Reverse Engineering – Petir Cyber Security

March 27, 2019

[SECCON 2016] – Anti-Debugging

Posted in Reverse Engineering by Henky Tornado Leave a Comment

File : https://drive.google.com/open?id=1mYYtqL1cIJTCQOubMdMR0boo6RYVFCHL Original WriteUp : https://0xd13a.github.io/ctfs/seccon2016/anti-debugging/ Disini seperti biasa kita akan mulai dengan melihat informasi dari jenis file tersebut

kazuya@ubuntu:~/Desktop$ file bin.exe
bin.exe: PE32 executable (console) Intel 80386, for MS Windows

1 2	kazuya@ubuntu:~/Desktop$ file bin.exe bin.exe: PE32 executable (console) Intel 80386, for MS Windows

setelah dilihat kita dapat berasumsi bahwa disini dia adalah executable file di windows kemudian, setelah dijalankan program ini memberikan exe berupa kemudian untuk melanjutkan proses analisisnya saya melanjutkan dengan membuka file ini dengan strings […]

October 9, 2018

[SharifCTF 2016] – SCrack – 150

Posted in Reverse Engineering by Putu Krisna Leave a Comment

Original Writeup : https://github.com/InfoSecIITR/write-ups/tree/master/2016/SharifCTF-2016/rev-150 Download : https://drive.google.com/file/d/11RDu4pF6AqOoE-2MZEtLi5wp9ETzxq0J/view?usp=sharing Seperti pada challenge-challenge reverse lainnya, kita diberikan sebuah ELF.

$ file SCrack

SCrack: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.24, BuildID[sha1]=d011afc29443bbb3ea2c72ef5ac15f8dc278397a, not stripped

$ file SCrack

SCrack: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.24, BuildID[sha1]=d011afc29443bbb3ea2c72ef5ac15f8dc278397a, not stripped

Kita kami jalankan, programnya meminta sebuah passcode. Jadi langkah berikutnya tentu saja kami membuka binary ini di IDA, tetapi entah karena IDA nya tidak bisa disassemble atau karena setup kami, binary tersebut tidak dapat di load di IDA. […]

June 19, 2018

[34C3 CTF] – arm2

Posted in Reverse Engineering by Henky Tornado Leave a Comment

Write up : https://github.com/KosBeg/ctf-writeups/tree/master/34C3_CTF/arm_stage2 Challenge File : https://drive.google.com/open?id=1Hz5sOQFq3ULyY-1bVGNekseb3eR84KkS Pertama mari kita melihat jenis file apa ini

$ file arm_stage2.bin 
arm_stage2.bin: data

1 2	$ file arm_stage2.bin arm_stage2.bin: data

kemudian mari kita langsung saja buka dengan IDA pro dengan menggunakkan processor metapc sebenarnya disini kita dapat langsung tau apa isinya dari flag tersebut namun disini terjadi suatu proses yang membuat isi flag tersebut menjadi aneh, […]

May 20, 2018

[picoCTF 2017]: Coffee

Posted in Reverse Engineering by Khallisa Mediana Leave a Comment

Challenge: You found a suspicious USB drive in a jar of pickles. It contains this file. File. File yang diberikan (freeThePickles.class) merupakan class Java yang telah dikompilasi. Kita bisa mendapatkan source code awalnya dengan menggunakan decompiler pada www.javadecompilers.com Hasilnya:

import java.util.Base64.Decoder;

public class problem {
  public problem() {}
  
  public static String get_flag() { String str1 = "Hint: Don't worry about the schematics";
    String str2 = "eux_Z]\\ayiqlog`s^hvnmwr[cpftbkjd";
    String str3 = "Zf91XhR7fa=ZVH2H=QlbvdHJx5omN2xc";
    byte[] arrayOfByte1 = str2.getBytes();
    byte[] arrayOfByte2 = str3.getBytes();
    byte[] arrayOfByte3 = new byte[arrayOfByte2.length];
    for (int i = 0; i < arrayOfByte2.length; i++)
    {
      arrayOfByte3[i] = arrayOfByte2[(arrayOfByte1[i] - 90)];
    }
    System.out.println(java.util.Arrays.toString(java.util.Base64.getDecoder().decode(arrayOfByte3)));
    return new String(java.util.Base64.getDecoder().decode(arrayOfByte3));
  }
  
  public static void main(String[] paramArrayOfString) {
    System.out.println("Nothing to see here");
  }
}

import java.util.Base64.Decoder;

public class problem {

public problem() {}

public static String get_flag() { String str1 = "Hint: Don't worry about the schematics";

