Skip to content

Instantly share code, notes, and snippets.

@Mukundan314
Last active December 13, 2019 10:21
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Mukundan314/f27153ea407878f9f28c45df76737a12 to your computer and use it in GitHub Desktop.
Save Mukundan314/f27153ea407878f9f28c45df76737a12 to your computer and use it in GitHub Desktop.

If we get all printable inside the executable by using the strings command and ignore all symbol and compiler metadata what is left is:

Enter password:
FEDORAGCIPASSEASY
Success!
Error! Wrong password!
0x1337
0x133337

we can ignore Enter password:, Success! and Error! Wrong password! since they are probabaly use for printing the messages

so the passwords are:

FEDORAGCIPASSEASY
0x1337
0x133337

main symbol disassembled:

0000000000001165 <main>:
    1165:	55                   	push   %rbp
    1166:	48 89 e5             	mov    %rsp,%rbp
    1169:	48 83 ec 20          	sub    $0x20,%rsp
    116d:	89 7d ec             	mov    %edi,-0x14(%rbp)
    1170:	48 89 75 e0          	mov    %rsi,-0x20(%rbp)
    1174:	48 b8 46 45 64 30 72 	movabs $0x4347617230644546,%rax
    117b:	61 47 43 
    117e:	48 89 45 f2          	mov    %rax,-0xe(%rbp)
    1182:	c7 45 fa 49 74 40 73 	movl   $0x73407449,-0x6(%rbp)
    1189:	66 c7 45 fe 6b 00    	movw   $0x6b,-0x2(%rbp)
    118f:	83 7d ec 02          	cmpl   $0x2,-0x14(%rbp)
    1193:	74 25                	je     11ba <main+0x55>
    1195:	48 8b 45 e0          	mov    -0x20(%rbp),%rax
    1199:	48 8b 00             	mov    (%rax),%rax
    119c:	48 89 c6             	mov    %rax,%rsi
    119f:	48 8d 3d 5e 0e 00 00 	lea    0xe5e(%rip),%rdi        # 2004 <_IO_stdin_used+0x4>
    11a6:	b8 00 00 00 00       	mov    $0x0,%eax
    11ab:	e8 90 fe ff ff       	callq  1040 <printf@plt>
    11b0:	bf 01 00 00 00       	mov    $0x1,%edi
    11b5:	e8 a6 fe ff ff       	callq  1060 <exit@plt>
    11ba:	48 8b 45 e0          	mov    -0x20(%rbp),%rax
    11be:	48 83 c0 08          	add    $0x8,%rax
    11c2:	48 8b 00             	mov    (%rax),%rax
    11c5:	48 8d 55 f2          	lea    -0xe(%rbp),%rdx
    11c9:	48 89 d6             	mov    %rdx,%rsi
    11cc:	48 89 c7             	mov    %rax,%rdi
    11cf:	e8 7c fe ff ff       	callq  1050 <strcmp@plt>
    11d4:	85 c0                	test   %eax,%eax
    11d6:	75 0e                	jne    11e6 <main+0x81>
    11d8:	48 8d 3d 3b 0e 00 00 	lea    0xe3b(%rip),%rdi        # 201a <_IO_stdin_used+0x1a>
    11df:	e8 4c fe ff ff       	callq  1030 <puts@plt>
    11e4:	eb 0c                	jmp    11f2 <main+0x8d>
    11e6:	48 8d 3d 36 0e 00 00 	lea    0xe36(%rip),%rdi        # 2023 <_IO_stdin_used+0x23>
    11ed:	e8 3e fe ff ff       	callq  1030 <puts@plt>
    11f2:	b8 00 00 00 00       	mov    $0x0,%eax
    11f7:	c9                   	leaveq 
    11f8:	c3                   	retq   
    11f9:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)

Explanation of important instructions (format is "instruction address: explanation"):

1174: put the data 0x4347617230644546 (FEd0raGC) to register rax

117e: copy data from rax register to a address 0xe (14) before rbp

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|F|E|d|0|r|a|G|C| | | | | | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                             ^
                            rbp

1182: put the data 0x73407449 (It@s) at 0x6 (6) before rbp

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|F|E|d|0|r|a|G|C|I|t|@|s| | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                             ^
                            rbp

1189: put the data 0x6b (k) at 0x2 (2) before rbp

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|F|E|d|0|r|a|G|C|I|t|@|s|k| | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                             ^
                            rbp

11cf: compare value at 0xe (14) before rbp and user input

so password is FEd0raGCIt@sk

main symbol disassembled:

00000000000011a7 <main>:
    11a7:	55                   	push   %rbp
    11a8:	48 89 e5             	mov    %rsp,%rbp
    11ab:	48 83 ec 40          	sub    $0x40,%rsp
    11af:	48 b8 30 30 67 36 31 	movabs $0x306b403136673030,%rax
    11b6:	40 6b 30 
    11b9:	48 ba 30 6c 61 6e 64 	movabs $0x313531646e616c30,%rdx
    11c0:	31 35 31 
    11c3:	48 89 45 e0          	mov    %rax,-0x20(%rbp)
    11c7:	48 89 55 e8          	mov    %rdx,-0x18(%rbp)
    11cb:	c7 45 f0 34 63 65 6c 	movl   $0x6c656334,-0x10(%rbp)
    11d2:	66 c7 45 f4 21 00    	movw   $0x21,-0xc(%rbp)
    11d8:	c7 45 fc 00 00 00 00 	movl   $0x0,-0x4(%rbp)
    11df:	48 8d 3d 76 0e 00 00 	lea    0xe76(%rip),%rdi        # 205c <_IO_stdin_used+0x5c>
    11e6:	b8 00 00 00 00       	mov    $0x0,%eax
    11eb:	e8 50 fe ff ff       	callq  1040 <printf@plt>
    11f0:	48 8d 45 c0          	lea    -0x40(%rbp),%rax
    11f4:	48 89 c7             	mov    %rax,%rdi
    11f7:	b8 00 00 00 00       	mov    $0x0,%eax
    11fc:	e8 5f fe ff ff       	callq  1060 <gets@plt>
    1201:	48 8d 4d e0          	lea    -0x20(%rbp),%rcx
    1205:	48 8d 45 c0          	lea    -0x40(%rbp),%rax
    1209:	ba 16 00 00 00       	mov    $0x16,%edx
    120e:	48 89 ce             	mov    %rcx,%rsi
    1211:	48 89 c7             	mov    %rax,%rdi
    1214:	e8 37 fe ff ff       	callq  1050 <memcmp@plt>
    1219:	85 c0                	test   %eax,%eax
    121b:	75 07                	jne    1224 <main+0x7d>
    121d:	c7 45 fc 01 00 00 00 	movl   $0x1,-0x4(%rbp)
    1224:	48 8d 3d 46 0e 00 00 	lea    0xe46(%rip),%rdi        # 2071 <_IO_stdin_used+0x71>
    122b:	e8 00 fe ff ff       	callq  1030 <puts@plt>
    1230:	83 7d fc 00          	cmpl   $0x0,-0x4(%rbp)
    1234:	74 16                	je     124c <main+0xa5>
    1236:	48 8d 3d 4b 0e 00 00 	lea    0xe4b(%rip),%rdi        # 2088 <_IO_stdin_used+0x88>
    123d:	e8 ee fd ff ff       	callq  1030 <puts@plt>
    1242:	bf 00 00 00 00       	mov    $0x0,%edi
    1247:	e8 24 fe ff ff       	callq  1070 <exit@plt>
    124c:	48 8d 3d 57 0e 00 00 	lea    0xe57(%rip),%rdi        # 20aa <_IO_stdin_used+0xaa>
    1253:	e8 d8 fd ff ff       	callq  1030 <puts@plt>
    1258:	b8 00 00 00 00       	mov    $0x0,%eax
    125d:	c9                   	leaveq 
    125e:	c3                   	retq   
    125f:	90                   	nop

Explanation of important instructions (format is "instruction address: explanation"):

11af: put the data 0x306b403136673030 (00g61@k0) into rax

11b9: put the data 0x313531646e616c30 (0land151) into rdx

11c3: copy data from rax to 0x20 (32) before rbp

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|0|g|6|1|@|k|0| | | | | | | | | | | | | | | | | | | | | | | | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                                                 ^
                                                                rbp

11c7: copy data from rdx to 0x18 (24) before rbp

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|0|g|6|1|@|k|0|0|l|a|n|d|1|5|1| | | | | | | | | | | | | | | | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                                                 ^
                                                                rbp

11cb: put the data 0x6c656334 (4cel) at 0x10 (16) before rbp

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|0|g|6|1|@|k|0|0|l|a|n|d|1|5|1|4|c|e|l| | | | | | | | | | | | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                                                 ^
                                                                rbp

11d2: put the data 0x21 (!) at 0xc (12) before rbp

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|0|0|g|6|1|@|k|0|0|l|a|n|d|1|5|1|4|c|e|l|!| | | | | | | | | | | | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                                                                 ^
                                                                rbp

1214: compare value at 0x20 (32) before rbp and user input

so password is 00g61@k00land1514cel!

Note: Since the password and user input are side by side we can input a 64 char strings to overflow and login so abcdefghijklmnopqrstuvwxyz123456abcdefghijklmnopqrstuvwxyz123456 will work

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment