This downloads as a bash script that gzip decodes data inside of it and runs the decoded data.
We can string the top of the bash script and decode the data ourselves to get a binary.
The binary is a 64-bit ELF.
After looking at the disassembled code I decided to run the binary. The binary did the same as SIMD, compared input with a string stored in the binary. I decided to go the easy route and look for the compare.
I started the binary, and broke when my input was read by the binary:
(gdb) r Starting program: ./override Please enter your password: ^C Program received signal SIGINT, Interrupt. 0x00007ffff7b32a50 in read () from /lib/libc.so.6 (gdb) finish Run till exit from #0 0x00007ffff7b32a50 in read () from /lib/libc.so.6 AAAAAAAAAAAAAAAAAAAA 0x00007ffff7acd598 in _IO_file_underflow () from /lib/libc.so.6 (gdb) finish ...snip... (gdb) x/i $rip => 0x40084f: mov rdx,0x600dd8 (gdb) x/s 0x600dd8 0x600dd8: 'A' <repeats 20 times>, "\n" (gdb) rwatch *0x600dd8 Hardware read watchpoint 1: *0x600dd8 ...snip... Value = 1094795585 0x0000000000400805 in ?? () (gdb) x/4i $rip => 0x400805: mov eax,DWORD PTR [rbp-0x4] 0x400808: cdqe 0x40080a: add rax,QWORD PTR [rbp-0x20] 0x40080e: movzx eax,BYTE PTR [rax]
After reaching code back in the original binary, i slowly continued until i found a compare.
(gdb) 0x00000000004006f0 in ?? () 1: x/4i $rip => 0x4006f0: cmp edx,eax 0x4006f2: xchg eax,eax 0x4006f4: jmp 0x4006cd 0x4006f6: push rax (gdb)
From here i setup a few gdb commands for the breakpoint on the compare, and let the program run
(gdb) b *0x4006f0 Breakpoint 1 at 0x4006f0 (gdb) commands Type commands for when breakpoint 1 is hit, one per line. End with a line saying just "end". >i r $rax >set $rdx=$rax >c >end (gdb) r Starting program: ./override Please enter your password: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Breakpoint 1, 0x00000000004006f0 in ?? () rax 0x42 66 Breakpoint 1, 0x00000000004006f0 in ?? () rax 0x67 103 Breakpoint 1, 0x00000000004006f0 in ?? () rax 0x38 56 Breakpoint 1, 0x00000000004006f0 in ?? () rax 0x50 80 ...snip... Breakpoint 1, 0x00000000004006f0 in ?? () rax 0x33 51 Breakpoint 1, 0x00000000004006f0 in ?? () rax 0x6b 107 Success! You are now logged into the system. Program exited normally. (gdb)
Going back to the output and collecting all of the bytes into one string gives us (This is the key):
Bg8Ph#xnr||l*YjV|9K#RRfh6XhnhK8*%f:h5AAUgg%t5K3%xRnR%Xh|iU#W6h3k
Which can once again be verified with the binary.
scarecrow@firefly:~/PlaidCTF/Override$ ./override Please enter your password: Bg8Ph#xnr||l*YjV|9K#RRfh6XhnhK8*%f:h5AAUgg%t5K3%xRnR%Xh|iU#W6h3k Success! You are now logged into the system.