Padocon Qualifiers CTF 2010 : CatchMe - 200 Points

Padocon Qualifiers CTF 2010 : CatchMe - 200 Points

File given to us:
This is the original file:
CatchMeIfYouCan.zip


Recommended Tools:
Brains and Programming skills

Solving the Puzzle:
Let's fire up the binary which we are given.


Hmmmm...i can't seem to click on the button. I guess i have to click on the button in order to solve this.
As the button moved away whenever i placed my mouse cursor near it.
I guess i have to either reverse the application but i didn't want to spend too much time trying to reverse this application.

Thus, I've decided to make use of my development skills to solve this puzzle.

Logic behind this Solution:
Since moving my mouse cursor near the button will cause it to move away.

I've decided to send WM_LBUTTONDOWN (http://msdn.microsoft.com/en-us/library/windows/desktop/ms645607(v=vs.85).aspx) & WM_LBUTTONUP (http://msdn.microsoft.com/en-us/library/windows/desktop/ms645608(v=vs.85).aspx) messages with SendMessage function (http://msdn.microsoft.com/en-us/library/windows/desktop/ms644950(v=vs.85).aspx) to simulate the mouse cursor actions of clicking the button.

But in order to do that i need get the handle to CatchMeIfYouCan.exe.

So i've used FindWindow function (http://msdn.microsoft.com/en-us/library/windows/desktop/ms633499(v=vs.85).aspx) to look for "Catch Me If You Can!"
Then i get the area of the binary using GetClientRect function (http://msdn.microsoft.com/en-us/library/windows/desktop/ms633503(v=vs.85).aspx)

Brute-Force Logic:

#include<stdio.h>
#include<windows.h>
int main(int argc, char *argv[]){
    HWND hWnd;
    RECT rect1;
    hWnd = FindWindow(NULL,L"Catch Me If You Can!");
    GetClientRect(hWnd, &rect1);
    for( rect1.left = 0; rect1.left <= rect1.right ; rect1.left++ ){
        for( rect1.top = 0; rect1.top <= rect1.bottom ; rect1.top++ ){
            SendMessage(hWnd, WM_LBUTTONDOWN, 0, MAKELONG(rect1.left, rect1.top));
            SendMessage(hWnd, WM_LBUTTONUP, 0, MAKELONG(rect1.left, rect1.top));
        }
    }
}

Final Solution:
Once you have compiled the above code and get it to run. The button will stop moving and you can click on the button and you will be presented with a messagebox with the solution, "Zntus_WARTG_gAng"


I have attached the source code for the brute-force application so that you can try it on your own.


File:CatchMeIfYouCan.c


cheers
0x4a61636f62