sábado, 3 de junio de 2023

NcN 2015 CTF - theAnswer Writeup


1. Overview

Is an elf32 static and stripped binary, but the good news is that it was compiled with gcc and it will not have shitty runtimes and libs to fingerprint, just the libc ... and libprhrhead
This binary is writed by Ricardo J Rodrigez

When it's executed, it seems that is computing the flag:


But this process never ends .... let's see what strace say:


There is a thread deadlock, maybe the start point can be looking in IDA the xrefs of 0x403a85
Maybe we can think about an encrypted flag that is not decrypting because of the lock.

This can be solved in two ways:

  • static: understanding the cryptosystem and programming our own decryptor
  • dynamic: fixing the the binary and running it (hard: antidebug, futex, rands ...)


At first sight I thought that dynamic approach were quicker, but it turned more complex than the static approach.


2. Static approach

Crawling the xrefs to the futex, it is possible to locate the main:



With libc/libpthread function fingerprinting or a bit of manual work, we have the symbols, here is the main, where 255 threads are created and joined, when the threads end, the xor key is calculated and it calls the print_flag:



The code of the thread is passed to the libc_pthread_create, IDA recognize this area as data but can be selected as code and function.

This is the thread code decompiled, where we can observe two infinite loops for ptrace detection and preload (although is static) this antidebug/antihook are easy to detect at this point.


we have to observe the important thing, is the key random?? well, with the same seed the random sequence will be the same, then the key is "hidden" in the predictability of the random.

If the threads are not executed on the creation order, the key will be wrong because is xored with the th_id which is the identify of current thread.

The print_key function, do the xor between the key and the flag_cyphertext byte by byte.


And here we have the seed and the first bytes of the cypher-text:



With radare we can convert this to a c variable quickly:


And here is the flag cyphertext:


And with some radare magics, we have the c initialized array:


radare, is full featured :)

With a bit of rand() calibration here is the solution ...



The code:
https://github.com/NocONName/CTF_NcN2k15/blob/master/theAnswer/solution.c





3. The Dynamic Approach

First we have to patch the anti-debugs, on beginning of the thread there is two evident anti-debugs (well anti preload hook and anti ptrace debugging) the infinite loop also makes the anti-debug more evident:



There are also a third anti-debug, a bit more silent, if detects a debugger trough the first available descriptor, and here comes the fucking part, don't crash the execution, the execution continues but the seed is modified a bit, then the decryption key will not be ok.





Ok, the seed is incremented by one, this could be a normal program feature, but this is only triggered if the fileno(open("/","r")) > 3 this is a well known anti-debug, that also can be seen from a traced execution.

Ok, just one byte patch,  seed+=1  to  seed+=0,   (add eax, 1   to add eax, 0)

before:


after:



To patch the two infinite loops, just nop the two bytes of each jmp $-0



Ok, but repairing this binary is harder than building a decryptor, we need to fix more things:

  •  The sleep(randInt(1,3)) of the beginning of the thread to execute the threads in the correct order
  •  Modify the pthread_cond_wait to avoid the futex()
  • We also need to calibrate de rand() to get the key (just patch the sleep and add other rand() before the pthread_create loop
Adding the extra rand() can be done with a patch because from gdb is not possible to make a call rand() in this binary.

With this modifications, the binary will print the key by itself. 

