In this challenge, we are given a binary and the instructions to “Use pwntools and ghidra to reverse engineer and break into the ultrasecure(tm) vault!”<\/p>\n\n\n\n
Let’s check it out!<\/p>\n\n\n\n
Running the binary gives us the output:<\/p>\n\n\n\n
$ .\/ultrasecure\nProve that you are not human, repeat this to me in less than .05s: 1626412526\n1626412526\nWhoops, too slow<\/code><\/pre>\n\n\n\nLooks like my reflexes aren’t quite fast enough, so we’ll have to automate the nonce. This is a good time to use pwntools! First we’ll connect to the binary, and then we’ll read in and repeat the nonce back. The code for the nonce looks like this:<\/p>\n\n\n\n
\nnonce = conn.recvline()\nnonce = nonce.split()\nnonce = nonce[-1]\n# Sends line\nconn.sendline(nonce)\n<\/code><\/pre>\n\n\n\nRunning this script gives us<\/p>\n\n\n\n
You passed the nonce check! Now, Unlock the UltraSecure(tm) Vault:\n$ password\nWhoops, wrong password :(<\/code><\/pre>\n\n\n\nFiring up Ghidra gives us a password_check<\/code> function, which contains the lines below.<\/p>\n\n\n\n \n local_c = -0x21524cc1; \n__isoc99_scanf(&DAT_00400b9f,&local_3c);\n if (local_c == local_3c) {\n print_flag();\n \/* WARNING: Subroutine does not return *\/\n exit(0);\n }<\/code><\/pre>\n\n\n\n-0x21524cc1 = -559041729, so we’ve got our password! Entering it after running our script gives us access to the flag.<\/p>\n","protected":false},"excerpt":{"rendered":"
In this challenge, we are given a binary and the instructions to “Use pwntools and ghidra to reverse engineer and break into the ultrasecure(tm) vault!” Let’s check it out! Running the binary gives us the output: Looks like my reflexes aren’t quite fast enough, so we’ll have to automate the nonce. This is a good … Continue reading Writeup: Ultrasecure<\/span><\/a><\/p>\n","protected":false},"author":11809,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-42","post","type-post","status-publish","format-standard","hentry","category-writeups"],"_links":{"self":[{"href":"https:\/\/blogs.oregonstate.edu\/paul\/wp-json\/wp\/v2\/posts\/42","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.oregonstate.edu\/paul\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.oregonstate.edu\/paul\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.oregonstate.edu\/paul\/wp-json\/wp\/v2\/users\/11809"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.oregonstate.edu\/paul\/wp-json\/wp\/v2\/comments?post=42"}],"version-history":[{"count":2,"href":"https:\/\/blogs.oregonstate.edu\/paul\/wp-json\/wp\/v2\/posts\/42\/revisions"}],"predecessor-version":[{"id":44,"href":"https:\/\/blogs.oregonstate.edu\/paul\/wp-json\/wp\/v2\/posts\/42\/revisions\/44"}],"wp:attachment":[{"href":"https:\/\/blogs.oregonstate.edu\/paul\/wp-json\/wp\/v2\/media?parent=42"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.oregonstate.edu\/paul\/wp-json\/wp\/v2\/categories?post=42"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.oregonstate.edu\/paul\/wp-json\/wp\/v2\/tags?post=42"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}