HackMD
tags: pwnable.kr tutorials CTF hacking beginner flag binary exploitation pwn Toddlers' Bottle
flag From Pwnable.kr
Category : Toddler's Bottle
The challenge flag was of reverse engineering category. Reverse Engineering is a handy skill to have while pwning binaries. The challenge gives only a binary and which mentions that it has allocated a malloc and saved the flag in that. So let's start the challenge.
Let's read the prompt and download the important files to our box.
Dry Run
Let's give the binary a dry run and see what happens.
The binary says its has stored the contents of flag in the malloc that it created. So this should be easy, we open the binary in gdb and grab the contents that its strcpy to the malloc.
There are no functions or calls in the binary. This is weird. On first glance this weird behaviour is difficult to analyze.
One of the reasons that the binary shows no function in the gdb could be it is packed with upx. The man page of upx states that:-
Unpack the binary
Now let's unpack the binary with upx and analyse it in the gdb again.
Now when you open it in gdb and check for functions you'll be able to see more data than earilier.
That being said, now all we need to get the flag from the malloc.
Getting the flag.
- Set a breakpoint at main
- Run the binary with command
r - Run the binary step by step and see the memory (command
ni).
We see that, first a malloc is being created with argument 0x64 i.e 100.
And we see the flag being passed to malloc occupied memory.
Flag is:
