Resources
Challenge Instructions
To complete this exercise, you will need to leverage GDB in order to extract information embedded within the binary and weaponize it to attain the flag. Here are some guiding comments to bear in mind:
- Frustratingly, the source code (flag.c) is pretty sparse. However, we compiled the binary such that it preserved all of its symbols under-the-hood, so you should be able to glean plenty of insight about what the program is doing by (s)tepping into various functions.
- When the flag binary is ran, it prompts you for login credentials (username and password). Figuring out what those are is the whole challenge. If the account you login with is recognized as an Administrator, you get your flag!
- One of the first things you’re going to want to do is enumerate the struct that contains all of the users and their information. The flag.c source code hints at how this is organized, but you may want to do some research about GDB’s commands in order to scrape up everything you need.
- Unfortunately for us, the binary doesn’t store any passwords in plaintext; instead, it only stores password hashes. Since hashing is a one-way function, there’s no way for us to “undo” the hashing: our only hope is to try to crack the password(s).
- You are welcome to leverage password cracking software explored in any other part of the class, but we recommend using hashcat.
- The hashcat password cracker is an incredibly powerful piece of password cracking software. To run it, you need to specify the hash-mode (-m) a number which specifies the type of algorithm used (e.g. MD5), the type of attack hashcat should perform (-a), the list of hashes to crack, the dictionary wordlist to reference, and any modifiers/rules to use.
- We’ve provided a wordlist (passwords.txt) that the Administrator’s account password is derived from; the exact password is not within the list, however. You’ll need to leverage context clues from your analysis of the binary in order to determine what kinds of rules/mutations need to be accounted for by your password cracking attack. This list – compared to others – is very short, so cracking the correct password should be near instant when ran correctly.