String str2 = "eux_Z]\\ayiqlog`s^hvnmwr[cpftbkjd";

String str3 = "Zf91XhR7fa=ZVH2H=QlbvdHJx5omN2xc";

byte[] arrayOfByte1 = str2.getBytes();

byte[] arrayOfByte2 = str3.getBytes();

byte[] arrayOfByte3 = new byte[arrayOfByte2.length];

for (int i = 0; i < arrayOfByte2.length; i++)

{

arrayOfByte3[i] = arrayOfByte2[(arrayOfByte1[i] - 90)];

}

System.out.println(java.util.Arrays.toString(java.util.Base64.getDecoder().decode(arrayOfByte3)));

return new String(java.util.Base64.getDecoder().decode(arrayOfByte3));

}

public static void main(String[] paramArrayOfString) {

System.out.println("Nothing to see here");

}

Kita dapat menulis ulang function get_flag() menggunakan Python:

import base64
str2 = "eux_Z]\\ayiqlog`s^hvnmwr[cpftbkjd"
str3 = "Zf91XhR7fa=ZVH2H=QlbvdHJx5omN2xc"
arrayOfByte1 = str2.encode()
arrayOfByte2 = str3.encode()
arrayOfByte3 = []
i = 0
while i < 32:
    a = arrayOfByte2[(arrayOfByte1[i]-90)]
    i = i + 1
    arrayOfByte3.append(a)

letters = ""
for i in arrayOfByte3:
    letters = letters + chr(i)
flag = base64.b64decode(letters).decode("utf-8")
print(flag)

import base64

str2 = "eux_Z]\\ayiqlog`s^hvnmwr[cpftbkjd"

str3 = "Zf91XhR7fa=ZVH2H=QlbvdHJx5omN2xc"

arrayOfByte1 = str2.encode()

arrayOfByte2 = str3.encode()

arrayOfByte3 = []

i = 0

while i < 32:

a = arrayOfByte2[(arrayOfByte1[i]-90)]

i = i + 1

arrayOfByte3.append(a)

letters = ""

for i in arrayOfByte3:

letters = letters + chr(i)

flag = base64.b64decode(letters).decode("utf-8")

print(flag)

Lalu menjalankannya untuk mendapatkan flag:

nacl@ubuntu:~/Desktop$ python freeThePickles.py
flag_{pretty_cool_huh}

1 2	nacl@ubuntu:~/Desktop$ python freeThePickles.py flag_{pretty_cool_huh}

Flag: flag_{pretty_cool_huh}

May 20, 2018

[Angstrom CTF 2018]: Product Key – Static Analysis

Posted in Misc, Reverse Engineering by Khallisa Mediana Leave a Comment

Challenge: Artemis wants a copy of Windows, but she doesn’t feel like paying for it. She decided to hack Microsoft’s servers to generate a product key, and found their verification software, which runs on Linux for some reason. Can you get her a working product key (form ABCD-EFGH-IIJK-LMNO-PQRS-TUVW, each uppercase letter is a digit) using the […]

May 20, 2018

[Codegate CTF 2018 Preliminary] – Welcome to droid – 635

Posted in Reverse Engineering by Putu Krisna Leave a Comment

Original Writeup : https://github.com/vsnrain/ctf-writeups/tree/master/2018/codegate-pre/welcome\_to\_droid Download : https://drive.google.com/file/d/1H8wDt4STvJhrILUhh1johiZnfq97KTXL/view?usp=sharing Untuk challenge ini kita diberikan sebuah apk. Kita pun mencoba untuk menjalankan apk tersebut pada device android kami, tetapi aplikasi ternyata force close ketika dibuka. Lalu kita membuka apk tersebut pada jadx, yaitu sebuah java decompiler.

