Reversing ELF

 Tryhackme - Reversing ELF

 

Crackme1  

Run the program

chmod 777 crackme1

./crackme1

 

#1 :- What is the flag?

Answer :- flag{not_that_kind_of_elf} 

Crackme2

chmod 777 crackme2

./crackme2 

strings crackme2

#2 :- What is the super secret password ?

Answer :- super_secret_password

#3 :- What is the flag ?

Answer :- flag{if_i_submit_this_flag_then_i_will_get_points} 

Crackme3 

chmod 777 crackme3

./crackme3

strings crackme3

 

 base64 decode 

echo "ZjByX3kwdXJfNWVjMG5kX2xlNTVvbl91bmJhc2U2NF80bGxfN2gzXzdoMW5nNQ==" | base64 -d

                                                         
f0r_y0ur_5ec0nd_le55on_unbase64_4ll_7h3_7h1ng5 

#4 :- What is the flag?

Answer :- f0r_y0ur_5ec0nd_le55on_unbase64_4ll_7h3_7h1ng5 

Crackme4 

chmod 777 crackme4

./crackme3

Let’s debug,

r2 -d ./crackme4 

Analyze the program

aaa 

lists functions

afl

there's is mainfunction 

pdf @main

This looks like comparing function.

 pdf @main

 

Here’s the string compare.

Set breakpoint

db 0x004006d5

supply argument

ood 'argement'

Run til breakpoint

dc

pdf @sym.compare_pwd

 

Let’s check the value

px @rdi

#5 :- What is the password ?

Answer :- my_m0r3_secur3_pwd

crackme5 

chmod 777 crackme5

./crackme5

strings crackme5

 

let's debug,

r2 -d ./crackme5

analysis 

aaa

list function

afl 

pdf @main

There’s string compare.

db 0x0040082f

dc

pdf @main

Let’s get value of rsi.

px @rsi

#6 :- What is the input ?

Answer :- OfdlDSA|3tXb32~X3tX@sX`4tXtz

Crackme6 

 ./crackme6

strings crackme6

check debug,

r2 -d ./crackme6

analysis 

aaa

list function

afl

there are main function,

pdf @main

pdf @sym.compare_pwd

There’s another function.

pdf @sym.my_secure_test 

I think this is comparing character function.

then, convert to hex to text converter,

 

 

#7 :- What is the password ?

Answer :- 1337_pwd 

Crackme7  

./crackme7

strings crackme7

lets check debug

pdf @main

Looking more closely, there’s comparing function.

hexa to decimal converter,

 

 success!

 

#8 :-What is the flag ?

Answer :-flag{much_reversing_very_ida_wow}

Crackme8 

./crackme8

strings crackme8

let's check debug,

r2 -d ./crackme8

pdf @main

There’s cmp here with “0xcafef00d”. Before that there’s atoi function.

 

Input numbers decimal and signed 2 complement.

 

 

 

 

#9 :- What is the flag ? 

Answer :- flag{at_least_this_cafe_wont_leak_your_credit_card_numbers}