Megabeets

LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices

Fri, 07 Nov 2025 00:00:00 +0000

When Avatars Come Alive: Understanding Hybrid Threat Actors

Wed, 01 Oct 2025 00:00:00 +0000

AdaptixC2: A New Open-Source Framework Leveraged in Real-World Attacks

Wed, 10 Sep 2025 00:00:00 +0000

Modern Approach to Attributing Hacktivist Groups

Tue, 01 Oct 2024 00:00:00 +0000

Virus Bulletin 2024 Conference Paper

About

Mon, 01 Jan 2024 00:00:00 +0000

‹

›

$ WHOAMI

Hey there!👋 I’m Itay Cohen. I’ve been fascinated by computers for as long as I can remember. Over time, I developed a fascination with cybersecurity and started teaching myself about hacking, reverse engineering and malware analysis. Most of my free time is dedicated for political and social activism and in general pursuing of what I see as just. I am an animal liberation activist and vegan. I read a lot, I’m a non-stop learner and I’ll always jump on an opportunity to solve a good challenge.

Darkbit Decoded: Analysis of an Iranian-Sponsored Attack

Wed, 04 Oct 2023 00:00:00 +0000

Virus Bulletin 2023 Conference Paper

The Dragon Who Sold His Camaro: Analyzing Custom Router Implant

Tue, 16 May 2023 00:00:00 +0000

Twisted Panda: Chinese APT espionage operation against Russian state-owned defense institutes

Thu, 19 May 2022 00:00:00 +0000

EvilPlayout: Attack Against Iran’s State Broadcaster

Fri, 18 Feb 2022 00:00:00 +0000

Indra — Hackers Behind Recent Attacks on Iran

Sat, 14 Aug 2021 00:00:00 +0000

IndigoZebra APT continues to attack Central Asia with evolving tools

Thu, 01 Jul 2021 00:00:00 +0000

The Story of Jian - How APT31 Stole and Used an Unknown Equation Group 0-Day

Mon, 22 Feb 2021 00:00:00 +0000

SUNBURST, TEARDROP and the NetSec New Normal

Tue, 22 Dec 2020 00:00:00 +0000

Bandook: Signed & Delivered

Thu, 26 Nov 2020 00:00:00 +0000

Pay2Key Ransomware Alert

Fri, 06 Nov 2020 00:00:00 +0000

Exploit Developer Spotlight: The Story of PlayBit

Fri, 02 Oct 2020 00:00:00 +0000

Part of multi-publication entry

Graphology of an Exploit - Hunting for exploits by looking for the author's fingerprints

Thu, 01 Oct 2020 00:00:00 +0000

Virus Bulletin 2020 Conference Paper

Mapping the connections inside Russia’s APT Ecosystem

Sat, 04 Jul 2020 15:27:48 +0000

If the names Turla, Sofacy, and APT29 strike fear into your heart, you are not alone. These are known to be some of the most advanced, sophisticated and notorious APT groups out there – and not in vain. These Russian-attributed actors are part of a bigger picture in which Russia is one of the strongest powers in the cyber warfare today. Their advanced tools, unique approaches, and solid infrastructures suggest enormous and complicated operations that involve different military and government entities inside Russia.

Deobfuscating APT32 Flow Graphs with Cutter and Radare2

Sat, 04 Jul 2020 14:25:38 +0000

The Ocean Lotus group, also known as APT32, is a threat actor which has been known to target East Asian countries such as Vietnam, Laos and the Philippines. The group strongly focuses on Vietnam, especially private sector companies that are investing in a wide variety of industrial sectors in the country. While private sector companies are the group’s main targets, APT32 has also been known to target foreign governments, dissidents, activists, and journalists.

The Evolution of BackSwap

Sat, 04 Jul 2020 14:14:33 +0000

The BackSwap banker has been in the spotlight recently due to its unique and innovative techniques to steal money from victims while staying under the radar and remaining undetected. This malware was previously spotted targeting banks in Poland but has since moved entirely to focus on banks in Spain. The techniques used by it were thoroughly described by our fellow researchers at the Polish CERT and Michal Poslusny from ESET, who revealed and coined the malware’s name earlier this year. However after witnessing ongoing improvements to its malicious techniques we decided to share this information to the wider research community.

Nazar: Spirits of the Past

Tue, 05 May 2020 00:00:00 +0000

CONFidence Teaser CTF – Hidden Flag

Sun, 15 Mar 2020 10:57:56 +0000

During CONFidence Teaser CTF, one specific task caught my interest. Not because it was hard or complicated – it wasn’t, but because the concept behind it was interesting and relevant to my day-to-day work as a malware researcher.

In this short article, I will show a highly esoteric, not to say trivial, concept in which you can leak the content of “sensitive” files on systems where scanning the files with Yara is allowed, but downloading the files is not possible. Not only that I’ll show how it was used, as an intended solution, to solve the “Hidden Flag” challenge on the CTF, but will also demonstrate how it can be used to retrieve the data of TLP;RED, or un-downloadable files on premium services such as Hybrid-Analysis, where the major limitation is the bandwidth.

Vicious Panda: The COVID Campaign

Wed, 01 Jan 2020 00:00:00 +0000

5 Ways to patch binaries with Cutter

Mon, 23 Dec 2019 16:34:36 +0000

I recently watched a video by LiveOverflow in which he showed how different tools are used to patch binaries. By demonstrating some of the features that Radare2, Ghidra, and Binary Ninja offer for the task, the viewer can get some sense of the things they can get from using these tools.

While all these tools are great, and although Radare2 was showed there (and oh boy, things went wrong), there was one tool, which is dear to my heart, that wasn’t there – Cutter. Notwithstanding that it is the youngest member of the pack, Cutter is growing up very fast and when it has to do with binary patching – it does not stay behind.

Mapping the connections inside Russia's APT Ecosystem

Tue, 24 Sep 2019 00:00:00 +0000

Cutter: The radare2 GUI

Sun, 01 Sep 2019 00:00:00 +0000

Deobfuscating APT32 Flow Graphs with Cutter and Radare2

Wed, 24 Apr 2019 00:00:00 +0000

The Evolution of BackSwap

Fri, 30 Nov 2018 00:00:00 +0000

A Targeted Campaign Break-Down - Ryuk Ransomware

Mon, 20 Aug 2018 00:00:00 +0000

Decrypting APT33’s Dropshot Malware with Radare2 and Cutter – Part 2

Mon, 18 Jun 2018 15:37:22 +0000

Prologue

Previously, in the first part of this article, we used Cutter, a GUI for radare2, to statically analyze APT33’s Dropshot malware. We also used radare2’s Python scripting capabilities in order to decrypt encrypted strings in Dropshot. If you didn’t read the first part yet, I suggest you do it now.

Today’s article will be shorter, now that we are familiar with cutter and r2pipe, we can quickly analyze another interesting component of Dropshot — an encrypted resource that includes Dropshot’s actual payload. So without further ado, let’s start.

Downloading and installing Cutter

Cutter is available for all platforms (Linux, OS X, Windows). You can download the latest release here. If you are using Linux, the fastest way to use Cutter is to use the AppImage file.

If you want to use the newest version available, with new features and bug fixes, you should build Cutter from source by yourself. It isn’t a complicated task and it is the version I use.

First, you must clone the repository:

git clone --recurse-submodules https://github.com/radareorg/cutter
cd cutter

Building on Linux:

./build.sh

Building on Windows:

prepare_r2.bat
build.bat

If any of those do not work, check the more detailed instruction page here

Dropshot \ StoneDrill

As in the last part, we’ll analyze Dropshot, which is also known by the name StoneDrill. It is a wiper malware associated with the APT33 group which targeted mostly organizations in Saudi Arabia. Dropshot is a sophisticated malware sample, that employed advanced anti-emulation techniques and has a lot of interesting functionalities. The malware is most likely related to the infamous Shamoon malware. Dropshot was analyzed thoroughly by Kaspersky and later on by FireEye. In this article, we’ll focus on decrypting the encrypted resource of Dropshot which contains the actual payload of the malware.

The Dropshot sample can be downloaded from here (password: infected). I suggest you star (★) the repository to get updates on more radare2 tutorials 🙂

Please, be careful when using this sample. It is a real malware, and more than that, a wiper! Use with caution!

Since we’ll analyze Dropshot statically, you can use a Linux machine, as I did.

