key = "XAEQXIajamj1EDqa9n34eHZ7y0XbfuxPt7pMj3jX8lFiNQ7JHQBVu"
result = ""
for i in range(1, len(sequence) + 1):
i_mod = i % len(key)
if i_mod == 0:
i_mod = len(key)
step1 = key[i_mod+offset-1]
step2 = ord(step1)
step3 = step2 ^ sequence[i - 1]
result += chr(step3)
return result
seq = [123, 11, 48, 89, 76, 63, 6, 59, 118, 65, 47, 104, 51, 39, 51, 27, 120, 41, 36, 50, 51, 44, 5, 75, 65, 36, 77, 92, 101, 55, 5, 4, 88, 2, 90, 90, 2, 104, 59, 91, 21, 16, 33, 13, 19, 7, 88, 54, 29, 91, 21, 62, 75]
offset = 143
result = "Haha you've been hacked! I'm stealing all your files!"
Part1 = vba_decode(seq, offset, key)
assert Part1 == "Haha you've been hacked! I'm stealing all your files!"
#%%
def vba_reverse(sequence, offset, result):
# Input a list and an integer
key = {}
for i in range(1, len(sequence) + 1):
i_mod = i
step3 = ord(result[i - 1])
step2 = step3 ^ sequence[i - 1]
step1 = chr(step2)
key[i_mod + offset - 1] = step1
return key
rev = vba_reverse(seq, offset, result)
# %%
print(vba_decode([35, 33, 60, 17, 9, 127, 109, 17, 78, 82, 109, 64, 28, 110, 13, 105, 98, 116], 125))
print(vba_decode([47, 39, 58, 70, 14, 80, 16, 27, 20, 75, 73, 78, 101, 14, 85, 49, 30, 15, 90, 17, 26,
102, 30, 33, 22, 1, 38, 63, 70, 52, 1, 41, 2, 42, 88, 9, 92, 69, 20, 23, 15,
56, 28, 60, 58, 79, 93, 81, 118, 28, 2, 20, 118, 95, 57, 18, 87, 19, 26, 57, 110,
53, 7, 5, 0, 52, 45, 31, 3, 70, 11, 99, 40, 28, 59, 119, 13, 108, 110, 4, 66,
40, 6, 76, 94, 98, 56, 76, 25, 64, 80, 69, 63, 71, 60], 30))
print(vba_decode([26, 89, 24, 113, 51, 48, 52, 28, 14, 48, 9, 46, 53, 12, 4, 5, 8, 67, 54, 54, 27, 29, 123, 77, 28, 88], 4))
print(vba_decode([33, 23, 68, 54], 0))
# %%
for i in range(len(key)):
result = vba_decode([47, 39, 58, 70, 14, 80, 16, 27, 20, 75, 73, 78, 101, 14, 85, 49, 30, 15, 90, 17, 26,
102, 30, 33, 22, 1, 38, 63, 70, 52, 1, 41, 2, 42, 88, 9, 92, 69, 20, 23, 15,
56, 28, 60, 58, 79, 93, 81, 118, 28, 2, 20, 118, 95, 57, 18, 87, 19, 26, 57, 110,
53, 7, 5, 0, 52, 45, 31, 3, 70, 11, 99, 40, 28, 59, 119, 13, 108, 110, 4, 66,
40, 6, 76, 94, 98, 56, 76, 25, 64, 80, 69, 63, 71, 60], 30, key[i:])
if "dvCTF{" in result:
print(result)
# %%
key = open("/Users/blueset/Downloads/key2.txt", "r").read()
# for i in range(len(key)):
# result = vba_decode([41, 51, 25, 44, 5, 73, 26, 62, 46, 17, 86, 87, 23, 51, 61, 16, 10, 37, 29, 26, 15, 69, 19, 92, 4, 56, 61, 21, 2, 45, 1, 33, 61, 32, 43, 59, 16, 49, 6, 82, 38, 66, 5, 13, 29, 47, 47, 19, 2, 16, 16], 0, key[i:])
# if "dvCTF{" in result:
# print(result)
# for i in range(len(key)):
# if "dvCTF{" in result:
# print(result, i)
# for i in range(len(key)):
# if "dvCTF{" in result:
# print(result, i)
result = vba_decode([49, 47, 20, 28, 19, 79, 56, 91, 61, 85, 3, 8, 106, 120, 33, 54, 17, 37, 124, 48, 102, 47, 97, 109, 42, 90, 28, 69, 6, 120, 45, 10, 7, 12], 0, key[149874:])
print(result)
result = vba_decode([1, 53, 32, 16, 99, 43, 34, 66, 66, 38, 61, 75, 53, 4, 80, 11, 75, 49, 50, 22, 59, 36, 50, 88, 16, 62, 87, 15, 72, 42, 27, 34, 19, 26, 33, 61, 19, 77, 48, 46, 58, 102, 8, 94, 64, 36, 72, 47, 32, 56, 80, 0, 106], 34, key[149874:])
print(result)
# %%
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment