1

Just as a preface, this is a crackme from https://hack.ainfosec.com/. I know you can submit these as part of a job app, I have no intentions of doing that. Very happy to have a job in a related, but different field as this is not my strong suit (go figure).

Also, I have solved this crackme via a different method (changing the MAC on my NIC to what the executable was expecting). I want to further solve this so that I don't have to bend my system to the program's will, but the other way around instead.

This is my already-modified version of the getFlag function.

[0x00400b8d]> pdf
            ; CALL XREF from sym.generateSentence @ 0x400db0
┌ 161: sym.getFlag ();
│           ; var void *ptr @ rbp-0x10
│           ; var int64_t var_8h @ rbp-0x8
│           0x00400b8d      55             push rbp
│           0x00400b8e      4889e5         mov rbp, rsp
│           0x00400b91      4883ec10       sub rsp, 0x10
│           0x00400b95      b800000000     mov eax, 0
│           0x00400b9a      e87d050000     call sym.getMac
│           0x00400b9f      488945f0       mov qword [ptr], rax
│           0x00400ba3      48837df000     cmp qword [ptr], 0
│       ┌─< 0x00400ba8      eb0a           jmp 0x400bb4
..
│      ││   ; CODE XREF from sym.getFlag @ 0x400ba8
│      │└─> 0x00400bb4      488b45f0       mov rax, qword [ptr]
│      │    0x00400bb8      488d3572f40a.  lea rsi, qword str.de:ad:be:ef:fa:ce ; 0x4b0031 ; "de:ad:be:ef:fa:ce"
│      │    0x00400bbf      4889c7         mov rdi, rax
│      │    0x00400bc2      e809f9ffff     call fcn.004004d0
│      │    0x00400bc7      85c0           test eax, eax
│      │    0x00400bc9      90             nop
│      │    0x00400bca      90             nop
│      │    0x00400bcb      0fb60564a12d.  movzx eax, byte [obj.user_seed] ; [0x6dad36:1]=0
│      │    0x00400bd2      84c0           test al, al
│      │    0x00400bd4      90             nop
│      │    0x00400bd5      90             nop
│      │    0x00400bd6      488d3d66f40a.  lea rdi, qword str.You_win  ; 0x4b0043 ; "You win!" ; const char *s
│      │    0x00400bdd      e8be130100     call sym.puts               ; int puts(const char *s)
│      │    0x00400be2      488b45f0       mov rax, qword [ptr]
│      │    0x00400be6      4889c6         mov rsi, rax
│      │    0x00400be9      488d3d5cf40a.  lea rdi, qword str.Mac_Address:__s ; 0x4b004c ; "Mac Address: %s\n"
│      │    0x00400bf0      b800000000     mov eax, 0
│      │    0x00400bf5      e8a6040100     call sym.__printf
│      │    0x00400bfa      488b45f0       mov rax, qword [ptr]
│      │    0x00400bfe      4889c7         mov rdi, rax
│      │    0x00400c01      e8faf8ffff     call fcn.00400500
│      │    0x00400c06      89c2           mov edx, eax
│      │    0x00400c08      488b45f0       mov rax, qword [ptr]
│      │    0x00400c0c      89d1           mov ecx, edx                ; int64_t arg4
│      │    0x00400c0e      4889c2         mov rdx, rax                ; int64_t arg3
│      │    0x00400c11      be11000000     mov esi, 0x11               ; 17 ; signed int64_t arg2
│      │    0x00400c16      488d3d03f40a.  lea rdi, qword obj.FLAG     ; 0x4b0020 ; int64_t arg1
│      │    0x00400c1d      e877040000     call sym.xorencrypt
│      │    0x00400c22      488945f8       mov qword [var_8h], rax
│      │    0x00400c26      488b45f0       mov rax, qword [ptr]
│      │    0x00400c2a      4889c7         mov rdi, rax                ; void *ptr
│      │    0x00400c2d      e8de0f0200     call sym.__free
│      │    0x00400c32      488b45f8       mov rax, qword [var_8h]
│      │    ; CODE XREF from sym.getFlag @ +0x22
│      └──> 0x00400c36      c9             leave
└           0x00400c37      c3             ret

I would like to modify the input for the xorencrypt function to "de:ad:be:ef:fa:ce", instead of my actual MAC address, which I believe is identified as var_8h. I am sure there's a way to move the value at 0x4b0031 (de:ad:be:ef:fa:ce) to var_8h or something like that, but I'm not sure how to go about it. I believe it would be easier to change the input to xorencrypt rather than changing the output of getMac, but I could be wrong.

This is pretty much my first go with (dis)assembly and Radare2.

The 64-bit ELF executable has 2 flags, --debug and --set-seed. You can solve this by setting the seed to 19016 and changing the MAC address of the first NIC in your system to de:ad:be:ef:fa:ce.

Original executable here (sentencebot)

My modified version here (sentencebot2)

0

1 Answer 1

1

I think the best way to solve your problem is to study function calls in assembler.

My guess is just need to replace the argument on the top of the stack with your desired MAC address.

I believe this set of slides from Princeton will put you on the right track: https://www.cs.princeton.edu/courses/archive/spr11/cos217/lectures/15AssemblyFunctions.pdf

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.