Skip to content

Latest commit

 

History

History
31 lines (17 loc) · 1.6 KB

n00b16ctf_bin-medium.md

File metadata and controls

31 lines (17 loc) · 1.6 KB

CTF: n00b16ctf

Challenge: bin-medium

Classification: Reversing

Pretty clear-cut challenge. We just need to dive into this binary and get the flag. If we run the program, it prompts us for a special passphrase, which we don't have on hand. But perhaps we don't need it!

Looking at the output from objdump we can see a lot of stuff going on in the memory, which is putting together what will ultimately be the flag. If you want to take the long way, you can step through the assembler code and construct the flag yourself OR you can simply use GDB and debug to bypass the passphrase check and get the flag.

Set a breakpoint in the program right before the first printf() at 0x80485d4 and run the program.

Once the breakpoint is hit, we have freedom to change where our instruction pointer is set to, so let's point to it directly to the beginning of where our flag is constructed.

Redirecting the instruction pointer to bypass the necessity of a passphrase, it builds our flag for us and prints it out!

Changing where the instruction pointer goes by modifying it with "set $eip=< memory address >" is quite useful when debugging.