Cyber Apocalypse 2021: Passphrase

2021-04-25

Passphrase is a ELF 64 bit executable. It is dynamically linked and is not stripped for debug symbols.

$ file passphrase
passphrase: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=60f6b6064d2e34a2b6a24dda9feb943b0b8c360f, not stripped

Strings doens’t reveal a whole lot of info. The binary prompts for a “secret passphrase”. If it is correct, it asks that a message, presumably the flag, be taken to the chief.

Since the executable is not stripped when it is opened in Ghidra main() is clearly listed in the functions section of the symbol tree.

There a load of variables are initialized.

They are then set to various hex values while the prompt for a “secret passphrase” is output.

collect input
compare input with string of variable values

if match{
    Success
}
else{
    Denied
}

The value user input is being compared to can be determined by converting the values of each variable to ASCII. Combine these values and we have retrieved the flag

Cyber Apocalypse 2021: Backdoor

Cyber Apocalypse 2021: Authenticator