Cybercamp 2017 Online – 06. Pretty flowers [300]

Superando el tercio de pruebas vamos a por la sexta que nos deja el siguiente enunciado y link:

This exercise consists of three files: an executable, an image and an encrypted 7z. Somehow the three files are related. Find out how and validate the flag.

https://s3.eu-central-1.amazonaws.com/cyberrange/cyb_2017_quals/objective6.zip

En este caso nos dan una imagen, un archivo 7z y un binario, como animal de costumbres que soy lo primero que hice fue investigar la imagen a ver si encontraba algo pero después de darle mil vueltas y perder un tiempo valioso decidí irme a por el binario a ver si tenía más suerte, lo cargue en gdb con peda e hice un disas main:

   0x56555700 <+0>:     lea    ecx,[esp+0x4]
   0x56555704 <+4>:     and    esp,0xfffffff0
   0x56555707 <+7>:     push   DWORD PTR [ecx-0x4]
   0x5655570a <+10>:    push   ebp
   0x5655570b <+11>:    mov    ebp,esp
   0x5655570d <+13>:    push   edi
   0x5655570e <+14>:    push   esi
   0x5655570f <+15>:    push   ebx
   0x56555710 <+16>:    push   ecx
   0x56555711 <+17>:    sub    esp,0x878
   0x56555717 <+23>:    call   0x565555d0 <__x86.get_pc_thunk.bx>
   0x5655571c <+28>:    add    ebx,0x18e4
   0x56555722 <+34>:    mov    esi,ecx
   0x56555724 <+36>:    mov    BYTE PTR [ebp-0x6d],0x41
   0x56555728 <+40>:    mov    BYTE PTR [ebp-0x6c],0x42
   0x5655572c <+44>:    mov    BYTE PTR [ebp-0x6b],0x43
   0x56555730 <+48>:    mov    BYTE PTR [ebp-0x6a],0x44
   0x56555734 <+52>:    mov    BYTE PTR [ebp-0x69],0x45
   0x56555738 <+56>:    mov    BYTE PTR [ebp-0x68],0x46
   0x5655573c <+60>:    mov    BYTE PTR [ebp-0x67],0x47
   0x56555740 <+64>:    mov    BYTE PTR [ebp-0x66],0x48
   0x56555744 <+68>:    mov    BYTE PTR [ebp-0x65],0x49
   0x56555748 <+72>:    mov    BYTE PTR [ebp-0x64],0x4a
   0x5655574c <+76>:    mov    BYTE PTR [ebp-0x63],0x4b
   0x56555750 <+80>:    mov    BYTE PTR [ebp-0x62],0x4c
   0x56555754 <+84>:    mov    BYTE PTR [ebp-0x61],0x4d
   0x56555758 <+88>:    mov    BYTE PTR [ebp-0x60],0x4e
   0x5655575c <+92>:    mov    BYTE PTR [ebp-0x5f],0x4f
   0x56555760 <+96>:    mov    BYTE PTR [ebp-0x5e],0x50
   0x56555764 <+100>:   mov    BYTE PTR [ebp-0x5d],0x51
   0x56555768 <+104>:   mov    BYTE PTR [ebp-0x5c],0x52
   0x5655576c <+108>:   mov    BYTE PTR [ebp-0x5b],0x53
   0x56555770 <+112>:   mov    BYTE PTR [ebp-0x5a],0x54
   0x56555774 <+116>:   mov    BYTE PTR [ebp-0x59],0x55
   0x56555778 <+120>:   mov    BYTE PTR [ebp-0x58],0x56
   0x5655577c <+124>:   mov    BYTE PTR [ebp-0x57],0x57
   0x56555780 <+128>:   mov    BYTE PTR [ebp-0x56],0x58
   0x56555784 <+132>:   mov    BYTE PTR [ebp-0x55],0x59
   0x56555788 <+136>:   mov    BYTE PTR [ebp-0x54],0x5a
   0x5655578c <+140>:   mov    BYTE PTR [ebp-0x53],0x5f
   0x56555790 <+144>:   mov    BYTE PTR [ebp-0x52],0x61
   0x56555794 <+148>:   mov    BYTE PTR [ebp-0x51],0x62
   0x56555798 <+152>:   mov    BYTE PTR [ebp-0x50],0x63
