Reversing ELF
This is my write-up for Reversing ELF on TryHackMe located at: https://tryhackme.com/room/reverselfiles.
Crackme1
(2)(1)-1625038959f3f3aed39b831a83c05cee.png)
I just ran the file and it gave me the flag:
(2)-d03882f3609c04dd739c4b7ff69221e8.png)
Crackme2
(2)(1)-f58ffb7048325cb8657a093e3f4f7050.png)
Running the code lets you know that there is a password you need to get access to the flag:
(2)-3fbcb828750b1ec1752efd850aeac881.png)
Running strings on the code shows me that there might be the password in plain text:
(2)-0ba9b79e613d2be3ae5cd790d3f388a7.png)
Using that password, you are able to see the flag:
-65426f63b60136b21cda1ea952ce38f0.png)
Crackme3
(1)(2)-d657a071af4d17f9bd9f08a0f701419a.png)
(2)-2f87c7c6e422e19de203e6befbf07ba7.png)
I ran strings on the file to see if there was something I was able to get from it. I was able to find what looked like a base64 encoded string:
(2)-291ce6183251f5dbdb34dbfede54fbe1.png)
I then decoded that string using the terminal, and got the flag:
(2)(1)-1f6024b6080e724cb90529a47d1e06b5.png)
Crackme4
(2)(1)(1)-21c4370922c6a84e29d37badff656c1e.png)
I think I had seen somewhere that strcmp is vulnerable. In addition, strings did not provide me with any hints or passwords. I pulled up the code in Ghidra, and noticed that there is a function called compare_pwd:
(2)-647b558b8121b1bad2daeee01de46043.png)
I then patched the code to make the password seem correct. I did this by patching the instruction for where iVar == 0, thus leading to if iVar ==0, IF the password is incorrect. However, this did not end up giving me the flag:
(3)(1)-a427e79f3689828ffce71f198d47aa82.png)
I then opened the file in Cutter, and put a break-point where the strcmp occurs:
(3)-74505959a572a200b9871338a4421982.png)
After I get to the break-point, I held my mouse over the rax variable, and that led me to the password. The following screenshot is from the Register References window in Cutter:
(1)-c38b09a8cb05270554391209cd1ee825.png)
I was able to replicate this in gdb-peda as well:
(2)-e1b967395129a9f976b751198bdf3e87.png)
The main thing here is that strcmp will compare two strings and output an integer value based on if they are equal or not. If you are able to print out the values at the registers prior to the comparison, you can get the flag.
Crackme5
-e412d0976e1d02b37190f6efc11070c5.png)
Running the command doesn't really give that much information:
(1)-030610f46b50709ca1cd21bce85afb72.png)
I looked at the code in Cutter:
(3)-e5e2ed8f8de3bb4fc9977ba4922a70a4.png)
In the image, I have highlighted the registers that interested me the most. It seemed that those registers were being compared later on. Since they will be compared, my assumption was that one was the correct password and one variable was the input from the user. With that being said, I hopped into gdb (with the peda modifications) and then put a break-point right at rax = $s1. The reason for this was that when I put the break-point there, rdx AND rax would be set with the values and it would be easier to read both there. That ended up getting me the flag:
(2)(1)-f045d8f3d20f10008130855a83d2a7a9.png)
In the image, I did end up accidentally using the flag as my input, thus rax AND rdx being hidden.
Crackme6
(2)(2)-845d3f6fc4e79285978bd6cc22f1fd58.png)
Running the program by itself does not give off too much data. I opened the code using Cutter:
(1)-f9da4abcdcf4d3bb7bcc936ccd379084.png)
Here we can see the if statement checking if there is a command line argument while the code is being run or not. If there is not, then it prints the string. If there is, then it goes into the compare_pwd function:
(2)(3)-6a45a58c45df120645a0dc3a3de18555.png)
This is a simple function to check if the password is correct or not. It does rely on another function in order to make this decision: my_secure_test.
-223207adb034fe11739e3a338d5789d7.png)
This function seems to be taking in the users input and then checking each character of the user input. There are 8 labels in total, so my assumption is then that this is an 8 character password. I see that al (a register?) is being compared in each label to a hex value. I got all of the hex values from each of the labels and used https://www.rapidtables.com/convert/number/hex-to-ascii.html to decode it for me:
-afbc1513bdb1959f6cd934767e7942fd.png)
It ended up outputting a password for me. That was the flag:
Crackme7
-fb5e19238d67c2ce1b4c54cc96749d0e.png)
-e481f733b74a62226d1f9f3773feeedc.png)
It seems like I would have to bypass the checks in place for each of the functions to get to the flag. I opened the file up in Cutter and noticed a giveFlag function:
-5c574a51a12f01ccfecb737386bb5697.png)
I went back into the main function to see if there was anything more tangible for me to go off of. I noticed something interesting:
-d56b86d43ad79a4c7996525565343839.png)
In order for you to even have access to the giveFlag function, the register eax has to be set to the hex value of 0x7a69. I tried multiple variations of this:
(3)-b3cc0f6e22ce782079b080669f5b47a0.png)
None of them seemed to work. Then I opened the file in Ghidra, and held my mouse on the value:
-7062f940b3a29baed160076653afe8f5.png)
It gave me the decimal value, which turned out to be the password:
-f41d6070b394bc6790d78e64d0326253.png)
Crackme8
(3)-5fc8a914c8b250c6a2177288287cd356.png)
(1)-2bb7d736af4a2fa16a0f1f7e675c1a0d.png)
I opened the file in Cutter to see what the main function had in it:
-89e073ea5d8926559171a11c9f680736.png)
It seems that this should be pretty straight forward. If the register eax is equal to the value 0xcafef00d, you get the flag.
Trying that as is did not seem to work. I then looked into the atoi function and found this website that explained a bit about it: https://www.tutorialspoint.com/c_standard_library/c_function_atoi.htm.
-a7921fd093317850a63d81b0b67b2948.png)
This makes me think that I might have to change the hex value of 0xcafef00d to some other type to get the flag. The return value of atoi is of type integer so that does give a little bit of a hint. I did end up getting the flag, but not the way it was intended. I will look at other people's solutions to how they ended up solving this without patching the code. What I have learned so far was that atoi and itoa are "opposite" functions. atoi would make a string an integer, while itoa would make an integer into a string. In the code, you are to input a value, which would get passed into atoi. Then that output from atoi gets compared to 0xcafef00d. If they are the same, then you get the flag. I was not able to get the flag this way. The way I did it was that I patched the code using ghidra, and then got the flag since the patch made it that any password other than the correct password would get me the flag:
-db79da6e82f05bc6dbe594b88ac235fe.png)
(1)-00334f01bcdca0ae3bff47c27164c907.png)
After reading https://tereresecurity.wordpress.com/2021/12/09/write-up-reversing-elf/, I realized that I had overlooked the two's compliment number, which was a number I had seen multiple times while in Ghidra. That number was the actual password for this binary.