Night Batch

The brief

Ops note, taped to the 3270 before the floor was cleared. NIGHTBATCH acct-validation step. The load module is all we kept, the COPYLIB and source rode out with the frame. It still runs: ./night-batch ACCOUNT-KEY. A good key clears the step. Everything else bounces. The key was on a card by the console, card's gone. Recover it from the module.

• night-batch.zip, 190 KB

In short

Night Batch is a COBOL account check compiled for Linux with no source. It stores an 18 digit key as packed decimal and runs 23 checks on the digits, most of which keep only the last digit. The lab traced every check in one run and solved them as a small system with exactly one answer.

A batch step with no source

The file is a 392,008 byte Linux binary built from COBOL. It takes one 18 digit key and answers account rejected to anything else. Its text is XORed with 0x5a, so not even that message shows in plain sight.

Eighteen digits, packed decimal

The program wants exactly 18 numeric characters. It stores each digit as one byte of packed decimal, the digit in the high nibble and the sign F in the low one, in 18 bytes starting at 0x460100.

All 23 checks in one run

Every check goes through two helpers of the COBOL runtime, one that adds and multiplies and one that compares. The lab set breakpoints on both. One run with a dummy key printed 101 operations in 23 blocks, each a sum or product of digits.

Only the last digit counts

Test keys showed that 22 checks compare only the last digit of the result, so d3 + d4 + d8 = 3 passes when the sum is 13. One check is exact, 9d16 + 2d15 + 5d10 + 5d6 + 4d3 must equal 94.

One key passes all 23

Taken mod 10, the checks form a small linear system. With d8 fixed at 6, each check pins another digit, and a search over five digits does the rest. Exactly one key passes, 481702596318740925.

The step clears

Given that key, the module prints the flag, which it builds from the key and stores nowhere. A key that differs only in its last two digits still bounces with account rejected.

The insight

Checks that keep only the last digit turn an 18 digit key into a small system mod 10, and one traced run hands over every equation.

The flag

hiCTF{c0b0l_p4ck3d_d3c1mal_n1ghtly_b4tch!}