   0x5655579c <+156>:   mov    BYTE PTR [ebp-0x4f],0x64
   0x565557a0 <+160>:   mov    BYTE PTR [ebp-0x4e],0x65
   0x565557a4 <+164>:   mov    BYTE PTR [ebp-0x4d],0x66
   0x565557a8 <+168>:   mov    BYTE PTR [ebp-0x4c],0x67
   0x565557ac <+172>:   mov    BYTE PTR [ebp-0x4b],0x68
   0x565557b0 <+176>:   mov    BYTE PTR [ebp-0x4a],0x69
   0x565557b4 <+180>:   mov    BYTE PTR [ebp-0x49],0x6a
   0x565557b8 <+184>:   mov    BYTE PTR [ebp-0x48],0x6b
   0x565557bc <+188>:   mov    BYTE PTR [ebp-0x47],0x6c
   0x565557c0 <+192>:   mov    BYTE PTR [ebp-0x46],0x6d
   0x565557c4 <+196>:   mov    BYTE PTR [ebp-0x45],0x6e
   0x565557c8 <+200>:   mov    BYTE PTR [ebp-0x44],0x6f
   0x565557cc <+204>:   mov    BYTE PTR [ebp-0x43],0x70
   0x565557d0 <+208>:   mov    BYTE PTR [ebp-0x42],0x71
   0x565557d4 <+212>:   mov    BYTE PTR [ebp-0x41],0x72
   0x565557d8 <+216>:   mov    BYTE PTR [ebp-0x40],0x73
   0x565557dc <+220>:   mov    BYTE PTR [ebp-0x3f],0x74
   0x565557e0 <+224>:   mov    BYTE PTR [ebp-0x3e],0x75
   0x565557e4 <+228>:   mov    BYTE PTR [ebp-0x3d],0x76
   0x565557e8 <+232>:   mov    BYTE PTR [ebp-0x3c],0x77
   0x565557ec <+236>:   mov    BYTE PTR [ebp-0x3b],0x78
   0x565557f0 <+240>:   mov    BYTE PTR [ebp-0x3a],0x79
   0x565557f4 <+244>:   mov    BYTE PTR [ebp-0x39],0x7a
   0x565557f8 <+248>:   cmp    DWORD PTR [esi],0x1
   0x565557fb <+251>:   je     0x56555807 <main+263>
   0x565557fd <+253>:   mov    eax,0x1
   0x56555802 <+258>:   jmp    0x56555c55 <main+1365>
   0x56555807 <+263>:   sub    esp,0xc
   0x5655580a <+266>:   lea    eax,[ebx-0x1310]
   0x56555810 <+272>:   push   eax
   0x56555811 <+273>:   call   0x56555570 <exif_data_new_from_file@plt>
   0x56555816 <+278>:   add    esp,0x10
   0x56555819 <+281>:   mov    DWORD PTR [ebp-0x2c],eax
   0x5655581c <+284>:   cmp    DWORD PTR [ebp-0x2c],0x0
   0x56555820 <+288>:   jne    0x56555847 <main+327>
   0x56555822 <+290>:   mov    eax,DWORD PTR [esi+0x4]
   0x56555825 <+293>:   add    eax,0x4
   0x56555828 <+296>:   mov    eax,DWORD PTR [eax]
   0x5655582a <+298>:   sub    esp,0x8
   0x5655582d <+301>:   push   eax
   0x5655582e <+302>:   lea    eax,[ebx-0x1304]
   0x56555834 <+308>:   push   eax
   0x56555835 <+309>:   call   0x56555500 <printf@plt>
   0x5655583a <+314>:   add    esp,0x10
   0x5655583d <+317>:   mov    eax,0x2
   0x56555842 <+322>:   jmp    0x56555c55 <main+1365>
   0x56555847 <+327>:   mov    DWORD PTR [ebp-0x28],0x0
   0x5655584e <+334>:   jmp    0x56555b04 <main+1028>
   0x56555853 <+339>:   cmp    DWORD PTR [ebp-0x28],0x0
   0x56555857 <+343>:   jne    0x5655590a <main+522>
   0x5655585d <+349>:   lea    eax,[ebp-0x881]
   0x56555863 <+355>:   mov    ecx,0x64
   0x56555868 <+360>:   mov    esi,0x0
   0x5655586d <+365>:   mov    DWORD PTR [eax],esi
   0x5655586f <+367>:   mov    DWORD PTR [eax+ecx*1-0x4],esi
   0x56555873 <+371>:   lea    edx,[eax+0x4]
   0x56555876 <+374>:   and    edx,0xfffffffc
   0x56555879 <+377>:   sub    eax,edx