public void onClick(View view) {
                String obj = this.a.l.getText().toString();
                int length = this.a.l.length();
                if (length >= 10 && length <= 26) {
                    Intent intent = new Intent(view.getContext(), Main2Activity.class);
                    intent.putExtra("edittext", obj);
                    this.a.startActivity(intent);
                }
            }

public void onClick(View view) {

String obj = this.a.l.getText().toString();

int length = this.a.l.length();

if (length >= 10 && length <= 26) {

Intent intent = new Intent(view.getContext(), Main2Activity.class);

intent.putExtra("edittext", obj);

this.a.startActivity(intent);

}

Disini bisa kita lihat bahwa class MainActivity akan mengecek jika panjang […]

May 20, 2018

[EasyCTF IV]- ez_rev – 140

Posted in Reverse Engineering by Putu Krisna Leave a Comment

Original Writeup : https://github.com/KosBeg/ctf-writeups/blob/master/EasyCTF_IV/ez_rev/README.md Download : https://drive.google.com/file/d/1U4dJfiVBo01tXRCPV8lqYBdudIPjD1rc/view?usp=sharing File yang diberikan merupakan file ELF 64bit, dynamically linked, not stripped.

$ file ez_rev

ez_rev: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=eb7a47c52c657a17b5ae730826c4640de86b0dcf, not stripped

$ file ez_rev

ez_rev: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=eb7a47c52c657a17b5ae730826c4640de86b0dcf, not stripped

Ketika dijalankan program akan meminta password sebagai argumen. Jika kita memasukan password yang salah, program akan menghapus dirinya sendiri.

$ ./ez_rev_1 test

successfully deleted!

$ ./ez_rev_1 test

successfully deleted!

Kemudian kita membuka programnya di IDA, mari kita lihat pseudo nya.

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int result; // eax
  int v4; // [rsp+10h] [rbp-20h]
  int v5; // [rsp+14h] [rbp-1Ch]
  int v6; // [rsp+18h] [rbp-18h]
  int v7; // [rsp+1Ch] [rbp-14h]
  int v8; // [rsp+20h] [rbp-10h]
  const char *v9; // [rsp+28h] [rbp-8h]

  signal(2, sigintHandler);
  target = (char *)*argv;
  if ( argc != 2 )
    return 2;
  v9 = argv[1];
  v4 = 1;
  v5 = 2;
  v6 = 3;
  v7 = 4;
  v8 = 5;
  v4 = *v9 + 1;
  v5 = v9[1] + 2;
  v6 = v9[2] + 3;
  v7 = v9[3] + 4;
  v8 = v9[4] + 5;
  if ( v7 != 111 || v6 != 125 || v4 != v8 - 10 || v5 != 53 || v8 != v7 + 3 )
  {
    sleep(2u);
    remove(*argv);
    puts("successfully deleted!");
    result = 2;
  }
  else
  {
    printf("Now here is your flag: ", sigintHandler, argv);
    print_5(&v4);
    result = 1;
  }
  return result;
}

int __cdecl main(int argc, const char **argv, const char **envp)

{

int result; // eax

int v4; // [rsp+10h] [rbp-20h]

int v5; // [rsp+14h] [rbp-1Ch]

int v6; // [rsp+18h] [rbp-18h]

int v7; // [rsp+1Ch] [rbp-14h]

int v8; // [rsp+20h] [rbp-10h]

const char *v9; // [rsp+28h] [rbp-8h]

signal(2, sigintHandler);

target = (char *)*argv;

if ( argc != 2 )

return 2;

v9 = argv[1];

v4 = 1;

v5 = 2;

v6 = 3;

v7 = 4;

v8 = 5;

v4 = *v9 + 1;

v5 = v9[1] + 2;

v6 = v9[2] + 3;

v7 = v9[3] + 4;

v8 = v9[4] + 5;

if ( v7 != 111 || v6 != 125 || v4 != v8 - 10 || v5 != 53 || v8 != v7 + 3 )

