1. Overview
Is an elf32 static and stripped binary, but the good news is that it was compiled with gcc and it will not have shitty runtimes and libs to fingerprint, just the libc ... and libprhrhead
This binary is writed by Ricardo J Rodrigez
When it's executed, it seems that is computing the flag:
But this process never ends .... let's see what strace say:
There is a thread deadlock, maybe the start point can be looking in IDA the xrefs of 0x403a85
Maybe we can think about an encrypted flag that is not decrypting because of the lock.
This can be solved in two ways:
- static: understanding the cryptosystem and programming our own decryptor
- dynamic: fixing the the binary and running it (hard: antidebug, futex, rands ...)
At first sight I thought that dynamic approach were quicker, but it turned more complex than the static approach.
2. Static approach
Crawling the xrefs to the futex, it is possible to locate the main:
With libc/libpthread function fingerprinting or a bit of manual work, we have the symbols, here is the main, where 255 threads are created and joined, when the threads end, the xor key is calculated and it calls the print_flag:
The code of the thread is passed to the libc_pthread_create, IDA recognize this area as data but can be selected as code and function.
This is the thread code decompiled, where we can observe two infinite loops for ptrace detection and preload (although is static) this antidebug/antihook are easy to detect at this point.
we have to observe the important thing, is the key random?? well, with the same seed the random sequence will be the same, then the key is "hidden" in the predictability of the random.
If the threads are not executed on the creation order, the key will be wrong because is xored with the th_id which is the identify of current thread.
The print_key function, do the xor between the key and the flag_cyphertext byte by byte.
And here we have the seed and the first bytes of the cypher-text:
With radare we can convert this to a c variable quickly:
And here is the flag cyphertext:
And with some radare magics, we have the c initialized array:
radare, is full featured :)
With a bit of rand() calibration here is the solution ...
The code:
https://github.com/NocONName/CTF_NcN2k15/blob/master/theAnswer/solution.c
3. The Dynamic Approach
First we have to patch the anti-debugs, on beginning of the thread there is two evident anti-debugs (well anti preload hook and anti ptrace debugging) the infinite loop also makes the anti-debug more evident:
There are also a third anti-debug, a bit more silent, if detects a debugger trough the first available descriptor, and here comes the fucking part, don't crash the execution, the execution continues but the seed is modified a bit, then the decryption key will not be ok.
Ok, the seed is incremented by one, this could be a normal program feature, but this is only triggered if the fileno(open("/","r")) > 3 this is a well known anti-debug, that also can be seen from a traced execution.
Ok, just one byte patch, seed+=1 to seed+=0, (add eax, 1 to add eax, 0)
before:
after:
To patch the two infinite loops, just nop the two bytes of each jmp $-0
Ok, but repairing this binary is harder than building a decryptor, we need to fix more things:
- The sleep(randInt(1,3)) of the beginning of the thread to execute the threads in the correct order
- Modify the pthread_cond_wait to avoid the futex()
- We also need to calibrate de rand() to get the key (just patch the sleep and add other rand() before the pthread_create loop
Adding the extra rand() can be done with a patch because from gdb is not possible to make a call rand() in this binary.
With this modifications, the binary will print the key by itself.
