1. Overview
Is an elf32 static and stripped binary, but the good news is that it was compiled with gcc and it will not have shitty runtimes and libs to fingerprint, just the libc ... and libprhrhead
This binary is writed by Ricardo J Rodrigez
When it's executed, it seems that is computing the flag:
But this process never ends .... let's see what strace say:
There is a thread deadlock, maybe the start point can be looking in IDA the xrefs of 0x403a85
Maybe we can think about an encrypted flag that is not decrypting because of the lock.
This can be solved in two ways:
- static: understanding the cryptosystem and programming our own decryptor
- dynamic: fixing the the binary and running it (hard: antidebug, futex, rands ...)
At first sight I thought that dynamic approach were quicker, but it turned more complex than the static approach.
2. Static approach
Crawling the xrefs to the futex, it is possible to locate the main:
With libc/libpthread function fingerprinting or a bit of manual work, we have the symbols, here is the main, where 255 threads are created and joined, when the threads end, the xor key is calculated and it calls the print_flag:
The code of the thread is passed to the libc_pthread_create, IDA recognize this area as data but can be selected as code and function.
This is the thread code decompiled, where we can observe two infinite loops for ptrace detection and preload (although is static) this antidebug/antihook are easy to detect at this point.
we have to observe the important thing, is the key random?? well, with the same seed the random sequence will be the same, then the key is "hidden" in the predictability of the random.
If the threads are not executed on the creation order, the key will be wrong because is xored with the th_id which is the identify of current thread.
The print_key function, do the xor between the key and the flag_cyphertext byte by byte.
And here we have the seed and the first bytes of the cypher-text:
With radare we can convert this to a c variable quickly:
And here is the flag cyphertext:
And with some radare magics, we have the c initialized array:
radare, is full featured :)
With a bit of rand() calibration here is the solution ...
The code:
https://github.com/NocONName/CTF_NcN2k15/blob/master/theAnswer/solution.c
3. The Dynamic Approach
First we have to patch the anti-debugs, on beginning of the thread there is two evident anti-debugs (well anti preload hook and anti ptrace debugging) the infinite loop also makes the anti-debug more evident:
There are also a third anti-debug, a bit more silent, if detects a debugger trough the first available descriptor, and here comes the fucking part, don't crash the execution, the execution continues but the seed is modified a bit, then the decryption key will not be ok.
Ok, the seed is incremented by one, this could be a normal program feature, but this is only triggered if the fileno(open("/","r")) > 3 this is a well known anti-debug, that also can be seen from a traced execution.
Ok, just one byte patch, seed+=1 to seed+=0, (add eax, 1 to add eax, 0)
before:
after:
To patch the two infinite loops, just nop the two bytes of each jmp $-0
Ok, but repairing this binary is harder than building a decryptor, we need to fix more things:
- The sleep(randInt(1,3)) of the beginning of the thread to execute the threads in the correct order
- Modify the pthread_cond_wait to avoid the futex()
- We also need to calibrate de rand() to get the key (just patch the sleep and add other rand() before the pthread_create loop
Adding the extra rand() can be done with a patch because from gdb is not possible to make a call rand() in this binary.
With this modifications, the binary will print the key by itself.
