[Boards: 3 / a / aco / adv / an / asp / b / bant / biz / c / can / cgl / ck / cm / co / cock / d / diy / e / fa / fap / fit / fitlit / g / gd / gif / h / hc / his / hm / hr / i / ic / int / jp / k / lgbt / lit / m / mlp / mlpol / mo / mtv / mu / n / news / o / out / outsoc / p / po / pol / qa / qst / r / r9k / s / s4s / sci / soc / sp / spa / t / tg / toy / trash / trv / tv / u / v / vg / vint / vip / vp / vr / w / wg / wsg / wsr / x / y ] [Search | Free Show | Home]

Israeli security services riddle

This is a blue board which means that it's for everybody (Safe For Work content only). If you see any adult content, please report it.

Thread replies: 28
Thread images: 5

File: 71f510abb219e104e4b4067e4e4b32a9.png (784KB, 1057x454px) Image search: [Google]
71f510abb219e104e4b4067e4e4b32a9.png
784KB, 1057x454px
A riddle posted by recruiters from the israeli internal cyber security services- i guess its a cypher to decode:

MTAxMDAxMTAxMTAxMDAwMDExMDAwMDEwMTEwMDAxMDAxMTAwMDAxMDExMDEwMTEuY29t
>>
It's not a code. It's just what Hebrew sounds like.
>>
>>8863371
My man
>>
Did you decode that cypher?
>>
Did you decode that cipher?
>>
i think it translates to "oy vey palestinian terrorists are genociding us, we must conduct defensive genocide"
>>
>>8863365
1320012413040124132001241320012413040123130405241304012313040523132005231304012413040124132001231304012413040524130405231320052125 20

ez
>>
plz halp
>>
help me i want to hack terrorists
>>
omg i got i got it, it's in UTF-8
10100110110100001100001011000100110000101101011.com
>>
>>8863711
it's a website of some sort, someone should go to it, i don't want the israeli security agency on me
>>
The second site is another challenge with a rar folder..
>>
Inside plane first.exe, I've found an interesting string: %PROGRAMFILES%\meseeker inc
No actual folder has been created, though.
>>
File: Capture.png (31KB, 797x647px) Image search: [Google]
Capture.png
31KB, 797x647px
>>8863874
I saw that too.
>>
>>8863946
What are you using?
I just opened up the exe in archive manager.
>>
File: cap2.png (217KB, 1713x1076px) Image search: [Google]
cap2.png
217KB, 1713x1076px
>>8863956
IDA Pro and X32DBG.

I noticed a call to WriteConsole, followed the external reference to some sub routine responsible for taking a buffer and shifting / printing it. I jumped to it in my debugger and while stepping through the routine it shows unicode jibberish - prolly Hebrew.
>>
How you compiled the file? 0.0
>>
I don't know assembly much, but it seems that this program is decoding an internal code into a message to output.

>>8863946
This guy probably already knows this, but oh well.
>>
>>8864065
By internal code, I mean the encoded string, not actual code.
>>
decompiled with flow charts for easier understanding

https://dropfile.to/tEzb9Yo
>>
>>8863365

This one will be tough. You see, riddles exist on a spectrum...
>>
>>8863365
>MTAxMDAxMTAxMTAxMDAwMDExMDAwMDEwMTEwMDAxMDAxMTAwMDAxMDExMDEwMTEuY29t
Translates to
>Yes the jews did it
But what did they mean by this?
>>
Does anybody have something new ?
>>
>>8864456
Just saw this, plan on working on it when I get home.
>>
The original MTAx etc code is Base64. Translates to that long .com.
>>
File: 1493317815609.jpg (87KB, 600x900px) Image search: [Google]
1493317815609.jpg
87KB, 600x900px
it is a threat.
I will arise and kill there god.
they are scared.
>>
Some interesting references:
kernelbase.&RtlIntegerToUnicodeString
kernel32.WideCharToMultiByte
>>
File: 3deK80y.gif (1MB, 490x367px) Image search: [Google]
3deK80y.gif
1MB, 490x367px
In home base it wants you to compile c++ and run it.
Thread posts: 28
Thread images: 5


[Boards: 3 / a / aco / adv / an / asp / b / bant / biz / c / can / cgl / ck / cm / co / cock / d / diy / e / fa / fap / fit / fitlit / g / gd / gif / h / hc / his / hm / hr / i / ic / int / jp / k / lgbt / lit / m / mlp / mlpol / mo / mtv / mu / n / news / o / out / outsoc / p / po / pol / qa / qst / r / r9k / s / s4s / sci / soc / sp / spa / t / tg / toy / trash / trv / tv / u / v / vg / vint / vip / vp / vr / w / wg / wsg / wsr / x / y] [Search | Top | Home]

I'm aware that Imgur.com will stop allowing adult images since 15th of May. I'm taking actions to backup as much data as possible.
Read more on this topic here - https://archived.moe/talk/thread/1694/


If you need a post removed click on it's [Report] button and follow the instruction.
DMCA Content Takedown via dmca.com
All images are hosted on imgur.com.
If you like this website please support us by donating with Bitcoins at 16mKtbZiwW52BLkibtCr8jUg2KVUMTxVQ5
All trademarks and copyrights on this page are owned by their respective parties.
Images uploaded are the responsibility of the Poster. Comments are owned by the Poster.
This is a 4chan archive - all of the content originated from that site.
This means that RandomArchive shows their content, archived.
If you need information for a Poster - contact them.