{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-harekazectf-2022-en","result":{"data":{"markdownRemark":{"id":"a7ef91f5-5e2d-5f17-b114-e8abffb1f78f","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I took part in Harekaze mini CTF 2021, which was held on 12/24.

\n

I participated as 0neP@adding and finished in 29th place.

\n

I still could not solve the harder Reversing challenges, so I clearly have more work to do.

\n

Crackme(Rev)

\n

Looking at the decompiled output, you can see that it performs a calculation on each input character one by one, and the characters whose result becomes greater than 0 are the characters of the flag.

\n

It looked possible to reverse it and work backward as well, but since it seemed like a brute-force attack would identify the flag within a few minutes, I used the following script to automate GDB analysis and recover the flag.

\n
import gdb\n\nBINDIR = \"~/Downloads\"\nBIN = \"crackme\"\nINPUT = \"./in.txt\"\nBREAK = \"0x55555555523f\"\n\ngdb.execute('file {}/{}'.format(BINDIR, BIN))\ngdb.execute('b *{}'.format(BREAK))\n\nFlag = list(\"HarekazeCTF{quadrat1c_3quati0n}\")\ncounter = len(Flag)\nFlag += [\".\" for i in range(0x1f-len(Flag))]\n\ntable = \"_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890!#$=}{\"\nprint(\"\".join(Flag))\n\nwhile True:\n    print(\"===============================================\")\n\n    for t in table:\n        Flag[counter] = t\n        gdb.execute('run {}'.format(\"\".join(Flag)))\n\n        if counter > 0:\n            for i in range(counter):\n                print(\"next\")\n                gdb.execute('c')\n        \n        r = gdb.parse_and_eval(\"$al\")\n        print(r)\n        if r != 0x0:\n            counter += 1\n            # print(\"\".join(Flag))\n            break\n        print(\"\".join(Flag))\n\ngdb.execute('quit')\nprint(\"\".join(Flag))
\n

Summary

\n

It was the last CTF of the year, but next year I want to study more so that I can solve harder challenges as well.

","fields":{"slug":"/ctf-harekazectf-2022-en","tagSlugs":["/tag/ctf-en/","/tag/reversing-en/","/tag/security-en/","/tag/english/"]},"frontmatter":{"date":"2021-12-29","description":"","tags":["CTF (en)","Reversing (en)","Security (en)","English"],"title":"Harekaze mini CTF 2021 Writeup","socialImage":{"publicURL":"/static/09ccb7d9b02690ed61c59ffaf9aa0954/ctf-harekazectf-2022.png"}}}},"pageContext":{"slug":"/ctf-harekazectf-2022-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}