ダウンロードしたファイルをobjdumpコマンドで逆アセンブルします。High Quality Checks
Rev110225After two break-ins to his shell server, kmh got super paranoid about a third! He's so paranoid that he abandoned the traditional password storage method and came up with this monstrosity! I reckon he used the flag as the password, can you find it?
<check>関数の中でさらに関数を呼び出して入力文字列をチェックしています。$ objdump -s -D -M intel high_quality_checks >aaa.txt
000000000040094a <check>:40094a: 55 push rbp40094b: 48 89 e5 mov rbp,rsp40094e: 48 83 ec 08 sub rsp,0x8400952: 48 89 7d f8 mov QWORD PTR [rbp-0x8],rdi400956: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8]40095a: 48 83 c0 0c add rax,0xc40095e: 48 89 c7 mov rdi,rax400961: e8 7f ff ff ff call 4008e5 <d> #12文字目からc710400966: 85 c0 test eax,eax400968: 0f 84 e6 00 00 00 je 400a54 <check+0x10a>40096e: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8]400972: 0f b6 00 movzx eax,BYTE PTR [rax]400975: 0f be c0 movsx eax,al400978: 89 c7 mov edi,eax40097a: e8 d4 fc ff ff call 400653 <v> #0文字目がa40097f: 85 c0 test eax,eax400981: 0f 84 cd 00 00 00 je 400a54 <check+0x10a>400987: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8]40098b: 48 83 c0 11 add rax,0x1140098f: 0f b6 00 movzx eax,BYTE PTR [rax]400992: 0f be d0 movsx edx,al400995: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8]400999: 48 83 c0 10 add rax,0x1040099d: 0f b6 00 movzx eax,BYTE PTR [rax]4009a0: 0f be c0 movsx eax,al4009a3: 89 d6 mov esi,edx #17文字目4009a5: 89 c7 mov edi,eax #16文字目4009a7: e8 54 ff ff ff call 400900 <u> #16文字目がn、17文字目が54009ac: 85 c0 test eax,eax4009ae: 0f 84 a0 00 00 00 je 400a54 <check+0x10a>4009b4: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8]4009b8: 48 83 c0 05 add rax,0x54009bc: 0f b6 00 movzx eax,BYTE PTR [rax]4009bf: 0f be c0 movsx eax,al4009c2: 89 c7 mov edi,eax4009c4: e8 7f fd ff ff call 400748 <k> #5文字目がf4009c9: 85 c0 test eax,eax4009cb: 0f 85 83 00 00 00 jne 400a54 <check+0x10a>4009d1: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8]4009d5: 48 83 c0 09 add rax,0x94009d9: 0f b6 00 movzx eax,BYTE PTR [rax]4009dc: 0f be c0 movsx eax,al4009df: 89 c7 mov edi,eax4009e1: e8 62 fd ff ff call 400748 <k> #9文字目がf4009e6: 85 c0 test eax,eax4009e8: 75 6a jne 400a54 <check+0x10a>4009ea: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8]4009ee: 48 83 c0 01 add rax,0x14009f2: 48 89 c7 mov rdi,rax4009f5: e8 8a fc ff ff call 400684 <w> #1文字目からctf4009fa: 85 c0 test eax,eax4009fc: 74 56 je 400a54 <check+0x10a>4009fe: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8]400a02: be 12 00 00 00 mov esi,0x12400a07: 48 89 c7 mov rdi,rax400a0a: e8 e7 fc ff ff call 4006f6 <b> #18文字目が}400a0f: 85 c0 test eax,eax400a11: 74 41 je 400a54 <check+0x10a>400a13: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8]400a17: be 04 00 00 00 mov esi,0x4400a1c: 48 89 c7 mov rdi,rax400a1f: e8 d2 fc ff ff call 4006f6 <b> #4文字目が{400a24: 85 c0 test eax,eax400a26: 74 2c je 400a54 <check+0x10a>400a28: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8]400a2c: be 6c 00 00 00 mov esi,0x6c400a31: 48 89 c7 mov rdi,rax400a34: e8 34 fd ff ff call 40076d <z> #6文字目がu、7文字目がn、10文字目がu、11文字目がn400a39: 85 c0 test eax,eax400a3b: 74 17 je 400a54 <check+0x10a>400a3d: 48 8b 45 f8 mov rax,QWORD PTR [rbp-0x8]400a41: 48 89 c7 mov rdi,rax400a44: e8 40 fe ff ff call 400889 <s> #8文字目が_400a49: 85 c0 test eax,eax400a4b: 74 07 je 400a54 <check+0x10a>400a4d: b8 01 00 00 00 mov eax,0x1400a52: eb 05 jmp 400a59 <check+0x10f>400a54: b8 00 00 00 00 mov eax,0x0400a59: c9 leave400a5a: c3 ret
それではフラグが合っているか試してみます。
$ ./high_quality_checksEnter your input:actf{fun_func710n5}You found the flag!
フラグは、
actf{fun_func710n5}