‘Decrypting APT33’s Dropshot Malware with Radare2 and Cutter – Part 1’

Mon, 21 May 2018 14:12:27 +0000

Prologue

As a reverse engineer and malware researcher, the tools I use are super important for me. I have invested hours and hours in creating the best malware analysis environment for myself and chose the best tools for me and my needs. For the last two years, radare2 is my go-to tool for a lot of reverse-engineering tasks such as automating RE related work, scripting, CTFing, exploitation and more. That said, I almost never used radare2 for malware analysis, or more accurately, for analysis of malware for Windows. The main reason was that radare2 command-line interface felt too clumsy, complicated and an over-kill. IDA Pro was simply better for these tasks, a quick inspection of functions, data structures, renaming, commenting, et cetera. It felt more intuitive for me and that what I was searching for while doing malware analysis. And then came Cutter.

Cutter

Along the years, the radare2 community had tried to develop many different graphic-interfaces for radare2. None of them came even close to Cutter. Cutter is a QT C++ based GUI for radare2. In my opinion, it is the GUI that radare2 deserves. To quote from Cutter’s Github page:

Cutter is not aimed at existing radare2 users. It instead focuses on those whose are not yet radare2 users because of the learning curve, because they don’t like CLI applications or because of the difficulty…

Cutter is a young project, only one-year-old, and it is the official GUI of radare2 (the first and only GUI to be announced “official”). Cutter is a cross-platform GUI that aims to export radare2’s plenty of functionality into a user-friendly and modern GUI. In this post, I’ll show you some of Cutter’s features and how I work with it. To be honest, Cutter is intuitive so you probably won’t need me to show you around, but just in case.

Downloading and installing Cutter

Cutter is available for all platforms (Linux, OS X, Windows). You can download the latest release here. If you are using Linux, the fastest way to use Cutter is to use the AppImage file.

If you want to use the newest version available, with new features and bug fixes, you should build Cutter from source by yourself. It isn’t a complicated task and it is the version I use.

First, you must clone the repository:

git clone --recurse-submodules https://github.com/radareorg/cutter
cd cutter

Building on Linux:

```default ./build.sh ```

Building on Windows:

prepare_r2.bat
build.bat

If any of those do not work, check the more detailed instruction page here.

Dropshot \ StoneDrill

Dropshot, also known as StoneDrill, is a wiper malware associated with the APT33 group which targeted mostly organizations in Saudi Arabia. Dropshot is a sophisticated malware sample, that employed advanced anti-emulation techniques and has a lot of interesting functionalities. The malware is most likely related to the infamous Shamoon malware. Dropshot was analyzed thoroughly by Kaspersky and later on by FireEye. In this article, we’ll focus on analyzing how Dropshot decrypted the strings inside it in order to evade analysis. In part 2 of this article, which will be published soon, we’ll focus on decrypting the encrypted resource of Dropshot which contains the actual payload of the malware.

The Dropshot sample can be downloaded from here (password: infected). I suggest you star (★) the repository to get updates on more radare2 tutorials 🙂

Please, be careful when using this sample. It is a real malware, and more than that, a wiper! Use with caution!

Since we’ll analyze Dropshot statically, you can use a Linux machine, as I did.

Solving PwCTF Prequel

Sat, 27 Jan 2018 18:08:32 +0000

Epilogue

PwCTF is an on-site CTF event in Israel. It will take part on January 29-31 in Cybertech Tel-Aviv 2018. Honestly I’ve never heard of it before but I thought I’ll give it a try and ended up to be the first to finish the prequels. In the following writeup I’ll go step by step on how I solved each challenge. Here we go.

The first challenge

It was a morning time, I was eating my breakfast while reading messages on my security groups. One of the messages, by my friend Netanel Fisher, announced of the opening of CTF Prequalification Challenge. They said “challenge” and immediately caught my attention. I cannot say “no” to a challenge. So, I thought to myself that I’ll sign up and see what challenges are there. I clicked on the link to the CTF’s website and got into this lovely landing page:

Reversing a Self-Modifying Binary with radare2

Sun, 14 Jan 2018 08:50:31 +0000

Prologue

It took me three months to finish writing this article. I had so many tasks on my to-do list that sadly this one was pushed down to the bottom of the list. Last weekend I made a promise to myself that until Sunday I’m going to finish writing it, I successfully kept my word and here it is, another radare2 tutorial.

Today we’ll solve a very nice challenge, “packedup”, written by ad3l for r2con 2017 competition. It is not the first writeup that I publish from r2con competition, you can check out “Reverse engineering a Gameboy ROM with radare2” as well, make sure not to miss the cool swags I got from winning the competition.

This article is aimed to those of you who are familiar with radare2. If you are not, I suggest you to start from part 1 of my series “A Journey Into Radare2”.

So, without further ado, let’s dig into the binary.

Getting radare2

Installation

Radare2’s development is pretty quick – the project evolves every day, therefore it’s recommended to use the current git version over the stable one. Sometimes the stable version is less stable than the current git version!

$ git clone https://github.com/radare/radare2.git
$ cd radare2
$ ./sys/install.sh

If you don’t want to install the git version or you want the binaries for another machine (Windows, OS X, iOS, etc.) check out the download page at the radare2 website.

Updating

As I said before, it is highly recommended to always use the newest version of r2 from the git repository. All you need to do to update your r2 version from the git is to execute:

$ ./sys/install.sh

And you’ll have the latest version from git. I usually update my version of radare2 in the morning with a scheduled task, so I can wake up to the latest version available. If you’re using radare2 often, I recommend you do the same.

packedup

You can download packedup from here. I suggest you to star (★) the repository to get updates about more radare2 tutorials 🙂

First thing to do, obviously, is to execute the binary and get a basic feeling of what we are going to face.

$ ./packedup 
Welcome to packedup for r2crackmes :)
Flag << MEGABEETS 
Try again!

packedup is executed, it requests us to give it a flag. It then probably does some calculations at the backend to see if the inputted flag is the right one. I entered “MEGABEETS” which is likely not the correct flag and finished with the fail message — “Try again!”.

Reversing time!

Now for our favorite part, let’s open the binary with radare2 and try to figure out how packedup is checking the submitted flag:

$ r2 ./packedup
— Here be dragons.
[0x004004d0]> aaa
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze len bytes of instructions for references (aar)
[x] Analyze function calls (aac)
[*] Use -AA or aaaa to perform additional experimental analysis.
[x] Constructing a function name for fcn.* and sym.func.* functions (aan)

Analysis

I usually begin with executing aa (analyze all) or with aas (to analyze functions, symbols and more). The name is misleading because there is a lot more to analyze (check aa?) but it’s enough to start with for most of the binaries I examined. This time we’ll start straight with aaa to make things simpler and due to the binary’s small size. You can also run radare2 with the -A flag to analyze the binary straight at startup using aaa (e.g r2 -A ./packedup).

Note: as I mentioned in the previous posts, starting with aaa is not always the recommended approach since analysis is very complicated process. I wrote more about it in this answer — read it to better understand why.

Getting Information

So now that we opened our binary with radare2, we have been located automatically at the program’s entrypoint. But before we start working on the code itself It’s a good approach to get to know our binary characteristics. radare2 can show us the information we need using the i command (I removed some information for the sake of readability):

[0x004004d0]> i
...
file ./packedup
format elf64
iorw false
mode -r-x
size 0x1878
humansz 6.1K
type EXEC (Executable file)
arch x86
...
bintype elf
bits 64
...
endian little
...
intrp /lib64/ld-linux-x86-64.so.2
lang c
...
machine AMD x86-64 architecture
stripped true
...

The i command used for getting info about the opened file. It’s a wrapper around rabin2 which is an information extractor tool in the radare2 framework. radare2 offers us tons amount of information about the binary. Check out i? to list the information’s subcommands.

packedup is a 64-bit stripped ELF binary. Cool. Let’s move on.

Reverse engineering a Gameboy ROM with radare2

Mon, 09 Oct 2017 18:32:50 +0000

Prologue

A month ago in Barcelona I was attending to r2con for the first time. This is the official congress of the radare2 community where everyone can learn more about radare2 framework and dive deep into different aspects of reverse engineering, malware analysis, fuzzing, exploiting and more. It also the place where all of us, the contributors and developers of radare2, can meet, discuss and argue about every other line of code in the framework.

This was the second congress of radare2, after the success of the first congress in last year which was also a celebration for radare’s 10 years old birthday. This year the conference was bigger, fancier and probably organized much better. r2con was four days long, starting at September 6 and lasted until September 9. The first two days were dedicated to training and took place at Universitat de Barcelona. The other two days were talks days and took place at the MediaPro.

Crackmes Competition

During r2con this year there was a Crackmes competition where all the attendees were given with the same 5 challenges and had to publish a writeups to all the challenges they had solved. The scoring was based on the quality of the writeups along with the quantity of solved challenges.

I won the competition and got myself some cool swag!

Flag of radare2
POC | GTFO book
Orange PI with 3D printed case of r2con logo
Radare2 stickers
A beer 🍺

I thought of sharing some of my writeups with you, so you can taste a bit from what we had in the competition and so that others, coming from google, twitter and such, could learn how to use radare2 for solving different challenges. This article is aimed to those of you who are familiar with radare2. If you are not, I suggest you to start from part 1 of my series “A Journy Into Radare2”.

Getting radare2

Installation

$ git clone https://github.com/radare/radare2.git
$ cd radare2
$ ./sys/install.sh

If you don’t want to install the git version or you want the binaries for another machine (Windows, OS X, iOS, etc) check out the download page at the radare2 website.

Updating

As I said before, it is highly recommended to always use the newest version of r2 from the git repository. All you need to do to update your r2 version from the git is to execute:

$ ./sys/install.sh

And you’ll have the latest version from git. I usually update my version of radare2 in the morning, while watching cat videos.

Let’s use radare2 to reverse engineer a Gameboy ROM!
Check it out @ https://t.co/g1kYJuShzE @radareorg #radare2 pic.twitter.com/7FJOB3SdKS
— Itay Cohen (@megabeets_) <a href="https://twitter.com/megabeets_/status/917464989027454976?ref_src=twsrc%5Etfw">October 9, 2017</a>

Playing with Gameboy ROM

This post will describe how I solved simple.gb, a Gameboy ROM challenge written by @condret. It was actually my first time reversing a Gameboy ROM — and it was awesome!

First thing I did was to open the binary in radare2 and check for its architecture and format:

$ r2 simple.gb
— For a full list of commands see `strings /dev/urandom`
[0x00000100]> i~format
format ningb
[0x00000100]> i~machine
machine Gameboy

The i command gives us information about the binary. Check i? for more commands.

Tilde (~) is r2’s internal grep.

Surprise, surprise, it is a Gameboy ROM — dah. After reading a bit about its instruction set we should go to the mission.

The obvious thing to do is open the ROM in an Gameboy emulator. I downloaded the good old emulator I used back in the days when I played Pokemon: VisualBoy Advance.

Let’s open the ROM in our emulator and see what we have:

Woops, wrong file. Bad habits… Let’s try again:

Cool! It’s a simple game where, by using the arrow keys, you increase/decrease 5 digits. We ‘simply’ need to find the correct password.

A journey into Radare 2 – Part 2: Exploitation

Sat, 02 Sep 2017 16:37:46 +0000

Prologue

helllo

asf

world

fas

Welcome back to the second part of our journey into the guts of radare2! In this part we’ll cover more of the features of radare2, this time with the focus on binary exploitation.

A lot of you waited for the second part, so here it is! Hope to publish the next part faster, much faster. If you didn’t read the first part of the series I highly recommend you to do so. It describes the basics of radare2 and explains many of the commands that I’ll use here.

In this part of the series we’ll focus on exploiting a simple binary. radare2 has many features which will help us in exploitation, such as mitigation detection, ROP gadget searching, random patterns generation, register telescoping and more. You can find a Reference Sheet at the end of this post. Today I’ll show you some of these great features and together we’ll use radare2 to bypass nx protected binary on an <code>ASLR enabled system. I assume that you are already familiar with the following prerequisites:

It’s really important to be familiar with these topics because I won’t get deep into them, or even won’t briefly explain some of them.

Updating radare2

First of all, let’s update radare2 to its newest git version:

$ git clone https://github.com/radare/radare2.git # clone radare2 if you didn't do it yet for some reason.
$ cd radare2
$ ./sys/install.sh

We have a long journey ahead so while we’re waiting for the update to finish, let’s get some motivation boost — cute cats video!

Getting familiar with our binary

You can download the binary from here, and the source from here.
If you want to compile the source by yourself, use the following command:

$ gcc -m32 -fno-stack-protector -no-pie megabeets_0x2.c -o megabeets_0x2

Our binary this time is quite similar to the one from the previous post with a few slight changes to the main() function:

Compiled without -z execstac to enable NX bit
Receives user input with scanf and not from program’s arguments
Uses mostly puts to print to screen
Little changes to the program’s output

This was the previous main():

int main(int argc, char *argv[])
{
 printf("\n .:: Megabeets ::.\n");
 printf("Think you can make it?\n");
 if (argc >= 2 && beet(argv[1]))
 {
 printf("Success!\n\n");
 }
 else
 printf("Nop, Wrong argument.\n\n");

 return 0;
}

And now main looks like this:

int main(int argc, char *argv[])
{
 char *input; 
 puts("\n .:: Megabeets ::.\n");
 puts("Show me what you got:");
 
 scanf("%ms", &input);
 if (beet(input))
 {
 printf("Success!\n\n");
 }
 else
 puts("Nop, Wrong argument.\n\n");

 return 0;
}

The functionality of the binary is pretty simple and we went through it in the previous post — It asks for user input, performs rot13 on the input and compares it with the result of rot13 on the string “Megabeets”. Id est, the input should be ‘Zrtnorrgf’.

$ ./megabeets_0x2 

 .:: Megabeets ::.

Show me what you got:
blablablabla
Nop, Wrong argument.

$ ./megabeets_0x2 

 .:: Megabeets ::.

Show me what you got:
Zrtnorrgf
Success!

It’s all well and good but today our post is not about cracking a simple Crackme but about exploiting it. Wooho! Let’s get to the work.

The second part of “A journey into #radare2” is finally out – and this time: Exploitation! Check it out @ https://t.co/sKH1YhxJwK @radareorg
— Itay Cohen (@megabeets_) <a href="https://twitter.com/megabeets_/status/904381915964346372">September 3, 2017</a>

Understanding the vulnerability

As with every exploitation challenge, it is always a good habit to check the binary for implemented security protections. We can do it with rabin2 which I demonstrated in the last post or simply by executing i from inside radare’s shell. Because we haven’t opened the binary with radare yet, we’ll go for the rabin2 method:

$ rabin2 -I megabeets_0x2

arch x86
binsz 6072
bintype elf
bits 32
canary false
class ELF32
crypto false
endian little
havecode true
intrp /lib/ld-linux.so.2
lang c
linenum true
lsyms true
machine Intel 80386
maxopsz 16
minopsz 1
nx true
os linux
pcalign 0
pic false
relocs true
relro partial
rpath NONE
static false
stripped false
subsys linux
va true

As you can see in the marked lines, the binary is NX protected which means that we won’t have an executable stack to rely on. Moreover, the file isn’t protected with canaries , pic or relro.

A journey into Radare 2 – Part 1: Simple crackme

Mon, 27 Mar 2017 09:30:58 +0000

Update (2020): Since writing this article, it has become, in a way, the go-to tutorial for learning radare2. Your feedback was amazing and I am very happy for the opportunity to teach new people about radare2.
A lot has changed since I wrote this tutorial, both with radare2 and with me. I am now, for several years, a core member in the radare2 team and a maintainer of <a href="https://cutter.re/">Cutter</a>, a modern, GUI-based, reverse engineering framework that is powered by radare2.

This is an updated version of the original tutorial. I will keep it updated every now and then to make sure it is up-to-date with the changes in radare2.

Enjoy!

Prologue

I was playing a lot with radare2 in the past years, ever since I began participating in CTFs and got deeper into RE and exploitation challenges. I found radare2 very helpful with many CTFs tasks and my solutions had shortened significantly. It’s also my go-to tool for malware analysis tasks such as configuration retrievals. Sadly, I believe that only few people are familiar with radare2. It might be because they’re afraid to break out of their comfort zone (IDA Pro, x64dbg, Ghidra, OllyDBG, gdb) or they have simply not heard of it. Either way, I honestly believe that you must include radare2 in your toolbox.

Because I got really enthusiastic about the project and I want more and more researchers to be familiar with it, use it and hopefully contribute to the project, I decided to create a series of articles and use-cases of r2. Since these articles aim to teach you the basics of radare2, its features, and capabilities, I’ll explain much more than you actually need to know in order to solve each task.

Welcome to IDA 10.0. (see radare2/doc/fortunes.fun for more fortunes)

radare2

radare2 is an open-source framework for reverse engineering and binary analysis which implements a rich command-line interface for disassembling, analyzing data, patching binaries, comparing data, searching, replacing, visualizing and more. It has great scripting capabilities, it runs on all major platforms (GNU/Linux, Windows, *BSD, iOS, OSX, Solaris…) and it supports tons of architectures and file formats. But maybe above all of its features stands the ideology – radare2 is absolutely free.

This framework is composed of a set of utilities that can be used either together from r2 shell or independently – We’ll get familiar with tools such as rahash2, rabin2 and ragg2. Together they create one of the most powerful toolsets in the field of static and dynamic analysis, hex editing and exploitation (in the following articles I’ll dive deeper into developing exploits using radare2).

It is important to note that r2’s learning curve is pretty steep – although it has an amazing GUI called Cutter, which I co-maintain, it is still young to compete with more mature RE applications such as IDA or Ghidra. The CLI, however, including its Visual Mode, is still the core of radare2 and where its power lays. Because of its complexity, I’ll try to make things as clear and simple as I can.

This is more or less how r2 learning curve works.

Finally published the first part in a series of articles: A journey into radare2.
Check it out @ https://t.co/MybNPqq2CH @radareorg #radare2
— Itay Cohen🌱 (@megabeets_)
<a href="https://twitter.com/megabeets_/status/846314627059400704?ref_src=twsrc%5Etfw">March 27, 2017</a>

Getting radare2

Installation

Radare2’s development is pretty quick – the project evolves every day. Therefore it’s recommended to use the current git version over the release one. Sometimes the release version is less stable than the current git version because of bug fixes!

git clone https://github.com/radare/radare2.git
cd radare2
./sys/install.sh

If you don’t want to install the git version or you want the binaries for another machine (Windows, OS X, iOS, etc) download the release from github.

Updating

As I said before, it is highly recommended to always use the newest version of r2 from the git repository. All you need to do to update your r2 version from the git is to execute:

./sys/install.sh

And you’ll have the latest version from git. I usually update my version of radare2 in the morning, while watching cat videos.

Uninstalling

I Can’t think of a reason for you to uninstall radare2 so early in the article but if you do want to, you can simply execute:

make uninstall
make purge

Getting Started

[!] Download the first challenge from here.

Now that radare2 is installed on your system and you have downloaded the binary, we are ready to start exploring the basic usage of radare2. I’ll work on a Linux machine but most of the commands and explanations (if not all of them) would be the same for Windows machines and others.

Command Line Arguments

As most command-line utilities, the best approach to reveal the list of the possible arguments is to execute the program with the -h flag.

r2 -h

I won’t paste here the full output. Instead, I’ll point out those which I usually use in my daily work:

Usage: r2 [-ACdfLMnNqStuvwzX] [-P patch] [-p prj] [-a arch] [-b bits] [-i file]
 [-s addr] [-B baddr] [-m maddr] [-c cmd] [-e k=v] file|pid|-|--|=
 - same as 'r2 malloc://512'
 -a [arch] set asm.arch
 -A run 'aaa' command to analyze all referenced code
 -b [bits] set asm.bits
 -B [baddr] set base address for PIE binaries
 -c 'cmd..' execute radare command
 -d debug the executable 'file' or running process 'pid'
 -i [file] run script file
 -k [OS/kern] set asm.os (linux, macos, w32, netbsd, ...)
 -l [lib] load plugin file
 -p [prj] use project, list if no arg, load if no file
 -w open file in write mode

[Pragyan CTF] New Avenger

Sun, 05 Mar 2017 07:32:29 +0000

Description:

New Avenger | Stego 300 pts

The Avengers are scouting for a new member. They have travelled all around the world, looking for suitable candidates for the new position.
Finally, they have found the perfect candidate. But, they are in a bad situation. They do not know who the guy is behind the mask.
Can you help the Avengers to uncover the identity of the person behind the mask ?

avengers.gif

Those of you who read my blog frequently are already know how much I’m into superheroes. Give me a challenge with superheroes and you bought me. Although I’m more DC guy, this challenge was with the Marvels and still it was awesome! We’re given with a gif file. I ran `binwalk` on it to find whether it contains another files within.

