# Riscure hack me 2 (quals)

Download

# wget https://github.com/Riscure/Rhme-2016/raw/master/RHme2_prequalification_challenge
# file RHme2_prequalification_challenge
RHme2_prequalification_challenge: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=d2e181c26c49dbf067beaba93387f7ef75bc3a91, not stripped

Option 1: Hopper and gdb

# strings RHme2_prequalification_challenge | grep Well
Well done! You found the secret password!

1. Load the binary using hopper.
2. Search the previous string.
3. Go to the address where is referenced (0x400855).
4. Do a decompilation:

int main() {
    stack[2047] = rbx;
    rsp = rsp - 0x8 - 0x1b0;
    rbx = arg_32;
    rax = 0x0;
    asm{ rep stosq  qword [ds:rdi], rax };
    do {
            rsi = sign_extend_64(rax);
            rdx = rax << 0x4 | rax;
            rax = rax + 0x1;
            *(int8_t *)(rsi + 0x601080) = rdx ^ *(int8_t *)(rsi + 0x601080) & 0xff;
    } while (rax != 0x20);
    AES_set_decrypt_key(0x601080, 0x100, var_4);
    AES_decrypt(arg_30, rbx, var_4);
    puts("What is the secret password?");
    fgets(arg_42, 0x50, *__TMC_END__);
    if (memcmp(arg_42, rbx, 0x10) != 0x0) {
            __printf_chk(0x1, "\nThat is not correct!");
    }
    else {
            __printf_chk(0x1, "\nWell done! You found the secret password!");
    }
    rax = 0x0;
    rbx = stack[1993] ^ *0x28;
    COND = rbx != 0x0;
    if (COND) {
            rax = __stack_chk_fail();
    }
    return rax;
}

5. Find the address where memcmp is called:

000000000040081d         call       j_memcmp

# gdb ./RHme2_prequalification_challenge
(gdb) b *0x40081d
(gdb) run
What is the secret password?
IDONTKNOW

Breakpoint 1, 0x000000000040081d in main ()
(gdb) x/s $rbx
0x7fffffffe508: "TH1S 1s s3cr3t!!"

Option 2: LD_PRELOAD

# cat mylib.c
int memcmp(const void *s1, const void *s2, int n){
    printf("%s\n", s1);
    printf("%s\n", s2);
}
# gcc -fPIC -shared mylib.c -o mylib.dylib
# LD_PRELOAD=/tmp/mylib.dylib ./RHme2_prequalification_challenge
What is the secret password?
IDONTKNOW
IDONTKNOW

TH1S 1s s3cr3t!!

That is not correct!

Option 3: Frida

# cat hook.py
import frida
import sys

process = sys.argv[1]
address = str(int(sys.argv[2], 16))

session = frida.attach(process)
script = session.create_script('''
Interceptor.attach(ptr("''' + address + '''"), {
    onEnter: function(args) {
        // User password
        send(Memory.readCString(args[0]));
        // Secret password
        send(Memory.readCString(args[1]));
    }
});
''')

def on_message(message, data):
    print message['payload'].strip()

script.on('message', on_message)
script.load()
sys.stdin.read()

# ./RHme2_prequalification_challenge
What is the secret password?
IDONTKNOW

That is not correct!

# python hook.py RHme2_prequalification_challenge 0x400730
IDONTKNOW
TH1S 1s s3cr3t!!

Option 4: Radare

# r2 -d ./RHme2_prequalification_challenge
Process with PID 31679 started...
attach 31679 31679
bin.baddr 0x00400000
Assuming filepath ./RHme2_prequalification_challenge
asm.bits 64
[0x7f6fa0ec02d0]> dcu sym.imp.memcmp
Continue until 0x00400730 using 1 bpsize
What is the secret password?
IDONTKNOW
hit breakpoint at: 400730
attach 31679 1
[0x00400730]> ps @ rbx
TH1S 1s s3cr3t!!

Reference

https://www.riscure.com/challenge

# radare2: hexadecimal editor, disassembler and debugger

Installation

# apt-get install build-essential
# git clone https://github.com/radare/radare2.git
# radare2/sys/user.sh
# radare2/sys/user.sh
# r2pm init
# r2pm -i r2dec
# r2pm -l

Analyzing

# r2 challenge
# r2 -A challenge
# r2 -A -q -c 'iI' challenge # execute iI command and exit

[Command mode]

[addr]> aaa # Analysis = aa + aar + aac + aan
[addr]> aaaa # Experimental analysis = aaa + aae + aat + aav

[addr]> pd 10 # print disassemble 10 instructions at current seek
[addr]> 3 pd 10 # 3 times, print disassemble 10 instructions at current seek
[addr]> pd 10 @ main # print disassemble 10 instructions at main
[addr]> pd @ main ! 10 # print disassemble at current seek and limit to 10 bytes

[addr]> b 64 # set block size to 64

[addr]> i~machine,os # grep machine or os, at info output
[addr]> drr~[0] # awk first column
[addr]> drr~:0 # grep first line
[addr]> drr~:0[0] # grep first line and awk first column

[addr]> / secret ; px @@ hit0_* # find secret string and foreach hit, print hexdump

[addr]> ? 0x7a69 # quick numeric conversion

[addr]> i? # like rabin2

[addr]> f myflag @ main+123 # set a flag at main+123

[addr]> afl # list functions
[addr]> s sym.main # seek to addr/symbol
[addr]> pdf # print disassemble function

[Visual mode]

[addr]> vV # view graph
p/P # rotate graph modes
< # global callgraph
> # function callgraph

Decompiling

# r2 -A challenge
[addr]> pdd
[addr]> pdda

Debugging

# r2 -Ad `pgrep challenge` # attach and debug pid
# r2 -Ad challenge # run and debug program
# r2 -Ad rarun2 script.rr2 # debug in a custom environment

[Command mode]

[addr]> db # list breakpoints

[addr]> ds 10 # step into 10 instructions
[addr]> dso 10 # step over 10 instructions

[addr]> dcu main # continue until main

[addr]> drr # show registers references (telescoping)

[addr]> db 0x0040081d # add breakpoint
[addr]> dbc 0x0040081d drr # run command when breakpoint is hit

[addr]> dm # list memory maps
[addr]> dm= # list memory maps (ascii art)

[Visual mode]

[addr]> vpp # debug view

:<cmd> # run radare command

; # comment

b # breakpoint

o # seek to offset

p/P # rotate print modes

_ # fuzzy flag searcher

x/X # show xrefs/refs

d # define function
f # analyze function
d # define
r # rename function
fun.callme # function name

Editing

# r2 -w challenge

[Command mode]

[addr]> oo+ # Reopen the current file in read-write

[addr]> wz "See you in shell" # write string\00 at current seek

[addr]> wx 0xcafe @ 0x100 # write 0xcafe at 0x100

[addr]> wb 0x010203 # write the current block cycling 0x010203 pattern

[addr]> woe 42 3 @ edi ! 32 # a = 42; for i in xrange(32): edi[i] = a; a += 3

[addr]> wox 0xcafe @ ebx ! 2 # cf = [0xca, 0xfe]; for i in xrange(2): ebx[i] ^= cf[i]

[Visual mode]

[addr]> v # hex view

c # cursor
<tab> # switch between hex and plain areas
i # insert values
<shift><hjkl> + y # select and copy
<hjkl> + Y # find position and paste

[addr]> v # hex view
a # assemble code
A # visual assembler

ESIL (Evaluable String Intermediate Language)

[addr]> vip

:> s 0x08048486
:> e asm.emu = true # Run ESIL emulation analysis on disasm
:> e asm.esil = true # Show ESIL instead of mnemonic
:> e io.cache = true # Enable cache for io changes
:> aei # initialize ESIL VM state
:> aeip # initialize ESIL pc to curseek
:> aer eax=0x1234
:> aer
:> "aecue 0x1234,eax,^" # Continue until evil expression is true
ESIL BREAK!
:> s `aer~eip[1]`
:> pd -1

Exploiting

[addr]> iI~canary,nx,pic,crypto,class,arch,bits,stripped,static

[addr]> wopD 100 @ eax # Write a De Bruijn pattern
[addr]> wopO 0x41614141 # or wopO $$ - Finds the value into a De Bruijn pattern
[addr]> gi exec # Compile shellcode
[addr]> wx `g` @ eax # Write shellcode at @eax
[addr]> wb 0x90 @ eax+24 ! 52
[addr]> wv `/R call eax~eax:1[0]` @ eax+76 # Write value (address)
[addr]> pcp 80 @ eax # Print Code Python

Project management

[addr]> Ps <name> # save project
[addr]> Po <name> # open project
[addr]> Pn # show project notes
[addr]> Pn - # edit project notes

# radare2 utilities

rax2: base converter

# rax2 =2 31337
111101001101001b

# rax2 =16 111101001101001b
0x7a69

# rax2 -s 64656164
dead

# rax2 -S babe
62616265

# rax2 =16 0xbeef^0x7411
0xcafe

rabin2: binary program info extractor

# rabin2 -d challenge # show debug/dwarf information
# rabin2 -e challenge # show entrypoints
# rabin2 -H challenge # show headers
# rabin2 -I challenge # show binary info
# rabin2 -i challenge # show imports
# rabin2 -l challenge # list linked libraries
# rabin2 -R challenge # show relocations
# rabin2 -s challenge # show exported symbols
# rabin2 -S challenge # show sections
# rabin2 -z challenge # show strings inside .data section
# rabin2 -zz challenge # show strings
# rabin2 -g challenge # show all possible information

rasm2: assembler and disassembler tool

# rasm2 -a x86 -b 32 'mov eax, 33' # assemble
# rasm2 -a x86 -b 32 -d -s intel b821000000 # disassemble in intel
# rasm2 -a x86 -b 32 -d -s intel "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80"
# rasm2 -a x86 -b 32 -E b821000000 # disassemble in esil
# rasm2 -L # list asm plugins
# rasm2 -a avr -b 8 -w spm # describe opcode (spm)

radiff2: unified binary diffing utility

# radiff2 -a x86 -b 64 /bin/true /bin/false 
# radiff2 -a x86 -b 64 -AA -C /bin/true /bin/false # code diffing using grapdiff algorithm

rafind2: advanced commandline hexadecimal editor

# rafind2 -z challenge # display zero-terminated strings
# rafind2 -s secret -X challenge # search a specific string and display hexdump
# rafind2 -m challenge # carve for known file-types

rahash2: block based hashing utility

# rahash2 -L # list available algorithms
# rahash2 -a all challenge # hash the file with all algorithms
# rahash2 -B -b 512 -a entropy challenge # entropy for each 512 byte block
# rahash2 -B -b 512 -a sha512 challenge # sha256 hash for each 512 byte block
# rahash2 -a sha384 -s "1234" # hash a string
# rahash2 -E base91 challenge # encode with base91
# rahash2 -E blowfish -S secretkey challenge # encrypt with blowfish

rarun2: run programs in exotic environments

Directives:

arg[0-3]: set arguments
aslr: enable/disable
clearenv
connect: stdin/stdout/stderr to a socket
input: string passed to stdin
libpath: override shared libraries path
listen: bound stdin/stdout/stderr to a listening socket
preload: a library
program: to be executed
setenv: set value to a given environment variable
setuid: set process user id
sleep: seconds
stdin: select file to read data
stdout: select file to write data
unsetenv: unset one environment variable

# rarun2 program=challenge listen=1234
# nc -v localhost 1234

ragg2-cc: CC frontend for compiling shellcodes

# cat execve.c
int main(){
        char *shell[2];
        shell[0]="/bin/sh";
        shell[1]=0;
        execve("/bin/sh",shell,NULL);
}
# ragg2-cc -a x86 -b 64 -k linux -x execve.c
eb00488d3d1b00000066480f6ec70f294424e8488d7424e831d2b83b0000000f0531c0c32f62696e2f736800

ragg2: frontend for r_egg

# ragg2 -a x86 -b 64 -k linux -f elf -i exec -e xor -c key=0xcc -s
.hex 31c048bbd19d9691d08c97ff48f7db53545f995257545eb03b0f05

# ragg2 -a x86 -b 64 -k linux -f elf -B `ragg2-cc -a x86 -b 64 -k linux -x execve.c` -e xor -c key=0xcc -s
.hex eb00488d3d1b00000066480f6ec70f294424e8488d7424e831d2b83b0000000f0531c0c32f62696e2f736800