1. Overview
Is an elf32 static and stripped binary, but the good news is that it was compiled with gcc and it will not have shitty runtimes and libs to fingerprint, just the libc ... and libprhrhead
This binary is writed by Ricardo J Rodrigez
When it's executed, it seems that is computing the flag:
But this process never ends .... let's see what strace say:
There is a thread deadlock, maybe the start point can be looking in IDA the xrefs of 0x403a85
Maybe we can think about an encrypted flag that is not decrypting because of the lock.
This can be solved in two ways:
- static: understanding the cryptosystem and programming our own decryptor
- dynamic: fixing the the binary and running it (hard: antidebug, futex, rands ...)
At first sight I thought that dynamic approach were quicker, but it turned more complex than the static approach.
2. Static approach
Crawling the xrefs to the futex, it is possible to locate the main:
With libc/libpthread function fingerprinting or a bit of manual work, we have the symbols, here is the main, where 255 threads are created and joined, when the threads end, the xor key is calculated and it calls the print_flag:
The code of the thread is passed to the libc_pthread_create, IDA recognize this area as data but can be selected as code and function.
This is the thread code decompiled, where we can observe two infinite loops for ptrace detection and preload (although is static) this antidebug/antihook are easy to detect at this point.
we have to observe the important thing, is the key random?? well, with the same seed the random sequence will be the same, then the key is "hidden" in the predictability of the random.
If the threads are not executed on the creation order, the key will be wrong because is xored with the th_id which is the identify of current thread.
The print_key function, do the xor between the key and the flag_cyphertext byte by byte.
And here we have the seed and the first bytes of the cypher-text:
With radare we can convert this to a c variable quickly:
And here is the flag cyphertext:
And with some radare magics, we have the c initialized array:
radare, is full featured :)
With a bit of rand() calibration here is the solution ...
The code:
https://github.com/NocONName/CTF_NcN2k15/blob/master/theAnswer/solution.c
3. The Dynamic Approach
First we have to patch the anti-debugs, on beginning of the thread there is two evident anti-debugs (well anti preload hook and anti ptrace debugging) the infinite loop also makes the anti-debug more evident:
There are also a third anti-debug, a bit more silent, if detects a debugger trough the first available descriptor, and here comes the fucking part, don't crash the execution, the execution continues but the seed is modified a bit, then the decryption key will not be ok.
Ok, the seed is incremented by one, this could be a normal program feature, but this is only triggered if the fileno(open("/","r")) > 3 this is a well known anti-debug, that also can be seen from a traced execution.
Ok, just one byte patch, seed+=1 to seed+=0, (add eax, 1 to add eax, 0)
before:
after:
To patch the two infinite loops, just nop the two bytes of each jmp $-0
Ok, but repairing this binary is harder than building a decryptor, we need to fix more things:
- The sleep(randInt(1,3)) of the beginning of the thread to execute the threads in the correct order
- Modify the pthread_cond_wait to avoid the futex()
- We also need to calibrate de rand() to get the key (just patch the sleep and add other rand() before the pthread_create loop
Adding the extra rand() can be done with a patch because from gdb is not possible to make a call rand() in this binary.
With this modifications, the binary will print the key by itself.