Read more
  1. Pentest Tools Framework
  2. Pentest Tools Free
  3. Pentest Reporting Tools
  4. Blackhat Hacker Tools
  5. Hack Tools Online
  6. Hacking Tools And Software
  7. Hacking Tools For Games
  8. Pentest Tools List
  9. Hacking Tools For Pc
  10. Hack Website Online Tool
  11. What Is Hacking Tools
  12. Hacking Tools Kit
  13. World No 1 Hacker Software
  14. Hacker Tools 2020
  15. Hacker Techniques Tools And Incident Handling
  16. Best Hacking Tools 2020
  17. Hacker Tools 2019
  18. Pentest Tools Download
  19. Best Hacking Tools 2020
  20. Hackers Toolbox
  21. Hack Tools For Mac
  22. Pentest Tools Apk
  23. Top Pentest Tools
  24. Hacker Tools Online
  25. Hacking Tools Github
  26. Pentest Tools Free
  27. Hacking Tools For Beginners
  28. Hacker Security Tools
  29. Hacking Tools For Kali Linux
  30. Hack Tools Online
  31. Hacker
  32. Pentest Tools Download
  33. Free Pentest Tools For Windows
  34. Hack Tools Github
  35. Pentest Tools Kali Linux
  36. Hacker Tools Linux
  37. Hacker Tools Software
  38. Hacker Techniques Tools And Incident Handling
  39. Hacking Tools Mac
  40. Best Hacking Tools 2019
  41. Best Hacking Tools 2019
  42. Hacking Tools Pc
  43. Tools Used For Hacking
  44. Hacking Tools For Windows Free Download
  45. Easy Hack Tools
  46. Hacking App
  47. Hack Tools For Ubuntu
  48. Hacker Tools List
  49. Pentest Recon Tools
  50. Pentest Tools For Windows
  51. Hack Tools For Pc
  52. Hacking Tools Hardware
  53. Hacker Tools For Windows
  54. Beginner Hacker Tools
  55. Pentest Tools Subdomain
  56. Hack And Tools
  57. Github Hacking Tools
  58. Hacker Hardware Tools
  59. Pentest Tools For Mac
  60. Tools For Hacker
  61. Hack Tools
  62. World No 1 Hacker Software
  63. Pentest Tools Review
  64. What Is Hacking Tools
  65. What Are Hacking Tools
  66. Hak5 Tools
  67. Best Pentesting Tools 2018
  68. Pentest Tools Online
  69. Top Pentest Tools
  70. Hack Tools 2019
  71. Pentest Automation Tools
  72. Hacker Tools Apk
  73. Hack And Tools
  74. How To Hack
  75. Best Hacking Tools 2019
  76. Hacker Tools Mac
  77. Pentest Tools Download
  78. Nsa Hack Tools
  79. Hacker Tools Apk Download
  80. Pentest Tools Subdomain
  81. Pentest Tools Apk
  82. Hacker Hardware Tools
  83. Hacking Tools Free Download
  84. Hackrf Tools
  85. Hacking Tools For Games
  86. Hack Tools For Games
  87. Bluetooth Hacking Tools Kali
  88. Pentest Tools Url Fuzzer
  89. Pentest Tools Free
  90. How To Hack
  91. Hacker Tools For Ios
  92. What Is Hacking Tools
  93. Hacker Tools Online
  94. Hack Apps
  95. Hack Tools 2019
  96. Nsa Hacker Tools
  97. Hacking App
  98. Hack Tools For Pc
  99. Hacking Tools For Games
  100. Pentest Tools For Mac
  101. Usb Pentest Tools
  102. Hacker Tools 2020
  103. Hacker Tools Free Download
  104. Hacking Tools Windows 10
  105. Pentest Tools Kali Linux
  106. Hacker Tools Free Download
  107. Hacking Tools And Software
  108. Hacker Tools For Mac
  109. Hacking Tools 2019
  110. Game Hacking
  111. Pentest Tools Find Subdomains
  112. Hacking Tools 2020
  113. Underground Hacker Sites
  114. Hacking Tools Name
  115. Hacking Tools Online
  116. Termux Hacking Tools 2019
  117. New Hack Tools
  118. Nsa Hack Tools Download
  119. Hacker Tools Online
  120. Hacking Tools Windows 10
  121. Hacking Tools Name
  122. Nsa Hacker Tools
  123. Wifi Hacker Tools For Windows
  124. Hacker Tools Hardware
  125. Hacking Tools For Windows Free Download
  126. How To Install Pentest Tools In Ubuntu
  127. Pentest Tools Windows
  128. Pentest Tools Subdomain
  129. Hack Apps
  130. Beginner Hacker Tools
  131. Pentest Tools Open Source
  132. Hack Rom Tools
  133. Hacking Apps
  134. Hacker Tools Github
  135. Hack Tools Online
  136. Hack Tools Online
  137. Hacking Tools Usb
  138. Hak5 Tools
  139. Free Pentest Tools For Windows
  140. Install Pentest Tools Ubuntu
  141. Hacker Tools Apk
  142. Hacker Tools Apk Download
  143. Underground Hacker Sites
  144. Tools 4 Hack
  145. Pentest Tools Bluekeep
  146. Pentest Reporting Tools
  147. Hackers Toolbox
  148. Pentest Tools List
  149. Hacker Tools Free
  150. Nsa Hack Tools
  151. Hacks And Tools
  152. Blackhat Hacker Tools
  153. Pentest Tools Subdomain
  154. Hacking Tools Software
  155. Hackrf Tools
  156. Github Hacking Tools
  157. Hack Tools Download
  158. Hacking Tools For Windows
  159. Android Hack Tools Github
  160. Hack Tools For Pc
  161. Hacking Tools Github
  162. Hacker Tools Linux
  163. Hacker Tools Hardware
  164. Tools Used For Hacking
  165. Hacking Tools And Software
  166. Hacker Tools Apk
  167. Pentest Tools Website Vulnerability
  168. Hack Tools
  169. Hacking Tools For Kali Linux
  170. Kik Hack Tools
  171. Pentest Tools Find Subdomains
  172. Hacking Apps
  173. Pentest Tools Github
  174. Hack Tools Github

No hay comentarios: