Jigsaw Hack The Box¶

import 'dart:ffi';
class AESService {

  static const platform = MethodChannel('parttwo');
  Future<Map<String, List<int>>> getparttwo() async {
    try {

      final Map<dynamic, dynamic> result = await platform.invokeMethod('parttwo');
      return {
        "key": List<int>.from(result['key']),
        "iv": List<int>.from(result['iv']),
      };
    } on PlatformException catch (e) {
      print("Failed to get parttwo: '${e.message}'.");
      return {};
    }
typedef GetAESKeyNative = Pointer<Uint8> Function();
typedef GetAESIVNative = Pointer<Uint8> Function();
class AESNativeLib {
  final DynamicLibrary _dylib;
  // Private constructor
  AESNativeLib._(this._dylib);
  // Singleton instance
  static AESNativeLib? _instance;
  // Load the shared library and return the instance
  static AESNativeLib get instance {
    _instance ??= AESNativeLib._(DynamicLibrary.open('libmenascyber.so'));
    return _instance!;
  List<int> getAESKey() {
    final getAESKey = _dylib
        .lookupFunction<GetAESKeyNative, GetAESKeyNative>('partthree_1');
    final keyPointer = getAESKey();
    return keyPointer.asTypedList(32);
  List<int> getAESIV() {
    final getAESIV = _dylib
        .lookupFunction<GetAESIVNative, GetAESIVNative>('partthree_2');
    final ivPointer = getAESIV();
    return ivPointer.asTypedList(16);
class AESCombinedService {
  final AESNativeLib _nativeLib = AESNativeLib.instance;
  final AESService _aesService = AESService();
   // Hardcoded key and IV
  final List<int> _hardcodedKey = List<int>.generate(32, (i) => (i + 1) % 256);
  final List<int> _hardcodedIV = List<int>.generate(16, (i) => (i + 10) % 256);
  // Deterministic shuffling method
  List<int> _deterministicShuffle(List<int> input, int shift) {
    return List<int>.generate(input.length, (i) {
      return input[(i + shift) % input.length];
    });
  Future<Map<String, List<int>>> partone() async {
    // Shuffle the key and IV deterministically
    final shuffledKey = _deterministicShuffle(_hardcodedKey, 5);
    final shuffledIV = _deterministicShuffle(_hardcodedIV, 3);
    return {
      "key": shuffledKey,
      "iv": shuffledIV,
    };
  Future<Map<String, List<int>>> getflag() async {
    final partoneData = await partone();
    final parttwoData = await _aesService.getparttwo();
    final partthreeKey = _nativeLib.getAESKey();
    final partthreeIV = _nativeLib.getAESIV();
    // Combine and slice the key and IV from each part
    final combinedKey = [
      ...partoneData['key']!.sublist(0, 8),
      ...parttwoData['key']!.sublist(0, 8),
      ...partthreeKey.sublist(0, 16)
    ];
    final combinedIV = [
      ...partoneData['iv']!.sublist(0, 4),
      ...parttwoData['iv']!.sublist(0, 4),
      ...partthreeIV.sublist(0, 8)
    ];
    return {
      "key": combinedKey,
      "iv": combinedIV,
    };

import 'dart:typed_data';
import 'package:encrypt/encrypt.dart' as encrypt;
import 'package:flutter/material.dart';
import 'package:jigsaw/services.dart';
import  'package:ffi/ffi.dart';
import 'package:jigsaw/flag.dart';
void main() {
  runApp(MyApp());
class MyApp extends StatelessWidget {
  @override
  Widget build(BuildContext context) {
    return MaterialApp(
      title: 'Login App',
      theme: ThemeData(
        primarySwatch: Colors.blue,
      ),
      home: LoginPage(),
    );
class LoginPage extends StatefulWidget {
  @override
  _LoginPageState createState() => _LoginPageState();
class _LoginPageState extends State<LoginPage> {
  final TextEditingController _usernameController = TextEditingController();
  final TextEditingController _passwordController = TextEditingController();
  final AESCombinedService _aesCombinedService = AESCombinedService();
 Future<void> fetchAndDecryptFlag() async {
    try {
      final finallyClass = Finally();
      final decryptedFlag = await finallyClass.decryptFlag();

    } catch (e) {

    }
  void _login() {
    // Check if the username and password are correct
    if (_usernameController.text == 'nimda' && _passwordController.text == 'guessme') {

