Tags: rev 

Rating:

You're given a executable file `match_me`

Let's see what it does
```
$ ./match_me
12 <input_guess>
Nope <output>
```
Lets have a look at dynamic library calls for no input.
```
$ ltrace ./match_me

__libc_start_main(0x400a03, 1, 0x7ffcd5f460a8, 0x400ad0 <unfinished ...>
malloc(1000) = 0x133c010
scanf(0x400b6d, 0x133c010, 0x133c010, 0x7f217ad32b20) = 0xffffffff
malloc(1000) = 0x133c810
strlen("firhfgferfibbqlkdfhh") = 20
strlen("firhfgferfibbqlkdfhh") = 20
strlen("firhfgferfibbqlkdfhh") = 20
strncmp("firhfgferfibbqlkdfhh", "[[[[[[[[[[[[[[[[[[[[", 20) = 11
puts("Nope"Nope
) = 5
+++ exited (status 0) +++
```
Interesting. `strcmp` is being called to compare a hardcoded string "firhfgferfibbqlkdfhh" with some other string. Lets run again the ltrace with input "12" (without quotes)
```
$ ltrace ./match_me

__libc_start_main(0x400a03, 1, 0x7ffcd5f460a8, 0x400ad0 <unfinished ...>
malloc(1000) = 0x133c010
scanf(0x400b6d, 0x133c010, 0x133c010, 0x7f217ad32b20) = 0xffffffff
malloc(1000) = 0x133c810
strlen("firhfgferfibbqlkdfhh") = 20
strlen("firhfgferfibbqlkdfhh") = 20
strlen("firhfgferfibbqlkdfhh") = 20
strncmp("firhfgferfibbqlkdfhh", "S[[[[[[[[[[[[[[[[[[[", 20) = 11
puts("Nope"Nope
) = 5
+++ exited (status 0) +++
```
Nice, so we see that integer 12 is mapped to "S" (See the change of compared string from "[[[[[[..." to "S[[[..."). So, all we have to do is write a simple script to find mappings of all integers from 1-100 to corresponding characters.

So, we get 59:f, 76:i, 65:r and so on.

Key with all mappings done = firhfgferfibbqlkdfhh: 5976657559745958655976555564937857597575
Let's check our executable with above key
```
$ ./match_me
5976657559745958655976555564937857597575
Match
```
Yay! Now we need to send this key to defcon.org.in:8082
```
$ echo "5976657559745958655976555564937857597575" | nc defcon.org.in 8082

Flag: d4rk{595c7f5b595a59587f595c55557e5f5e57595b5b}c0de

Original writeup (https://github.com/mananpal1997/Hackcon_WriteUps_2017).