   0x5655587b <+379>:   add    ecx,eax
   0x5655587d <+381>:   and    ecx,0xfffffffc
   0x56555880 <+384>:   shr    ecx,0x2
   0x56555883 <+387>:   mov    edi,edx
   0x56555885 <+389>:   mov    eax,esi
   0x56555887 <+391>:   rep stos DWORD PTR es:[edi],eax
   0x56555889 <+393>:   movzx  eax,BYTE PTR [ebp-0x5b]
   0x5655588d <+397>:   mov    BYTE PTR [ebp-0x881],al
   0x56555893 <+403>:   movzx  eax,BYTE PTR [ebp-0x44]
   0x56555897 <+407>:   mov    BYTE PTR [ebp-0x880],al
   0x5655589d <+413>:   movzx  eax,BYTE PTR [ebp-0x4d]
   0x565558a1 <+417>:   mov    BYTE PTR [ebp-0x87f],al
   0x565558a7 <+423>:   movzx  eax,BYTE PTR [ebp-0x3f]
   0x565558ab <+427>:   mov    BYTE PTR [ebp-0x87e],al
   0x565558b1 <+433>:   movzx  eax,BYTE PTR [ebp-0x3c]
   0x565558b5 <+437>:   mov    BYTE PTR [ebp-0x87d],al
   0x565558bb <+443>:   movzx  eax,BYTE PTR [ebp-0x52]
   0x565558bf <+447>:   mov    BYTE PTR [ebp-0x87c],al
   0x565558c5 <+453>:   movzx  eax,BYTE PTR [ebp-0x41]
   0x565558c9 <+457>:   mov    BYTE PTR [ebp-0x87b],al
   0x565558cf <+463>:   movzx  eax,BYTE PTR [ebp-0x4e]
   0x565558d3 <+467>:   mov    BYTE PTR [ebp-0x87a],al
   0x565558d9 <+473>:   sub    esp,0xc
   0x565558dc <+476>:   lea    eax,[ebp-0x881]
   0x565558e2 <+482>:   push   eax
   0x565558e3 <+483>:   call   0x56555560 <exif_tag_from_name@plt>
   0x565558e8 <+488>:   add    esp,0x10
   0x565558eb <+491>:   mov    DWORD PTR [ebp-0x30],eax
   0x565558ee <+494>:   mov    eax,DWORD PTR [ebp-0x2c]
   0x565558f1 <+497>:   mov    eax,DWORD PTR [eax]
   0x565558f3 <+499>:   sub    esp,0x8
   0x565558f6 <+502>:   push   DWORD PTR [ebp-0x30]
   0x565558f9 <+505>:   push   eax
   0x565558fa <+506>:   call   0x56555550 <exif_content_get_entry@plt>
   0x565558ff <+511>:   add    esp,0x10
   0x56555902 <+514>:   mov    DWORD PTR [ebp-0x24],eax
   0x56555905 <+517>:   jmp    0x56555b00 <main+1024>
   0x5655590a <+522>:   cmp    DWORD PTR [ebp-0x28],0x1
   0x5655590e <+526>:   jne    0x56555a11 <main+785>
   0x56555914 <+532>:   lea    eax,[ebp-0x881]
   0x5655591a <+538>:   mov    ecx,0x64
   0x5655591f <+543>:   mov    esi,0x0
   0x56555924 <+548>:   mov    DWORD PTR [eax],esi
   0x56555926 <+550>:   mov    DWORD PTR [eax+ecx*1-0x4],esi
   0x5655592a <+554>:   lea    edx,[eax+0x4]
   0x5655592d <+557>:   and    edx,0xfffffffc
   0x56555930 <+560>:   sub    eax,edx
   0x56555932 <+562>:   add    ecx,eax
   0x56555934 <+564>:   and    ecx,0xfffffffc
   0x56555937 <+567>:   shr    ecx,0x2
   0x5655593a <+570>:   mov    edi,edx
   0x5655593c <+572>:   mov    eax,esi
   0x5655593e <+574>:   rep stos DWORD PTR es:[edi],eax
   0x56555940 <+576>:   movzx  eax,BYTE PTR [ebp-0x65]
   0x56555944 <+580>:   mov    BYTE PTR [ebp-0x881],al
   0x5655594a <+586>:   movzx  eax,BYTE PTR [ebp-0x46]
   0x5655594e <+590>:   mov    BYTE PTR [ebp-0x880],al
   0x56555954 <+596>:   movzx  eax,BYTE PTR [ebp-0x52]
   0x56555958 <+600>:   mov    BYTE PTR [ebp-0x87f],al
   0x5655595e <+606>:   movzx  eax,BYTE PTR [ebp-0x4c]
