\n\nThis page has been machine-translated from the original page.
\n
We participated in picoCTF 2024, held in March, as team 0nePadding and placed 64th out of 6,957 teams.
\nAnalyzing the unpacked binary revealed an embedded flag string in hexdump form.
\nDecoding that gave us the flag.
\n\n\nThis challenge will introduce you to ‘Anti-Debugging.’ Malware developers don’t like it when you attempt to debug their executable files because debugging these files reveals many of their secrets! That’s why, they include a lot of code logic specifically designed to interfere with your debugging process.\nNow that you’ve understood the context, go ahead and debug this Windows executable!\nThis challenge binary file is a Windows console application and you can start with running it using cmd on Windows.\nChallenge can be downloaded here.
\n
This was the first challenge in the Windows anti-debugging series.
\nAnalyzing the binary shows it checks the return value of IsDebuggerPresent.
Since this is a classic technique, I patched the binary to bypass the check and then used a debugger to obtain the flag.
\n\n\nThis challenge is a little bit invasive. It will try to fight your debugger. With that in mind, debug the binary and get the flag!\nThis challenge executable is a GUI application and it requires admin privileges. And remember, the flag might get corrupted if you mess up the process’s state.\nChallenge can be downloaded here.
\n
Inspecting the binary revealed it was packed with UPX.
\nSo I first unpacked the binary.
\nThe unpacked binary contained multiple anti-debug mechanisms that would each need to be patched, but for some reason the unpacked binary crashed with an access violation on startup and could not be executed at all — let alone patched.
\nI therefore abandoned the idea of using the unpacked binary and decided to use TTD (Time Travel Debugging) to bypass the anti-debug measures while performing the analysis statically to retrieve the flag.
\nAnalyzing the unpacked binary shows a location where the DecryptFlag function is called with the address of a data region called HASH as its argument.
However, this code sits beyond an infinite loop and is therefore never executed under normal circumstances.
\n(That is also why it does not appear in the decompiler output.)
\nIn addition, the FLAG and HASH byte arrays are populated and modified at runtime, making it difficult to recover their values through static analysis alone.
I therefore used WinDbg’s TTD to perform dynamic analysis while bypassing the anti-debug measures, and observed the initial state of the FLAG and HASH byte arrays as well as their state immediately before DecryptFlag is called.
TTD stands for Time Travel Debugging; it records a full execution trace of the program.
\nWhen analyzing a TTD trace you cannot manipulate registers as you would in a normal debugger, but you can replay execution while ignoring most anti-debug techniques.
\nMy TTD analysis showed that FLAG and HASH were initially empty but were populated immediately after the ReadConfig function was called.
Advancing the trace further revealed that while the FLAG value remains constant, the key HASH value is updated frequently.
Specifically, HASH is updated every time the periodically-called ComputeHash function runs.
The ComputeHash function is implemented as shown below. It loops a number of times equal to its argument (1–3) and applies a transformation to each byte of HASH.
Finally, we XOR the string obtained by the script above ( This yielded the correct flag. A classic Crackme. Find the password, get the flag!\nBinary can be downloaded here.\nCrack the Binary file locally and recover the password. Use the same password on the server to get the flag!\nAdditional details will be available after launching your challenge instance. Analyzing the binary provided as the challenge file revealed the following implementation. I have a friend that enjoys coding and he hasn’t stopped talking about a snake recently\nHe left this file on my computer and dares me to uncover a secret phrase from it. Can you assist? The file provided as the challenge binary appeared to be assembly code from a compiled Python script. Reading through the implementation carefully, it simply XORs the flag with a key. I therefore used the following solver to retrieve the flag. I’ve gotten bored of handing out flags as text. Wouldn’t it be cool if they were an image instead?\nYou can download the challenge files here:\nchallenge.zip\nAdditional details will be available after launching your challenge instance. Scanning the QR code provided as the challenge file with an online tool immediately gave us the flag. People keep trying to trick my players with imitation flags. I want to make sure they get the real thing! I’m going to provide the SHA-256 hash and a decrypt script to help you know that my flags are legitimate.\nYou can download the challenge files here:\nchallenge.zip\nAdditional details will be available after launching your challenge instance. I modified the provided decryption script slightly so it brute-forces decryption across all files in the directory, which yielded the flag. How about some hide and seek?\nDownload this file here. The EXIF data of the image file provided as the challenge binary contained a Base64-encoded flag. First, I retrieved the second half of the flag from the PDF. Next, I changed the extension to Can you handle APKs?