# S3r14l\_Br34k3r

## <mark style="color:red;">Downloading Challenge Files</mark>

here is the executable file to download

{% file src="<https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FLrNKWXSUKAQsd6p6RFKm%2FS3r14l_Br34k3r.rar?alt=media&token=e1a7ffb7-0fdd-4bf2-811a-72b0b1229a58>" %}

## <mark style="color:red;">Basic EXE Reconnaissance</mark>

the executable is 64 bit that means that addresses will be 8 bytes and the exe is stripped that means we cannot view the function names even if we reverse engineer it&#x20;

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FTEh8bgAul1jyZyWTaxnr%2Fimage.png?alt=media&#x26;token=f1d3038d-e7bd-40c9-af50-f5cdf9caf40e" alt=""><figcaption></figcaption></figure></div>

## <mark style="color:red;">Reverse Engineering</mark>

to reverse engineer an executable file you can use a variety of debuggers like ghidra, IDA Pro that have a GUI Interface or use a debugger that doesn't have a GUI but very powerful in terms of Dynamic Analysis like GDB or Radar2&#x20;

in this case i will use ghidra, if u dont have ghidra installed on your linux machine install it using apt package manager running this command

```
sudo apt install ghidra
```

and then to open ghidra run this command

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F5lPkay9BiBoTsCYGwgQt%2Fimage.png?alt=media&#x26;token=bae8e441-de81-4a2e-be72-02cd53ff45ca" alt=""><figcaption></figcaption></figure></div>

now ghidra should be opened after a few seconds, now create a new Project

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F5nPEShkIevGhZMCemV9L%2Fimage.png?alt=media&#x26;token=be4f4c02-d5f7-47c3-8fc9-855eea9a96ad" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FkX4hO0sPMsVifZDbto2T%2Fimage.png?alt=media&#x26;token=4b3d84fe-6c81-470b-94a1-a3356bf86392" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FMCf2jdlAXaYLIVWxjmbS%2Fimage.png?alt=media&#x26;token=2be05bf3-3ed0-46bf-9d6b-f987f27ec99c" alt=""><figcaption></figcaption></figure></div>

now we have created a new project now let's import the executable into the ghidra application so it can analyze it and decompile it for us

<figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F74t6yXb2UuX0a0zMF8zx%2Fimage.png?alt=media&#x26;token=274142e8-8cff-42d0-aa42-f463679c5091" alt=""><figcaption></figcaption></figure>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Fpb9vBZkmvxDBw3KGWya5%2Fimage.png?alt=media&#x26;token=88b79dac-36ab-4f08-8f16-38ea8142d02f" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F1pjONpFb16c9NRsmz3kf%2Fimage.png?alt=media&#x26;token=b41f1b7a-c6b4-429b-8a33-1d4c90fdf0a8" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F5wXDGw0aL5d0i1XbYaxm%2Fimage.png?alt=media&#x26;token=78313426-91e3-4ab9-baf2-773dfa34ca48" alt=""><figcaption></figcaption></figure></div>

now few popups will be shown just click on yes and analyze&#x20;

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FqseKyv0rEqKFgNH6SSlX%2Fimage.png?alt=media&#x26;token=1061b6d7-9630-417f-a507-f53b6f6a7ff1" alt=""><figcaption></figcaption></figure></div>

now let's open the Functions and take a look at all the functions that we have we can see that the functions names are random because the executable as i said in the beginning is stripped

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Fx2eTkLTq6jx9uTPt0qAC%2Fimage.png?alt=media&#x26;token=935ab3f9-f948-4e4d-abb9-85522cfb1fe6" alt=""><figcaption></figcaption></figure></div>

now take a look at all the functions when u spot the \_\_libc\_start\_main that mains that u have found the main function (ENTRY) double click on the function to see the decompiled code of the main function&#x20;

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Fnhu1PabRB9UMoabWirAT%2Fimage.png?alt=media&#x26;token=6ec88283-207b-44df-bc42-83d119e8b71f" alt=""><figcaption></figcaption></figure></div>

and this is the decompiled main function&#x20;

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FYmW2N0ruSUg7UEJ8rKWL%2Fimage.png?alt=media&#x26;token=86a1b918-9f26-4972-9475-537c580f279f" alt=""><figcaption></figcaption></figure></div>

let's start explaining this code because if you didn't understand the code you will not be able to reverse it in the first place

the first thing is initializing and reserving space for variables and then take the input of username and the serial number from the user and storing them into the username and Serial\_number variables respectivly&#x20;

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Fn0O8KO8lobNo6RbCe9Ub%2Fimage.png?alt=media&#x26;token=a1af4b3e-c76c-46df-91fd-dcbc4ebbafbb" alt=""><figcaption></figcaption></figure></div>

and then storing the length of the Serial number that the user have given us into te variable sVar1

Serial\_Length variable will take the int value of the sVar1 variable which is the Serial Number's Length

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FhyzT1ufuih1lk99eTq7y%2Fimage.png?alt=media&#x26;token=95cd97da-7e2d-4070-b7e9-c2475376eee2" alt=""><figcaption></figcaption></figure></div>

and then we will start a loop that iterates based on the serial number's Length if it's 1 then we will iterate once

and then we will xor the Serial Number given by the user with the value 1 and store it in the Serial Number Variable

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F6mRMjyIh5gWJdI4nDIUX%2Fimage.png?alt=media&#x26;token=33af6775-e5df-4f97-9fc1-fa41b9446142" alt=""><figcaption></figcaption></figure></div>

after the loop is finished we will compare the Serial Number after the XOR operation with the value 0 if it's indeed 0 then strcmp will return 0 if not it will return 1&#x20;

then if the strcmp is returning 0 that means that the if statement will be true and Congratulation will be outputed if it's returning 0 then Invalid Serial Number will be outputed

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FFFB99A2wEj7oXYeTPgAv%2Fimage.png?alt=media&#x26;token=f29c0d23-c56f-40c8-83f1-3caa58591521" alt=""><figcaption></figcaption></figure></div>

so now after we have understood the mechanisms of this code let's reverse it and find a way into making the if statement true&#x20;

to do this we have to find a serial number that xors 1 and outputs 0&#x20;

since we can input the serial number with the length that we want we will use the serial number of 1 which will be xored with 1 once because the length of the serial number is 1 and 1 ^ 1 = 0 => the condition is true&#x20;

let's now run the program and do it&#x20;

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FW2XRYsJ0qwNDrfoD0xB6%2Fimage.png?alt=media&#x26;token=e8d4b463-67dc-49cc-9db5-a86927899bbd" alt=""><figcaption></figcaption></figure></div>

## <mark style="color:red;">MD5 Hashing</mark>

to find the flag we have to hash the serial number that we have found which is 1, we will use an online MD5 hashing generator

* [**https://www.md5hashgenerator.com/**](https://www.md5hashgenerator.com/)

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FlNaYkwH8CqGJG32MneAY%2Fimage.png?alt=media&#x26;token=7cbc110c-9b87-40ec-8e46-18faf46981be" alt=""><figcaption></figcaption></figure></div>

## <mark style="color:red;">Flag</mark>

**DEFENSYS{c4ca4238a0b923820dcc509a6f75849b}**

Greetings from [<mark style="color:blue;">**Sayonara**</mark>](https://github.com/ismail-arame/)
