[ent0xE]

The solution is pretty simple, not really reversing needed:

1.Generate a pw-list with the "V1" binary from 2013-12-10 00:00:00 until 2013-12-11 23:59:59 (172800 passwords).
2.Rewrite the decrypt.py script so you can bruteforce with this passwordlist.

i dont post the flag this time, my hints tough:

• use faketime https://commandmasters.com/commands/faketime-linux/
  
• echo '20\nyes\nyes' | ./V1
  gives you a password with current systemtime
  
• 2013-12-11 13:01:25 is the time when the correct password was generated
  

good luck

[test888]

Are you certain this is the correct time ? 2013-12-11 13:01:25

[opo]

great Budyyyyyyyyyyyyyyyyyyyyyyyyyyyy

[ent0xE]

Are you certain this is the correct time ? 2013-12-11 13:01:25

unless its per instance randomized, yes; but the generation of the pwlist is pretty simple as well, and the bruteforce takes max 1 min.

i ran a test again, it's depended on you current time setting (for the adjustment with faketime), the correct time in unix epoch is: 1386784885; its also part of the flag.

python-script to generate pwlist:

import subprocess from datetime import datetime, timedelta from pwn import * start_time = datetime(2013, 12, 10, 0, 0, 0) end_time = datetime(2013, 12, 11, 23, 59, 59) cmd = f"echo '20\nyes\nyes' | ./V1" def run_with_faketime(current_time):     result = subprocess.run(['faketime', current_time.strftime("%Y-%m-%d %H:%M:%S"), 'sh', '-c', cmd], capture_output=True, text=True)     match = re.search(r'Generated password:\s*(\S+)', result.stdout)     if match:         password = match.group(1)         print(password) current_time = start_time while current_time <= end_time:     run_with_faketime(current_time)     current_time += timedelta(seconds=1)

[test888]

Are you certain this is the correct time ? 2013-12-11 13:01:25

unless its per instance randomized, yes; but the generation of the pwlist is pretty simple as well, and the bruteforce takes max 1 min.

python-script to generate pwlist:

import subprocess from datetime import datetime, timedelta from pwn import * start_time = datetime(2013, 12, 10, 0, 0, 0) end_time = datetime(2013, 12, 11, 23, 59, 59) cmd = f"echo '20\nyes\nyes' | ./V1" def run_with_faketime(current_time):     result = subprocess.run(['faketime', current_time.strftime("%Y-%m-%d %H:%M:%S"), 'sh', '-c', cmd], capture_output=True, text=True)     match = re.search(r'Generated password:\s*(\S+)', result.stdout)     if match:         password = match.group(1)         print(password) current_time = start_time while current_time <= end_time:     run_with_faketime(current_time)     current_time += timedelta(seconds=1)

Understood, thank you!

[ent0xE]

Are you certain this is the correct time ? 2013-12-11 13:01:25

unless its per instance randomized, yes; but the generation of the pwlist is pretty simple as well, and the bruteforce takes max 1 min.

python-script to generate pwlist:

import subprocess from datetime import datetime, timedelta from pwn import * start_time = datetime(2013, 12, 10, 0, 0, 0) end_time = datetime(2013, 12, 11, 23, 59, 59) cmd = f"echo '20\nyes\nyes' | ./V1" def run_with_faketime(current_time):     result = subprocess.run(['faketime', current_time.strftime("%Y-%m-%d %H:%M:%S"), 'sh', '-c', cmd], capture_output=True, text=True)     match = re.search(r'Generated password:\s*(\S+)', result.stdout)     if match:         password = match.group(1)         print(password) current_time = start_time while current_time <= end_time:     run_with_faketime(current_time)     current_time += timedelta(seconds=1)

Understood, thank you!

see my edit... its depended on your current set OS-Time, cause its calculated from that. in UTC+0 its December 11, 2013 6:01:25 PM

[test888]

Are you certain this is the correct time ? 2013-12-11 13:01:25

unless its per instance randomized, yes; but the generation of the pwlist is pretty simple as well, and the bruteforce takes max 1 min.

python-script to generate pwlist:

import subprocess from datetime import datetime, timedelta from pwn import * start_time = datetime(2013, 12, 10, 0, 0, 0) end_time = datetime(2013, 12, 11, 23, 59, 59) cmd = f"echo '20\nyes\nyes' | ./V1" def run_with_faketime(current_time):     result = subprocess.run(['faketime', current_time.strftime("%Y-%m-%d %H:%M:%S"), 'sh', '-c', cmd], capture_output=True, text=True)     match = re.search(r'Generated password:\s*(\S+)', result.stdout)     if match:         password = match.group(1)         print(password) current_time = start_time while current_time <= end_time:     run_with_faketime(current_time)     current_time += timedelta(seconds=1)

Understood, thank you!

see my edit... its depended on your current set OS-Time, cause its calculated from that. in UTC+0 its December 11, 2013 6:01:25 PM

Yeah, ended up figuring it out. Your hint was very useful, gave you rep!