A couple of my internet fellas were working on a CTF that presented them a binary file, which had the flag inside they had to retrieve. I jumped on this without expecting much, but anyway.
I did a quick
file bin to check what type of file it was:
The file was a non-stripped out linux binary file, which means debugging will be easier since we will be able to see original function names used in the binary.
I ran the file through strings
strings bin to see if anything stood out:
We can notice some interesting things that we can make some assumptions about - notably the following strings:
ACCESS GRANTED/ACCESS DENIED - possibly will need to enter a password somewhere in the binary and these messages will be printed to the user depending on if the provded password is correct/incorrect.
some long strings - maybe something interesting encoded here or maybe those strings are used as part of the password decryption algorithm?
%32s - maybe a C string output format (32 characters)?
Simply running the file prompted for a password and failed with an error message
Let's have a quick look at the disassembly of the file and look at its
objdump -d bin | more
Note the following from the above screenshot:
We can see that at offset
b14 (cyan) there is a C function
scanf called which reads from the standard input.
b20 (orange) calls a
check_pw routine - we can assume that the input captured from the instruction at
b14 will be passed to
check_pw function to decide if the string received from the standard input matches the password the binary is protected with or not
b25 carries out a check against the
eax register and based on if eax==0 or eax!=0, it will either take a jump to instructions at
b27 (if eax==0) or continue executing instructions at
b29 if eax!=0. Pressumably, the jumps are carried out based on if the provided password is correct or incorrect.
Let's look at the file through GDB with Peda plugin
Let's set a break point on the main function
Do a quick
disas of the
main function to remind ourselves once again what the routine for password checking was
Let's set a breakpoint
check_pw routine as well
gdb binb maindisasb check_pw
c to continue running the program until the
scanf function is called and then provide it with some dummy password, say
Once the password is entered, the program breaks on
If we skip through instructions one by one and keep observing how register values change over time and what instructions are executed, we will soon end up at
Note this from the above screenshot:
current instruction at
check_pw+88: cmp dl, al - al and dl register values are being compared
rdx values are
t respectively (organge at the top). If you followed the register values whilst stepping through the code, you would notice that the value in the rdx is actually the first letter of our password
est. Having said this, it looks like the binary is checking if the first character of the provided password is actually an ascii
dl==al, the code should jump to
check_pw+99 as seen at offset
However, stepping through the instructions further, we can see that the jump is NOT taken - the program continues executing instructions at offset
check_pw+92 - suggesting the first character of the password does NOT start with a
What if we rerun the program and supply it with a password
est this time (replacing the first
b, since the binary seemed to be expecting to see in the
Well, this time the
cmp al,dl sets the
zero flag to
true and the jump at
check_pw+90 is taken - suggesting that the first character of the password is indeed a
If we repeat this process 32 more times (remember the
%32s string discussed previously?), we will eventually get the full password:
Going back to the long strings we saw earlier - they were indeed used in the password decryption routine, but going through the algorithm is out of scope for today:
Now, there is probably a better/automated way of solving this, so if you know a better way, I would like to hear about it!