   0x56555962 <+610>:   mov    BYTE PTR [ebp-0x87e],al
   0x56555968 <+616>:   movzx  eax,BYTE PTR [ebp-0x4e]
   0x5655596c <+620>:   mov    BYTE PTR [ebp-0x87d],al
   0x56555972 <+626>:   movzx  eax,BYTE PTR [ebp-0x6a]
   0x56555976 <+630>:   mov    BYTE PTR [ebp-0x87c],al
   0x5655597c <+636>:   movzx  eax,BYTE PTR [ebp-0x4e]
   0x56555980 <+640>:   mov    BYTE PTR [ebp-0x87b],al
   0x56555986 <+646>:   movzx  eax,BYTE PTR [ebp-0x40]
   0x5655598a <+650>:   mov    BYTE PTR [ebp-0x87a],al
   0x56555990 <+656>:   movzx  eax,BYTE PTR [ebp-0x50]
   0x56555994 <+660>:   mov    BYTE PTR [ebp-0x879],al
   0x5655599a <+666>:   movzx  eax,BYTE PTR [ebp-0x41]
   0x5655599e <+670>:   mov    BYTE PTR [ebp-0x878],al
   0x565559a4 <+676>:   movzx  eax,BYTE PTR [ebp-0x4a]
   0x565559a8 <+680>:   mov    BYTE PTR [ebp-0x877],al
   0x565559ae <+686>:   movzx  eax,BYTE PTR [ebp-0x43]
   0x565559b2 <+690>:   mov    BYTE PTR [ebp-0x876],al
   0x565559b8 <+696>:   movzx  eax,BYTE PTR [ebp-0x3f]
   0x565559bc <+700>:   mov    BYTE PTR [ebp-0x875],al
   0x565559c2 <+706>:   movzx  eax,BYTE PTR [ebp-0x4a]
   0x565559c6 <+710>:   mov    BYTE PTR [ebp-0x874],al
   0x565559cc <+716>:   movzx  eax,BYTE PTR [ebp-0x44]
   0x565559d0 <+720>:   mov    BYTE PTR [ebp-0x873],al
   0x565559d6 <+726>:   movzx  eax,BYTE PTR [ebp-0x45]
   0x565559da <+730>:   mov    BYTE PTR [ebp-0x872],al
   0x565559e0 <+736>:   sub    esp,0xc
   0x565559e3 <+739>:   lea    eax,[ebp-0x881]
   0x565559e9 <+745>:   push   eax
   0x565559ea <+746>:   call   0x56555560 <exif_tag_from_name@plt>
   0x565559ef <+751>:   add    esp,0x10
   0x565559f2 <+754>:   mov    DWORD PTR [ebp-0x34],eax
   0x565559f5 <+757>:   mov    eax,DWORD PTR [ebp-0x2c]
   0x565559f8 <+760>:   mov    eax,DWORD PTR [eax]
   0x565559fa <+762>:   sub    esp,0x8
   0x565559fd <+765>:   push   DWORD PTR [ebp-0x34]
   0x56555a00 <+768>:   push   eax
   0x56555a01 <+769>:   call   0x56555550 <exif_content_get_entry@plt>
   0x56555a06 <+774>:   add    esp,0x10
   0x56555a09 <+777>:   mov    DWORD PTR [ebp-0x20],eax
   0x56555a0c <+780>:   jmp    0x56555b00 <main+1024>
   0x56555a11 <+785>:   lea    eax,[ebp-0x881]
   0x56555a17 <+791>:   mov    ecx,0x64
   0x56555a1c <+796>:   mov    esi,0x0
   0x56555a21 <+801>:   mov    DWORD PTR [eax],esi
   0x56555a23 <+803>:   mov    DWORD PTR [eax+ecx*1-0x4],esi
   0x56555a27 <+807>:   lea    edx,[eax+0x4]
   0x56555a2a <+810>:   and    edx,0xfffffffc
   0x56555a2d <+813>:   sub    eax,edx
   0x56555a2f <+815>:   add    ecx,eax
   0x56555a31 <+817>:   and    ecx,0xfffffffc
   0x56555a34 <+820>:   shr    ecx,0x2
   0x56555a37 <+823>:   mov    edi,edx
   0x56555a39 <+825>:   mov    eax,esi
   0x56555a3b <+827>:   rep stos DWORD PTR es:[edi],eax
   0x56555a3d <+829>:   movzx  eax,BYTE PTR [ebp-0x65]
   0x56555a41 <+833>:   mov    BYTE PTR [ebp-0x881],al
   0x56555a47 <+839>:   movzx  eax,BYTE PTR [ebp-0x5b]
   0x56555a4b <+843>:   mov    BYTE PTR [ebp-0x880],al
