Flare-On3 - 01 - Challenge 1

Table of Contents

Flare-On-03 - This article is part of a series.

Part 1: This Article

I decided to move onto FlareOn3 as the later challenges in 1 & 2 are quite tough. This one I cracked in under ten minutes. Not as easy as previous round 1 challenges but should be trivial if you’ve completed the previous challenges like I have.

Initial
#

You’re presented with challenge1.exe that when ran on the terminal, you get this.

Okay fine, so I loaded the binary into Ghidra, and because we know what to look for from previous challenges, I performed a string search, looking for a reference to ‘Wrong Password’. When I found it, I spotted two interesting strings, x2dtJEOmyjacxDemx2eczT5cVS9fVUGvWTuZWjuexjRqy24rV29q and ZYXABCDEFGHIJKLMNOPQRSTUVWzyxabcdefghijklmnopqrstuvw0123456789+/, the latter suggesting the former is base64 encoded but using a custom key.Normally, base64 starts with ABCD....

I see that the strings were referenced in FUN_00401420, so let’s take a look.

undefined4 FUN_00401420(void)

{
  int iVar1;
  undefined1 local_98 [128];
  char *local_18;
  char *local_14;
  HANDLE local_10;
  HANDLE local_c;
  DWORD local_8;
  
  local_c = GetStdHandle(0xfffffff5);
  local_10 = GetStdHandle(0xfffffff6);
  local_14 = "x2dtJEOmyjacxDemx2eczT5cVS9fVUGvWTuZWjuexjRqy24rV29q";
  WriteFile(local_c,"Enter password:\r\n",0x12,&local_8,(LPOVERLAPPED)0x0);
  ReadFile(local_10,local_98,0x80,&local_8,(LPOVERLAPPED)0x0);
  local_18 = (char *)FUN_00401260(local_98,local_8 - 2);
  iVar1 = _strcmp(local_18,local_14);
  if (iVar1 == 0) {
    WriteFile(local_c,"Correct!\r\n",0xb,&local_8,(LPOVERLAPPED)0x0);
  }
  else {
    WriteFile(local_c,"Wrong password\r\n",0x11,&local_8,(LPOVERLAPPED)0x0);
  }
  return 0;
}

So,working backwards, we need iVar1 to equal 0 which comes from a _strcmp or string compare. That is comparing two vars, local_18 and local_14). The latter is the encoded string, so the other must be the user input.

Base64 is trivial to decode, but the custom charmap makes it difficult. I found a script online that allows you to convert charmaps in Python, so I repurposed that…

#!/usr/bin/env python3

import base64
std_base64chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
custom = "ZYXABCDEFGHIJKLMNOPQRSTUVWzyxabcdefghijklmnopqrstuvw0123456789+/"
x = "x2dtJEOmyjacxDemx2eczT5cVS9fVUGvWTuZWjuexjRqy24rV29q"
newb64 = bytes(str(x).translate(str(x).maketrans(custom, std_base64chars)), 'utf-8')
print(base64.b64decode(newb64).decode('utf-8'))

Running it gives the flag: sh00ting_phish_in_a_barrel@flare-on.com

Nice easy start to this set of challenges.

Flare-On-03 - This article is part of a series.

Part 1: This Article

Initial#

Initial
#