Name:
Location: Winnipeg, Manitoba, Canada

The Wholefood Farmacy makes eating healthy easy, convenient and affordable. We offer pure, nutrient-dense, ready-to-eat, whole food meals, snacks, soups, smoothie mixes and treats for the children. All of our foods are vegetarian, most are raw and vegan as well. We also offer many gluten-free and nut-free whole food choices for those with food sensitivities - see our FAQ section of the Whole Food Farmacy Website for more information.

Wednesday, January 17, 2024

NcN 2015 CTF - theAnswer Writeup


1. Overview

Is an elf32 static and stripped binary, but the good news is that it was compiled with gcc and it will not have shitty runtimes and libs to fingerprint, just the libc ... and libprhrhead
This binary is writed by Ricardo J Rodrigez

When it's executed, it seems that is computing the flag:


But this process never ends .... let's see what strace say:


There is a thread deadlock, maybe the start point can be looking in IDA the xrefs of 0x403a85
Maybe we can think about an encrypted flag that is not decrypting because of the lock.

This can be solved in two ways:

  • static: understanding the cryptosystem and programming our own decryptor
  • dynamic: fixing the the binary and running it (hard: antidebug, futex, rands ...)


At first sight I thought that dynamic approach were quicker, but it turned more complex than the static approach.


2. Static approach

Crawling the xrefs to the futex, it is possible to locate the main:



With libc/libpthread function fingerprinting or a bit of manual work, we have the symbols, here is the main, where 255 threads are created and joined, when the threads end, the xor key is calculated and it calls the print_flag:



The code of the thread is passed to the libc_pthread_create, IDA recognize this area as data but can be selected as code and function.

This is the thread code decompiled, where we can observe two infinite loops for ptrace detection and preload (although is static) this antidebug/antihook are easy to detect at this point.


we have to observe the important thing, is the key random?? well, with the same seed the random sequence will be the same, then the key is "hidden" in the predictability of the random.

If the threads are not executed on the creation order, the key will be wrong because is xored with the th_id which is the identify of current thread.

The print_key function, do the xor between the key and the flag_cyphertext byte by byte.


And here we have the seed and the first bytes of the cypher-text:



With radare we can convert this to a c variable quickly:


And here is the flag cyphertext:


And with some radare magics, we have the c initialized array:


radare, is full featured :)

With a bit of rand() calibration here is the solution ...



The code:
https://github.com/NocONName/CTF_NcN2k15/blob/master/theAnswer/solution.c





3. The Dynamic Approach

First we have to patch the anti-debugs, on beginning of the thread there is two evident anti-debugs (well anti preload hook and anti ptrace debugging) the infinite loop also makes the anti-debug more evident:



There are also a third anti-debug, a bit more silent, if detects a debugger trough the first available descriptor, and here comes the fucking part, don't crash the execution, the execution continues but the seed is modified a bit, then the decryption key will not be ok.





Ok, the seed is incremented by one, this could be a normal program feature, but this is only triggered if the fileno(open("/","r")) > 3 this is a well known anti-debug, that also can be seen from a traced execution.

Ok, just one byte patch,  seed+=1  to  seed+=0,   (add eax, 1   to add eax, 0)

before:


after:



To patch the two infinite loops, just nop the two bytes of each jmp $-0



Ok, but repairing this binary is harder than building a decryptor, we need to fix more things:

  •  The sleep(randInt(1,3)) of the beginning of the thread to execute the threads in the correct order
  •  Modify the pthread_cond_wait to avoid the futex()
  • We also need to calibrate de rand() to get the key (just patch the sleep and add other rand() before the pthread_create loop
Adding the extra rand() can be done with a patch because from gdb is not possible to make a call rand() in this binary.

With this modifications, the binary will print the key by itself. 