   0x56555a51 <+849>:   movzx  eax,BYTE PTR [ebp-0x5f]
   0x56555a55 <+853>:   mov    BYTE PTR [ebp-0x87f],al
   0x56555a5b <+859>:   movzx  eax,BYTE PTR [ebp-0x5b]
   0x56555a5f <+863>:   mov    BYTE PTR [ebp-0x87e],al
   0x56555a65 <+869>:   movzx  eax,BYTE PTR [ebp-0x43]
   0x56555a69 <+873>:   mov    BYTE PTR [ebp-0x87d],al
   0x56555a6f <+879>:   movzx  eax,BYTE PTR [ebp-0x4e]
   0x56555a73 <+883>:   mov    BYTE PTR [ebp-0x87c],al
   0x56555a79 <+889>:   movzx  eax,BYTE PTR [ebp-0x4e]
   0x56555a7d <+893>:   mov    BYTE PTR [ebp-0x87b],al
   0x56555a83 <+899>:   movzx  eax,BYTE PTR [ebp-0x4f]
   0x56555a87 <+903>:   mov    BYTE PTR [ebp-0x87a],al
   0x56555a8d <+909>:   movzx  eax,BYTE PTR [ebp-0x5c]
   0x56555a91 <+913>:   mov    BYTE PTR [ebp-0x879],al
   0x56555a97 <+919>:   movzx  eax,BYTE PTR [ebp-0x52]
   0x56555a9b <+923>:   mov    BYTE PTR [ebp-0x878],al
   0x56555aa1 <+929>:   movzx  eax,BYTE PTR [ebp-0x3f]
   0x56555aa5 <+933>:   mov    BYTE PTR [ebp-0x877],al
   0x56555aab <+939>:   movzx  eax,BYTE PTR [ebp-0x4a]
   0x56555aaf <+943>:   mov    BYTE PTR [ebp-0x876],al
   0x56555ab5 <+949>:   movzx  eax,BYTE PTR [ebp-0x45]
   0x56555ab9 <+953>:   mov    BYTE PTR [ebp-0x875],al
   0x56555abf <+959>:   movzx  eax,BYTE PTR [ebp-0x4c]
   0x56555ac3 <+963>:   mov    BYTE PTR [ebp-0x874],al
   0x56555ac9 <+969>:   movzx  eax,BYTE PTR [ebp-0x40]
   0x56555acd <+973>:   mov    BYTE PTR [ebp-0x873],al
   0x56555ad3 <+979>:   sub    esp,0xc
   0x56555ad6 <+982>:   lea    eax,[ebp-0x881]
   0x56555adc <+988>:   push   eax
   0x56555add <+989>:   call   0x56555560 <exif_tag_from_name@plt>
   0x56555ae2 <+994>:   add    esp,0x10
   0x56555ae5 <+997>:   mov    DWORD PTR [ebp-0x38],eax
   0x56555ae8 <+1000>:  mov    eax,DWORD PTR [ebp-0x2c]
   0x56555aeb <+1003>:  mov    eax,DWORD PTR [eax+0x8]
   0x56555aee <+1006>:  sub    esp,0x8
   0x56555af1 <+1009>:  push   DWORD PTR [ebp-0x38]
   0x56555af4 <+1012>:  push   eax
   0x56555af5 <+1013>:  call   0x56555550 <exif_content_get_entry@plt>
   0x56555afa <+1018>:  add    esp,0x10
   0x56555afd <+1021>:  mov    DWORD PTR [ebp-0x1c],eax
   0x56555b00 <+1024>:  add    DWORD PTR [ebp-0x28],0x1
   0x56555b04 <+1028>:  cmp    DWORD PTR [ebp-0x28],0x2
   0x56555b08 <+1032>:  jle    0x56555853 <main+339>
   0x56555b0e <+1038>:  cmp    DWORD PTR [ebp-0x1c],0x0
   0x56555b12 <+1042>:  je     0x56555bd0 <main+1232>
   0x56555b18 <+1048>:  cmp    DWORD PTR [ebp-0x20],0x0
   0x56555b1c <+1052>:  je     0x56555bd0 <main+1232>
   0x56555b22 <+1058>:  cmp    DWORD PTR [ebp-0x24],0x0
   0x56555b26 <+1062>:  je     0x56555bd0 <main+1232>
   0x56555b2c <+1068>:  sub    esp,0x4
   0x56555b2f <+1071>:  push   0x400
   0x56555b34 <+1076>:  lea    eax,[ebp-0x881]
   0x56555b3a <+1082>:  push   eax
   0x56555b3b <+1083>:  push   DWORD PTR [ebp-0x20]
   0x56555b3e <+1086>:  call   0x56555510 <exif_entry_get_value@plt>
   0x56555b43 <+1091>:  add    esp,0x10
