Reversing ELF TryHackMe

 

1) crackme1

for the first challenge all we need to do is run the file named "crackme1" and we got the flag.





2) crackme2

when we try to run the file, it correct us and say the right usage is ./crackme2 + password, and we need to find this password.



As we open the file in ghidra, we can see if we use "super_secret+password" it will give us access granted as the output.



and as we suspected, once we use it as the password, it will give us the flag. 




3) crackme3

The same case as crackme2, so first let's see if there is any interesting strings that we can see. 

here we can see there is a base64 strings


as we open the file in ghidra, it says that if we input the base64 strings as the password, then the password is correct. 


so we decode the strings first


and then use it as the password. 





4) crackme4

This launches GDB (GNU Debugger) and loads the executable crackme4.



This tells GDB to print all the functions found inside the binary.

This lets you identify where the real password check happens.

The interesting function is likely: compare_pwd


This sets a breakpoint at address 0x400520, which is the entry for: strcmp@plt


Why?
Because strcmp is the function that compares the user input with the real hidden password.

So by breaking there, you can inspect the arguments passed to strcmp.





then we use info register to show the CPU registers



x/s — examine memory and display it as a string.

You inspected the address stored in rsi (second argument to strcmp) and found: "my+m0r3_secur3_pwd"





5) crackme5

This challenge follows the same step as crackme4







6) crackme6

we run the file as usual and examine the code in ghidra

as we follow the functions, it will start at main -> compare_pwd -> my_secure_test 


here, we can see the code resembling a strings inside the if else, and we got 1337_pwd


we use it as the password, and it turns out ccorrect. 




7) crackme7

We run the file and prompted with options, make sure to test each of the options in case there is anything interesting pop out. 


the output seems normal so far, let's see if there is any interesting strings.

From the list of strings, there is a "wow such a h4x0r" which we didn't get when entering the prompt above.



we open the file in ghidra, and see "0x7a69"

in a sense, if we fill up the condition local14 == "0x7a69", it the output will be "wow such a h4x0r" which is what we want. 



we use python command, and we got the number. 

so instead of using 1,2,3, we use 31337. 


8) crackme8

the same steps as crackme7.

















































































Comments

Post a Comment

Popular posts from this blog

Data Exfiltrtation Detection (DNS, FTP, HTTP, ICMP)

Image
Learning Objectives In this entry, we will cover the following learning objectives: - Understand the common methods used for data exfiltration. - Learn how to detect exfiltration attempts using network traffic analysis. - Identify signs of exfiltration on endpoint devices. - Correlate logs in a SIEM to uncover hidden exfiltration channels. 1) Data Exfil: Overview Tech, and indicators -> unauthorized data transfer from in to out by adversaries -> can be by insider or malware 1.1) Why they do data exfil?  Reason Description Financial Gain Stolen data (e.g., credit card information, personal records) can be sold on the dark web or used for fraud. Espionage Nation-state actors target intellectual property, trade secrets, or classified information for strategic advantage. Ransomware & Extortion Attackers steal data and threaten to leak it unless a ransom is paid. Disruption & Sabotage Adversaries aim to damage an organization's reputation or operations by exposing sensitiv...
Read more

Firewall, WAF, and VPN manual log Analysis using command line.

Image
Incident Scenario Initech Corp, a mid-sized financial services company, has recently deployed a new firewall and intrusion detection system (IDS) to monitor its network perimeter. Over the past month, security analysts have noticed abnormal traffic patterns, but the SOC team has been overwhelmed and missed deeper analysis. As a new security analyst, you have been tasked with reviewing one month of perimeter logs to determine what techniques the adversary used, and whether they succeeded in breaching the perimeter. You have been given three sets of logs from the time of the incident. The logs can be found in the Perimeter_logs/challenge directory on the Desktop. Firewall Logs:firewall.log WAF Logs:ids_alerts.log  VPN Logs:vpn_auth.log  LOG ANALYSIS Let's start by exploring the logs, as shown below: Commandline: head firewall.log Explore ids logs, as shown below: Commandline: head ids_alerts.log Examine VPN Logs, as shown below: Commandline: head vpn_auth.log Reconnaissance atte...
Read more