NcN 2015 CTF - theAnswer Writeup


1. Overview

Is an elf32 static and stripped binary, but the good news is that it was compiled with gcc and it will not have shitty runtimes and libs to fingerprint, just the libc ... and libprhrhead
This binary is writed by Ricardo J Rodrigez

When it's executed, it seems that is computing the flag:


But this process never ends .... let's see what strace say:


There is a thread deadlock, maybe the start point can be looking in IDA the xrefs of 0x403a85
Maybe we can think about an encrypted flag that is not decrypting because of the lock.

This can be solved in two ways:

  • static: understanding the cryptosystem and programming our own decryptor
  • dynamic: fixing the the binary and running it (hard: antidebug, futex, rands ...)


At first sight I thought that dynamic approach were quicker, but it turned more complex than the static approach.


2. Static approach

Crawling the xrefs to the futex, it is possible to locate the main:



With libc/libpthread function fingerprinting or a bit of manual work, we have the symbols, here is the main, where 255 threads are created and joined, when the threads end, the xor key is calculated and it calls the print_flag:



The code of the thread is passed to the libc_pthread_create, IDA recognize this area as data but can be selected as code and function.

This is the thread code decompiled, where we can observe two infinite loops for ptrace detection and preload (although is static) this antidebug/antihook are easy to detect at this point.


we have to observe the important thing, is the key random?? well, with the same seed the random sequence will be the same, then the key is "hidden" in the predictability of the random.

If the threads are not executed on the creation order, the key will be wrong because is xored with the th_id which is the identify of current thread.

The print_key function, do the xor between the key and the flag_cyphertext byte by byte.


And here we have the seed and the first bytes of the cypher-text:



With radare we can convert this to a c variable quickly:


And here is the flag cyphertext:


And with some radare magics, we have the c initialized array:


radare, is full featured :)

With a bit of rand() calibration here is the solution ...



The code:
https://github.com/NocONName/CTF_NcN2k15/blob/master/theAnswer/solution.c





3. The Dynamic Approach

First we have to patch the anti-debugs, on beginning of the thread there is two evident anti-debugs (well anti preload hook and anti ptrace debugging) the infinite loop also makes the anti-debug more evident:



There are also a third anti-debug, a bit more silent, if detects a debugger trough the first available descriptor, and here comes the fucking part, don't crash the execution, the execution continues but the seed is modified a bit, then the decryption key will not be ok.





Ok, the seed is incremented by one, this could be a normal program feature, but this is only triggered if the fileno(open("/","r")) > 3 this is a well known anti-debug, that also can be seen from a traced execution.

Ok, just one byte patch,  seed+=1  to  seed+=0,   (add eax, 1   to add eax, 0)

before:


after:



To patch the two infinite loops, just nop the two bytes of each jmp $-0



Ok, but repairing this binary is harder than building a decryptor, we need to fix more things:

  •  The sleep(randInt(1,3)) of the beginning of the thread to execute the threads in the correct order
  •  Modify the pthread_cond_wait to avoid the futex()
  • We also need to calibrate de rand() to get the key (just patch the sleep and add other rand() before the pthread_create loop
Adding the extra rand() can be done with a patch because from gdb is not possible to make a call rand() in this binary.

With this modifications, the binary will print the key by itself. 

