-1

Learning how to use radare2 while getting the feel for crackmes. Following the steps for Flare-on 2015 Challenge One on hxxp://solidsec.blogspot.com/2015/10/ctf-fire-eye-flareon-2015-challenges-1-3.html (change hxxp to http, not enough cred to embed the link after adding the two pictures :-( sorry)

  • Load exe using r2 -A
  • go to address 0x00402140
  • px 0x18

enter image description here

I get all FFs.

The documentation of the site shows actual values versus all FFs as seen below: enter image description here

Why?

Problem with my copy of radare2 (running off of Remnux) or not loading the exe right into r2? I realize the number of variables here is just about endless, but hoping it is just something simple that I'm missing due to being new to RE. Thanks!

  • Radare2 from remnux is probably 5 years old, use radare2 from github version : git clone https://github.com/radare/radare2 && cd radare2 && ./sys/install.sh – Maijin Feb 13 '16 at 11:03
  • @Maijin, that was it exactly. Remnux was using a version from 2014-04-10. I've installed the latest and it works as expected! Thanks and yes, I should have checked that first. Lesson learned – slackerd Feb 13 '16 at 20:42
  • In order for you to validate an answer I have converted the previous comment in answer. – Maijin Feb 14 '16 at 10:18
2

Radare2 from remnux is probably 5 years old, use radare2 from github version : git clone https://github.com/radare/radare2 && cd radare2 && ./sys/install.sh

1

the first file needs to be extracted to get another executable and then you can find the email address that is needed to pass the challenge in the extacted executable

2015_FLAREOn_Challenges\1>r2 -A i_am_happy_you_are_to_playing_the_flareon_challenge.exe
[0x00401000]> s 0x402140 ; px 24 ; e io.cache = true ; wox 0x7d @0x402140:24 ; px 24
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x00402140  1f08 1313 0422 0e11 4d0d 183d 1b11 1c0f  ....."..M..=....
0x00402150  1850 1213 531e 1210                      .P..S...
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x00402140  6275 6e6e 795f 736c 3070 6540 666c 6172  bunny_sl0pe@flar
0x00402150  652d 6f6e 2e63 6f6d                      e-on.com
[0x00402140]>



 md5 of the extracted executable = 
    $b="";(([system.security.cryptography.md5]::Create("md5")).computehash( 
( gc -Encoding byte arg1))) | %{$b+="{0:X2}" -f $_} ;$b

7C0F16DE595AE03E2928D3FA6B73B235
  • You can use rahash -a md5, #md5 or !md5sum within radare – Maijin Feb 13 '16 at 11:42
  • @blabb, nice trick with wox. Thanks for posting your solution to the exercise. – slackerd Feb 13 '16 at 20:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.