zacheller@home:~/blog$ - flag


Papa brought me a packed present! let’s open it.

Download :

This is reversing task. all you need is binary


Download the file and figure out what it does.

noble@heart:~/cyber/ctf/$ wget

noble@heart:~/cyber/ctf/$ file flag
flag: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, no section header

noble@heart:~/cyber/ctf/$ chmod +x flag

noble@heart:~/cyber/ctf/$ ./flag
I will malloc() and strcpy the flag there. take it.

Check for longer strings, perhaps the flag?

noble@heart:~/cyber/ctf/$ strings -25 flag
$Info: This file is packed with the UPX executable packer $
$Id: UPX 3.08 Copyright (C) 1996-2011 the UPX Team. All Rights Reserved. $
GCC: (Ubuntu/Linaro 4.6.3-1u)#

File was packed with UPX; let’s unpack it.

noble@heart:~/cyber/ctf/$ upx -d flag
                       Ultimate Packer for eXecutables
                          Copyright (C) 1996 - 2018
UPX 3.95        Markus Oberhumer, Laszlo Molnar & John Reiser   Aug 26th 2018

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
    883745 <-    335288   37.94%   linux/amd64   flag

Unpacked 1 file.

# Still the same output
noble@heart:~/cyber/ctf/$ ./flag
I will malloc() and strcpy the flag there. take it.

Let’s check the calls made with gdb (-q is the quiet flag):

noble@heart:~/cyber/ctf/$ gdb -q flag
Reading symbols from flag...(no debugging symbols found)...done.
(gdb) disass main
Dump of assembler code for function main:
   0x0000000000401164 <+0>:     push   %rbp
   0x0000000000401165 <+1>:     mov    %rsp,%rbp
   0x0000000000401168 <+4>:     sub    $0x10,%rsp
   0x000000000040116c <+8>:     mov    $0x496658,%edi
   0x0000000000401171 <+13>:    callq  0x402080 <puts>
   0x0000000000401176 <+18>:    mov    $0x64,%edi
   0x000000000040117b <+23>:    callq  0x4099d0 <malloc>
   0x0000000000401180 <+28>:    mov    %rax,-0x8(%rbp)
   0x0000000000401184 <+32>:    mov    0x2c0ee5(%rip),%rdx        # 0x6c2070 <flag>
   0x000000000040118b <+39>:    mov    -0x8(%rbp),%rax
   0x000000000040118f <+43>:    mov    %rdx,%rsi
   0x0000000000401192 <+46>:    mov    %rax,%rdi
   0x0000000000401195 <+49>:    callq  0x400320
   0x000000000040119a <+54>:    mov    $0x0,%eax
   0x000000000040119f <+59>:    leaveq
   0x00000000004011a0 <+60>:    retq
End of assembler dump.
(gdb) x/s *0x6c2070
0x496628:       "{censored}"