PwnMe 2025 - Back To The Past | MindCrafters CTF Team

The challenge contains two files, flag.enc and backToThePast elf file. After decompiling it in ida we receive this code.

if ( argc > 1 )
  {
    v12 = time(0LL, argv, envp);
    printf((unsigned int)"time : %ld\n", v12, v5, v6);
    srand(v12);
    v13 = fopen64(argv[1], "rb+");
    if ( v13 )
    {
      while ( 1 )
      {
        v11 = getc(v13);
        if ( v11 == -1 )
          break;
        fseek(v13, -1LL, 1LL);
        v9 = rand();
        fputc(v11 ^ (unsigned int)(v9 % 127), v13);
      }
      fclose(v13);
      strcpy(v14, argv[1]);
      strcat(v14, ".enc");
      if ( (unsigned int)rename(argv[1], v14) )
      {
        printf((unsigned int)"Can't rename %s filename to %s.enc", (unsigned int)argv[1], (unsigned int)argv[1], v10);
        return 1;
      }
      else
      {
        return 0;
      }
    }
    else
    {
      printf((unsigned int)"Can't open file %s\n", (unsigned int)argv[1], v7, v8);
      return 1;
    }
  }
  else
  {
    printf((unsigned int)"Usage: %s <filename>\n", (unsigned int)*argv, (_DWORD)envp, v3);
    return 1;
  }
}

We can see that the code behind it is quite simple. It uses as a seed it's current time and xors every flag character with rand()%127. We also know that that program ran in May 2024. I made a program to reverse it, but it didn't work, then i decompiled rand() function to see how it works and it looked like that.

unsigned __int64 rand()
{
  seed = 0x5851F42D4C957F2DLL * seed + 1;
  return (unsigned __int64)seed >> 33;
}

As we can see it's completely something different, now we can write code to reverse this. We will bruteforce all possible seed values for May 2024 which were 1714521600 to 1717200000;

#include <iostream>
#include <string>

unsigned long long custom_rand(unsigned long long &seed) {
    seed = 0x5851F42D4C957F2DLL * seed + 1;
    return seed >> 33;
}

void decrypt(const std::string &str, unsigned long long initialSeed) {
    std::string nowy = "";
    unsigned long long state = initialSeed;
    for (auto litera : str) {
        unsigned long long v9 = custom_rand(state);
        nowy += litera ^ static_cast<unsigned int>(v9 % 127);
    }
    if(nowy.find("PWNME{") != std::string::npos) {
        std::cout << nowy << '\n';
    }
}

int main() {
    auto flag_encrypted = std::string("\x20\x34\x0c\x1d\x2f\x2d\x0d\x4b\x3b\x6f\x18\x15\x5d\x6c\x2f\x16\x42\x57\x66\x1b\x16\x78\x07\x34\x1c\x2b\x6c\x66\x7b\x25\x41\x51\x55\x3a\x4d\x5d\x5f\x25\x6b");
    for (unsigned int i = 1714521600; i < 1717200000; i++) {
        decrypt(flag_encrypted, i);
    }
    return 0;
}

And it returns flag.

PWNME{4baf3723f62a15f22e86d57130bc40c3}