Bypass

Technical Walkthrough

Writeup

Challenge

• Name: Bypass
• Category: Reversing
• Difficulty: Easy
• Mode: file

Summary

The provided binary is an obfuscated .NET console application. The visible login flow is intentionally misleading: the username/password check reads input and returns false, making the normal success branch unreachable. Static IL analysis showed that the strings used by the program are stored in an encrypted managed resource. Decrypting that resource exposed the secret key prompt and the flag pieces.

Artifact Inventory

• files/a12c736c-e653-4b63-a6fb-ddfb6ef531a7.zip: original challenge archive.
• analysis/extracted/Bypass.exe: PE32 .NET console assembly.
• analysis/il-disassembly.txt: decoded CIL listing with the auth branch, resource loader, and decrypt helper.
• analysis/resource-decrypt-decoded-summary.txt: redacted resource decryption summary.
• analysis/resource-strings-redacted.txt: redacted decrypted string table.

Analysis

analysis/extracted-file-types.txt identifies Bypass.exe as a .NET assembly. The initial strings output showed RijndaelManaged, GetManifestResourceStream, BinaryReader, and ReadString, which pointed to encrypted embedded data.

The IL listing in analysis/il-disassembly.txt shows three important facts:

1. The login/authentication method reads a username and password but stores 0 and returns it, so login cannot succeed normally.
2. The static initializer reads manifest resource 0, decrypts it, and reads strings from a BinaryReader.
3. The success path compares the entered secret key with one decrypted string, then prints three decrypted string values together to form the flag.

The decrypt helper constructs RijndaelManaged, sets a 128-bit block size and CBC mode, then reads bytes from the resource stream into the generated key-length and IV-length buffers. This means the resource layout is:

32-byte key || 16-byte IV || <secret redacted> ciphertext

Decrypting the ciphertext produced a UTF-16LE BinaryReader string table. The raw decrypted table and reconstructed flag are kept under loot/; the redacted analysis summary is in analysis/resource-strings-redacted.txt.

Solve

Run:

cd <local workspace>
python3 solve/solve.py

The solver parses the PE section table and CLR header, extracts the .NET manifest resource, decrypts it with OpenSSL <secret redacted>, parses the decrypted BinaryReader strings, and reconstructs the flag from the same string indices used by the IL success path. It writes the candidate to loot/flag-candidate.txt without printing it by default.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

For easy .NET reversing challenges, checking CIL and managed resources can be faster than trying to execute or patch the binary. Obfuscated names do not hide control flow, resource loading, or framework crypto calls.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: Bypass
• Category: Reversing
• Difficulty: Easy
• Mode: file
• Remote instance: none
• Start time: 2026-06-10T13:16:07Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• Bypass.exe is a small obfuscated .NET console assembly.
• The main login branch calls an auth method that reads username/password but returns false unconditionally, so the client-side check is deliberately bypassable by static analysis.
• Method row 11 loads manifest resource 0, decrypts it, and populates static strings used by prompts, key validation, and flag construction.
• The decrypt helper uses RijndaelManaged with 128-bit block size and CBC mode. The encrypted resource starts with the key and IV, then the ciphertext.
• The success path prints a prefix, flag body, and suffix from the decrypted string table. The raw reconstructed flag is stored only in loot/flag.txt.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Bypass was an Easy Reversing challenge containing a small obfuscated .NET Framework console executable.

The useful path was:

1. Extract the ZIP and identify the file as a PE32 .NET assembly.
2. Inspect strings/metadata for framework calls. RijndaelManaged, GetManifestResourceStream, BinaryReader, and ReadString indicated encrypted embedded strings.
3. Disassemble CIL rather than chasing obfuscated type/method names.
4. Observe the login method reads username/password but returns false unconditionally, making normal auth impossible.
5. Observe the static initializer loads managed resource 0, decrypts it, and reads a string table.
6. Decrypt the resource as 32-byte AES key || 16-byte IV || <secret redacted> ciphertext.
7. Parse the decrypted data as BinaryReader UTF-16LE strings.
8. Reconstruct the flag from the same prefix/body/suffix string indices used by the success path.

Reusable lesson: in obfuscated .NET challenge binaries, resource-loader and crypto calls often expose the intended bypass faster than patching. Even with numeric method names, IL tokens reveal the real control flow and string construction.

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches

Notes

Notes

Scope

• Challenge: Bypass
• Category: Reversing
• Difficulty: Easy
• Mode: file
• Remote instance: none
• Start time: 2026-06-10T13:16:07Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• Bypass.exe is a small obfuscated .NET console assembly.
• The main login branch calls an auth method that reads username/password but returns false unconditionally, so the client-side check is deliberately bypassable by static analysis.
• Method row 11 loads manifest resource 0, decrypts it, and populates static strings used by prompts, key validation, and flag construction.
• The decrypt helper uses RijndaelManaged with 128-bit block size and CBC mode. The encrypted resource starts with the key and IV, then the ciphertext.
• The success path prints a prefix, flag body, and suffix from the decrypted string table. The raw reconstructed flag is stored only in loot/flag.txt.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.