GRUPO 40121

NcN 2015 CTF - theAnswer Writeup


1. Overview

Is an elf32 static and stripped binary, but the good news is that it was compiled with gcc and it will not have shitty runtimes and libs to fingerprint, just the libc ... and libprhrhead
This binary is writed by Ricardo J Rodrigez

When it's executed, it seems that is computing the flag:


But this process never ends .... let's see what strace say:


There is a thread deadlock, maybe the start point can be looking in IDA the xrefs of 0x403a85
Maybe we can think about an encrypted flag that is not decrypting because of the lock.

This can be solved in two ways:

  • static: understanding the cryptosystem and programming our own decryptor
  • dynamic: fixing the the binary and running it (hard: antidebug, futex, rands ...)


At first sight I thought that dynamic approach were quicker, but it turned more complex than the static approach.


2. Static approach

Crawling the xrefs to the futex, it is possible to locate the main:



With libc/libpthread function fingerprinting or a bit of manual work, we have the symbols, here is the main, where 255 threads are created and joined, when the threads end, the xor key is calculated and it calls the print_flag:



The code of the thread is passed to the libc_pthread_create, IDA recognize this area as data but can be selected as code and function.

This is the thread code decompiled, where we can observe two infinite loops for ptrace detection and preload (although is static) this antidebug/antihook are easy to detect at this point.


we have to observe the important thing, is the key random?? well, with the same seed the random sequence will be the same, then the key is "hidden" in the predictability of the random.

If the threads are not executed on the creation order, the key will be wrong because is xored with the th_id which is the identify of current thread.

The print_key function, do the xor between the key and the flag_cyphertext byte by byte.


And here we have the seed and the first bytes of the cypher-text:



With radare we can convert this to a c variable quickly:


And here is the flag cyphertext:


And with some radare magics, we have the c initialized array:


radare, is full featured :)

With a bit of rand() calibration here is the solution ...



The code:
https://github.com/NocONName/CTF_NcN2k15/blob/master/theAnswer/solution.c





3. The Dynamic Approach

First we have to patch the anti-debugs, on beginning of the thread there is two evident anti-debugs (well anti preload hook and anti ptrace debugging) the infinite loop also makes the anti-debug more evident:



There are also a third anti-debug, a bit more silent, if detects a debugger trough the first available descriptor, and here comes the fucking part, don't crash the execution, the execution continues but the seed is modified a bit, then the decryption key will not be ok.





Ok, the seed is incremented by one, this could be a normal program feature, but this is only triggered if the fileno(open("/","r")) > 3 this is a well known anti-debug, that also can be seen from a traced execution.

Ok, just one byte patch,  seed+=1  to  seed+=0,   (add eax, 1   to add eax, 0)

before:


after:



To patch the two infinite loops, just nop the two bytes of each jmp $-0



Ok, but repairing this binary is harder than building a decryptor, we need to fix more things:

  •  The sleep(randInt(1,3)) of the beginning of the thread to execute the threads in the correct order
  •  Modify the pthread_cond_wait to avoid the futex()
  • We also need to calibrate de rand() to get the key (just patch the sleep and add other rand() before the pthread_create loop
Adding the extra rand() can be done with a patch because from gdb is not possible to make a call rand() in this binary.

With this modifications, the binary will print the key by itself. 

More information


  1. Hacker Tools Free
  2. Hack Tool Apk No Root
  3. Hacking Tools Pc
  4. Hacker Tools Mac
  5. Hacker Search Tools
  6. Hack Tools For Games
  7. Hacking Tools Name
  8. Pentest Tools Framework
  9. Hacker Tools 2020
  10. Wifi Hacker Tools For Windows
  11. Hacking Tools Kit
  12. Black Hat Hacker Tools
  13. Hacking Tools Windows 10
  14. Hacker Techniques Tools And Incident Handling
  15. Pentest Tools For Windows
  16. Free Pentest Tools For Windows
  17. Hacker Tools 2020
  18. Pentest Tools Nmap
  19. Hacker Tools 2019
  20. Hack Tool Apk
  21. Pentest Tools Website Vulnerability
  22. Pentest Tools Find Subdomains
  23. Github Hacking Tools
  24. Hacking Tools Windows
  25. Hack Tools Github
  26. Hack Tools Online
  27. Hacker Tools Mac
  28. Hack Tools Mac
  29. Pentest Tools For Mac
  30. Hackrf Tools
  31. Hak5 Tools
  32. Free Pentest Tools For Windows
  33. Wifi Hacker Tools For Windows
  34. Pentest Reporting Tools
  35. Hacking Tools Kit
  36. Hacker
  37. How To Hack
  38. Hacking Tools And Software
  39. Hacker Tools For Mac
  40. Hacking Tools Mac
  41. Growth Hacker Tools
  42. Nsa Hack Tools
  43. Pentest Tools For Android
  44. Hacking Tools 2020
  45. Hacking Tools For Pc
  46. Hacking Tools For Kali Linux
  47. Computer Hacker
  48. Hacker Tools 2019
  49. Pentest Tools Free
  50. World No 1 Hacker Software
  51. Easy Hack Tools
  52. Hacker Tools 2020
  53. Hacking Tools For Pc
  54. Hack Tools
  55. Pentest Tools Website
  56. Hacker Tools Online
  57. Hack Tools Pc
  58. Hacker Tools For Mac
  59. Hack Tools For Ubuntu
  60. Pentest Tools List
  61. Hack Website Online Tool
  62. Pentest Tools Download
  63. Pentest Tools Subdomain
  64. Hack Tools Github
  65. Hacking Tools
  66. Hacking Tools For Mac
  67. Hack Tools For Windows
  68. Pentest Tools Framework
  69. Hacker Tools For Ios
  70. Best Hacking Tools 2019
  71. Nsa Hacker Tools
  72. Hackrf Tools
  73. Black Hat Hacker Tools
  74. Underground Hacker Sites
  75. Hacking Tools For Kali Linux
  76. Pentest Tools Bluekeep
  77. Hacking Tools Name
  78. Pentest Tools Website Vulnerability
  79. Hacker Techniques Tools And Incident Handling
  80. Hacker Hardware Tools
  81. Black Hat Hacker Tools
  82. Pentest Tools Nmap

No hay comentarios:

Publicar un comentario

Nota: solo los miembros de este blog pueden publicar comentarios.