## ECOWAS CTF Pre-Qual 2023


i participated in ECOWAS CTF pre-qualification and had a blast! While some challenges were tough, it was all part of the fun. Here i the solutions of the Reverse challenges i cracked and blooded :100:

### Reverse challenges
#### veyize : 100 points


This reverse challenge was quiet weird and simple at the same time. let go :100:

i started opening the file in ghidra , main function shows there are three checks to be passed! and if you fail any explode function is called which basically quits the program with a try harder message


### Phase1
On phase1 function we get a loop that is basically comparing each character of our input with another character of a hardcoded string! If any of the characters don’t match explode function is called as weell. To be able to pass this check we need to supply that exact string…


### Phase2
The phase2 is doing alot of job , trying to understand the decompiled code proved to be tiresome, but the code helps in that we know the input we give should be equal to that hardcoded value!


one of the best way to be able to know that is to enumerate the right input to give is using dynamic analysis, we are suppossed to enter 4 numbers , since we dont have a bruteforce script we can enter the same number 4 times and check if the resultant value is close the hardcoded value. eg 500 gives 2040000 which is slightly higher than the required value



(gdb) disass phase2
Dump of assembler code for function phase2:
   0x00000a04 <+0>:     push   %ebp
   0x00000a05 <+1>:     mov    %esp,%ebp
   0x00000a07 <+3>:     push   %ebx
   0x00000a08 <+4>:     sub    $0x34,%esp
   0x00000a0b <+7>:     call   0x700 <__x86.get_pc_thunk.bx>
   0x00000a10 <+12>:    add    $0x2590,%ebx
   0x00000a16 <+18>:    mov    %gs:0x14,%eax
   0x00000a1c <+24>:    mov    %eax,-0xc(%ebp)
   0x00000a1f <+27>:    xor    %eax,%eax
   0x00000a21 <+29>:    sub    $0xc,%esp
   0x00000a24 <+32>:    lea    -0x20a2(%ebx),%eax
   0x00000a2a <+38>:    push   %eax
   0x00000a2b <+39>:    call   0x640 <puts@plt>
   0x00000a30 <+44>:    add    $0x10,%esp
   0x00000a33 <+47>:    movl   $0x0,-0x34(%ebp)
   0x00000a3a <+54>:    jmp    0xa4e <phase2+74>
   0x00000a3c <+56>:    call   0x8cd <get_number>
   0x00000a41 <+61>:    mov    %eax,%edx
   0x00000a43 <+63>:    mov    -0x34(%ebp),%eax
   0x00000a46 <+66>:    mov    %edx,-0x1c(%ebp,%eax,4)
   0x00000a4a <+70>:    addl   $0x1,-0x34(%ebp)
   0x00000a4e <+74>:    cmpl   $0x3,-0x34(%ebp)
   0x00000a52 <+78>:    jle    0xa3c <phase2+56>
   0x00000a54 <+80>:    movl   $0x0,-0x30(%ebp)
   0x00000a5b <+87>:    movl   $0x0,-0x2c(%ebp)
   0x00000a62 <+94>:    jmp    0xab5 <phase2+177>
   0x00000a64 <+96>:    mov    -0x2c(%ebp),%eax
   0x00000a67 <+99>:    mov    -0x1c(%ebp,%eax,4),%eax
   0x00000a6b <+103>:   mov    %eax,-0x20(%ebp)
   0x00000a6e <+106>:   movl   $0x0,-0x28(%ebp)
   0x00000a75 <+113>:   jmp    0xaab <phase2+167>
   0x00000a77 <+115>:   movl   $0x0,-0x24(%ebp)
   0x00000a7e <+122>:   jmp    0xaa1 <phase2+157>
   0x00000a80 <+124>:   mov    -0x28(%ebp),%eax
   0x00000a83 <+127>:   lea    0x0(,%eax,4),%edx
   0x00000a8a <+134>:   mov    -0x24(%ebp),%eax
   0x00000a8d <+137>:   add    %edx,%eax
   0x00000a8f <+139>:   mov    0x80(%ebx,%eax,4),%eax
   0x00000a96 <+146>:   imul   -0x20(%ebp),%eax
--Type <RET> for more, q to quit, c to continue without paging--c
   0x00000a9a <+150>:   add    %eax,-0x30(%ebp)
   0x00000a9d <+153>:   addl   $0x1,-0x24(%ebp)
   0x00000aa1 <+157>:   cmpl   $0x3,-0x24(%ebp)
   0x00000aa5 <+161>:   jle    0xa80 <phase2+124>
   0x00000aa7 <+163>:   addl   $0x1,-0x28(%ebp)
   0x00000aab <+167>:   cmpl   $0x3,-0x28(%ebp)
   0x00000aaf <+171>:   jle    0xa77 <phase2+115>
   0x00000ab1 <+173>:   addl   $0x1,-0x2c(%ebp)
   0x00000ab5 <+177>:   cmpl   $0x3,-0x2c(%ebp)
   0x00000ab9 <+181>:   jle    0xa64 <phase2+96>
   0x00000abb <+183>:   cmpl   $0x1cc320,-0x30(%ebp)
   0x00000ac2 <+190>:   je     0xac9 <phase2+197>
   0x00000ac4 <+192>:   call   0x92d <explode>
   0x00000ac9 <+197>:   mov    $0x1,%eax
   0x00000ace <+202>:   mov    -0xc(%ebp),%ecx
   0x00000ad1 <+205>:   xor    %gs:0x14,%ecx
   0x00000ad8 <+212>:   je     0xadf <phase2+219>
   0x00000ada <+214>:   call   0xe30 <__stack_chk_fail_local>
   0x00000adf <+219>:   mov    -0x4(%ebp),%ebx
   0x00000ae2 <+222>:   leave
   0x00000ae3 <+223>:   ret
End of assembler dump.
(gdb) b *phase2+183
Breakpoint 1 at 0xabb
(gdb) r
Starting program: /root/Downloads/ecowas-ctf/veyize 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Are u ready for a bomb lab?
Let's begin!!
Phase 1 Begin!!!
slimelove
Better luck next time ...
[Inferior 1 (process 514529) exited with code 0255]
(gdb) r
Starting program: /root/Downloads/ecowas-ctf/veyize 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Are u ready for a bomb lab?
Let's begin!!
Phase 1 Begin!!!
slimelove
Better luck next time ...
[Inferior 1 (process 515733) exited with code 0255]
(gdb) r
Starting program: /root/Downloads/ecowas-ctf/veyize 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Are u ready for a bomb lab?
Let's begin!!
Phase 1 Begin!!!
slime love
passed phase1
Alright! Here is phase 2:)
500
500
500
500

