We got a binary file ttt2.exe and when I run it, I received the following error:
Tools
- BlobRunner
- HxD
- IDA
- x64dbg
- WireShark
- Online Disassembly
- IONinja
- Python
We received a capture network file named: re_crowd.pcapng.
Notice that there are number of records with PROPFIND:
I noticed the file is packed with UPX:
We received a packed TPK file that we can just unpack with 7zip. Inside the “bin” folder we had number of interesting DLLs, the one that was the most interesting was the “TKApp.dll”, so we analyzed it with dnSpy.
When I tried to open the report.xls file I received an error:
Tools to use:
- IDA
- x64dbg
When start the program, we received a game menu:
Tools to use:
- x64dbg
- HxD
- pestudio
- upx-3.96-win64
- IDA
- Python
When I tried to load the file to x64dbg I received a message that this is an invalid PE file:
We received the application binary file together with the python source code.
Tools to use:
- notepad++
When you start the application, you get:
This year I participated in Flare-On 7 (2020) and I wanted to share my thoughts about this great CTF.
Overview
The challenges were great this year, I learned a lot and they were pure reversing. For anyone wants to strength his reversing skills, flare-on is a great choice. This is like an intensive reversing course for six weeks that you will suffer and enjoy both together.
Solutions
I separated my solutions into different pages to make it more readable:
Sometimes it happens, in my case, in CTF challenge - the day when you received an ELF binary but your host machine is Windows and your IDA+license is already installed on your host. One option is to install a free version of IDA on a virtual Linux machine but there is another option that sounds in the beginning complex, but actually it is not.
This option called “Remote Debugging”, the ability to debug a process from your host while it runs on a “remote” machine or in my case, virtual machine.
The scenario: We need to debug 32-bit ELF binary…
Eviatar Gerzi
Security researcher interested in reversing, solving CTFs, malware analysis, penetration testing and DevOps security (docker and Kubernetes)
