You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
100 lines
3.9 KiB
100 lines
3.9 KiB
+++
|
|
author = "Maik de Kruif"
|
|
title = "Konski-Hiakawa Law of Droids"
|
|
subtitle = "Beginners Quest 9 - Google CTF"
|
|
date = 2021-11-07T12:01:00+01:00
|
|
description = "A writeup for challenge 9 of the beginners quests of the Google CTF."
|
|
cover = "img/writeups/google-ctf/2021/beginners-quest/9/cover.png"
|
|
tags = [
|
|
"Google CTF",
|
|
"Beginners Quest",
|
|
"ctf",
|
|
"hacking",
|
|
"writeup",
|
|
"reversing",
|
|
]
|
|
categories = [
|
|
"ctf",
|
|
"writeups",
|
|
"hacking",
|
|
"reversing",
|
|
]
|
|
aliases = [
|
|
"9"
|
|
]
|
|
+++
|
|
|
|
## Story line
|
|
|
|
### Johannesburg - Hideout
|
|
|
|
Johannesburg is hot, and you are on your way to the secret lair. It seems like it is well fortified, even though you are expected under the alias of the assassin, perhaps it will be a better idea to sneak inside the lair, unseen? You climb up on a brick wall, and jump over it. On the other side you spot a lot of guards, quick, hide in a bush. Now you have to sneak past the guards into the main building's entrance.
|
|
|
|
### Challenge: Konski-Hiakawa Law of Droids (reversing)
|
|
|
|
In this challenge, you have to find the flag using memory forensics. Good luck! Note, surround the flag with CTF{...} to submit it. Note, API Level 25 is what you're looking for.
|
|
|
|
### After solving
|
|
|
|
Congratulations, you successfully sneaked past the guards, and now you are inside the main building in the secret lair. Look over there, a safe case! Wait, what, it is open, no way! It’s only a photo inside, what a disappointment... But wait, don’t get hasty now, it seems like it’s an airport in the picture, it’s Heathrow, and there is something scribbled on the back, it’s coordinates to a secret warehouse at Heathrow, it seems like London is calling!
|
|
|
|
## Attachment
|
|
|
|
attachment.zip (_file too large_)
|
|
|
|
- [bzImage.elf](/files/writeups/google-ctf/2021/beginners-quest/9/bzImage.elf)
|
|
|
|
## Recon
|
|
|
|
The attachment contains four files: `bzImage`, `bzImage.elf`, `bzImage.elf.i64` and `gCTF.apk`.
|
|
|
|
## Solving
|
|
|
|
To start off, I don't think I solved it in the intended way as this challenge took me only a few minutes.
|
|
|
|
As always, I started off by listing the strings in the binary files using the following command.
|
|
|
|
```sh
|
|
strings --print-file-name * | grep CTF
|
|
```
|
|
|
|
This listed a lot of strings, which is expected when there is an app with CTF in the name. So I did the same command, but this time only on the other files:
|
|
|
|
```sh
|
|
strings --print-file-name bzImage* | grep CTF
|
|
```
|
|
|
|
This returned three lines:
|
|
|
|
```text
|
|
bzImage: CTF!
|
|
bzImage.elf: gCTF:KEY:
|
|
bzImage.elf: C300-CTFDDAC128MAG
|
|
```
|
|
|
|
`gCTF:KEY` looks interesting, so I used grep to get the content around it and then piped it into bat (`cat` would work as well, but `bat` looks nicer) to see the non-printable characters.
|
|
|
|
```sh
|
|
grep -B 2 -A 2 -a gCTF bzImage.elf | bat -A
|
|
```
|
|
|
|
```text
|
|
␀free_calls␀alloc_calls␀validate␀store_user␀poison␀red_zone␀sanity_checks␀total_objects␀slabs␀
|
|
destroy_by_rcu␀cache_dma␀hwcache_align␀reclaim_account␀slabs_cpu_partial␀objects_partial␀objec
|
|
ts␀cpu_slabs␀partial␀aliases␀ctor␀cpu_partial␀min_partial␀objs_per_slab␀object_size␀align␀slab
|
|
_size␀nr_succeeded=%lu·nr_failed=%lu·mode=%s·reason=%s␊
|
|
␀succeeded␀failed␀enum·migrate_mode␀reason␀mm/migrate.c␀MIGRATE_ASYNC␀MIGRATE_SYNC_LIGHT␀MIGRA
|
|
TE_SYNC␀memory_failure␀memory_hotplug␀syscall_or_cpuset␀mempolicy_mbind␀cma␀mm_migrate_pages␀m
|
|
igrate␀mm/page_isolation.c␀\u{1}3VFS:·Close:·file·count·is·0␊
|
|
␀fs/open.c␀SusanSue␀/sdcard/Download/Raven.txt␀gCTF:KEY:␀SB:575756␀\u{1}6VFS:·file-max·limit·%
|
|
lu·reached␊
|
|
␀fs/file_table.c␀filp␀files_lglock␀VFS:·Busy·inodes·after·unmount·of·%s.·Self-destruct·in·5·se
|
|
conds.··Have·a·nice·day...␊
|
|
␀fs/super.c␀\u{1}3VFS:Filesystem·freeze·failed␊
|
|
```
|
|
|
|
This output shows that the value of `gCTF:KEY` is `SB:575756`. I added the CTF{} brackets and submitted it.
|
|
|
|
## Solution
|
|
|
|
The flag is correct! It's `CTF{SB:575756}`.
|
|
|