To access “Level 3” of the NcN CTF we first need to download the file (level.elf) the server offers. Running the program for the first time shows the following output:

The binary waits for user input. After pressing one key, it denies access with the message “I DON’T THINK SO”. Maybe we need to press another key to that one I pressed before. I tried all keys and finally got this result when pressing “SPACE”.

It displays an additional star to indicate that our first character (SPACE) was right. Pressing SPACE again leads to program failure again. What we need to do is just gaining the full passphrase. This can be achieved by brute forcing it – the same way we found the first character – or by analyzing the binary code.

A first look into the assembler code of the binary shows some obfuscation inside. So I decided that brute forcing the key will be much faster. The following PERL Script does the job for us:

#!/usr/bin/perl -w

$found = $ARGV[0];

for ($i = 0x20; $i<=0x7f; $i++) {
  $try = $found . chr($i);
  print "TRYING: $try ($i)\n";

  open(CRACK, "| ./level.elf");
  print CRACK $try;
  close(CRACK);
}

At first it takes one argument that contains the beginning of the string, we already verified. Afterwards the script just tries to append all human-readable characters to the string and passes it to the binary. The result is printed on the screen.
Continue reading →