One Bite

Rev

60

465

Whenever I have friends over, I love to brag about things that I can eat in a single bite. Can you give this program a tasty flag that fits the bill?

/problems/2019/one_bite

$ objdump -s -D -M intel one_bite >aaa.txt

  4006fa: 83 f0 3c              xor    eax,0x3c #

(略)

  400723: 48 c7 45 b8 20 08 40 mov    QWORD PTR [rbp-0x48],0x400820 #]_HZGUcHTURWcUQc[SUR[cHSc^YcOU_WA

  40072a: 00 

  40072b: 48 8b 55 b8          mov    rdx,QWORD PTR [rbp-0x48]

  40072f: 48 8d 45 c0          lea    rax,[rbp-0x40]

  400733: 48 89 d6              mov    rsi,rdx

  400736: 48 89 c7              mov    rdi,rax

  400739: e8 52 fe ff ff        call   400590 <strcmp@plt>

s = ']_HZGUcHTURWcUQc[SUR[cHSc^YcOU_WA'

key = 0x3c

flag = ''

for c in s:

flag += chr(ord(c) ^ key)

print(flag)

actf{i_think_im_going_to_be_sick}

論理回路講義ノート [単行本]

工藤 栄亮

コロナ社

2018-08-25

Intro to Rev

Rev

10

895

Many of our problems will require you to run Linux executable files (ELFs). This problem will help you figure out how to do it on our shell server. Use your credentials to log in, then navigate to /problems/2019/intro_to_rev. Run the executable and follow its instructions to get a flag!

$ cd /problems/2019/intro_to_rev

$ ls

flag.txt  intro_to_rev

$ ./intro_to_rev

Welcome to your first reversing challenge!

If you are seeing this, then you already ran the file! Let's try some input next.

Enter the word 'angstrom' to continue:

angstrom

Good job! Some programs might also want you to enter information with a command line argument.

When you run a file, command line arguments are given by running './introToRev argument1 argument2' where you replace each argument with a desired string.

To get the flag for this problem, run this file again with the arguments 'binary' and 'reversing' (don't put the quotes).

$ ./intro_to_rev binary reversing

Welcome to your first reversing challenge!

If you are seeing this, then you already ran the file! Let's try some input next.

Enter the word 'angstrom' to continue:

angstrom

Good job! Some programs might also want you to enter information with a command line argument.

When you run a file, command line arguments are given by running './introToRev argument1 argument2' where you replace each argument with a desired string.

Good job, now go solve some real problems!

actf{this_is_only_the_beginning}

actf{this_is_only_the_beginning}

です。

[改訂第3版]シェルスクリプト基本リファレンス ──#!/bin/shで、ここまでできる (WEB+DB PRESS plus) [単行本（ソフトカバー）]

山森 丈範

技術評論社

2017-01-20

I Like It

Rev

40

549

Now I like dollars, I like diamonds, I like ints, I like strings. Make Cardi like it please.

/problems/2019/i_like_it

$ objdump -s -D -M intel i_like_it >aaa.txt

  4007ff: be a1 09 40 00        mov    esi,0x4009a1 #okrrrrrrr

  400804: 48 89 c7              mov    rdi,rax

  400807: e8 64 fe ff ff        call   400670 <strcmp@plt>

  40086e: 8b 55 c8              mov    edx,DWORD PTR [rbp-0x38]

  400871: 8b 45 cc              mov    eax,DWORD PTR [rbp-0x34]

  400874: 01 d0                add    eax,edx

  400876: 3d 88 00 00 00        cmp    eax,0x88 #足して136

  40087b: 75 1a                jne    400897 <main+0xf1>

  40087d: 8b 55 c8              mov    edx,DWORD PTR [rbp-0x38]

  400880: 8b 45 cc              mov    eax,DWORD PTR [rbp-0x34]

  400883: 0f af c2              imul   eax,edx

  400886: 3d c7 0e 00 00        cmp    eax,0xec7 #掛けて3783

  40088b: 75 0a                jne    400897 <main+0xf1>

  40088d: 8b 55 c8              mov    edx,DWORD PTR [rbp-0x38]

  400890: 8b 45 cc              mov    eax,DWORD PTR [rbp-0x34]

  400893: 39 c2                cmp    edx,eax #1つ目のほうが小さい

$ ./i_like_it

I like the string that I'm thinking of:

okrrrrrrr

I said I like it like that!