      Navigator.push(
        context,
        MaterialPageRoute(builder: (context) => HomePage(username: _usernameController.text)),
      );
    } else {
      showDialog(
        context: context,
        builder: (context) {
          return AlertDialog(
            title: Text('Login Failed'),
            content: Text('Crack me and find the flag'),
            actions: [
              TextButton(
                onPressed: () {
                  Navigator.of(context).pop();
                },
                child: Text('OK'),
              ),
            ],
          );
        },
      );
    }
  @override
  Widget build(BuildContext context) {
    return Scaffold(
      body: Container(
        decoration: BoxDecoration(
          gradient: LinearGradient(
            colors: [Colors.blue, Colors.blueAccent],
            begin: Alignment.topCenter,
            end: Alignment.bottomCenter,
          ),
        ),
        child: Padding(
          padding: const EdgeInsets.all(16.0),
          child: Column(
            mainAxisAlignment: MainAxisAlignment.center,
            children: <Widget>[
              Text(
                'Welcome Back!',
                style: TextStyle(
                  color: Colors.white,
                  fontSize: 32,
                  fontWeight: FontWeight.bold,
                ),
              ),
              SizedBox(height: 20),
              TextField(
                controller: _usernameController,
                style: TextStyle(color: Colors.white),
                decoration: InputDecoration(
                  labelText: 'Username',
                  labelStyle: TextStyle(color: Colors.white),
                  filled: true,
                  fillColor: Colors.white.withOpacity(0.2),
                  border: OutlineInputBorder(
                    borderRadius: BorderRadius.circular(15),
                    borderSide: BorderSide.none,
                  ),
                  prefixIcon: Icon(Icons.person, color: Colors.white),
                ),
              ),
              SizedBox(height: 20),
              TextField(
                controller: _passwordController,
                style: TextStyle(color: Colors.white),
                decoration: InputDecoration(
                  labelText: 'Password',
                  labelStyle: TextStyle(color: Colors.white),
                  filled: true,
                  fillColor: Colors.white.withOpacity(0.2),
                  border: OutlineInputBorder(
                    borderRadius: BorderRadius.circular(15),
                    borderSide: BorderSide.none,
                  ),
                  prefixIcon: Icon(Icons.lock, color: Colors.white),
                ),
                obscureText: true,
              ),
              SizedBox(height: 20),
              ElevatedButton(
                onPressed: _login,
                style: ElevatedButton.styleFrom(
                  padding: EdgeInsets.symmetric(horizontal: 60, vertical: 10),
                  shape: RoundedRectangleBorder(
                    borderRadius: BorderRadius.circular(15),
                  ),
                  backgroundColor: Colors.white,
                ),
                child: Text(
                  'Login',
                  style: TextStyle(
                    fontSize: 18,
                    color: Colors.blueAccent,
                  ),
                ),
              ),
            ],
          ),
        ),
      ),
    );
class HomePage extends StatelessWidget {
  final String username;
  HomePage({required this.username});
  @override
  Widget build(BuildContext context) {
    return Scaffold(
      appBar: AppBar(
        title: Text('Home Page'),
      ),
     body: Center(
        child: Column(
          mainAxisAlignment: MainAxisAlignment.center,
          children: [
            Image.asset(
              'assets/images/laughing.png', // Ensure you have this image in your assets folder
              width: 150,
              height: 150,
            ),
            SizedBox(height: 20),
            Text(
              'Sorry, no flag here.',
              style: TextStyle(
                fontSize: 24,
                color: Colors.redAccent,
              ),
            ),
          ],
        ),
      ),
    );

import 'dart:convert';
import 'dart:typed_data';
import 'package:encrypt/encrypt.dart' as encrypt;
import 'package:jigsaw/services.dart'; // Import the file containing AESCombinedService
class Finally {
  final String _encryptedFlagBase64 = 'aZ/KF0GsnN81j5XStQyKz3vXtktTVN5zFqy5lwTmub6fx5w70c+p08O0OWcn/9nh';
  Future<String> decryptFlag() async {

    final aesService = AESCombinedService();
    final flagData = await aesService.getflag();

    final encryptedFlagBytes = _base64ToBytes(_encryptedFlagBase64);

    final key = Uint8List.fromList(flagData['key']!);
    final iv = Uint8List.fromList(flagData['iv']!);
    final encryptKey = encrypt.Key(key);
    final encryptIV = encrypt.IV(iv);
    final encrypter = encrypt.Encrypter(encrypt.AES(encryptKey, mode: encrypt.AESMode.cbc));
    final decrypted = encrypter.decrypt(
      encrypt.Encrypted.fromBase64(_encryptedFlagBase64),
      iv: encryptIV,
    );



    //return decrypted;


     String message = "Developer forgot to uncomment";
     return  message;
 // Helper function to convert base64 string to bytes
  List<int> _base64ToBytes(String base64) {
    final bytes = base64Decode(base64);
    return bytes;
  String bytesToHex(Uint8List bytes) {
  final buffer = StringBuffer();
  for (var byte in bytes) {
    buffer.write(byte.toRadixString(16).padLeft(2, '0'));
  return buffer.toString();

final String _encryptedFlagBase64 = 'aZ/KF0GsnN81j5XStQyKz3vXtktTVN5zFqy5lwTmub6fx5w70c+p08O0OWcn/9nh';

final flagData = await aesService.getflag();

final List<int> _hardcodedKey = List<int>.generate(32, (i) => (i + 1) % 256);
final List<int> _hardcodedIV  = List<int>.generate(16, (i) => (i + 10) % 256);

_deterministicShuffle(input, shift) => input[(i + shift) % input.length];

shuffledKey = _deterministicShuffle(_hardcodedKey, 5).sublist(0, 8);
shuffledIV  = _deterministicShuffle(_hardcodedIV, 3).sublist(0, 4);

if (_usernameController.text == 'nimda' && _passwordController.text == 'guessme')