Thursday, 17 March 2011

LuTiN NoIR Small RSA keygenme for newbies

In February, Le_MaLaDe reopened UFDC (Université Française de Cracking)
The first challenge of the 'Competence 5' is a packed (ASPack) KeygenMe: LuTiN NoIR Small RSA keygenme for newbies (Yeah, the site is from 2000-2002 it's old)
Protection: MD5+RSA.


For make fast:
M = C^D mod N
M = MD5(NAME)


You grab N inside (2F774486FD3B97FFA559687F7F9D5335CA3D16FBB60C0019)
And factorise it with RSA-Tool 2 by tE, after few seconds/mins you get P and Q

PRIME FACTOR: 69EF193F0EC20A9E57B455DB
PRIME FACTOR: 72B4BF519A43852C9F9C761B

Now with that you calculate D: 2312552808E487A2F561E2BBEF5FB7275C2BD350491DB9A1

MD5 for "Xylitol": 9F01C4DEFB31F597423AC2E0CAB0FA54

Now rSab0x:

Name: Xylitol
Serial: 1A82A1823B1445B66580029237258D411C788A202D982451

I wanted make a keygen in PHP but finaly i've not found a RSA classe for do it
so i hope you like assembly... :)

The code seem crappy in blogspot :'(


base.asm:
.386
.model  flat, stdcall
option  casemap :none

include     windows.inc
include     user32.inc
include     kernel32.inc
include     comctl32.inc
include     \masm32\macros\macros.asm
includelib  user32.lib
includelib  kernel32.lib
includelib  comctl32.lib
include     winmm.inc
includelib  winmm.lib

include     biglib.inc
includelib  biglib.lib
include     cryptohash.inc
includelib  cryptohash.lib
include     ufmod.inc
includelib  ufmod.lib


DlgProc     PROTO :DWORD,:DWORD,:DWORD,:DWORD

.const
IDD_MAIN      EQU 1000
IDB_EXIT      EQU 1001
IDC_NAME      EQU 1002
IDC_SERIAL    EQU 1005
IDB_GENERATE  EQU 1006
IDB_ABOUT     EQU 1007
IDI_ICON      EQU 100
MAXSIZE       EQU 512

.data
N           db  "2F774486FD3B97FFA559687F7F9D5335CA3D16FBB60C0019",0
D           db  "2312552808E487A2F561E2BBEF5FB7275C2BD350491DB9A1",0

.data?
hInstance   dd  ?

szName          db  MAXSIZE dup(?)
szSerial        db  MAXSIZE dup(?)
szHash          db  MAXSIZE dup(?)

BigN        dword ?
BigD        dword ?
BigC        dword ?
BigM        dword ?

.code
start:
    invoke  GetModuleHandle, NULL
    mov hInstance, eax
    invoke  DialogBoxParam, hInstance, IDD_MAIN, 0, offset DlgProc, 0
    invoke  ExitProcess, eax
    invoke  InitCommonControls

DlgProc proc uses esi edi hWnd:DWORD,uMsg:DWORD,wParam:DWORD,lParam:DWORD
        mov eax,uMsg
            .if eax == WM_INITDIALOG
                invoke  LoadIcon,hInstance,200
                invoke  SendMessage, hWnd, WM_SETICON, 1, eax
                invoke uFMOD_PlaySong,666,hInstance,XM_RESOURCE
                invoke  GetDlgItem,hWnd,IDC_NAME
                invoke  SendMessage,eax,EM_LIMITTEXT,60,0
                invoke  GetDlgItem,hWnd,IDC_SERIAL
                invoke  SendMessage,eax,EM_LIMITTEXT,32,0
                jmp @KEYGENNiNG
            .elseif eax == WM_COMMAND
                mov eax,wParam
                    .if eax == IDB_EXIT
                       
