rgbCTF Writeup(Rev/Pwn)
Hello everyone, i'm sh4d0wless and here is my writeup for some challenges in rgbCTF 2020. I joined this ctf for our ctf team Hex2Text(https://ctftime.org/team/84925)Sorry for my really bad english :)
Too Slow(Pwn/Rev)
I've made this flag decryptor! It's super secure, but it runs a little slow.
Check given binary with file command.
file a.out
a.out: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/l, BuildID[sha1]=462dfe207acdfe1da2133cac6b69b45de5169ee2, for GNU/Linux 3.2.0, not stripped
When we run it, it says generating key but dont return anything :/ Yes, its "Too Slow" but we don't want to wait. Lets check the binary in ghidra.
İn main function, it prints something and get key to uVar1 variable and run "win" function with this value.
İn getKey function (i rename the variable names as i and x), it start a while loops with i=0 value and make the first loop continue while the "i" value is smaller than 0x265d1d23 and return the i value on end of the function. But in the while loops "i" value is only incremented by 1. finally it return i= 0x265d1d23 and we are wait for shitty arithmetic operations on x value.
To bypass this while loops we can patch the binary.
On the assembly codes write click on this mov operation and select "patch instruction"
Change the 0x0 value to 0x265d1d23 and export the binary from "File -> Export Program"
Note: To patch the binary succesfully, open the given binary as "raw binary" on ghidra. İf you open it as ELF binary you will get segmentation fault when run the exported binary.
Lets run the exported binary and get flag.
Advanced Reversing Mechanics 1 (Pwn/Rev)
Very very advanced trust me(Some values given here...)
They give some values on description of question.
71, 66, 61, 42, 53, 45, 7A, 40, 51, 4C, 5E, 30, 79, 5E, 31, 5E, 64, 59, 5E, 38, 61, 36, 65, 37, 63, 7C,Check given binary with file command.
file easy.o
easy.o: ELF 32-bit LSB relocatable, ARM, EABI5 version 1 (SYSV), not stripped
Open it with ghidra.
On the main function it makes a lot of things but i dont know what it make and i checked the encryptFlag function. İts simply encrypt the flag by increment by 1 the value off character on flag. İf we convert the given numbers to ascii the string is
qfaBSEz@QL^0y^1^dY^8a6e7c|
rgbCTF{ARM_1z_2_eZ_9b7f8d}
Yorumlar
Yorum Gönder