{

sleep(2u);

remove(*argv);

puts("successfully deleted!");

result = 2;

}

else

{

printf("Now here is your flag: ", sigintHandler, argv);

print_5(&v4);

result = 1;

}

return result;

}

Setelah itu kita dapat […]

May 20, 2018

[34C3 CTF] – Morph

Posted in Reverse Engineering by Henky Tornado Leave a Comment

write up asli : https://teamrocketist.github.io/2017/12/30/Reverse-34C3ctf-m0rph/ binary file : https://drive.google.com/file/d/1aVF5hBrf9C3HeEgHSWn7QCPMlREjgaZO/view?usp=sharing pertama yang saya lakukan adalah mengecek jenis dari file ini

kazuya12@ubuntu:~/Desktop$ file morph
morph: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=1c81eb4bc8b981ed39ef79801d6fef03d4d81056, stripped

1 2	kazuya12@ubuntu:~/Desktop$ file morph morph: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=1c81eb4bc8b981ed39ef79801d6fef03d4d81056, stripped

lalu setelah itu saya coba jalankan filenya

kazuya12@ubuntu:~/Desktop$ ./morph
kazuya12@ubuntu:~/Desktop$

1 2	kazuya12@ubuntu:~/Desktop$ ./morph kazuya12@ubuntu:~/Desktop$

tidak ada yang terjadi jadi langsung saja file ini saya disass di IDA pro 64 untuk mengetahui apa yang sebenarnya dijalankan oleh program. darisini kita bisa tau […]

April 27, 2018

[BSidesSF-2017]: Skipper

Posted in Reverse Engineering by Yerriell Leave a Comment

SOAL Biner yang diberikan akan memberikan Anda sebuah Password.. Jika Anda menemukan kriterianya! FILE https://goo.gl/WosMaz SOLVE Kita diberi sebuah file bernama ‘Skipper-64’, lalu kita coba execute filenya, hasilnya ternyata program melihat Computer name kita dari system, dan saya curiga pasti ada strcmp dalam flow program tersebut, untuk liat source code program, kita gunakan IDA Pro, […]

April 27, 2018

[0x00ctf-2017] – Hello – 50

Posted in Reverse Engineering by Putu Krisna Leave a Comment

Original Writeup : https://github.com/SPRITZ-Research-Group/ctf-writeups/tree/master/0x00ctf-2017/reverse/challenge-004-50 Download : https://drive.google.com/file/d/1KxJjtybOlBtr2vHzBqgyx7JnoFqsJ7S2/view?usp=sharing Untuk challenge kali ini kita diberikan sebuah ELF 64-bit. Saat kita check menggunakan command “file” di linux, terdapat error yang aneh.

$ file hello

hello: ERROR: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.24, BuildID[sha1]=b8ccefeffb8978b2289ec31802396333def9dfad error reading (Invalid argument)

$ file hello

hello: ERROR: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.24, BuildID[sha1]=b8ccefeffb8978b2289ec31802396333def9dfad error reading (Invalid argument)

Ketika dijalankan, program akan memberikan output seperti ini:

$ ./hello

Welcome to the Twinlight Zone!!!

Password: test

Keep Trying!

$ ./hello

Welcome to the Twinlight Zone!!!

Password: test

Keep Trying!

Akhirnya, kami mencoba membukanya di IDA Pro

    __int64 __fastcall main(__int64 a1, char **a2, char **a3)

    {

    puts("Hello World!\n");

    return 0LL;

    }

__int64 __fastcall main(__int64 a1, char **a2, char **a3)

{

puts("Hello World!\n");

return 0LL;

}

Kita melihat ini, kami makin bingung, karena function main […]