I like two integers that I'm thinking of (space separated):

39 97

I said I like it like that!

Flag: actf{okrrrrrrr_39_97}

actf{okrrrrrrr_39_97}

です。

続 メカ屋のための脳科学入門-記憶・学習/意識 編- [単行本]

高橋 宏知

日刊工業新聞社

2017-07-19

High Quality Checks

Rev

110

225

After two break-ins to his shell server, kmh got super paranoid about a third! He's so paranoid that he abandoned the traditional password storage method and came up with this monstrosity! I reckon he used the flag as the password, can you find it?

$ objdump -s -D -M intel high_quality_checks >aaa.txt

000000000040094a <check>:

  40094a: 55                    push   rbp

  40094b: 48 89 e5              mov    rbp,rsp

  40094e: 48 83 ec 08          sub    rsp,0x8

  400952: 48 89 7d f8          mov    QWORD PTR [rbp-0x8],rdi

  400956: 48 8b 45 f8          mov    rax,QWORD PTR [rbp-0x8]

  40095a: 48 83 c0 0c          add    rax,0xc

  40095e: 48 89 c7              mov    rdi,rax

  400961: e8 7f ff ff ff        call   4008e5 <d> #12文字目からc710

  400966: 85 c0                test   eax,eax

  400968: 0f 84 e6 00 00 00    je     400a54 <check+0x10a>

  40096e: 48 8b 45 f8          mov    rax,QWORD PTR [rbp-0x8]

  400972: 0f b6 00              movzx  eax,BYTE PTR [rax]

  400975: 0f be c0              movsx  eax,al

  400978: 89 c7                mov    edi,eax

  40097a: e8 d4 fc ff ff        call   400653 <v> #0文字目がa

  40097f: 85 c0                test   eax,eax

  400981: 0f 84 cd 00 00 00    je     400a54 <check+0x10a>

  400987: 48 8b 45 f8          mov    rax,QWORD PTR [rbp-0x8]

  40098b: 48 83 c0 11          add    rax,0x11

  40098f: 0f b6 00              movzx  eax,BYTE PTR [rax]

  400992: 0f be d0              movsx  edx,al

  400995: 48 8b 45 f8          mov    rax,QWORD PTR [rbp-0x8]

  400999: 48 83 c0 10          add    rax,0x10

  40099d: 0f b6 00              movzx  eax,BYTE PTR [rax]

  4009a0: 0f be c0              movsx  eax,al

  4009a3: 89 d6                mov    esi,edx #17文字目

  4009a5: 89 c7                mov    edi,eax #16文字目

  4009a7: e8 54 ff ff ff        call   400900 <u> #16文字目がn、17文字目が5

  4009ac: 85 c0                test   eax,eax

  4009ae: 0f 84 a0 00 00 00    je     400a54 <check+0x10a>

  4009b4: 48 8b 45 f8          mov    rax,QWORD PTR [rbp-0x8]

  4009b8: 48 83 c0 05          add    rax,0x5

  4009bc: 0f b6 00              movzx  eax,BYTE PTR [rax]

  4009bf: 0f be c0              movsx  eax,al

  4009c2: 89 c7                mov    edi,eax

  4009c4: e8 7f fd ff ff        call   400748 <k> #5文字目がf

  4009c9: 85 c0                test   eax,eax

  4009cb: 0f 85 83 00 00 00    jne    400a54 <check+0x10a>

  4009d1: 48 8b 45 f8          mov    rax,QWORD PTR [rbp-0x8]

  4009d5: 48 83 c0 09          add    rax,0x9

  4009d9: 0f b6 00              movzx  eax,BYTE PTR [rax]

  4009dc: 0f be c0              movsx  eax,al

  4009df: 89 c7                mov    edi,eax

  4009e1: e8 62 fd ff ff        call   400748 <k> #9文字目がf

  4009e6: 85 c0                test   eax,eax

  4009e8: 75 6a                jne    400a54 <check+0x10a>

  4009ea: 48 8b 45 f8          mov    rax,QWORD PTR [rbp-0x8]

