Just as a preface, this is a crackme from https://hack.ainfosec.com/. I know you can submit these as part of a job app, I have no intentions of doing that. Very happy to have a job in a related, but different field as this is not my strong suit (go figure).
Also, I have solved this crackme via a different method (changing the MAC on my NIC to what the executable was expecting). I want to further solve this so that I don't have to bend my system to the program's will, but the other way around instead.
This is my already-modified version of the getFlag function.
[0x00400b8d]> pdf
; CALL XREF from sym.generateSentence @ 0x400db0
┌ 161: sym.getFlag ();
│ ; var void *ptr @ rbp-0x10
│ ; var int64_t var_8h @ rbp-0x8
│ 0x00400b8d 55 push rbp
│ 0x00400b8e 4889e5 mov rbp, rsp
│ 0x00400b91 4883ec10 sub rsp, 0x10
│ 0x00400b95 b800000000 mov eax, 0
│ 0x00400b9a e87d050000 call sym.getMac
│ 0x00400b9f 488945f0 mov qword [ptr], rax
│ 0x00400ba3 48837df000 cmp qword [ptr], 0
│ ┌─< 0x00400ba8 eb0a jmp 0x400bb4
..
│ ││ ; CODE XREF from sym.getFlag @ 0x400ba8
│ │└─> 0x00400bb4 488b45f0 mov rax, qword [ptr]
│ │ 0x00400bb8 488d3572f40a. lea rsi, qword str.de:ad:be:ef:fa:ce ; 0x4b0031 ; "de:ad:be:ef:fa:ce"
│ │ 0x00400bbf 4889c7 mov rdi, rax
│ │ 0x00400bc2 e809f9ffff call fcn.004004d0
│ │ 0x00400bc7 85c0 test eax, eax
│ │ 0x00400bc9 90 nop
│ │ 0x00400bca 90 nop
│ │ 0x00400bcb 0fb60564a12d. movzx eax, byte [obj.user_seed] ; [0x6dad36:1]=0
│ │ 0x00400bd2 84c0 test al, al
│ │ 0x00400bd4 90 nop
│ │ 0x00400bd5 90 nop
│ │ 0x00400bd6 488d3d66f40a. lea rdi, qword str.You_win ; 0x4b0043 ; "You win!" ; const char *s
│ │ 0x00400bdd e8be130100 call sym.puts ; int puts(const char *s)
│ │ 0x00400be2 488b45f0 mov rax, qword [ptr]
│ │ 0x00400be6 4889c6 mov rsi, rax
│ │ 0x00400be9 488d3d5cf40a. lea rdi, qword str.Mac_Address:__s ; 0x4b004c ; "Mac Address: %s\n"
│ │ 0x00400bf0 b800000000 mov eax, 0
│ │ 0x00400bf5 e8a6040100 call sym.__printf
│ │ 0x00400bfa 488b45f0 mov rax, qword [ptr]
│ │ 0x00400bfe 4889c7 mov rdi, rax
│ │ 0x00400c01 e8faf8ffff call fcn.00400500
│ │ 0x00400c06 89c2 mov edx, eax
│ │ 0x00400c08 488b45f0 mov rax, qword [ptr]
│ │ 0x00400c0c 89d1 mov ecx, edx ; int64_t arg4
│ │ 0x00400c0e 4889c2 mov rdx, rax ; int64_t arg3
│ │ 0x00400c11 be11000000 mov esi, 0x11 ; 17 ; signed int64_t arg2
│ │ 0x00400c16 488d3d03f40a. lea rdi, qword obj.FLAG ; 0x4b0020 ; int64_t arg1
│ │ 0x00400c1d e877040000 call sym.xorencrypt
│ │ 0x00400c22 488945f8 mov qword [var_8h], rax
│ │ 0x00400c26 488b45f0 mov rax, qword [ptr]
│ │ 0x00400c2a 4889c7 mov rdi, rax ; void *ptr
│ │ 0x00400c2d e8de0f0200 call sym.__free
│ │ 0x00400c32 488b45f8 mov rax, qword [var_8h]
│ │ ; CODE XREF from sym.getFlag @ +0x22
│ └──> 0x00400c36 c9 leave
└ 0x00400c37 c3 ret
I would like to modify the input for the xorencrypt function to "de:ad:be:ef:fa:ce", instead of my actual MAC address, which I believe is identified as var_8h. I am sure there's a way to move the value at 0x4b0031 (de:ad:be:ef:fa:ce) to var_8h or something like that, but I'm not sure how to go about it. I believe it would be easier to change the input to xorencrypt rather than changing the output of getMac, but I could be wrong.
This is pretty much my first go with (dis)assembly and Radare2.
The 64-bit ELF executable has 2 flags, --debug and --set-seed. You can solve this by setting the seed to 19016 and changing the MAC address of the first NIC in your system to de:ad:be:ef:fa:ce.
