sábado, 29 de agosto de 2020

NcN 2015 CTF - theAnswer Writeup


1. Overview

Is an elf32 static and stripped binary, but the good news is that it was compiled with gcc and it will not have shitty runtimes and libs to fingerprint, just the libc ... and libprhrhead
This binary is writed by Ricardo J Rodrigez

When it's executed, it seems that is computing the flag:


But this process never ends .... let's see what strace say:


There is a thread deadlock, maybe the start point can be looking in IDA the xrefs of 0x403a85
Maybe we can think about an encrypted flag that is not decrypting because of the lock.

This can be solved in two ways:

  • static: understanding the cryptosystem and programming our own decryptor
  • dynamic: fixing the the binary and running it (hard: antidebug, futex, rands ...)


At first sight I thought that dynamic approach were quicker, but it turned more complex than the static approach.


2. Static approach

Crawling the xrefs to the futex, it is possible to locate the main:



With libc/libpthread function fingerprinting or a bit of manual work, we have the symbols, here is the main, where 255 threads are created and joined, when the threads end, the xor key is calculated and it calls the print_flag:



The code of the thread is passed to the libc_pthread_create, IDA recognize this area as data but can be selected as code and function.

This is the thread code decompiled, where we can observe two infinite loops for ptrace detection and preload (although is static) this antidebug/antihook are easy to detect at this point.


we have to observe the important thing, is the key random?? well, with the same seed the random sequence will be the same, then the key is "hidden" in the predictability of the random.

If the threads are not executed on the creation order, the key will be wrong because is xored with the th_id which is the identify of current thread.

The print_key function, do the xor between the key and the flag_cyphertext byte by byte.


And here we have the seed and the first bytes of the cypher-text:



With radare we can convert this to a c variable quickly:


And here is the flag cyphertext:


And with some radare magics, we have the c initialized array:


radare, is full featured :)

With a bit of rand() calibration here is the solution ...



The code:
https://github.com/NocONName/CTF_NcN2k15/blob/master/theAnswer/solution.c





3. The Dynamic Approach

First we have to patch the anti-debugs, on beginning of the thread there is two evident anti-debugs (well anti preload hook and anti ptrace debugging) the infinite loop also makes the anti-debug more evident:



There are also a third anti-debug, a bit more silent, if detects a debugger trough the first available descriptor, and here comes the fucking part, don't crash the execution, the execution continues but the seed is modified a bit, then the decryption key will not be ok.





Ok, the seed is incremented by one, this could be a normal program feature, but this is only triggered if the fileno(open("/","r")) > 3 this is a well known anti-debug, that also can be seen from a traced execution.

Ok, just one byte patch,  seed+=1  to  seed+=0,   (add eax, 1   to add eax, 0)

before:


after:



To patch the two infinite loops, just nop the two bytes of each jmp $-0



Ok, but repairing this binary is harder than building a decryptor, we need to fix more things:

  •  The sleep(randInt(1,3)) of the beginning of the thread to execute the threads in the correct order
  •  Modify the pthread_cond_wait to avoid the futex()
  • We also need to calibrate de rand() to get the key (just patch the sleep and add other rand() before the pthread_create loop
Adding the extra rand() can be done with a patch because from gdb is not possible to make a call rand() in this binary.

With this modifications, the binary will print the key by itself. 

Related word


  1. Pentest Tools For Mac
  2. How To Install Pentest Tools In Ubuntu
  3. How To Hack
  4. Hacker Tools Hardware
  5. Hack Tools For Ubuntu
  6. Hacking Tools 2020
  7. Tools 4 Hack
  8. Hacking Tools Windows 10
  9. Hacker Tools Hardware
  10. Pentest Tools Open Source
  11. Hackrf Tools
  12. Hack Tool Apk
  13. Pentest Tools Android
  14. Hacking Tools For Windows 7
  15. Easy Hack Tools
  16. Ethical Hacker Tools
  17. Hacker Security Tools
  18. Hack And Tools
  19. Hacker Techniques Tools And Incident Handling
  20. Pentest Tools Port Scanner
  21. Nsa Hacker Tools
  22. Android Hack Tools Github
  23. Tools For Hacker
  24. Hacker Tools Github
  25. Hackers Toolbox
  26. Pentest Tools Linux
  27. Hacking Tools Name
  28. Kik Hack Tools
  29. Hacker Tools List
  30. Nsa Hack Tools
  31. Hacker Tools 2020
  32. Beginner Hacker Tools
  33. Game Hacking
  34. How To Hack
  35. Github Hacking Tools
  36. Hacker Tools For Windows
  37. Wifi Hacker Tools For Windows
  38. Hacker Tools Software
  39. Hacking Tools Download
  40. Pentest Tools Github
  41. Hack Tool Apk
  42. Tools For Hacker
  43. Hacker Tools Hardware
  44. Hack Apps
  45. Hack App
  46. Hack Tools Github
  47. Hack Website Online Tool
  48. World No 1 Hacker Software
  49. Pentest Box Tools Download
  50. Pentest Automation Tools
  51. Beginner Hacker Tools
  52. Pentest Tools Online
  53. Hacking Tools Pc
  54. Hacking Apps
  55. Pentest Tools Bluekeep
  56. Hacking Tools Download
  57. Pentest Tools Windows
  58. How To Make Hacking Tools
  59. Hacking Tools For Windows 7
  60. Pentest Tools Tcp Port Scanner
  61. Pentest Tools Windows
  62. Hackers Toolbox
  63. Hacking Tools Mac
  64. Hacking Tools Pc
  65. Tools 4 Hack
  66. What Is Hacking Tools
  67. Hacker Techniques Tools And Incident Handling
  68. Hacking Tools Name
  69. Hack Tool Apk No Root
  70. Hacker Tools Free Download
  71. Hack Tools
  72. Hacker Tools Free Download
  73. Github Hacking Tools
  74. Hacking Tools 2019
  75. Pentest Reporting Tools
  76. Hacking Tools For Games
  77. Hack Tools For Windows
  78. Underground Hacker Sites
  79. Android Hack Tools Github
  80. Hacker Hardware Tools
  81. Hacking Tools For Kali Linux
  82. Pentest Tools Find Subdomains
  83. Hacker Tools Hardware
  84. Hacking Tools Windows
  85. Hacking Tools Online
  86. Hacking Tools For Kali Linux
  87. Pentest Tools Android
  88. Hacking Tools Windows
  89. Hack Rom Tools
  90. Pentest Tools Port Scanner
  91. What Are Hacking Tools
  92. Pentest Tools Open Source
  93. World No 1 Hacker Software
  94. Hack Tools 2019
  95. Hackers Toolbox
  96. How To Hack
  97. Top Pentest Tools
  98. Hack Apps
  99. Github Hacking Tools
  100. Hacking Tools For Windows Free Download
  101. Hack Tools
  102. Hack Tools For Windows
  103. Pentest Tools Bluekeep
  104. Hacking App
  105. Hack Rom Tools
  106. Hacking Tools Pc
  107. Pentest Tools Android
  108. Pentest Tools Kali Linux
  109. Hacker Tools Linux
  110. Hacker Tools Online
  111. Hacker
  112. Hack Tools For Mac
  113. Pentest Tools Bluekeep
  114. Pentest Tools Website Vulnerability
  115. World No 1 Hacker Software
  116. Hacking Tools Kit
  117. Hack Tools
  118. Nsa Hack Tools Download
  119. Easy Hack Tools
  120. Hack Tools Online
  121. Hack Tools Github
  122. Hacking Tools Kit
  123. Physical Pentest Tools
  124. Hack Tools For Pc
  125. Hacking Tools For Kali Linux
  126. Hacker Tools For Ios
  127. Android Hack Tools Github
  128. Best Hacking Tools 2020
  129. Underground Hacker Sites
  130. World No 1 Hacker Software
  131. Hack Tools For Pc
  132. How To Install Pentest Tools In Ubuntu
  133. Usb Pentest Tools
  134. Hacking Tools
  135. Pentest Tools Github
  136. How To Make Hacking Tools
  137. Hacker Tools Free Download
  138. Best Hacking Tools 2019
  139. Hacking Tools Pc
  140. Install Pentest Tools Ubuntu
  141. Pentest Tools Open Source
  142. Nsa Hack Tools
  143. Hacker Tools Free
  144. Pentest Tools For Windows
  145. Hacker Tools Apk Download
  146. Underground Hacker Sites
  147. Hack Tools Github
  148. Hacking Tools Windows
  149. Hacking Tools Mac
  150. Hackers Toolbox
  151. Hacking Tools Hardware
  152. Hack Tools
  153. Hack Tool Apk
  154. Termux Hacking Tools 2019
  155. Pentest Tools List
  156. Hack Tools Pc
  157. Pentest Tools For Ubuntu
  158. Hack Tools 2019
  159. Hack Website Online Tool
  160. Easy Hack Tools
  161. Hack Tools For Mac
  162. Hacking Tools For Pc
  163. Pentest Tools Free
  164. Hacker Tools For Ios
  165. Hacker Tools Windows

No hay comentarios: