National Cyber Drill 2021 : Reverse Engineering challenges writeup

Name : “Braek it!”

This is an easy challenge. Nothing fancy!

We got an breakme.out file and an ip:port that we can netcat into. The binary file is an ELF 64-BIT executable. Executing the file and also netcat into the ip:port ,it asks for an input/passcode.

When we try to read the readable characters from the binary file using

strings breakme.out

we get something like this in " %4s" .This could mean it takes 4 digit code. So we can easily brute force this using bash

for i in {0000..9999}; do echo $i | ./breakme.out ; done

Running this gives us the correct passcode which is 2357. Now, we just

nc ip port

and provide the correct passcode to get the flag.

Name : Reverse Engineering up to date!!!

Description : A small Python BreakMe — enjoy! Break it and retrieve the hidden flag inside.

After downloading the zip file and unzipping it ,we get a binary file “breakmesir” and multiple python packages.

So, first we checked the file type :

Its an ELF 64-BIT executable. OK. We executed the file and we get an output :

We got an encoded string. Usually I tried several decoding method using CyberChef , no luck!. Ok. Now lets analyze the binary file. We got a binary file that was compiled using PyInstaller. From the official website manual we know this.

So, I used a PyInstaller Extractor known as pyinstxtractor. Using this python script we can extract the .pyc file from the binary.

python3 pyinstxtractor.py breakmesir

Now we use uncompyle6 to decompile the pyc file to see the python code.

uncompyle6 ./breakmesir_extracted/breakmesir.pyc > decoded_code.txt

Ok. So, if analyze the code here, we see that first the original flag was encoded into base64 ,then Every character was XORed with the next character and last character with the first one.

So, we reverse the given string , then XORed every char with the next one, then again reverse it and now we do the base64 decoding.

I hope this will reveal the flag! I wrote a simple python code here :

And Voilaaa!!

This was a fairly medium level challenge in the competition.

For practicing , you can download the files from here.

Good Luck!!

--

--

--

Cyber Security Enthusiast | CTF Player | Penetration Tester

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

Meet Stack Overflow, your path to programming and debugging knowledge

How I Brought A Dead Motherboard Back To Life

Reflections after AWS re:Invent 2019

Day 5: Nice Sprites

Web Shells. Additional Detection Strategies with Splunk Hands-On Labs.

Day 12 Code Berlin Challenge

Get Liberica Coffee Prices Using An API

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
0xRobin

0xRobin

Cyber Security Enthusiast | CTF Player | Penetration Tester

More from Medium

What is a SIEM and why do I need one?

Log4j RCE — An analysis and comparison of Software Composition Analysis tools in the market

What is threat modeling ❓ Definition, Methods, Example

How Microsoft 365 Defender Can Shield Your Company From Phishing Scams — Just Gilbey IT Solutions…