                        invoke  SendMessage, hWnd, WM_CLOSE, 0, 0
                    .elseif ax == IDC_NAME
                        shr eax, 16
                        .if ax == EN_CHANGE
                            jmp @KEYGENNiNG
                        .endif
                    .elseif eax == IDB_GENERATE
                        @KEYGENNiNG:
                            invoke GetDlgItemText,hWnd,IDC_NAME,addr szName,MAXSIZE
                            cmp eax,0
                            jnz @NEXT
                            invoke  SetDlgItemText,hWnd,IDC_SERIAL,chr$('Enter your name, buddy!')
                        @NEXT:
                            mov edx,eax
                            invoke  MD5Init
                            invoke  MD5Update,addr szName,edx
                            invoke  MD5Final
                            invoke HexEncode,eax,MD5_DIGESTSIZE,addr szHash
                            invoke _BigCreate,0
                            mov BigN,eax
                            invoke _BigCreate,0
                            mov BigD,eax
                            invoke _BigCreate,0
                            mov BigC,eax
                            invoke _BigCreate,0
                            mov BigM,eax
                            invoke  _BigIn,addr N,16,BigN
                            invoke  _BigIn,addr D,16,BigD
                            invoke  _BigIn,addr szHash,16,BigM
                            invoke  _BigPowMod,BigM,BigD,BigN,BigC
                            invoke  _BigOutB16,BigC,addr szSerial
                            invoke  SetDlgItemText,hWnd,IDC_SERIAL,addr szSerial
                            invoke  RtlZeroMemory,addr szName,sizeof szName
                            invoke  RtlZeroMemory,addr szHash,sizeof szHash  
                            invoke  RtlZeroMemory,addr szSerial,sizeof szSerial
                            invoke _BigDestroy,BigN
                            invoke _BigDestroy,BigD
                            invoke _BigDestroy,BigC
                            invoke _BigDestroy,BigM
                    .endif
            .elseif eax == WM_CLOSE
                invoke uFMOD_PlaySong,0,0,0
                invoke  EndDialog, hWnd, 0
            .endif
        XOR EAX,EAX
        RET
DlgProc endp
end start

base.rc:
;This Resource Script was generated by WinAsm Studio.

#define IDD_MAIN 1000
#define IDB_EXIT 1001
#define IDC_STATIC1003 1003
#define IDC_STATIC1004 1004
#define IDC_NAME 1002
#define IDC_SERIAL 1005
#define IDB_GENERATE 1006
#define IDI_ICON 100
#define IDC_IMAGE1008 1008
#define IDC_STATIC1009 1009
#define tune 666

1 24 DISCARDABLE "manifest.xml"
IDI_ICON ICON DISCARDABLE "app.ico"
946 BITMAP DISCARDABLE "5ab9y001.bmp"
tune RCDATA DISCARDABLE "music.xm"

IDD_MAIN DIALOGEX 10,10,392,135
CAPTION "LuTiN NoIR Small RSA keygenme for newbies *KeyGen*"
FONT 8,"Tahoma"
STYLE 0x90c80804
EXSTYLE 0x00000188
BEGIN
    CONTROL "Exit",IDB_EXIT,"Button",0x10010000,343,120,45,13,0x00000000
    CONTROL "Xylitol",IDC_NAME,"Edit",0x50010000,27,89,360,13,0x00000200
    CONTROL "Name",IDC_STATIC1003,"Static",0x50000000,3,89,20,8,0x00000000
    CONTROL "Serial",IDC_STATIC1004,"Static",0x50000000,4,108,20,9,0x00000000
    CONTROL "",IDC_SERIAL,"Edit",0x50010800,27,105,360,12,0x00000200
    CONTROL "GEN",IDB_GENERATE,"Button",0x10010000,297,120,44,13,0x00000000
    CONTROL "#946",IDC_IMAGE1008,"Static",0x5080020e,3,3,384,81,0x00000000
    CONTROL "17/03/2011",IDC_STATIC1009,"Static",0x58000000,0,126,81,7,0x00000000
END

cryptohash for the MD5, biglib for RSA and ufmod for the music...
these libs are easy to find ;)


Also if you want play with RSA, try Xyl Crypto-KeygenMe 2: rEvErs0rEd

1 comment: