search
Home

Reversing ELF

Date: 05, June, 2021

Author: Dhilip Sanjay S

Click Herearrow-up-right to go to the TryHackMe room.

hashtag
Crackme 1

$ ./crackme1
flag{not_that_kind_of_elf}

hashtag
Crackme 2

  • Analyze the binary using r2:

$ r2 -A crackme2
[..snip..]
0x080484db      6874860408     pushl $str.super_secret_password ; 0x8048674 ; "super_secret_password" ; const char *s2
[..snip..]

  • Enter the super secret password to obtain the flag:

$ ./crackme2 super_secret_password
Access granted.
flag{if_i_submit_this_flag_then_i_will_get_points}

hashtag
Crackme 3

  • Analyze the binary using r2:

  • Base64 decode the string:

  • Enter the password:

hashtag
Crackme 4

  • Analyze the binary using r2 by setting breakpoint in sym.compare_pwd function:

  • Enter the password to verify:

hashtag
Crackme 5

  • Analyze the binary using r2 by setting breakpoint before the function call to sym.strcmp_:

  • Enter the password to verify:

hashtag
Crackme 6

  • Analyze the binary using r2.

  • You'll find a function named sym.my_secure_test. Print the disassembled function:

  • Combine all the hex values that is being used for comparison.

  • Decode the hex value:

  • Enter the password to verify:

hashtag
Crackme 7

  • Analyze the binary using r2:

  • We can see that, other than the option 1,2 and 3, there is another option: 0x7a69

  • Use python to decode the hex value:

  • Enter the option as 31337:

hashtag
Crackme 8

  • Analyze the binary using r2.

  • You'll find that atoi() function is used before comparing with the password.

  • atoi() will convert the string to integer (if numbers are in the string, else it'll return 0)

  • Use signed int, big endian in struct to decode the hex value.

  • P.S: Unsigned decoded int doesn't work!

  • Enter the password to verify the flag:

PreviousReverseEngineeringNextSimple CTF

Last updated