{"id":2442,"date":"2016-07-03T16:25:44","date_gmt":"2016-07-03T14:25:44","guid":{"rendered":"https:\/\/0x90r00t.com\/fr\/?p=2442"},"modified":"2016-07-04T00:06:47","modified_gmt":"2016-07-03T22:06:47","slug":"ndh-2016-cracking-150-lol_so_obfuscated-write-up","status":"publish","type":"post","link":"https:\/\/0x90r00t.com\/fr\/2016\/07\/03\/ndh-2016-cracking-150-lol_so_obfuscated-write-up\/","title":{"rendered":"[NDH 2016] [CRACKING 150 \u2013 lol_so_obfuscated] Write Up"},"content":{"rendered":"

Description<\/h2>\n

Seulement un fichier \u00e9tait donn\u00e9 pour ce challenge: lol_so_obfuscated<\/a><\/p><\/blockquote>\n

<\/p>\n

Resolution<\/h2>\n

Comme tout cracking, on fait un peu de reconnaissance pour voir comment on va pouvoir r\u00e9soudre l’\u00e9preuve.<\/p>\n

\r\nlaxa:lol_so_obfuscated:16:02:28$ file lol_so_obfuscated \r\nlol_so_obfuscated: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter \/lib64\/ld-linux-x86-64.so.2, for GNU\/Linux 2.6.24, BuildID[sha1]=fd77362edbdc23030c91c114ab4d795133722d96, not stripped\r\nlaxa:lol_so_obfuscated:16:02:32$ ldd lol_so_obfuscated \r\nlinux-vdso.so.1 (0x00007ffeceb18000)\r\nlibc.so.6 => \/lib\/x86_64-linux-gnu\/libc.so.6 (0x00007f64f03dd000)\r\n\/lib64\/ld-linux-x86-64.so.2 (0x00007f64f0788000)\r\n<\/pre>\n
On lance le binaire rapidement pour voir ce qui est attendu :<\/p>\n
\r\nlaxa:lol_so_obfuscated:16:02:42$ .\/lol_so_obfuscated \r\nUsage .\/lol_so_obfuscated <flag>\r\nlaxa:lol_so_obfuscated:16:04:29$ .\/lol_so_obfuscated qwdqw\r\n29 29 10 16 3 \r\nYou're wrong.\r\n<\/pre>\n
Puis on passe le binaire sur IDA pour voir ce qu’il se passe :<\/p>\n
\r\nint __cdecl main(int argc, const char **argv, const char **envp)\r\n{\r\n  int v3; \/\/ edx@1\r\n  signed __int64 v4; \/\/ rcx@1\r\n  char *v5; \/\/ rdi@1\r\n  signed int v6; \/\/ ebx@5\r\n  char v8; \/\/ [sp+0h] [bp-58h]@1\r\n  char v9; \/\/ [sp+1h] [bp-57h]@4\r\n  char v10; \/\/ [sp+2h] [bp-56h]@4\r\n  char v11; \/\/ [sp+3h] [bp-55h]@4\r\n  char v12; \/\/ [sp+4h] [bp-54h]@4\r\n  char v13; \/\/ [sp+5h] [bp-53h]@4\r\n  char v14; \/\/ [sp+6h] [bp-52h]@4\r\n  char v15; \/\/ [sp+7h] [bp-51h]@4\r\n  char v16; \/\/ [sp+8h] [bp-50h]@4\r\n  char v17; \/\/ [sp+9h] [bp-4Fh]@4\r\n  char v18; \/\/ [sp+Ah] [bp-4Eh]@4\r\n  char v19; \/\/ [sp+Bh] [bp-4Dh]@4\r\n  char v20; \/\/ [sp+Ch] [bp-4Ch]@4\r\n  char v21; \/\/ [sp+Dh] [bp-4Bh]@4\r\n  char v22; \/\/ [sp+Eh] [bp-4Ah]@4\r\n  char v23; \/\/ [sp+Fh] [bp-49h]@4\r\n  char v24; \/\/ [sp+10h] [bp-48h]@4\r\n  char v25; \/\/ [sp+11h] [bp-47h]@4\r\n  char v26; \/\/ [sp+12h] [bp-46h]@4\r\n  char v27; \/\/ [sp+13h] [bp-45h]@4\r\n  char v28; \/\/ [sp+14h] [bp-44h]@4\r\n  char v29; \/\/ [sp+15h] [bp-43h]@4\r\n  char v30; \/\/ [sp+16h] [bp-42h]@4\r\n  char v31; \/\/ [sp+17h] [bp-41h]@4\r\n  char v32; \/\/ [sp+18h] [bp-40h]@4\r\n  char v33; \/\/ [sp+19h] [bp-3Fh]@4\r\n  char