Reverse

Author: Mubarak Mikail | 100 points

Description

Try reversing this file? Can ya?

I forgot the password to this file. Please find it for me?

Solution

The file we are given in is shown below.

% file ret
ret: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, 
interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=888d1ba834fd1239330e280dc72d4af290aca14d, 
for GNU/Linux 3.2.0, not stripped

We are given an executable file and told to to find the password to the file. When we execute the file, after adding permissions, we are given the following prompt.

% chmod u+x ret
% ./ret
Enter the password to unlock this file: 
You entered: test
Access denied

Since this challenge is one of the easier ones, I figured not to open up Ghidra or IDA right away and use some simple instead: strings. Strings is a tool in Linunx that... searchs a file for strings. This seems very basic but can be a good first step when analyzing any executable to identifiy labels and functions.

% strings ret
__isoc99_scanf
puts
__stack_chk_fail
printf
__cxa_finalize
strcmp
__libc_start_main
... <a bunch of random strings>
Password correct, please see flag: picoCTF{3lf_r3v3r5ing_succe55ful_2f0131a4}
... <a bunch of random strings>

Flag

After using the strings program, we find the flag picoCTF{3lf_r3v3r5ing_succe55ful_2f0131a4}