   0x56555b46 <+1094>:  movzx  eax,BYTE PTR [ebp-0x881]
   0x56555b4d <+1101>:  test   al,al
   0x56555b4f <+1103>:  je     0x56555bd0 <main+1232>
   0x56555b51 <+1105>:  sub    esp,0x8
   0x56555b54 <+1108>:  lea    eax,[ebp-0x881]
   0x56555b5a <+1114>:  push   eax
   0x56555b5b <+1115>:  lea    eax,[ebp-0x46d]
   0x56555b61 <+1121>:  push   eax
   0x56555b62 <+1122>:  call   0x56555530 <strcpy@plt>
   0x56555b67 <+1127>:  add    esp,0x10
   0x56555b6a <+1130>:  sub    esp,0x4
   0x56555b6d <+1133>:  push   0x400
   0x56555b72 <+1138>:  lea    eax,[ebp-0x881]
   0x56555b78 <+1144>:  push   eax
   0x56555b79 <+1145>:  push   DWORD PTR [ebp-0x24]
   0x56555b7c <+1148>:  call   0x56555510 <exif_entry_get_value@plt>
   0x56555b81 <+1153>:  add    esp,0x10
   0x56555b84 <+1156>:  sub    esp,0x8
   0x56555b87 <+1159>:  lea    eax,[ebp-0x881]
   0x56555b8d <+1165>:  push   eax
   0x56555b8e <+1166>:  lea    eax,[ebp-0x46d]
   0x56555b94 <+1172>:  push   eax
   0x56555b95 <+1173>:  call   0x56555520 <strcat@plt>
   0x56555b9a <+1178>:  add    esp,0x10
   0x56555b9d <+1181>:  sub    esp,0x4
   0x56555ba0 <+1184>:  push   0x400
   0x56555ba5 <+1189>:  lea    eax,[ebp-0x881]
   0x56555bab <+1195>:  push   eax
   0x56555bac <+1196>:  push   DWORD PTR [ebp-0x1c]
   0x56555baf <+1199>:  call   0x56555510 <exif_entry_get_value@plt>
   0x56555bb4 <+1204>:  add    esp,0x10
   0x56555bb7 <+1207>:  sub    esp,0x8
   0x56555bba <+1210>:  lea    eax,[ebp-0x881]
   0x56555bc0 <+1216>:  push   eax
   0x56555bc1 <+1217>:  lea    eax,[ebp-0x46d]
   0x56555bc7 <+1223>:  push   eax
   0x56555bc8 <+1224>:  call   0x56555520 <strcat@plt>
   0x56555bcd <+1229>:  add    esp,0x10
   0x56555bd0 <+1232>:  mov    DWORD PTR [ebp-0x481],0x0
   0x56555bda <+1242>:  mov    DWORD PTR [ebp-0x47d],0x0
   0x56555be4 <+1252>:  mov    DWORD PTR [ebp-0x479],0x0
   0x56555bee <+1262>:  mov    DWORD PTR [ebp-0x475],0x0
   0x56555bf8 <+1272>:  mov    DWORD PTR [ebp-0x471],0x0
   0x56555c02 <+1282>:  movzx  eax,BYTE PTR [ebp-0x468]
   0x56555c09 <+1289>:  mov    BYTE PTR [ebp-0x481],al
   0x56555c0f <+1295>:  movzx  eax,BYTE PTR [ebp-0x465]
   0x56555c16 <+1302>:  mov    BYTE PTR [ebp-0x480],al
   0x56555c1c <+1308>:  movzx  eax,BYTE PTR [ebp-0x467]
   0x56555c23 <+1315>:  mov    BYTE PTR [ebp-0x47f],al
   0x56555c29 <+1321>:  movzx  eax,BYTE PTR [ebp-0x46d]
   0x56555c30 <+1328>:  mov    BYTE PTR [ebp-0x47e],al
   0x56555c36 <+1334>:  movzx  eax,BYTE PTR [ebp-0x462]
   0x56555c3d <+1341>:  mov    BYTE PTR [ebp-0x47d],al
   0x56555c43 <+1347>:  movzx  eax,BYTE PTR [ebp-0x46c]
   0x56555c4a <+1354>:  mov    BYTE PTR [ebp-0x47c],al
   0x56555c50 <+1360>:  mov    eax,0x0
   0x56555c55 <+1365>:  lea    esp,[ebp-0x10]
   0x56555c58 <+1368>:  pop    ecx
   0x56555c59 <+1369>:  pop    ebx
   0x56555c5a <+1370>:  pop    esi
   0x56555c5b <+1371>:  pop    edi
   0x56555c5c <+1372>:  pop    ebp
   0x56555c5d <+1373>:  lea    esp,[ecx-0x4]
   0x56555c60 <+1376>:  ret

