https://app.hackthebox.com/challenges/2

Description

This is a program that generates Product Keys for a specific Software Brand. The input is the client UserName and the Number of Days that the sofware will remain active on the client. The output is the product key that client will use to activate the software package. We just have the following product key ‘cathhtkeepaln-wymddd’ Could you find the corresponding Username say A and the number of activation days say B given as input?

Exploitation

Use dnspy to decompile and read buttonCreateProductKey_Click

#!/usr/bin/python3

def unscramble_permutation(given_user, input_str, output_str):
   dictionary = {output_str[i]: given_user[i] for i in range(13)}
   key = ''.join(dictionary[k] for k in sorted(dictionary.keys())).lower()
   givenDay = "dddmyw"
   originalGivenDay = ''.join([chr(ord(givenDay[i])-1) for i in range(len(givenDay))])
   days = sum({'c': 100, 'l': 50, 'x': 10, 'v': 5}[c] for c in originalGivenDay.lower())
   return f"HTB{{{key}{days}}}"

given_user = "cathhtkeepaln"
input_str = "0123456789abc"
output_str = "21450c3b6798a"
print(unscramble_permutation(given_user, input_str, output_str))

Summary

The Art of Reversing: decompile the .NET logic, rebuild the check, and recover the accepted input.