v34; \/\/ [sp+1Ah] [bp-3Eh]@4\r\n  char v35; \/\/ [sp+1Bh] [bp-3Dh]@4\r\n  char v36; \/\/ [sp+1Ch] [bp-3Ch]@4\r\n  char v37; \/\/ [sp+1Dh] [bp-3Bh]@4\r\n  char v38; \/\/ [sp+1Eh] [bp-3Ah]@4\r\n  char v39; \/\/ [sp+1Fh] [bp-39h]@4\r\n  char v40; \/\/ [sp+20h] [bp-38h]@4\r\n  char v41; \/\/ [sp+21h] [bp-37h]@4\r\n  char v42; \/\/ [sp+22h] [bp-36h]@4\r\n  char v43; \/\/ [sp+23h] [bp-35h]@4\r\n  char v44; \/\/ [sp+24h] [bp-34h]@4\r\n  char v45; \/\/ [sp+25h] [bp-33h]@4\r\n  char v46; \/\/ [sp+26h] [bp-32h]@4\r\n  char v47; \/\/ [sp+27h] [bp-31h]@4\r\n  __int64 v48; \/\/ [sp+38h] [bp-20h]@1\r\n\r\n  v3 = argc;\r\n  v4 = 5LL;\r\n  v48 = *MK_FP(__FS__, 40LL);\r\n  v5 = &v8;\r\n  while ( v4 )\r\n  {\r\n    *(_QWORD *)v5 = 0LL;\r\n    v5 += 8;\r\n    --v4;\r\n  }\r\n  v8 = 2;\r\n  v9 = 17;\r\n  v10 = 10;\r\n  v11 = 83;\r\n  v12 = 92;\r\n  v13 = 5;\r\n  v14 = 84;\r\n  v15 = 96;\r\n  v16 = 59;\r\n  v17 = 113;\r\n  *v5 = 0;\r\n  v18 = 97;\r\n  v19 = 108;\r\n  v20 = 40;\r\n  v21 = 39;\r\n  v22 = 121;\r\n  v23 = 63;\r\n  v24 = 115;\r\n  v25 = 115;\r\n  v26 = 42;\r\n  v27 = 97;\r\n  v28 = 98;\r\n  v29 = 1;\r\n  v30 = 37;\r\n  v31 = 74;\r\n  v32 = 121;\r\n  v33 = 91;\r\n  v34 = 54;\r\n  v35 = 28;\r\n  v36 = 103;\r\n  v37 = 65;\r\n  v38 = 60;\r\n  v39 = 89;\r\n  v40 = 58;\r\n  v41 = 80;\r\n  v42 = 118;\r\n  v43 = 14;\r\n  v44 = 116;\r\n  v45 = 2;\r\n  v46 = 39;\r\n  v47 = 3;\r\n  if ( v3 == 2 )\r\n  {\r\n    encrypt("lwskdhgkjsqnvkjwxchzeUBVWCXKJBNVWXCKJBGGG", (char *)argv[1]);\r\n    v6 = strcmp(argv[1], &v8);\r\n    if ( v6 )\r\n    {\r\n      v6 = 0;\r\n      puts("You're wrong.");\r\n    }\r\n    else\r\n    {\r\n      puts("You're right.");\r\n    }\r\n  }\r\n  else\r\n  {\r\n    v6 = 1;\r\n    __printf_chk(1LL, 4196728LL, *argv);\r\n  }\r\n  return v6;\r\n}\r\n<\/pre>\n
On peut voir que notre input est chiffr\u00e9 puis compar\u00e9 \u00e0 une autre cha\u00eene de caract\u00e8re. Si celle-ci est \u00e9gale, c’est qu’on a le bon input.
\nDerri\u00e8re \u00e7a, j’ai un peu jou\u00e9 avec du ltrace pour voir le comportement d’un input diff\u00e9rent sur plusieurs caract\u00e8res, pour voir si chaque changement changeait la valeur retourn\u00e9e par encrypt(), de la m\u00eame fa\u00e7on qu’une fonction de hachage.
\nJ’ai test\u00e9 le principe de regarder le texte compar\u00e9 sur le strcmp, avec un caract\u00e8re jusqu’\u00e0 trouver le caract\u00e8re qui est \u00e9gal au premier caract\u00e8re du contenu que l’on doit avoir. Je passe au caract\u00e8re suivant et le reste de la comparaison ne change pas derri\u00e8re. Du coup, on peut bruteforce tr\u00e8s rapidement le bon input.<\/p>\n
Voici un test avec ltrace, le premier caract\u00e8re est bon, le suivant n’est pas correct et pourtant cela ne change pas le chiffrement du premier caract\u00e8re.<\/p>\n