```diff Megabeets$ binwalk avengers.gif

DECIMAL HEX DESCRIPTION

0 0x0 GIF image data, version 8"9a", 500 x 272 885278 0xD821E Zip archive data, at least v2.0 to extract, compressed size: 13422, uncompressed size: 13780, name: “1_image.jpg” 898769 0xDB6D1 Zip archive data, at least v1.0 to extract, compressed size: 1796904, uncompressed size: 1796904, name: “image_2.zip”

[Pragyan CTF] Roller Coaster Ride

Sun, 05 Mar 2017 07:32:28 +0000

Description:

Bobby has been into Reverse Engineering and Binary Exploitation lately.
One day, he went to an amusement park in his city. It was very famouse for its Roller Coaster Rides.
But, Bobby, being 12 years old, was not allowed on those rides, as it was open for people who were 14 years or older.
This made Bobby very angry. On reaching home, he hacked into the servers of the amusement park, got hold of the validation software for the Roller Coaster rides, and modified it, so that nobody is allowed to have a ride on those Roller Coasters.

[Pragyan CTF] Lost Friends

Sun, 05 Mar 2017 07:32:22 +0000

Description:

Lost Friends **| **Stego 300

Moana and her friends were out on a sea voyage, spending their summer joyously.
Unfortnately, they came across Charybdis, the sea monster. Charybdis, furious over having
unknown visitors, wreaked havoc on their ship. The ship was lost.

Luckily, Moana survived, and she was swept to a nearby island. But, since then, she has not seen her
friends. Moana has come to you for help. She believes that her friends are still alive, and that you are the
only one who can help her find them

[Pragyan CTF] The Vault

Sun, 05 Mar 2017 07:32:17 +0000

Description:

[!@# a-z $%^ A-Z &* 0-9] [1,3]

file

All we got is a file and regular expression.