- Hacking Tools Pc
- Hacker Tools List
- Hacker Techniques Tools And Incident Handling
- New Hacker Tools
- Android Hack Tools Github
- Pentest Tools List
- Pentest Tools Free
- Best Hacking Tools 2020
- Pentest Tools Website
- Hack Tools
- Hacker Tools Mac
- Free Pentest Tools For Windows
- Hacker Tools For Pc
- Hacker Tools 2020
- Hack Website Online Tool
- Hacking Tools Windows 10
- Hacker Tools Free
- Game Hacking
- Hack Tools
- Tools 4 Hack
- Hack Tools For Ubuntu
- How To Install Pentest Tools In Ubuntu
- Hacker Tools For Pc
- Pentest Tools Find Subdomains
- Hacker Tools 2019
- Hack Tools Github
- Hacker Security Tools
- Kik Hack Tools
- Pentest Tools Nmap
- Tools Used For Hacking
- Ethical Hacker Tools
- Kik Hack Tools
- Pentest Tools Find Subdomains
- Pentest Tools Find Subdomains
- Tools For Hacker
- Hacker Tools Hardware
- Pentest Recon Tools
- Hacking Tools Download
- Hacker Tool Kit
- Pentest Tools Review
- Hacker Tools
- How To Make Hacking Tools
- Hack Tools
- Hacker
- Hack Tools For Ubuntu
- Black Hat Hacker Tools
- Hack Tool Apk No Root
- Hacker Tools Software
- Hacking Tools For Beginners
- Hacking Tools Hardware
- Hacker Tools Apk
- Hack Website Online Tool
- Hack Tools
- Bluetooth Hacking Tools Kali
- Hacking Tools For Kali Linux
- Ethical Hacker Tools
- Pentest Tools
- Pentest Reporting Tools
- Hack Tools Github
- Kik Hack Tools
- Hackrf Tools
- Hacking Tools And Software
- Pentest Tools Linux
- Pentest Tools Kali Linux
- Growth Hacker Tools
- Physical Pentest Tools
- Hak5 Tools
- Hacker Tools Windows
- Hacking Tools Windows
- Pentest Tools Download
- Pentest Tools Subdomain
- Nsa Hacker Tools
- Hack Tools For Pc
- Hacking Tools
- Hacking App
- Hacking Tools Hardware
- Hack Apps
- Nsa Hacker Tools
- Hacking Tools Free Download
- Hacker Tools Windows
- Pentest Tools Framework
- Hack Tool Apk
- Hacking Tools Windows 10
- Hacking Tools Pc
- Hacker
- Termux Hacking Tools 2019
- Hack Tools For Windows
- Pentest Box Tools Download
- How To Install Pentest Tools In Ubuntu
- Hacker Tools Online
- Bluetooth Hacking Tools Kali
- Hacking Tools For Mac
- Hacker Tools Free
- Hacker Tools For Windows
- Hacker Hardware Tools
- Hacker
- New Hacker Tools
- Easy Hack Tools
- Best Pentesting Tools 2018
- Pentest Tools Apk
- Hacking App
- Hack Tool Apk
- Hacking Tools For Beginners
- Computer Hacker
- Hacking Tools For Mac
- Hacker Tools 2020
- Best Hacking Tools 2019
- Hacker Techniques Tools And Incident Handling
- Hack Tools For Mac
- Pentest Tools
- Hacker Search Tools
- New Hacker Tools
- Hacker
- Hack Tools Download
- Pentest Tools
- Tools 4 Hack
- Install Pentest Tools Ubuntu
- Hak5 Tools
- Hacker Tools Free Download
- Pentest Tools Github
- Pentest Tools Subdomain
- Hack Tools For Mac
- Pentest Tools Android
- Hacking Tools Free Download
- Hack Tools Mac
- Hack Tools Download
- Hacking App
- Pentest Recon Tools
- Hacking Tools Kit
- Hacking Tools Windows
- Nsa Hack Tools
- Hack Tools For Windows
- World No 1 Hacker Software
- Hack Tools Pc
- Hack Tools Online
- Pentest Tools List
- Hacker Tools 2019
- Hack Tools
- How To Make Hacking Tools
- Pentest Tools Find Subdomains
- How To Install Pentest Tools In Ubuntu
- Hacker Search Tools
- How To Hack
- Physical Pentest Tools
- Pentest Tools Bluekeep
- Hacker Tools
- Pentest Tools Nmap
- Pentest Tools For Ubuntu
- Pentest Tools Nmap
- Bluetooth Hacking Tools Kali
- Hacking Tools Kit
- Pentest Tools Url Fuzzer
- Pentest Tools For Mac
- Hack Tool Apk No Root
- Hack Tools Pc
- Tools For Hacker
- Hacking Tools
- Hack Tools Download
- Hack And Tools
0 comentarios:
Publicar un comentario