\r\nlaxa:lol_so_obfuscated:16:14:50$ ltrace .\/lol_so_obfuscated na\r\n(...)                                                                                                                                   = 10\r\nstrcmp("\002\024", "\002\021\\nS\\\\\005T`;qal('y?ss*ab\001%Jy[6\034gA<Y"...)                                                                                                = 3\r\n(...)\r\nlaxa:lol_so_obfuscated:16:14:52$ ltrace .\/lol_so_obfuscated nb\r\n(...)\r\nstrcmp("\002\027", "\002\021\\nS\\\\\005T`;qal('y?ss*ab\001%Jy[6\034gA<Y"...)                                                                                                = 6\r\n(...)\r\n<\/pre>\n
Avec gdb on r\u00e9cup\u00e8re la cha\u00eene compl\u00e8te de la comparaison du strcmp (puisque tronqu\u00e9 sur le ltrace) dont on a besoin pour faire le bruteforce.
\nIci on va pouvoir faire un script plut\u00f4t simple, le programme nous imprime la comparaison entre chaque caract\u00e8re, on sait que le premier caract\u00e8re chiffr\u00e9 de notre input doit sortir 2 sur la sortie standard.<\/p>\n
Voici le script final<\/p>\n
\r\n#!\/usr\/bin\/python\r\n\r\nfrom pwn import *\r\nimport string\r\nimport os\r\n\r\nflag = ""\r\ntest = "\002\021\\nS\\\\\005T`;qal('y?ss*ab\001%Jy[6\034gA<Y:Pv\016t\002'\003"\r\n\r\nfor a in range(0, len(test)):\r\n    for x in string.printable:\r\n        r = process([".\/lol_so_obfuscated", flag + x])\r\n        print "[%d]%c" % (a, x)\r\n        ret = r.recvline()\r\n        r.close()\r\n        if int(ret.split(" ")[a]) == int(ord(test[a])):\r\n            flag += x\r\n            print "flag so far: " + flag\r\n            break\r\n\r\nlog.info("flag is: " + flag)\r\n<\/pre>\n
Et on r\u00e9cup\u00e8re le flag : ndh2k16_19ac2d414c11f6f9da5a1d3342e304bc<\/p>\n","protected":false},"excerpt":{"rendered":"
Description Seulement un fichier \u00e9tait donn\u00e9 pour ce challenge: lol_so_obfuscated<\/p>\n","protected":false},"author":14,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[130,35,180],"tags":[178,179,177],"class_list":["post-2442","post","type-post","status-publish","format-standard","hentry","category-2016-fr","category-ctf-fr","category-nuit-du-hack-wargame","tag-cracking","tag-ndh2k16","tag-write-up"],"_links":{"self":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/2442","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/comments?post=2442"}],"version-history":[{"count":3,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/2442\/revisions"}],"predecessor-version":[{"id":2448,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/2442\/revisions\/2448"}],"wp:attachment":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/media?parent=2442"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/categories?post=2442"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/tags?post=2442"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}