Comment on page
Reversing Password Checking Routine
A couple of my internet fellas were working on a CTF that presented them a binary file, which had the flag inside they had to retrieve. I jumped on this without expecting much, but anyway.
I did a quick
file binto check what type of file it was:
The file was a non-stripped out linux binary file, which means debugging will be easier since we will be able to see original function names used in the binary.
I ran the file through strings
strings binto see if anything stood out:
We can notice some interesting things that we can make some assumptions about - notably the following strings:
- ACCESS GRANTED/ACCESS DENIED - possibly will need to enter a password somewhere in the binary and these messages will be printed to the user depending on if the provded password is correct/incorrect.
- some long strings - maybe something interesting encoded here or maybe those strings are used as part of the password decryption algorithm?
- a string
%32s- maybe a C string output format (32 characters)?
Simply running the file prompted for a password and failed with an error message
Let's have a quick look at the disassembly of the file and look at its
objdump -d bin | more
Note the following from the above screenshot:
- We can see that at offset
b14(cyan) there is a C function
scanfcalled which reads from the standard input.
- instruction at
b20(orange) calls a
check_pwroutine - we can assume that the input captured from the instruction at
b14will be passed to
check_pwfunction to decide if the string received from the standard input matches the password the binary is protected with or not
- instruction at
b25carries out a check against the
eaxregister and based on if eax==0 or eax!=0, it will either take a jump to instructions at
b27(if eax==0) or continue executing instructions at
b29if eax!=0. Pressumably, the jumps are carried out based on if the provided password is correct or incorrect.
- Let's look at the file through GDB with Peda plugin
- Let's set a break point on the main function
- Do a quick
mainfunction to remind ourselves once again what the routine for password checking was
- Let's set a breakpoint
check_pwroutine as well
cto continue running the program until the
scanffunction is called and then provide it with some dummy password, say
Once the password is entered, the program breaks on
If we skip through instructions one by one and keep observing how register values change over time and what instructions are executed, we will soon end up at
Note this from the above screenshot:
- current instruction at
check_pw+88: cmp dl, al- al and dl register values are being compared
trespectively (organge at the top). If you followed the register values whilst stepping through the code, you would notice that the value in the rdx is actually the first letter of our password
est. Having said this, it looks like the binary is checking if the first character of the provided password is actually an ascii
dl==al, the code should jump to
check_pw+99as seen at offset
However, stepping through the instructions further, we can see that the jump is NOT taken - the program continues executing instructions at offset
check_pw+92- suggesting the first character of the password does NOT start with a
What if we rerun the program and supply it with a password
estthis time (replacing the first
b, since the binary seemed to be expecting to see in the
Well, this time the
cmp al,dlsets the
trueand the jump at
check_pw+90is taken - suggesting that the first character of the password is indeed a
If we repeat this process 32 more times (remember the
%32sstring discussed previously?), we will eventually get the full password:
Going back to the long strings we saw earlier - they were indeed used in the password decryption routine, but going through the algorithm is out of scope for today:
Now, there is probably a better/automated way of solving this, so if you know a better way, I would like to hear about it!