{"id":1202,"date":"2015-09-22T02:41:19","date_gmt":"2015-09-22T00:41:19","guid":{"rendered":"https:\/\/0x90r00t.com\/fr\/?p=1202"},"modified":"2015-09-23T02:28:12","modified_gmt":"2015-09-23T00:28:12","slug":"ekoparty-pre-ctf-2015-reverse-50-decode-it-write-up","status":"publish","type":"post","link":"https:\/\/0x90r00t.com\/fr\/2015\/09\/22\/ekoparty-pre-ctf-2015-reverse-50-decode-it-write-up\/","title":{"rendered":"[EKOPARTY PRE-CTF 2015] [Rev50 – Decode it] Write up"},"content":{"rendered":"

Description<\/h2>\n

Decode it.<\/p>\n

Description: A not so known decoding algorithm.<\/p>\n

Hints: Do not trust symbols! they are lying. Check the algorithm.<\/p>\n

Attachment: reversing50.zip<\/a><\/p><\/blockquote>\n

<\/p>\n

Resolution<\/h2>\n

Au d\u00e9but, on voit ce qui doit \u00eatre un crackme, la particularit\u00e9 c’est qu’il est compil\u00e9 pour fonctionner sur une architecture arm 32 bits.<\/p>\n

ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked (uses shared libs), for GNU\/Linux 2.6.26, BuildID[sha1]=0c1ab16b5f128e614308d2f8c1776d46080a6597, not stripped<\/code><\/p>\n

En utilisant l’outil \u00ab\u00a0string\u00a0\u00bb nous voyons certains appels syst\u00e8me int\u00e9ressants :<\/p>\n

\r\nmemcmp\r\nmalloc\r\n[...]\r\nMD5@@OPENSSL_1.0.0\r\n[...]\r\nBase64decode_len\r\n<\/pre>\n
Memcmp ? Tiens donc. C’est plut\u00f4t utile pour comparer (entre autre) des chaines de caract\u00e8re \u00e7a. md5 pour hasher et base64 pour encoder\/d\u00e9coder.<\/p>\n
Jouons avec LD_PRELOAD pour hooker l’appel du memcmp :<\/p>\n
\r\n#define _GNU_SOURCE\r\n#include <dlfcn.h>\r\n#include <string.h>\r\n#include <stdio.h>\r\n\r\ntypedef int (*omemcmp)(const void *s1, const void *s2, size_t n);\r\n\r\nint memcmp(const void *s1, const void *s2, size_t n) {\r\n    omemcmp omem;\r\n    omem = (int)dlsym(RTLD_NEXT, "memcmp");\r\n    printf("s1:%s\\ns2:%s\\ns:%d\\n", s1, s2, n);\r\n    return omem(s1, s2, n);\r\n}\r\n<\/pre>\n
On le lance :<\/p>\n
\r\n$ echo 'a' | LD_PRELOAD=.\/preload.so .\/decoder\r\nPlease, enter your encoded password: s1:\r\ns2:PASS_QIV1qyLR0hFEQU5KCbfm3Hok5V0VmpinCWseVd2X\r\ns:4\r\nAccess denied\r\n<\/pre>\n
Nous voyons ici qu’il faut que la chaine pass\u00e9e en argument ait la valeur \u00ab\u00a0PASS_QIV1qyLR0hFEQU5KCbfm3Hok5V0VmpinCWseVd2X\u00a0\u00bb une fois arriv\u00e9e au point de comparaison. Mais passer cette chaine ne fonctionne pas.<\/p>\n
Apr\u00e8s une analyse plus pouss\u00e9e il s’est av\u00e9r\u00e9 qu’il faille envoyer cette m\u00eame chaine de caract\u00e8res, mais encod\u00e9e en base64.<\/p>\n
\r\n$ LD_PRELOAD=.\/preload.so .\/decoder\r\nPlease, enter your encoded password: UEFTU19RSVYxcXlMUjBpRkVRVTVLQ2JnbTNIb2s1VjBWbXBobkNXc2VWZDJY\r\ns1:PASS_QIV1qyLR0hFEQU5KCbfm3Hok5V0VmpinCWseVd2X\r\ns2:PASS_QIV1qyLR0hFEQU5KCbfm3Hok5V0VmpinCWseVd2X\r\ns:46\r\nGreat! the flag is EKO{4fa8c8eac431266a25f56a297a73c334}\r\n<\/pre>\n
Le flag est : EKO{4fa8c8eac431266a25f56a297a73c334}<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"
Description Decode it. Description: A not so known decoding algorithm. Hints: Do not trust symbols! they are lying. Check the algorithm. Attachment: reversing50.zip<\/p>\n","protected":false},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,35,70],"tags":[85,75,84,10],"class_list":["post-1202","post","type-post","status-publish","format-standard","hentry","category-2015-fr","category-ctf-fr","category-ekoparty","tag-base64","tag-ekoparty","tag-ld_preload","tag-reverse"],"_links":{"self":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/1202","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/comments?post=1202"}],"version-history":[{"count":8,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/1202\/revisions"}],"predecessor-version":[{"id":1275,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/1202\/revisions\/1275"}],"wp:attachment":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/media?parent=1202"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/categories?post=1202"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/tags?post=1202"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}