csaw23_rebug1.md (2726B)
1 title: CSAW23 rev/Rebug1 Writeup 2 date: 2023-09-28 12:00 3 --- 4 > Can't seem to print out the flag :( Can you figure how to get the flag 5 with this binary? 6 7 An innocent looking binary is given that asks for a string: 8 9 ``` 10 ./test.out 11 Enter the String: rptuainadui 12 that isn't correct, im sorry! 13 ``` 14 15 This is part of the rev category (which I think is for reverse 16 engineering). You could bruteforce this yes, but I found it easier 17 to put this into a decompiler like the ones on [DogBolt (Decompiler 18 Explorer)](https://dogbolt.org/) to see what it's doing. 19 20 Decompiled main function (via angr): 21 22 ``` 23 int main() 24 { 25 char v0; // [bp-0x448] 26 unsigned int v1; // [bp-0x41c] 27 char v2; // [bp-0x418] 28 char v3; // [bp-0x408] 29 unsigned long long v4; // [bp-0x18] 30 unsigned int v5; // [bp-0x10] 31 unsigned int v6; // [bp-0xc] 32 unsigned long long v8; // rax 33 34 printf("Enter the String: "); 35 __isoc99_scanf("%s", (unsigned int)&v3); 36 for (v6 = 0; (&v3)[v6]; v6 += 1); 37 if (v6 == 12) 38 { 39 puts("that's correct!"); 40 v4 = EVP_MD_CTX_new(); 41 (unsigned int)v8 = EVP_md5(); 42 EVP_DigestInit_ex(v4, v8, 0x0, v8); 43 EVP_DigestUpdate(v4, "12", 0x2, "12"); 44 v1 = 16; 45 EVP_DigestFinal_ex(v4, &v2, &v1, &v2); 46 EVP_MD_CTX_free(v4); 47 for (v5 = 0; v5 <= 15; v5 += 1) 48 { 49 sprintf(&(&v0)[2 * v5], "%02x", (&v2)[v5]); 50 } 51 printf("csawctf{%s}\n", (unsigned int)&v0); 52 return 0; 53 } 54 printf("that isn't correct, im sorry!"); 55 return 0; 56 } 57 ``` 58 59 This along with the rest of the decompiled binary can't be simply compiled again 60 as-is because there are a few issues, like the OpenSSL functions being called 61 having an extra argument added to the end. 62 63 When looking at the functions being called, it seems that the flag is just an 64 md5 of the number 12. The program also seems to give the flag itself if you give 65 it the character with the ASCII value of 12 (form feed). 66 67 The line that that has the data being checksummed is this: 68 69 ``` 70 EVP_DigestUpdate(v4, "12", 0x2, "12"); 71 ``` 72 73 I did try piping the form feed character via printf to the binary, but it did 74 not like that, so it seems that the only way to get the flag is through another 75 way. 76 77 While you could just create a very simplified version of the decompiled source 78 with OpenSSL's crypto library (which is what I did originally), it's much easier 79 to just pass the number 12 to a pre-installed md5 command (md5 on OpenBSD, 80 md5sum on Linux). 81 82 ``` 83 $ echo -n 12 | md5 84 c20ad4d76fe97759aa27a0c99bff6710 85 ``` 86 87 This CTF's flags were in the format of csawctf{somethinghere}, as also seen in 88 the decompiled source, so the actual flag was this: 89 90 ``` 91 csawctf{c20ad4d76fe97759aa27a0c99bff6710} 92 ``` 93 94 This was my first time doing any decompilation of a program, and I think this 95 was a good start to learn reverse engineering. 96 97 ```