More articles
  1. Hacker Security Tools
  2. Hackrf Tools
  3. Pentest Tools Github
  4. Free Pentest Tools For Windows
  5. Pentest Tools Find Subdomains
  6. Hack And Tools
  7. Hacking Tools For Windows 7
  8. Nsa Hack Tools Download
  9. Pentest Tools Website Vulnerability
  10. Hacking Tools Windows 10
  11. Hacker Tools Apk Download
  12. Hacking Tools Free Download
  13. Tools For Hacker
  14. Hacking Apps
  15. Hacking Apps
  16. Hacking Tools Github
  17. Hacking Apps
  18. Hacking Tools Windows 10
  19. Hacker Techniques Tools And Incident Handling
  20. Pentest Tools For Mac
  21. Hacking Tools
  22. Kik Hack Tools
  23. Hacker Tools For Ios
  24. Best Pentesting Tools 2018
  25. Pentest Box Tools Download
  26. Hack Rom Tools
  27. Pentest Tools List
  28. Hacking Tools Free Download
  29. Hacker Tools For Mac
  30. Pentest Tools Free
  31. Hacking Tools Name
  32. Hack Tools 2019
  33. Hacker Tools List
  34. Pentest Tools Kali Linux
  35. World No 1 Hacker Software
  36. Hacking Tools Software
  37. Pentest Tools Open Source
  38. Hack Tools For Windows
  39. Hacking Tools Download
  40. Hacker Tool Kit
  41. Hacker Tools List
  42. Hack And Tools
  43. Hacking Tools 2020
  44. Top Pentest Tools
  45. Pentest Tools Website
  46. Hacker Tools 2019
  47. Easy Hack Tools
  48. Pentest Tools Github
  49. Hacking Tools For Games
  50. How To Make Hacking Tools
  51. Termux Hacking Tools 2019
  52. Hack Tools Github
  53. Hacking Tools For Mac
  54. Android Hack Tools Github
  55. New Hacker Tools
  56. Pentest Tools Online
  57. Hacker Tools Linux
  58. Hack And Tools
  59. What Are Hacking Tools
  60. Hacking Tools Mac
  61. Game Hacking
  62. Hacker Tools Mac
  63. How To Install Pentest Tools In Ubuntu
  64. Hacker
  65. Hacking Apps
  66. Free Pentest Tools For Windows
  67. Best Hacking Tools 2019
  68. Best Pentesting Tools 2018
  69. Hacking Tools Windows
  70. Pentest Tools Windows
  71. Growth Hacker Tools
  72. Hack Website Online Tool
  73. Hacking Tools 2020
  74. Pentest Reporting Tools
  75. Hacker Tools For Mac
  76. Wifi Hacker Tools For Windows
  77. Pentest Automation Tools
  78. Hacking Tools Software
  79. Pentest Tools Linux
  80. Pentest Tools Tcp Port Scanner
  81. Hacking Tools Online
  82. Android Hack Tools Github
  83. Nsa Hack Tools Download
  84. Hacking Tools For Games
  85. Hacker Tool Kit
  86. Hack App
  87. Hacks And Tools
  88. Tools 4 Hack
  89. World No 1 Hacker Software
  90. Hack Tool Apk No Root
  91. Beginner Hacker Tools
  92. Hack Tools Download
  93. Pentest Tools Alternative
  94. Hackers Toolbox
  95. Hacking Tools Kit
  96. Hacker Tools For Ios
  97. Hacking Tools For Games
  98. Growth Hacker Tools
  99. Pentest Tools Kali Linux
  100. Pentest Tools Alternative
  101. Hacker Tools Hardware
  102. Hacker Search Tools
  103. Hacking Tools For Beginners
  104. Hack Tools For Windows
  105. Tools Used For Hacking
  106. Termux Hacking Tools 2019
  107. Hacker Search Tools
  108. Hacking Tools For Pc
  109. Ethical Hacker Tools
  110. Hacker Tools For Ios
  111. Hak5 Tools
  112. Android Hack Tools Github
  113. Nsa Hack Tools Download
  114. Pentest Automation Tools
  115. Hacker Tools Hardware
  116. Pentest Tools Free
  117. Hack Apps
  118. Hacks And Tools
  119. Hacker Tools List
  120. Hacking Tools Online
  121. Hacking Tools For Windows Free Download
  122. Pentest Tools Website
  123. Blackhat Hacker Tools
  124. Tools For Hacker
  125. Hacker Tools Mac
  126. Hack Tools Pc
  127. Pentest Tools Find Subdomains
  128. Hack Tools

No comments:

Post a Comment