More information
  1. Pentest Tools List
  2. Hacking Tools For Games
  3. Hack Rom Tools
  4. Hacking Apps
  5. Hack Tools Online
  6. Pentest Recon Tools
  7. Hacker Tools For Ios
  8. Hacking Tools 2019
  9. Hack Tools Pc
  10. Hacker Tools Free Download
  11. Hack Website Online Tool
  12. Usb Pentest Tools
  13. Hacking Tools Windows
  14. New Hacker Tools
  15. Pentest Tools Framework
  16. Pentest Tools Alternative
  17. Best Hacking Tools 2019
  18. Best Hacking Tools 2019
  19. Pentest Tools Subdomain
  20. Black Hat Hacker Tools
  21. Pentest Tools Subdomain
  22. Beginner Hacker Tools
  23. Hacking Tools Windows 10
  24. Pentest Automation Tools
  25. Hacking Tools Online
  26. Pentest Tools Tcp Port Scanner
  27. Hack Tools 2019
  28. Pentest Tools Alternative
  29. Pentest Box Tools Download
  30. Hacker Tools Apk Download
  31. Hackrf Tools
  32. Hackers Toolbox
  33. Hacker Tools Free Download
  34. Pentest Tools Review
  35. Hacker
  36. Hacking Tools For Kali Linux
  37. Pentest Tools Framework
  38. Hack Rom Tools
  39. Hacking Tools Pc
  40. Hack Tools Pc
  41. Hacking Tools Online
  42. Hacker Tools Hardware
  43. Hack Tools 2019
  44. Hack Tools
  45. What Are Hacking Tools
  46. Hacker Tools For Pc
  47. Hacker Tools Linux
  48. Pentest Tools Subdomain
  49. Nsa Hack Tools Download
  50. Usb Pentest Tools
  51. Hack Tools
  52. Hacking Tools 2020
  53. Kik Hack Tools
  54. Hack Tools For Pc
  55. Pentest Automation Tools
  56. Game Hacking
  57. Pentest Reporting Tools
  58. Pentest Tools Alternative
  59. Hack Tools Mac
  60. Hacking Tools For Beginners
  61. Hacking Tools For Windows
  62. Free Pentest Tools For Windows
  63. Beginner Hacker Tools
  64. Hacker Tools Mac
  65. Hacker Security Tools
  66. Hacking Apps
  67. Pentest Tools Windows
  68. Hacking Tools
  69. Bluetooth Hacking Tools Kali
  70. Usb Pentest Tools
  71. Nsa Hacker Tools
  72. Hacker Tools Online
  73. Hackers Toolbox
  74. Pentest Tools Nmap
  75. Pentest Tools Download
  76. Hacker Tools For Windows
  77. Best Hacking Tools 2020
  78. Hacker Tools Free
  79. Hacker Tools List
  80. Top Pentest Tools
  81. Hack Tools Mac
  82. Pentest Automation Tools
  83. Hacking Tools Mac
  84. Hack Tools For Windows
  85. Hack Tools Download
  86. Hack Tools Pc
  87. Pentest Tools Android
  88. Hacking Tools For Pc
  89. Hacking Tools Hardware
  90. Pentest Tools For Android
  91. Pentest Tools Linux
  92. Best Hacking Tools 2019
  93. Hacking Tools Software
  94. Pentest Tools Bluekeep
  95. Hacking Apps
  96. Pentest Tools Github
  97. Hacker
  98. Pentest Tools List
  99. Pentest Box Tools Download
  100. Growth Hacker Tools
  101. Hacker Tools For Pc
  102. Pentest Tools Download
  103. Game Hacking
  104. Pentest Tools List
  105. How To Hack
  106. New Hack Tools
  107. Hack Website Online Tool
  108. Game Hacking
  109. Hacker Tools 2019
  110. Hack Tools For Ubuntu
  111. Hacker Security Tools
  112. Pentest Tools
  113. Hacker Tools Free
  114. Best Hacking Tools 2019
  115. Usb Pentest Tools
  116. Hack Rom Tools
  117. Hacker Tools Github
  118. Hacking Tools Download
  119. Pentest Tools Subdomain
  120. Hacker Tools Hardware
  121. Hacker Hardware Tools
  122. Pentest Tools Apk
  123. World No 1 Hacker Software
  124. Hacker Tools Software
  125. Hacking Tools Pc
  126. Pentest Tools Github
  127. Pentest Tools Website Vulnerability
  128. Beginner Hacker Tools
  129. Pentest Tools Download
  130. How To Make Hacking Tools
  131. Hack Tools For Windows
  132. Hacker Tools 2020
  133. Pentest Tools Tcp Port Scanner
  134. Tools For Hacker
  135. Underground Hacker Sites
  136. Hacker Tools Apk
  137. Hacking App
  138. Hacker Tools Online
  139. Nsa Hack Tools Download
  140. Hacker Tools Apk Download
  141. Pentest Tools Review
  142. Hack Tools Download
  143. Hack Tools Download

0 Comments:

Post a Comment

<< Home