Breakpoint 1, 0x56555abb in phase2 ()
(gdb)  x $ebp-0x30
0xffffd488:     0x001f20c0
(gdb) p 0x001f20c0
$1 = 2040000
(gdb) p 0x1cc320
$2 = 1884960
(gdb) 

we can keep reducing the value till we get the right one :100:

### Phase3
The phase 3 creates some kind of linked list and calls the validate function like this


let’s go . this the validate function . In order to pass this phase we need to enter the ascii characters in their decimal equivalent, in the way that the node is followed very simple hehe smile in pain 😂


This is kind of linked list and it checks for node 42 which is the first one and checks if it holds character A , which i believe is 42 in decimal it continues like that till the end . the second it checks if node 27 holds letter K and so on , here the concept is simple you just need to understand the logic behind linked lists , one value points to the other , the other to another etc . so just you start with 42 which is already defined and enter the rest as well , very simple . To make easy Uvar2 is the node created with first value as 42 and then now from 42 you go to 65 and like that to 35. piece of cake 🎂 just like this :

1st => 65
2nd => 27
3rd => 75
4th => 57
5th => 12
6th => 35

All that work good and as final result we got like :

phase 1
slime love

phase 2
462

phase 3
1st => 65
2nd => 27
3rd => 75
4th => 57
5th => 12
6th => 35

it work properly hehe then run it now :