Thursday, May 30, 2013

First Puzzle on 0x41414141.com

Initial Stage:
When we go to 0x41414141.com, we saw something that looks like some disassembly of some binaries as you can see below.

00000000 54 6d 6c 6a 5a 53 42 7a 64 47 46 79 64 43 34 67 |TmljZSBzdGFydC4g|
00000010 49 46 4e 31 63 6d 55 67 61 47 39 77 5a 53 42 35 |IFN1cmUgaG9wZSB5|
00000020 62 33 55 67 64 47 68 70 62 6d 73 67 61 58 51 67 |b3UgdGhpbmsgaXQg|
00000030 64 32 46 7a 49 48 4e 30 64 58 42 70 5a 43 42 7a |d2FzIHN0dXBpZCBz|
00000040 61 57 31 77 62 47 55 75 49 41 6f 4b 55 32 56 75 |aW1wbGUuIAoKU2Vu|
00000050 5a 43 42 68 62 69 42 6c 4c 57 31 68 61 57 77 67 |ZCBhbiBlLW1haWwg|
00000060 64 47 38 67 5a 6d 39 76 51 47 4e 6f 59 57 78 73 |dG8gZm9vQGNoYWxs|
00000070 5a 57 35 6e 5a 53 34 77 65 44 51 78 4e 44 45 30 |ZW5nZS4weDQxNDE0|
00000080 4d 54 51 78 4c 6d 4e 76 62 53 34 67 51 53 42 79 |MTQxLmNvbS4gQSBy|
00000090 5a 58 42 73 65 53 42 33 61 57 78 73 49 47 4a 6c |ZXBseSB3aWxsIGJl|
000000a0 49 48 4e 6c 62 6e 51 67 64 47 38 67 64 47 68 6c |IHNlbnQgdG8gdGhl|
000000b0 49 48 4a 6c 63 47 78 35 4c 58 52 76 49 47 46 6b |IHJlcGx5LXRvIGFk|
000000c0 5a 48 4a 6c 63 33 4d 67 59 32 39 75 64 47 46 70 |ZHJlc3MgY29udGFp|
000000d0 62 6d 6c 75 5a 79 42 30 61 47 55 67 56 56 4a 4d |bmluZyB0aGUgVVJM|
000000e0 49 47 39 6d 49 48 52 6f 5a 53 42 7a 5a 57 4e 76 |IG9mIHRoZSBzZWNv|
000000f0 62 6d 51 67 64 47 46 7a 61 79 34 4b |bmQgdGFzay4K|



contact@0x41414141.com

Further Analysis:
After some further analysis, i've figured out that it's just a base64 encoded string.
So i've extracted out the string and got back this.
TmljZSBzdGFydC4g
IFN1cmUgaG9wZSB5
b3UgdGhpbmsgaXQg
d2FzIHN0dXBpZCBz
aW1wbGUuIAoKU2Vu
ZCBhbiBlLW1haWwg
dG8gZm9vQGNoYWxs
ZW5nZS4weDQxNDE0
MTQxLmNvbS4gQSBy
ZXBseSB3aWxsIGJl
IHNlbnQgdG8gdGhl
IHJlcGx5LXRvIGFk
ZHJlc3MgY29udGFp
bmluZyB0aGUgVVJM
IG9mIHRoZSBzZWNv
bmQgdGFzay4K

So i made a simple Python script and i've got back
Nice start. Sure hope you think it was stupid simple.

Send an e-mail to foo@challenge.0x41414141.com. A reply will be sent to the reply-to address containing the URL of the second task.

Sending an email to the above email address and i've got the next challenge awaiting for me. :D

Attached is the simple Python script.
pyBase64Decode.py

cheers
0x4a61636f62

No comments:

Post a Comment