- Pentest Tools Framework
- Pentest Tools Free
- Pentest Reporting Tools
- Blackhat Hacker Tools
- Hack Tools Online
- Hacking Tools And Software
- Hacking Tools For Games
- Pentest Tools List
- Hacking Tools For Pc
- Hack Website Online Tool
- What Is Hacking Tools
- Hacking Tools Kit
- World No 1 Hacker Software
- Hacker Tools 2020
- Hacker Techniques Tools And Incident Handling
- Best Hacking Tools 2020
- Hacker Tools 2019
- Pentest Tools Download
- Best Hacking Tools 2020
- Hackers Toolbox
- Hack Tools For Mac
- Pentest Tools Apk
- Top Pentest Tools
- Hacker Tools Online
- Hacking Tools Github
- Pentest Tools Free
- Hacking Tools For Beginners
- Hacker Security Tools
- Hacking Tools For Kali Linux
- Hack Tools Online
- Hacker
- Pentest Tools Download
- Free Pentest Tools For Windows
- Hack Tools Github
- Pentest Tools Kali Linux
- Hacker Tools Linux
- Hacker Tools Software
- Hacker Techniques Tools And Incident Handling
- Hacking Tools Mac
- Best Hacking Tools 2019
- Best Hacking Tools 2019
- Hacking Tools Pc
- Tools Used For Hacking
- Hacking Tools For Windows Free Download
- Easy Hack Tools
- Hacking App
- Hack Tools For Ubuntu
- Hacker Tools List
- Pentest Recon Tools
- Pentest Tools For Windows
- Hack Tools For Pc
- Hacking Tools Hardware
- Hacker Tools For Windows
- Beginner Hacker Tools
- Pentest Tools Subdomain
- Hack And Tools
- Github Hacking Tools
- Hacker Hardware Tools
- Pentest Tools For Mac
- Tools For Hacker
- Hack Tools
- World No 1 Hacker Software
- Pentest Tools Review
- What Is Hacking Tools
- What Are Hacking Tools
- Hak5 Tools
- Best Pentesting Tools 2018
- Pentest Tools Online
- Top Pentest Tools
- Hack Tools 2019
- Pentest Automation Tools
- Hacker Tools Apk
- Hack And Tools
- How To Hack
- Best Hacking Tools 2019
- Hacker Tools Mac
- Pentest Tools Download
- Nsa Hack Tools
- Hacker Tools Apk Download
- Pentest Tools Subdomain
- Pentest Tools Apk
- Hacker Hardware Tools
- Hacking Tools Free Download
- Hackrf Tools
- Hacking Tools For Games
- Hack Tools For Games
- Bluetooth Hacking Tools Kali
- Pentest Tools Url Fuzzer
- Pentest Tools Free
- How To Hack
- Hacker Tools For Ios
- What Is Hacking Tools
- Hacker Tools Online
- Hack Apps
- Hack Tools 2019
- Nsa Hacker Tools
- Hacking App
- Hack Tools For Pc
- Hacking Tools For Games
- Pentest Tools For Mac
- Usb Pentest Tools
- Hacker Tools 2020
- Hacker Tools Free Download
- Hacking Tools Windows 10
- Pentest Tools Kali Linux
- Hacker Tools Free Download
- Hacking Tools And Software
- Hacker Tools For Mac
- Hacking Tools 2019
- Game Hacking
- Pentest Tools Find Subdomains
- Hacking Tools 2020
- Underground Hacker Sites
- Hacking Tools Name
- Hacking Tools Online
- Termux Hacking Tools 2019
- New Hack Tools
- Nsa Hack Tools Download
- Hacker Tools Online
- Hacking Tools Windows 10
- Hacking Tools Name
- Nsa Hacker Tools
- Wifi Hacker Tools For Windows
- Hacker Tools Hardware
- Hacking Tools For Windows Free Download
- How To Install Pentest Tools In Ubuntu
- Pentest Tools Windows
- Pentest Tools Subdomain
- Hack Apps
- Beginner Hacker Tools
- Pentest Tools Open Source
- Hack Rom Tools
- Hacking Apps
- Hacker Tools Github
- Hack Tools Online
- Hack Tools Online
- Hacking Tools Usb
- Hak5 Tools
- Free Pentest Tools For Windows
- Install Pentest Tools Ubuntu
- Hacker Tools Apk
- Hacker Tools Apk Download
- Underground Hacker Sites
- Tools 4 Hack
- Pentest Tools Bluekeep
- Pentest Reporting Tools
- Hackers Toolbox
- Pentest Tools List
- Hacker Tools Free
- Nsa Hack Tools
- Hacks And Tools
- Blackhat Hacker Tools
- Pentest Tools Subdomain
- Hacking Tools Software
- Hackrf Tools
- Github Hacking Tools
- Hack Tools Download
- Hacking Tools For Windows
- Android Hack Tools Github
- Hack Tools For Pc
- Hacking Tools Github
- Hacker Tools Linux
- Hacker Tools Hardware
- Tools Used For Hacking
- Hacking Tools And Software
- Hacker Tools Apk
- Pentest Tools Website Vulnerability
- Hack Tools
- Hacking Tools For Kali Linux
- Kik Hack Tools
- Pentest Tools Find Subdomains
- Hacking Apps
- Pentest Tools Github
- Hack Tools Github
No hay comentarios:
Publicar un comentario