[trevor69000]

Hidden Content

You must register or login to view this content.

[unrecognized]

can u unlock it

[xsi5kqdb]

how did you decrypt for last q? Found key in pcap but cant seem to decrypt

[unrecognized]

how did you decrypt for last q? Found key in pcap but cant seem to decrypt

Pcap key is not a valid one. I found the iv. But didnt get how key is generated

[iamtroncarter]

i dont have enough credits for this

[skalvin]

stuck on the last question o.O

[luckystars0612]

the key in pcap is not valid. The following is obfuscation part inside it.
```cpp
__int64 convert_aeskey_tobase64()
{
  unsigned int i; // [rsp+34h] [rbp-24h]
  unsigned int v2; // [rsp+38h] [rbp-20h] BYREF
  __int64 mem; // [rsp+40h] [rbp-18h]

  if ( !qword_7FF77F68F388 )
    get_crypt32_baseaddr();
  v2 = 0;
  for ( i = 0; i < 0x20; ++i )
    *(_BYTE *)(random_aes_key + i) ^= 0xBBu;
  if ( !(unsigned __int8)CryptBinaryToString(random_aes_key, 0x20u, 0x40000001u, 0i64, (__int64)&v2) )
    return 0i64;
  mem = allocate_mem(v2);
  if ( (unsigned __int8)CryptBinaryToString(random_aes_key, 0x20u, 0x40000001u, mem, (__int64)&v2) )
    return mem;
  else
    return 0i64;
}
```
Hope this help someone

[noter]

each execution the key is unique and will be sent to the c2. but is the key the plaintext key? (BB)

[luckystars0612]

each execution the key is unique and will be sent to the c2. but is the key the plaintext key? (BB)

use get the key from pcap, as I remember, it's base64 format. decode it then xor with 0xBB

[92587a10fb]

i dont have enough credits for this