Lets run file command on the file to determine its type:

```diff $ file ./file.kdb file: Keepass password database 1.x KDB, 3 groups, 4 entries, 50000 key transformation rounds ```

The file is KDB file which is Keepass password database. Keepass is a famous opensource password manager.

I tried open it using KeePassX for windows, but we need a password to open the database. The password probably should match the regex, so I generated a dictionary with all the possible passwords (more then 300,000 words).

import string
import itertools

# strings match the regex
chars = string.lowercase + string.uppercase + string.digits + '!@#$%^&*'
f = open('dict.txt','a')

all_permutations = list(itertools.permutations(chars,1))+ list(itertools.permutations(chars,2))+ list(itertools.permutations(chars,3))

for p in all_permutations:
 f.write(''.join(p)+'\n')

&nbsp;

And I the ran John the Ripper to crack the password and went to eat lunch.

[Pragyan CTF] The Karaboudjan

Sun, 05 Mar 2017 07:32:09 +0000

Description

**The Karaboudjan | **Forensics 150 pts

Captain Haddock is on one of his ship sailing journeys when he gets stranded off the coast of North Korea. He finds shelter off a used nuke and decides to use the seashells to engrave a message on a piece of paper. Decrypt the message and save Captain Haddock.

->-.>-.—.–>-.>.>+.–>–..++++.

.+++.

.->-.->-.++++++++++.+>+++.++.-[->+++<]>+.+++++.++++++++++..++++[->+++<]>.–.->–.>.

clue.zip

This was funny challenge, I struggled with that Brainfuck but all it was is just brainfuck. Nothing more, we don’t need it to solve the challenge. Sorry guys.

[Pragyan CTF] Evil Corp

Sun, 05 Mar 2017 07:31:41 +0000

Description:

fsociety has launched another attack at Evil Corp. However, Evil Corp has decided to encrypt the .dat file with a CBC cipher. Reports reveal that it is not AES and the key is relatively simple, but the IV might be long. And remember, fsociety and evilcorp are closely linked.

Hint! Snakes serve the fsociety. Hmmm.

Hint! fsociety and evilcorp are too close, even 16 characters long together. Damn

fsociety_new.dat

[Pragyan CTF] Supreme Leader

Sun, 05 Mar 2017 07:31:37 +0000

Description:

North Korea reportedly has a bioweapon in the making. Hack into their database and steal it.

Link : http://139.59.62.216/supreme_leader

For the second web challenge we’re given with a URL, lets open it.

Cute Kim 🙂

Now let’d dump the headers of the response using curl:

Megabeets$ curl -D - http://139.59.62.216/supreme_leader/
HTTP/1.1 200 OK
Date: Sun, 05 Mar 2017 08:47:14 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.20
Set-Cookie: KimJongUn=2541d938b0a58946090d7abdde0d3890_b8e2e0e422cae4838fb788c891afb44f; expires=Sun, 05-Mar-2017 08:47:24 GMT; Max-Age=10
Set-Cookie: KimJongUn=TooLateNukesGone; expires=Sun, 05-Mar-2017 08:47:25 GMT; Max-Age=10
Vary: Accept-Encoding
Content-Length: 1117
Content-Type: text/html

[Pragyan CTF] Answer To Everything

Sun, 05 Mar 2017 07:30:52 +0000

Description:

Shal has got a binary. It contains the name of a wise man and his flag. He is unable to solve it.

Submit the flag to unlock the secrets of the universe.

main.exe

In this challenge we have a binary, I ran file command on it:

Megabeets$ file ./main.exe
main.exe: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, BuildID[sha1]=4b9b47b7eac612e0c367f0e3a9878eb1f09b841d, not stripped
root:/mnt/d/

[Pragyan CTF] Interstellar

Sun, 05 Mar 2017 07:30:32 +0000

Description:

Forensics 150 pts

Dr. Cooper, on another one of his endless journeys encounter a mysterious planet . However when he tried to land on it, the ship gave way and he was left stranded on the planet . Desperate for help, he relays a message to the mothership containing the details of the people with him . Their HyperPhotonic transmission is 10 times the speed of light, so there is no delay in the message . However, a few photons and magnetic particles interefered with the transmission, causing it to become as shown in the picture . Can you help the scientists on the mothership get back the original image?

[Pragyan CTF] Game of Fame

Sun, 05 Mar 2017 07:30:05 +0000

Description:

p xasc. a zdmik qtng. yiy uist. easc os iye iq trmkbumk. gwv wolnrg kaqcs vi rlr.

Hint! Robert Sedgewick

To be honest, this challenge was pretty simple. I decrypted the text using online Vigenere cipher decrypter, which is the first cipher I try in suchcases, just after Caesar cipher.

The key was “pragyan” and the result was: “a game. a movie star. his wife. name of the cs textbook. the winner takes it all.”

[33C3 CTF] pay2win Writeup

Thu, 29 Dec 2016 20:01:12 +0000

Description:

pay2win – Web
Do you have enough money to buy the flag?

This challenge was pretty tricky to understand at the beginning. I solved it with a quick and simple workaround that allowed me to solve the challenge without fully understand it. Once I got the flag I understood the whole story. So as with all the stories, we need to begin from the start.

We’re given with a website in where we can buy two products: ‘cheap’ (13.37 USD) and ‘flag’ (31337.42 USD). We, of course, want to buy the ‘cheap’ one because we don’t want to spend our money on some leet flag with the answer to life, the universe and blah blah. So — the ‘cheap’ it is.

[33C3 CTF] The 0x90s called Writeup

Thu, 29 Dec 2016 20:00:28 +0000

Description:

The 0x90s called – PWN

The 0x90s called, they want their vulns back!
Pwn this and get the flag. Who would’ve thought?
If you want to try it locally first, check this out.

This challenge was pretty simple and obvious. We are given with a website that is requesting a ‘proof of work’ from us to reduce the load on their infrastructure. We need to press start and then we get a port to which we can connect using netcat, username and password. We connect to the server and search for the flag.

Fantastic Malware and Where to Find Them

Wed, 12 Oct 2016 16:39:36 +0000

We, as malware analysts, are always in need of new samples to analyze in order to learn, train or develop new techniques and defenses. One of the most common questions I get is “Where to find malware to analyze?” so I’m sharing here my private collection of repositories, databases and lists which I use on a daily basis. Some of them are updated frequently and some of them are not. The short description under each link wasn’t written by me, it was written by the owners of the repositories.

[H4CK1T 2016] Crypt00perator – Ethiopia Writeup

Mon, 03 Oct 2016 22:07:32 +0000

Description:

Long time ago one security module has been written. But for now its sources have been missed somehow. We have forgotten th3 access k3y, which, as we remember, has been hardcoded inside the module. Help us to recollect th3 k3y!11
crypt0_0perator_56e0a9f07f54b3634ab5cc2b30e5b29e.exe

h4ck1t{…}

This is a pretty basic reverse challenge. We can solve it in many different ways but I will show you only two of them. The first one is the quickest method that will work only for this challenge, and the second is for those of you who want to understand better how to solve such challenges in the future.

[H4CK1T 2016] QRb00k – Russia Writeup

Mon, 03 Oct 2016 00:35:37 +0000

Description:

Task: QRb00k – Russia – W3b – 400
The secured messenger was developed in Canada, it’s using systems with qr keys for communicating, it allows to read other people’s messages only to this key holders. But is it true? And you have to figure it out …
http://hack-quest.com

This was a very good web challenge. It took me quite a time to fully understand it but was absolutely worth of its 400 points.

[H4CK1T 2016] ch17ch47 – Germany Writeup

Mon, 03 Oct 2016 00:30:10 +0000

Description:

ch17ch47 – Germany – 200 – Forensics
Find out who is the recipient of the information from the agent.
http://ctf.com.ua/data/attachments/CorpUser.zip

This challenge was second in this CTF which took me no more then five simple and basic commands in order to get the flag.

I roughly follow the same simple system whenever I face a new challenge. This system has prove itself again and again in almost any kind of challenge in different levels.

[H4CK1T 2016] 1magePr1son- Mozambique Writeup

Mon, 03 Oct 2016 00:10:42 +0000

Description:

Task: 1magePr1son- Nozambique- Stego- 150

Implementing of the latest encryption system as always brought a set of problems for one of the known FSI services: they have lost the module which is responsible for decoding information. And some information has been already ciphered! Your task for today: to define a cryptoalgorithm and decode the message.
https://ctf.com.ua/data/attachments/planet_982680d78ab9718f5a335ec05ebc4ea2.png.zip
h4ck1t{str(flag).upper()}
https://ctf.com.ua/data/attachments/planet_982680d78ab9718f5a335ec05ebc4ea2.png.zip

For the start we are given with a wallpaper image named planet.png (2560×1850)

[H4CK1T 2016] v01c3_0f_7h3_fu7ur3 – Australia Writeup

Sun, 02 Oct 2016 23:02:06 +0000

Description:

v01c3_0f_7h3_fu7ur3 – Australia – 300 – Network
The captured data contains encrypted information. Decrypt it.
http://ctf.com.ua/data/attachments/wireshark_8764d640d217fd346e2db2b5c38dde13.pcap

The first thing I do when I face a pcap challenge is, of course, open it in Wireshark. If it looks normal (and not, for example, Bluetooth traffic) I then run ‘foremost‘ on the file. ‘foremost‘ is searching for a known files in a given file by file headers, footers etc, and then extract it to ‘output’ folder in the directory.
So foremost found several files in the PCAP from several sources like http and ftp traffic

[H4CK1T 2016] Belarus – Electronicon Writeup

Sun, 02 Oct 2016 22:23:53 +0000

Description:

Belarus – Electronicon – PPC – 250 pts
EN: This task is one of the methods for the psychological attacks. It is intended for people who don’t have heart diseases and reached 18 years 😉

h4ck1t{flag.upper()}

paint.txt

As the attached file says, it was real pain. I opened the file in the browser and saw this horrible thing:

Looks bad and it crashed my browser. This text file was too big for it to handle. So I opened it on Notepad++ and it was’t any better:

[H4CK1T 2016] 1n51d3r’5 j0b – Canada Writeup

Sun, 02 Oct 2016 21:26:53 +0000

Description:

1n51d3r’5 j0b – Canada – 300 – Forensics
Tommy wrote a program. It seems he has hidden from us important information. Find out what Tommy hides.
http://ctf.com.ua/data/attachments/Tommy_2e00c18e3a480959ba5fb4f65ff7f2b7.zip

Oh god, this challenge was so fun. The easiest 300 point I’ve ever got. I’m sure it wasn’t the expected solution but it works so who am I to complain. Three commands, that’s all.

Megabeets:/tmp/h4ckit/canada# unzip Tommy_2e00c18e3a480959ba5fb4f65ff7f2b7.zip
Archive: Tommy_2e00c18e3a480959ba5fb4f65ff7f2b7.zip
 creating: 300/
 inflating: 300/out.txt
 inflating: 300/parse
Megabeets:/tmp/h4ckit/canada# ll
total 628
drwxrwxrwx 2 root root 0 Oct 3 00:22 ./
drwxrwxrwx 2 root root 0 Oct 2 16:04 ../
drwxrwxrwx 2 root root 0 Sep 24 18:17 300/
-rwxrwxrwx 1 root root 634168 Sep 28 20:42 Tommy_2e00c18e3a480959ba5fb4f65ff7f2b7.zip*
Megabeets:/tmp/h4ckit/canada# strings /300/parse | grep -i h4ck1t{
...h4ck1t{T0mmy_g0t_h1s_Gun}...

I don’t even know what the challenge is about. Just moved to the next challenge without asking any unnecessary questions.

[H4CK1T 2016] HellMath – Mongolia Writeup

Sun, 02 Oct 2016 21:14:57 +0000

Description:

HellMath – Mongolia – 100 – PPC – NEW

EN: Somebody thinks that you are able to calculate well. Is it true? Pass this task, prove the abilities and maybe we will recommend you to one of the most secret missions in this war.

# nc ctf.com.ua 9988 #

This one was a tricky question. Sometime we tend to think too complicated that we forget the basics of the basics.

[H4CK1T 2016] Pentest – Mexico Writeup

Sun, 02 Oct 2016 20:54:26 +0000

Description:

Task: Remote pentest – Mexico – 150 – Web

Our foreign partners have some problems with qualified staff in the field of information technology, we decided to help them and to conduct remote testing of their new website. Your task is to find a hole in the system and grab some information to confirm the hack .Good luck !
http://91.231.84.36:9150/

YAY! Web challenge! If you are following my blog (If not, the subscribe form is on left) you already know how much I love web challenges, It’s either easy points or great puzzle.

[H4CK1T 2016] PhParanoid – Malaysia Writeup

Sun, 02 Oct 2016 20:35:48 +0000

Description:

Task: PhParanoid – Malaysia – 225 – Rever$e

EN: I am so paranoid! I try to hide everything from this mad world! I have already obfuscated my calculator sources, my javascript site sources and I`m not going to stop! And u will never know what I hide, haha!

In this challenge we got Phb, i.e php file that compiled using BCompiler (PHP Bytecode Compiler). We can Decompile it using this.

[H4CK1T 2016] Hex0gator – Paraguay Writeup

Sun, 02 Oct 2016 20:33:31 +0000

Description:

EN: All Experts of The Silver Shield Project can’t decipher the intercepted data. Who knows, maybe you can do it?
100_00edb54bed7e46bd5cdb7c06059881c2

In this PPC 250 pts challenge we got only one file. Let’s run File command on it to determine it’s type.

Megabeets:/tmp/h4ckit/paraguay# file 100_00edb54bed7e46bd5cdb7c06059881c2
100_00edb54bed7e46bd5cdb7c06059881c2: Zip archive data, at least v2.0 to extract

This is a zip file which contains another folder within. The folder contains a file named ‘99‘. Let’s extract it and figure out it’s type:

[H4CK1T 2016] T3legr4m – United States Writeup

Sun, 02 Oct 2016 20:29:27 +0000

Description:

T3legr4m – United States – 50 – J0y
Join us in SUPER TOP SECRET telegram chat!!
https://telegram.me/hackitctf

In order to solve this challenge you need to join the Telegram group and go to Group Info.

The group description is the flag:

H4CK1T T3legr4m

Flag: h4ck1t{fr33_4nd_$ecur3!}

[CSAW 2016] Gametime Writeup

Sun, 18 Sep 2016 22:03:30 +0000

Description:

Guess what time it is! That’s right! Gametime! Wowwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww!!!!!!!!!!!!

Author: Brad Antoniewicz

note: flag is not in flag{} format

gametime.exe

To be honest, I downloaded the file, played the game once and got the key. It is possible for humans to win the game, or maybe it’s just my Super-Vegan powers LOL.

But I wanted, of course, to get the key using RE. I opened IDA and searched for interesting strings.