WOW! Como sabéis lo mio no es reversing precisamente así que me impresiono bastante ver todas estas lineas, de buenas a primeras lo que más me llamo la atención fue la llamada a strcat en la dirección 0x56555bc8 así que puse un breakpoint ahí:

¡Bien he encontrado algo, seguro que es la contraseña del 7z!… Ah pues no… jo

Y es que en mis ansías no me fijé en que a continuación se seguían realizando operaciones, así que una docena de breakpoints después (insisto, reversing no es lo mio probablemente haya mil maneras más faciles de sacarlo jeje) para ir viendo la última parte de la ejecución fui viendo que iba pasando en cada paso. Luego de un par de ejecuciones me fije en que en el registro EAX iban apareciendo una serie de caracteres antes de finalizar la ejecución:

Después de anotarlos me quede con el string w2aC7y, esta vez si que hubo suerte y esta era la contraseña que buscabamos para el 7z, descomprimimos y obtenemos un txt con la flag:

FLAG: ReversingIsCool

Seguramente alguien más ducho en reversing os podría explicar con más detalle que se va haciendo en cada paso y probablemente lo hubiese visto en el primer vistazo, por desgracia reversing es un tema que tengo muy verde y contento me quedo con haberlo conseguido sacar jeje

Un saludo y gracias por vuestra visita!

Esta entrada fue publicada en ctf, cybercamp, reversing, writeups. Guarda el enlace permanente.

Deja un comentario