  4009ee: 48 83 c0 01          add    rax,0x1

  4009f2: 48 89 c7              mov    rdi,rax

  4009f5: e8 8a fc ff ff        call   400684 <w> #1文字目からctf

  4009fa: 85 c0                test   eax,eax

  4009fc: 74 56                je     400a54 <check+0x10a>

  4009fe: 48 8b 45 f8          mov    rax,QWORD PTR [rbp-0x8]

  400a02: be 12 00 00 00        mov    esi,0x12

  400a07: 48 89 c7              mov    rdi,rax

  400a0a: e8 e7 fc ff ff        call   4006f6 <b> #18文字目が}

  400a0f: 85 c0                test   eax,eax

  400a11: 74 41                je     400a54 <check+0x10a>

  400a13: 48 8b 45 f8          mov    rax,QWORD PTR [rbp-0x8]

  400a17: be 04 00 00 00        mov    esi,0x4

  400a1c: 48 89 c7              mov    rdi,rax

  400a1f: e8 d2 fc ff ff        call   4006f6 <b> #4文字目が{

  400a24: 85 c0                test   eax,eax

  400a26: 74 2c                je     400a54 <check+0x10a>

  400a28: 48 8b 45 f8          mov    rax,QWORD PTR [rbp-0x8]

  400a2c: be 6c 00 00 00        mov    esi,0x6c

  400a31: 48 89 c7              mov    rdi,rax

  400a34: e8 34 fd ff ff        call   40076d <z> #6文字目がu、7文字目がn、10文字目がu、11文字目がn

  400a39: 85 c0                test   eax,eax

  400a3b: 74 17                je     400a54 <check+0x10a>

  400a3d: 48 8b 45 f8          mov    rax,QWORD PTR [rbp-0x8]

  400a41: 48 89 c7              mov    rdi,rax

  400a44: e8 40 fe ff ff        call   400889 <s> #8文字目が_

  400a49: 85 c0                test   eax,eax

  400a4b: 74 07                je     400a54 <check+0x10a>

  400a4d: b8 01 00 00 00        mov    eax,0x1

  400a52: eb 05                jmp    400a59 <check+0x10f>

  400a54: b8 00 00 00 00        mov    eax,0x0

  400a59: c9                    leave  

  400a5a: c3                    ret    

$ ./high_quality_checks 

Enter your input:

actf{fun_func710n5}

You found the flag!

actf{fun_func710n5}

です。

低レベルプログラミング [単行本（ソフトカバー）]

Igor Zhirkov

翔泳社

2018-01-19

FeelMyPain

Point: 100

Where pain comes from ? Find it and answer me!

Download:

http://material.grandprix.whitehatvn.com/grandprix2017/FeelMyPain_19c75ab715c271b61a947916fb8ed714c9e80d11.zip

http://bak.material.grandprix.whitehatvn.com/grandprix2017/FeelMyPain_19c75ab715c271b61a947916fb8ed714c9e80d11.zip

http://bak1.material.grandprix.whitehatvn.com/grandprix2017/FeelMyPain_19c75ab715c271b61a947916fb8ed714c9e80d11.zip

Author - BkavTeam

$ file Pain.exe 

Pain.exe: PE32 executable (console) Intel 80386, for MS Windows

>Pain.exe

here is your flag: ・.

Wait!!!Something went wrong? 続行するには何かキーを押してください . . .

IDA Pro Freeでステップ実行してみます。下記の場所まで進めるとスタックに文字列が積まれます。

この文字列のsha1ハッシュ値を求めます。

love_is_the_reason_why_there_is_pain

0c6e2e8f7719d0966cbc96dc9fab9c7b9c906ff9

WhiteHat{0c6e2e8f7719d0966cbc96dc9fab9c7b9c906ff9}

です。

Windowsデバッグの極意 ツールを使いこなして、バグハント! [大型本]

Mario Hewardt

アスキー・メディアワークス

2009-04-28