Related articles
- Hacker Tools Free
- Hacking Tools Github
- Wifi Hacker Tools For Windows
- Hacking Tools For Pc
- Hack App
- Pentest Recon Tools
- Tools 4 Hack
- Pentest Tools Website
- Tools Used For Hacking
- Tools 4 Hack
- Pentest Tools Android
- Pentest Tools Website Vulnerability
- Hack Website Online Tool
- Hacking Tools For Windows 7
- Game Hacking
- Pentest Tools List
- Hacker Tools Mac
- Hacker Tools For Mac
- Hacker Tools Windows
- Pentest Reporting Tools
- Hacking Tools Github
- Hacking Tools For Windows 7
- New Hacker Tools
- Hacker Tools Linux
- Pentest Tools Website
- Pentest Tools Subdomain
- Hacker Tools Apk
- Hack Tools For Ubuntu
- Hacker Techniques Tools And Incident Handling
- Hack Tool Apk
- Pentest Tools For Mac
- Tools For Hacker
- Pentest Tools Website Vulnerability
- Nsa Hack Tools
- Hacking Tools Usb
- Pentest Tools Kali Linux
- Hacking Tools Pc
- Ethical Hacker Tools
- What Are Hacking Tools
- Nsa Hack Tools
- Hacking Tools For Kali Linux
- Top Pentest Tools
- Black Hat Hacker Tools
- Hack Tools For Windows
- Hack Apps
- Hacks And Tools
- Pentest Tools Linux
- Hack Tool Apk
- Pentest Tools
- Hacks And Tools
- Hack Tools For Ubuntu
- Best Hacking Tools 2020
- Hacker Tools For Mac
- Hacker Search Tools
- Hack Tools For Mac
- Hack Tools For Windows
- Install Pentest Tools Ubuntu
- Hacking Tools Windows
- Hack Tools Online
- Nsa Hack Tools Download
- Pentest Tools Linux
- Pentest Tools Download
- Hacker Tools For Windows
- Github Hacking Tools
- Hacker Hardware Tools
- Hacker Tools Online
- Hack App
- Hack Tools Download
- Wifi Hacker Tools For Windows
- Pentest Automation Tools
- Hacks And Tools
- Hacker Tools For Windows
- Hacking Tools Hardware
- Hack Tools Online
- Wifi Hacker Tools For Windows
- Pentest Tools Subdomain
- Hacker Tools 2019
- Hacking Tools Pc
- Pentest Tools
- Install Pentest Tools Ubuntu
- Hacking Tools For Windows Free Download
- Pentest Tools Apk
- Pentest Tools Kali Linux
- Hacker Tools Apk Download
- What Is Hacking Tools
- Hack Tools Pc
- Pentest Recon Tools
- Hacking Apps
- Hacking Tools Free Download
- Hacking Tools For Games
- Hack Tool Apk No Root
- Hacker Tools 2019
- Hacker Tools For Mac
- Pentest Tools Free
- Hacking Tools Github
- Hacker Tools Apk
- Github Hacking Tools
- Hacking Tools Windows 10
- Hacker Tools Free Download
- Pentest Tools Nmap
- Blackhat Hacker Tools
- Hacker Tools Linux
- Nsa Hacker Tools
- Android Hack Tools Github
- How To Hack
- Pentest Automation Tools
- Hack Tools Github
- Hack Tools For Pc
- What Is Hacking Tools
- Hacker Tool Kit
- Hack Apps
- Ethical Hacker Tools
- Hacking Tools And Software
- Hack Tools 2019
- Hacking Tools For Windows 7
- Hack Tools For Mac
- Tools Used For Hacking
- Hack Tools
- Termux Hacking Tools 2019
- Hacker Security Tools
- Hacker Tools Apk Download
- Tools Used For Hacking
- Hackrf Tools
- Easy Hack Tools
- Hacking Tools Hardware
- Best Pentesting Tools 2018
- Hacker Tools Apk Download
- Hacker Tools Linux
- Hacker Search Tools
- Hack Tools For Ubuntu
- Hack Tools 2019
- Hacking Tools For Windows Free Download
- Hacking Tools Usb
- Hacking Tools For Pc
- How To Hack
- New Hack Tools
- Hack Website Online Tool
- Pentest Tools Apk
- Hacker Tools For Ios
- Pentest Tools Nmap
- Pentest Tools For Ubuntu
- Hack Tools Mac
- Hacker Tools Github
- Pentest Tools Website Vulnerability
- Pentest Tools Framework
- Hack Tool Apk No Root
- Hacking Tools For Mac
- Hacking Tools 2019
- Hacking Tools Software
- Hacking Tools Software
- Hacker Tools 2020
- Install Pentest Tools Ubuntu
- Pentest Tools Framework
- What Are Hacking Tools
- Hack Tools For Ubuntu
- Hacking Tools 2019
- Hackrf Tools
- Nsa Hack Tools Download
- Hacker Tool Kit
- Kik Hack Tools
- Android Hack Tools Github
- Pentest Tools For Ubuntu
- Black Hat Hacker Tools
- Hacking Tools Hardware
- Hacking Tools For Beginners
- Pentest Tools Website Vulnerability
- Underground Hacker Sites
- Hacking Tools 2020
- Hacking Tools Hardware
- Pentest Tools Nmap
- Hacker Tools 2019
- Hacking Tools Download
- Hacking Tools Windows
- Beginner Hacker Tools
- Pentest Tools Github
- Hacking Tools Software
- Pentest Tools Nmap
- Nsa Hack Tools Download
No hay comentarios:
Publicar un comentario