```asm .rdata:00A17858 00000014 C \rGet ready to play\n .rdata:00A1786C 00000034 C \rZOMGZOMGOZMGKZOMGZOMGOZMGZOMGZOMGOZMGZOMGZOMGOZMG\n ... .rdata:00A17970 00000033 C \rZOMGZOMG YOU DID IT!!! ZOMGOZMG\n .rdata:00A179A4 00000033 C \rZOMGZOMGOZMGZOMGZOMGOZMGZOMGZOMGOZMGZOMGZOMGOZMG\n ... .rdata:00A179E0 0000000F C key is %s (%s) .rdata:00A179F4 0000002C C \nWhen you see an 's', press the space bar\n\n .rdata:00A17A20 0000002C C \nWhen you see an '%c', press the '%c' key\n\n .rdata:00A17A50 00000010 C key is %s (%s)\r .rdata:00A17A60 0000002B C \rUDDER FAILURE! http://imgur.com/4Ajx21P \n .rdata:00A17A8C 00000024 C \r \r .rdata:00A17AB0 0000002A C UDDER FAILURE! http://imgur.com/4Ajx21P \n .rdata:00A17ADC 00000005 C %02x .rdata:00A17AEC 00000034 C \r\tZOMGZOMGOZMGZOMGZOMGOZMGZOMGZOMGOZMGZOMGZOMGOZMG\n .rdata:00A17B20 00000010 C \tkey is %s (%s) .rdata:00A17B30 00000034 C \r\tZOMGZOMG ZOMGZOMG\n .rdata:00A17B64 00000034 C \r\tZOMGZOMG TAP TAP REVOLUTION!!!!!!! ZOMGZOMG\n .rdata:00A17B98 00000036 C \r\tZOMGZOMGOZMGZOMGZOMGOZMGZOMGZOMGOZMGZOMGZOMGOZMG\n\n\n .rdata:00A17BD0 00000020 C \r\t R U READDY?!\n\n\n .rdata:00A17BF0 0000001D C \rThe game is starting in...\n .rdata:00A17C10 00000033 C \rTRAINING COMPLETE! \n .rdata:00A17C48 0000002A C \rNow you know everything you need to know .rdata:00A17C74 0000001F C \n\n\nfor the rest of your life!\n .rdata:00A17C94 0000000D C LETS PLAY !\n .rdata:00A17CA4 00000016 C \rooooh, you fancy!!!\n .rdata:00A17CBC 00000011 C NIIICE JOB)!!!!\n .rdata:00A17CD0 00000012 C \rTURBO TIME! \n ```

I highlighted the important lines: The success message (I know, I got it when I played) and the failure messages. Using X-Refs I found where the failure messages are printed out and patched the program to jump to the success instead. Notice that you&#8217;ll need to change <strong>two</strong> functions.

<strong>1st jump to change:</strong>

<img src="./gametime_1.png" />

<strong>2nd jump to change:</strong>

<img src="./gametime_2.png" />

Now apply the patches to the program and run it. Let the game play alone and the key will be printed.

[CSAW 2016] Key Writeup

Sun, 18 Sep 2016 22:02:54 +0000

Description:

So I like to make my life difficult, and instead of a password manager, I make challenges that keep my secrets hidden. I forgot how to solve this one and it is the key to my house… Can you help me out? It’s getting a little cold out here.

NOTE: Flag is not in normal flag format.

key.exe

Running the file we end up with a message: “?W?h?a?t h?a?p?p?e?n?”