\nDownload the android apk here. I extracted the APK with apktool and searched around for a while, but could not find anything resembling a flag. However, when I renamed the APK’s extension to This gave us the correct flag. Here’s a file that was recovered from a 32-bits system that organized the bytes a weird way. We’re not even sure what type of file it is.\nDownload it here and see what you can get out of it The file provided as the challenge binary was an unknown byte sequence. My first instinct was that it might be shellcode, so I disassembled it with objdump, but it didn’t look like meaningful executable code. Taking a closer look at the beginning of the byte sequence, I noticed The judge for these pictures is a real fan of antiques. Can you age this photo to the specifications?\nSet the timestamps on this picture to 1970:01:01 00:00:00.001+00:00 with as much precision as possible for each timestamp. In this example, +00:00 is a timezone adjustment. Any timezone is acceptable as long as the time is equivalent. As an example, this timestamp is acceptable as well: 1969:12:31 19:00:00.001-05:00. For timestamps without a timezone adjustment, put them in GMT time (+00:00). The checker program provides the timestamp needed for each.\nUse this picture.\nAdditional details will be available after launching your challenge instance. Submit your modified picture here:\nnc -w 2 mimas.picoctf.net 57013 < original_modified.jpg Check your modified picture here:\nnc -d mimas.picoctf.net 61685 This challenge required modifying the timestamps embedded in the EXIF data and MakerNotes of the provided image file. Updating the EXIF timestamps was straightforward with standard tools, but modifying the final MakerNotes timestamp proved more difficult. In the end I couldn’t find a tool that supported it directly, so I used a hex editor to locate the bytes encoding the UNIX timestamp in the MakerNotes. The original value corresponds to a date in 2023, as shown below. This successfully updated the MakerNotes timestamp. Running Loading the image into Autopsy and performing a general analysis revealed a suspicious empty file, Reference: Ext4 Disk Layout - Ext4 Running The hardest Rev and Forensic challenges were not overly difficult, but the Pwn and Web challenges looked quite tough. I’d like to keep improving so I can solve those higher-difficulty challenges as well.hkdvggsauxkalcboydzfoupczfmdxbpitnddbbga) with the FLAG byte array to recover the correct flag.FLAG = [0x18,0x02,0x07,0x19,0x24,0x33,0x35,0x1a,0x22,0x11,0x05,0x05,0x5c,0x14,0x11,0x30,0x18,0x0a,0x0e,0x0f,0x0b,0x46,0x12,0x04,0x25,0x56,0x15,0x57,0x48,0x52,0x2f,0x0b,0x16,0x08,0x52,0x57,0x00,0x51,0x57,0x1c]\nFLAG_SIZE = 0x28\nKEY = "hkdvggsauxkalcboydzfoupczfmdxbpitnddbbga"\nfor i in range(FLAG_SIZE):\n print(chr(FLAG[i]^ord(KEY[i%len(KEY)])),end="")Classic Crackme 0x100(Rev)
\n\n
\nweirdSnake(Rev)
\n\n
\n# l=\"\"\"10,0,4,2,1,54,4,2,41,6,3,0,8,4,112,10,5,32,12,6,25,14,7,49,16,8,33,18,9,3,20,3,0,22,3,0,24,10,57,26,5,32,28,11,108,30,12,23,32,13,48,34,0,4,36,14,9,38,15,70,40,16,7,42,17,110,44,18,36,46,19,8,48,11,108,50,16,7,52,7,49,54,20,10,56,0,4,58,21,86,60,22,43,62,23,105,64,24,114,66,25,91,68,3,0,70,26,71,72,27,106,74,28,124,76,29,93,78,30,78\"\"\".split(\",\")\n# arr = []\n# for i in range(len(l)):\n# if i % 3 == 2:\n# arr.append(int(l[i]))\n\narr = [4, 54, 41, 0, 112, 32, 25, 49, 33, 3, 0, 0, 57, 32, 108, 23, 48, 4, 9, 70, 7, 110, 36, 8, 108, 7, 49, 10, 4, 86, 43, 105, 114, 91, 0, 71, 106, 124, 93, 78]\nkey_str = \"t_Jo3\"\nkey = [ord(c) for c in key_str]\n\nfor i in range(len(arr)):\n print(chr(arr[i] ^ key[i % len(key)]),end=\"\")\n\n# picoCTF{N0t_sO_coNfus1ng_sn@ke_68433562}Scan Surprise(Forensic)
\n\n
\nVerify(Forensic)
\n\n
\n#!/bin/bash\n\n# # Check if the user provided a file name as an argument\n# if [ $# -eq 0 ]; then\n# echo \"Expected usage: decrypt.sh <filename>\"\n# exit 1\n# fi\n\ndirectory=\"/home/ubuntu/Hacking/CTF/2024/picoCTF/Forensic/Verify/drop-in/files\"\nfor file_name in \"$directory\"/*\ndo\n # echo \"Processing $file_name\"\n # Check if the provided argument is a file and not a folder\n if [ ! -f \"$file_name\" ]; then\n echo \"Error: '$file_name' is not a valid file. Look inside the 'files' folder with 'ls -R'!\"\n exit 1\n fi\n\n # If there's an error reading the file, print an error message\n if ! openssl enc -d -aes-256-cbc -pbkdf2 -iter 100000 -salt -in \"$file_name\" -k picoCTF; then\n echo \"Error: Failed to decrypt '$file_name'. This flag is fake! Keep looking!\"\n fi\ndone\n\n# picoCTF{trust_but_verify_c6c8b911}CanYouSee(Forensic)
\n\n
\n.png and opened the file to retrieve the first half of the flag.picoCTF{f1u3n7_1n_pn9_&_pdf_53b741d6}Mob psycho(Forensic)
\n\n
\n./smali2java_linux_amd64 -path_to_smali=/home/ubuntu/Hacking/CTF/2024/picoCTF/Forensic/Mob_psycho/mobpsycho/smali_classes3/com/example/mobpsycho.zip and unzipped it, I found that color/flag.txt contained a hexdumped flag.endianness-v2(Forensic)
\n\n
\nobjdump -M intel -D -b binary -m i386 challengefiled8 ff e0 ff — part of the JPEG magic number — stored in non-little-endian byte order.Blast from the past(Forensic)
\n\n
\nparted disk.flag.img print revealed that the filesystem is ext4.innocuous-file.txt, inside the root directory.fls -i raw -f ext4 part3.img 8 and examining the filenames found in the journal area, we were able to identify the correct flag as picoCTF{1_533_n4m35_80d24b30}.Summary
\n