Synopsis

Graverobber is a Very Easy reversing challenge. Players will use strace to identify binary functionality, then scripting to uncover the flag.

Skills Learned

- strace
- basic scripting

Solution

If we run the provided binary, we're given an error message.

We took a wrong turning!

Tracing

We can use strace to try and guess what the binary is doing.

$ strace ./robber
/* SNIP */
newfstatat(AT_FDCWD, "H/", 0x7ffcbd70cf50, 0) = -1 ENOENT (No such file or directory)
write(1, "We took a wrong turning!\n", 25We took a wrong turning!
) = 25
exit_group(1)                           = ?
+++ exited with 1 +++

We're trying to use newfstatat (a specialized version of the stat syscall used for file metadata) on some directory H. If we create it and run again:

newfstatat(AT_FDCWD, "H/", {st_mode=S_IFDIR|0755, st_size=4096, ...}, 0) = 0
newfstatat(AT_FDCWD, "H/T/", 0x7fff03f91e00, 0) = -1 ENOENT (No such file or directory)
write(1, "We took a wrong turning!\n", 25We took a wrong turning!

Looks like it will open several directories in sequence. We'll write a script to automate creating them.

Scripting

We'll begin by deleting and creating a directory to work in.

import os
import shutil
from pwn import *

try:
    shutil.rmtree("directories")
    os.mkdir("directories")
except Exception:
    pass
os.chdir("directories")

We'll then loop, running the binary under strace (using -e to filter to only the newfstatat calls):

while True:
    with context.local(log_level='ERROR'):
        p = process(["strace", "-e", "newfstatat", "../robber"])
        out = p.recvall().decode()
        p.close()

We'll then look at the last call to see the last path expected, and use that to create a directory. We'll also break if the error message isn't printed as we've likely found the whole path.

        if 'wrong turning' not in out: break
        stats = [line for line in out.split("\n") if "newfstatat" in line]
        # Get last line, and get the content of the string
        path = stats[-1].split('"')[1]
        # Remove separators and print path
        print(path.replace("/", ""))
        # Recursively make the directory
        os.makedirs(path)

On running this script, we'll get the flag.

2.6 KiB Raw Permalink Blame History

Synopsis

Skills Learned

Solution

Tracing

Scripting

2.6 KiB

Raw Permalink Blame History