Let’s open the exe in IDA and view it’s strings looking for interesting strings.

```asm .rdata:00AB52B8 00000029 C C:\\Users\\CSAW2016\\haha\\flag_dir\\flag.txt .rdata:00AB52E4 00000016 C ?W?h?a?t h?a?p?p?e?n? .rdata:00AB52FC 00000021 C |------------------------------| .rdata:00AB5320 00000021 C |==============================| .rdata:00AB5344 00000021 C \\ /\\ /\\ /\\ /\\==============| .rdata:00AB5368 00000021 C \\/ \\/ \\/ \\/ \\=============| .rdata:00AB538C 00000021 C |-------------| .rdata:00AB53B0 00000015 C Congrats You got it! .rdata:00AB53C8 00000012 C =W=r=o=n=g=K=e=y= ```

We have 4 interesting strings:

A path: C:\\Users\\CSAW2016\\haha\\flag_dir\\flag.txt
The known message: ?W?h?a?t h?a?p?p?e?n?
Good key: Congrats You got it!
Bad key: =W=r=o=n=g=K=e=y=

Visiting the function that uses the path string (X-ref) we understand the program is trying to read the key from it, if it doesn&#8217;t exists we would get: ?W?h?a?t h?a?p?p?e?n?

I Created the txt file with &#8220;aaa&#8221; inside and ran again, this time I set a breakpoint before the decision whether to jump to the success or failure message.

<img src="./asm_key_csaw.png" />

Now let&#8217;s see what we have in what seem like the comparison function.

Stepping the lines we can see that my &#8220;aaa&#8221; is compared with a string.

<img src="./csaw_key_eax.png" />

This string is the key &#8220;<em>idg_cni~bjbfi|gsxb</em>&#8221; and also the flag to the challenge.

&nbsp;

[CSAW 2016] Sleeping Guard Writeup

Sun, 18 Sep 2016 22:02:43 +0000

Description:

Only true hackers can see the image in this magic PNG….
nc crypto.chal.csaw.io 8000

Author: Sophia D’Antoine
sleeping_dist.py

We are given with python script, Netcat command and a hint about a PNG file. Let’s run Netcat and see what we will get:

[Megabeets] /tmp/CSAW/clam# nc crypto.chal.csaw.io 8000
3j8PL1JLRUFleSEyHicFOl9BXrdleSGXX2lBaF9EZRcjeSE/UwgAJR5BX/rqct1eUm9BaH8iFxkoeSFFcW9B6NtBX7FleSG/v29BHW9BX6EFeSEFz29Bfy/d5RpZeSE/Xh8JMSxBX1kReSEtI26fDkA5X0tkIEhrDxsZJRN7PCQIV0BbOA0kRicsL0tleSE/axd7EDIxMi4RGAFHOgMvG2U5YmkEHU5
...
<alot of base64 text here>
...

We received a base64 encoded text from the server. It is probably our image so let’s decode it and save it to file:

[CSAW 2016] mfw Writeup

Sun, 18 Sep 2016 22:02:18 +0000

Description:

Hey, I made my first website today. It’s pretty cool and web7.9.
http://web.chal.csaw.io:8000/

Entering the site, the first thing that comes to mind is a LFI attack. The site is including a page which is requested in the URL.

The following table describes the possible respond pages:

<td style="width: 484.131px;">
 <strong>Result</strong>
</td>

<td style="width: 484.131px;">
 The &#8220;home&#8221; page is shown.
</td>

<td style="width: 484.131px;">
 The &#8220;about&#8221; page is shown.
</td>

<td style="width: 484.131px;">
 The &#8220;contact&#8221; page is shown.
</td>

<td style="width: 484.131px;">
 Just a message saying: &#8220;That file doesn&#8217;t exist!&#8221;
</td>

<td style="width: 484.131px;">
 An empty page is shown <strong>inside </strong>the website.
</td>

<td style="width: 484.131px;">
 Just a message saying: &#8220;Detected hacking attempt!&#8221;
</td>

URL

http://web.chal.csaw.io:8000/?page=home

http://web.chal.csaw.io:8000/?page=about

http://web.chal.csaw.io:8000/?page=contact

http://web.chal.csaw.io:8000/?page=Megabeets

http://web.chal.csaw.io:8000/?page=flag

http://web.chal.csaw.io:8000/?page=../../../../etc/passwd

Looking at the source code i saw the following comment:

[CSAW 2016] PWN: Warmup Writeup

Sun, 18 Sep 2016 22:01:55 +0000

Description:

So you want to be a pwn-er huh? Well let’s throw you an easy one 😉
nc pwn.chal.csaw.io 8000

warmup

Let’s connect to the server and play with it a little bit:

[Meabeets] /tmp/CSAW/Warmup# nc pwn.chal.csaw.io 8000
-Warm Up-
WOW:0x40060d
>Beet

[Meabeets] /tmp/CSAW/Warmup# nc pwn.chal.csaw.io 8000
-Warm Up-
WOW:0x40060d
>Beetttttttttttttttttttttt

[Meabeets] /tmp/CSAW/Warmup# nc pwn.chal.csaw.io 8000
-Warm Up-
WOW:0x40060d
>aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

The program says “WOW:” followed by a memory address. This address is probably the address of the function we need to execute. Let’s open IDA to view the code:

[CSAW 2016] Clams Don’t Dance Writeup

Sun, 18 Sep 2016 22:01:40 +0000

Description:

Find the clam and open it to find the pearl.
out.img

We are given with a file. I ran file command on it to figure it’s file type:

[Megabeets] /tmp/CSAW/clam# file out.img
out.img: x86 boot sector

Ok, we have raw image file which will probably contain file/s with the flag. I’ll show 2 methods, choose your preferred one.

Method 1: Autopsy

Open Autopsy (my favorite forensics software, it’s free and heartily recommended) and choose the “Create New Case” on the Welcome window. You can also create a new case from the “File” menu.

[CSAW 2016] Regexpire Writeup

Sun, 18 Sep 2016 22:01:11 +0000

Description:

I thought I found a perfect match but she ended up being my regEx girlfriend.

nc misc.chal.csaw.io 8001

It wasn’t so hard, I asked google for the best way to generate matched string to a given pattern and wrote the following script. The only headache was when my generator used newlines (“\n”) so I removed them.

from pwn import *
import rstr
import exrex
from time import sleep
import re

# conect to server
r = remote('misc.chal.csaw.io', 8001)

# Print the question string
print r.recvline()

# Counter
i=1

while True:
	# Recieve the regex pattern
 reg = r.recvline()[:-1]
 print "%d -------\n"%i
 print reg
 print "-------\n"
 ans=rstr.xeger(reg).replace('\n','') # Remove newlines!
 # ans=exrex.getone(reg).replace('\n','') # Another possible option
 r.sendline(ans)
 i+=1
	sleep(0.2)

And after 1000 tests we got the flag: flag{^regularly_express_yourself$}

[CSAW 2016] Coinslot Writeup

Sun, 18 Sep 2016 22:00:33 +0000

Description:

#Hope #Change #Obama2008

nc misc.chal.csaw.io 8000

Let’s connect to the server and see what will happen:

[Megabeets] /tmp/CSAW/Coinslot# nc misc.chal.csaw.io 8000
$0.07
$10,000 bills: 0
$5,000 bills: 0
$1,000 bills: 0
$500 bills: 0
$100 bills: 0
...
...

So, the server is displaying a wanted amount of money and we need to calculate the number of bills and coins given the amount. All we need is writing a simple python script and a coffee break because it will take about 10 minutes for the flag to come up 🙁

[CSAW 2016] Kill Writeup

Sun, 18 Sep 2016 22:00:14 +0000

Description:

Is kill can fix? Sign the autopsy file?
kill.pcapng

This challenge was the first in the Forensics category and was very very simple. We are given with what seems like a corrupted pcapng file, I wasn’t able to open it in Wireshark nor Tcpdump. I ran strings on it with a hope to find the flag:

[Megabeets] /tmp/CSAW/kill# strings kill.pcapng | grep -i flag
=flag{roses_r_blue_violets_r_r3d_mayb3_harambae_is_not_kill}

And to my great surprise I got it, the flag was written plain-text in the file.

[ASIS CTF] SecuPrim Writeup

Sun, 11 Sep 2016 17:02:35 +0000

Description:
Test your might.
secuprim.asis-ctf.ir 42738

Who doesn’t love a good PPC challenge? We provided with only a URL and Port so I ran Netcat and faced a bot detection system asking me for ‘X’. The message said that |X|=4. I gave the 2 possible options for absolute value of 4 and those were wrong answers.

[Megabeets]$ nc secuprim.asis-ctf.ir 42738
Bot detection: Are you ready?
ASIS needs proof of work to start the Math challenge.
SHA256(X + "YNT7TFm4gVadh44qNzwQdG").hexdigest() = "9a1f5add2c9198721d5efe3ba4512866...",
X is a string of alphanumeric and |X| = 4
Enter X: 4
Sorry, Bad proof of work!

[Megabeets]$ nc secuprim.asis-ctf.ir 42738
Bot detection: Are you ready?
ASIS needs proof of work to start the Math challenge.
SHA256(X + "tu1uQei0DpFfmmKaF1rdAH").hexdigest() = "1b4d598ef4e9e86dc1adb7d862e7b35f...",
X is a string of alphanumeric and |X| = 4
Enter X: -4
Sorry, Bad proof of work!

Well, if |X| isn’t for ‘absolute value of()’ then it must be ‘length of()’. You can notice that both the string appended to X and the SHA256 result are changing in every connection. I wrote a python code to calculate the answer. You can find it in the script embedded below. After answering I got another test which I’ve been asked to solve 30 times (with a different value each time):

[ASIS CTF] Sky Blue Writeup

Sun, 11 Sep 2016 17:01:39 +0000

Description
Why is the sky blue?

We are given a PCAP file containing some Bluetooth traffic. The flag has probably been transmitted between the devices. Let’s see what files has been sent.

[Megabeets]$: binwalk -e blue.pcap

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
40535         0x9E57          PNG image, 1400 x 74, 8-bit colormap, non-interlaced

Binwalk found a PNG image but couldn’t export it. I opened Wireshark and searched for the string “PNG” in the packet bytes. I found the 7 packets containing the PNG and exported their packet bytes (i.e Only the DATA, without the header bytes of each packet: 02 0C 20 FC 03 F8 03 47 00 63 EF E6 07). I then concatenated the output files using HxD,

[ASIS CTF] Smallest MD5 Writeup

Sun, 11 Sep 2016 17:00:53 +0000

Description
I have lied that I have found the smallest MD5 hash possible, to win a bet.
Now the other guy is pissed off and wants to know where have I got this hash from. What results to this hash? Please help!

Just search Google for “MD5 minimum record” an you’ll find your answer: 08ni(g0u3ada_JiyongYoun-HLETRD

[ASIS CTF] CTF 101 Writeup

Sun, 11 Sep 2016 17:00:43 +0000

**Description:**http://www.megabeets.net/wp-admin/profile.php
Watch your heads!

The description is telling the whole story. Simply look in the response’s header and you’ll find the flag. In order to do that open the browser’s Developer Tools (F12), bring to focus the Network tab and click the challenge. The HTTP requests will show up on the left panel. Select the request and the Flag header will be displayed on the right panel.

Decode the string with base64 and reveal the flag.

[TWCTF-2016: Web] Global Page Writeup

Mon, 05 Sep 2016 00:01:54 +0000

**Challenge description: **
Welcome to TokyoWesterns’ CTF!

As I entered the challenge I faced a three items list – two links and a strikethrough word:.

Tokyo
~~Westerns~~
CTF

I clicked the tokyo link, which was actually a GET request with a parameter named page in index.php. In response I got a page with PHP error and information from Wikipedia about Tokyo, printed in Hebrew – my mother tongue.

[TWCTF-2016: Crypto] Twin Primes Writeup

Mon, 05 Sep 2016 00:00:52 +0000

Challenge description:
Decrypt it.
twin-primes.7z{.attachment}

We have 4 files in the archive:

encrypt.py – A Python script uses RSA algorithm to encrypt the flag
encryped – The encrypted message
key 1 – n, and e of one of the keys used in the encryption process
key 2 – n, and e of the other key used in the encryption process

Are you ready for your math lesson? Here we go.
After reading encrypt.py we know that:

[TWCTF-2016: PPC] Make a Palindrome! Writeup

Mon, 05 Sep 2016 00:00:46 +0000

Challenge description:

Your task is to make a palindrome string by rearranging and concatenating given words.

Input Format: N <Word_1> <Word_2> … <Word_N>
Answer Format: Rearranged words separated by space.
Each words contain only lower case alphabet characters.

Example Input: 3 ab cba c
Example Answer: ab c cba

You have to connect to ppc1.chal.ctf.westerns.tokyo:31111(TCP) to answer the problem.

$ nc ppc1.chal.ctf.westerns.tokyo 31111

Time limit is 3 minutes

The maximum number of words is 10.

[TWCTF-2016: Misc] glance Writeup

Mon, 05 Sep 2016 00:00:28 +0000

Challenge description
I saw this through a gap of the door on a train.

In order to view the flag you should split the frames of the gif and view it all together. Just paste the url in this site.

Result:

[TWCTF-2016: Web] Rescue Data 1: deadnas Writeup

Mon, 05 Sep 2016 00:00:18 +0000

Challenge description:

Today, our 3-disk NAS has failed. Please recover flag.
deadnas.7z{.attachment}

We are given an archive containing 3 files:

D:\Megabeets\deadnas> dir 
Directory of D:\Megabeets\deadnas
 .
 ..
524,288 disk0
 12 disk1
524,288 disk2

3 Disk NAS and one has failed? This challenge is obviously about RAID 5. I was asked to find a way to recover the failed disk and there is no simpler way than just XOR disk0 with disk2 and recreate the original disk1. If you are right now in your “WTF?!” mode you better go read about RAID 5 until you understand how it works.

[TWCTF-2016: Reverse] Reverse Box Writeup

Sun, 04 Sep 2016 23:58:28 +0000

Guest post by Shak.

Challenge description
$ ./reverse_box ${FLAG}
95eeaf95ef94234999582f722f492f72b19a7aaf72e6e776b57aee722fe77ab5ad9aaeb156729676ae7a236d99b1df4a
reverse_box.7z

This challenge is a binary which expects one argument and then spits out a string. We get the output of the binary for running it with the flag. Let’s fiddle with that for start.

./reverse_box 0000
28282828

The binary probably prints a hex value replacing each character. It is also clear that it is a unique value for each character. we must be dealing with some kind of substitution cipher. After running it again with the exact same argument, we get a different output, so the substitution is also randomized somehow.

[TWCTF-2016: PWN] judgement Writeup

Sun, 04 Sep 2016 23:54:32 +0000

Guest post by Shak.

Challenge description:
Host : pwn1.chal.ctf.westerns.tokyo
Port : 31729
judgement{.attachment}

[Megabeets]$ nc pwn1.chal.ctf.westerns.tokyo 31729
Flag judgment system
Input flag >> FLAG
FLAG
Wrong flag...

Let’s check the binary. The following function is reading the flag from a local file on the server, so this binary will not reveal the flag, but further examining it might.

int __cdecl load_flag(char *filename, char *s, int n)
{
 int result; // eax@2
 FILE *stream; // [sp+18h] [bp-10h]@1
 char *v5; // [sp+1Ch] [bp-Ch]@5

 stream = fopen(filename, "r");
 if ( stream ) {
 if ( fgets(s, n, stream) ) {
 v5 = strchr(s, 10);
 if ( v5 )
 *v5 = 0;
 result = 1;
 }
 else { result = 0;}
 }
 else { result = 0; }
 return result;
}

Next we can see the main function which gets our input and compares it to the flag.

[CTF(x) 2016 : WEB] Harambehub – 100 pts Writeup

Sun, 28 Aug 2016 21:37:46 +0000

Challenge description:
This website was created in honor of harambe: http://problems.ctfx.io:7003
Problem author: omegablitz
HarambeHub.java
User.java

This challenge was the second in the Web category and it actually was the first time I’ve ever seen something like that. We are given with a url, which returns an empty page and two source-files written in Java for Spark Framework. Make sure you read the given source-files before you continue.

The main file, HarambeHub.java, contains two methods which are actually get() and post() routes to two different pages, as you can see below:

[CTF(x) 2016 : WEB] north korea – 50 pts Writeup

Sun, 28 Aug 2016 16:47:54 +0000

Description:
What is North Korea hiding?
http://problems.ctfx.io:7002/

Entering the URL I faced with only a sentence:
“We, the Democratic People’s Republic of Korea, have developed a revolutionary new security standard. The West doesn’t stand a chance.”

That’s all? I took a look at the source code (ctrl+u) to see if something is hiding, and indeed I saw a hidden button and a simple script:

<button hidden type="button">Retrieve nuclear codes</button>
<span></span>
<script type="text/javascript">
$(function() {
	$("button").click(function() {
		$.get('code', function(code) {
			$('span').text(code);
		});
	});
});
</script>

I clicked the button and it gave me the content of “http://problems.ctfx.io:7002/code” which was a message: “Nice try kiddo”.
Well, I took a look again at the first message: “…The West doesn’t stand a chance.”. What about the north? What if i”ll set the X-Forwarded-For to North Korea’s IP? X-Forwarded-For is the conventional way of identifying the originating IP address of the user connecting to the web server coming from either a HTTP proxy, load balancer.

XOR Files With Python

Fri, 27 Nov 2015 08:08:59 +0000

This is a simple script, written in Python, that perform a logical exclusion, XOR, on two files and saves the result in the destination file. It is one of the most simple and effective tool in my forensics-toolbox. I used this tool several times for example to recover data from a broken RAID 5 or deobfuscate an obfuscated binary or image. The usage is very simple and intuitive.
You can find the full code and examples in the repository.

XOR Files With Powershell

Mon, 02 Nov 2015 18:24:21 +0000

Today I’m sharing with you one of the most simple and effective tool in my forensics-toolbox. A simple script, written in Powershell, that perform a logical exclusion, XOR, on two files and saves the result in the destination file. I used this tool several times for example to recover data from a broken RAID 5 or deobfuscate an obfuscated binary or image. The usage is very simple and intuitive.
You can find the full code and examples in the repository.

Private: [Root-Me] Javascript – Authentication Writeup

Thu, 02 Apr 2015 10:24:52 +0000

Recently I found this incredible project called Root-Me which contains, among other things, over 200 challenges in different levels and topics of the cyber-security field. If you’re into hacking challenges and wargames I recommend you to check this site out.

I decided to document my solutions for some of the challenges and share it with you, so that beginners can learn and become better hackers. The first challenge we’re going to solve is called **Javascript – Authentication. **That’s the easiest one in the Web-Client category. The challenge, like almost all of the other basic challenges in this category uses a web designing code called HTML (Hyper Text Markup Language) and Javascript along with some others client-side languages. If you know very little or nothing about HTML or Javascript I heartily recommend you read about it either in a book or online.