Tryhackme — Reversing ELF — writeup

Tryhackme — Reversing ELF

1.Crackme1

Run the program

chmod 777 crackme1

./crackme1

#1 :- What is the flag?

Answer :- flag{not_that_kind_of_elf}

2.Crackme2

chmod 777 crackme2

./crackme2

strings crackme2

#2 :- What is the super secret password ?

Answer :- super_secret_password

#3 :- What is the flag ?

Answer :- flag{if_i_submit_this_flag_then_i_will_get_points}

3.Crackme3

chmod 777 crackme3

./crackme3

strings crackme3

base64 decode

echo “ZjByX3kwdXJfNWVjMG5kX2xlNTVvbl91bmJhc2U2NF80bGxfN2gzXzdoMW5nNQ==” | base64 -d

f0r_y0ur_5ec0nd_le55on_unbase64_4ll_7h3_7h1ng5

#4 :- What is the flag?

Answer :- f0r_y0ur_5ec0nd_le55on_unbase64_4ll_7h3_7h1ng5

4.Crackme4

chmod 777 crackme4

./crackme3

Let’s debug,

r2 -d ./crackme4

Analyze the program

aaa

lists functions

afl

there’s is mainfunction

pdf @main

This looks like comparing function.

pdf @main

Here’s the string compare.

Set breakpoint

db 0x004006d5

ood ‘argement’

Run til breakpoint

dc

pdf @sym.compare_pwd

Let’s check the value

px @rdi

#5 :- What is the password ?

Answer :- my_m0r3_secur3_pwd

5.crackme5

chmod 777 crackme5

./crackme5

strings crackme5

let’s debug,

r2 -d ./crackme5

analysis

aaa

list function

afl

pdf @main

There’s string compare.

db 0x0040082f

dc

pdf @main

Let’s get value of rsi.

px @rsi

#6 :- What is the input ?

Answer :- OfdlDSA|3tXb32~X3tX@sX`4tXtz

6.Crackme6

./crackme6

strings crackme6

check debug,

r2 -d ./crackme6

analysis

aaa

list function

afl

there are main function,

pdf @main

pdf @sym.compare_pwd

There’s another function.

pdf @sym.my_secure_test

I think this is comparing character function.

then, convert to hex to text converter,

#7 :- What is the password ?

Answer :- 1337_pwd

7.Crackme7

./crackme7

strings crackme7

lets check debug

pdf @main

Looking more closely, there’s comparing function.

hexa to decimal converter,

success!

#8 :-What is the flag ?

Answer :-flag{much_reversing_very_ida_wow}

8.Crackme8

./crackme8

strings crackme8

let’s check debug,

r2 -d ./crackme8

pdf @main

There’s cmp here with “0xcafef00d”. Before that there’s atoi function.

Input numbers decimal and signed 2 complement.

success!

#9 :- What is the flag ?

Answer :- flag{at_least_this_cafe_wont_leak_your_credit_card_numbers}