TryHackMe - Reversing Elf - Walkthrough

Introduction

Today we're going to be doing a walkthrough for the Reversing ELF room hosted at https://tryhackme.com/room/reverselfiles . For this walkthrough, we'll be using one virtual machine (VMs), a Kali Linux VM as our attacking machine.

Task 1 - Crackme1

Questions

What is the flag?

Download the Task 1 Task File
Copy it to your working directory
Give the file executable permissions
Run the file

chmod +x crackme1
./crackme1

Task 2 - Crackme2

Questions

What is the super secret password ?

Give the file executable permissions
Run Ltrace on the file with a test string

chmod +x crackme2
ltrace ./crackme2 test

./crackme2 passwordFoundInPreviousStep

Task 3 - Crackme3

Questions

What is the flag?

Give the file executable permissions
Run strings on the file
Echo the base64 string you found, pipe it into Base64 decode

chmod +x crackme3
strings crackme3
echo “base64stringFoundInPreviousStep” | base64 -d

Task 4 - Crackme4

Questions

What is the password ?

Give the file executable permissions
Run Ltrace on the file with a test string

chmod +x crackme4
ltrace ./crackme4 test

Task 5 - Crackme5

Questions

Give the file executable permissions
Run Ltrace on the file with a test string
Run the file with the discovered strncmp string as input

chmod+x crackme5
ltrace ./crackme5
input test
./crackme5
input string found in previous step 

Task 6 - Crackme6

Questions

What is the password ?

Run the Ghidra program
Click New Project

Click Non-Shared Project, then Next >>

Enter crackme6 as the Project Name, then click Finish

Click File, then Import File

Find the crackme6 file, click it, then click on Select File To Import

Click OK after the file finishes importing

Click OK on the next screen that appears

From the main Ghidra window, double click the crackme6 file

Click Yes in the Analyze window

Then click Analyze

In the Symbol Tree window, select Functions

Then select the main function

In the Decompile window, we see that the main function makes reference to the compare_pwd function

We then select the compare_pwd function from the Symbol Tree window

In the Decompile window, we see that the function makes reference to the my_secure_test function

In the Symbol Tree window, we select the my_secure_test function

In the Decompile window we see the password

Task 7- Crackme7

Questions

What is the flag ?

We import the crackme7 file into Ghidra like we did the previous file
In the Symbol Tree window, we select the main function

In the Decompiler window, we see that there's a special response if we enter hex value 0x7a69, which in decimal is 31337:

chmod +x crackme7
./crackme7
31337

Task 8 - Crackme8

We import the crackme8 file into Ghidra like we did the previous file
In the Symbol Tree window, we select the main function

In the Decompile window, we see that the function is looking for the value of -0x35010ff3, which in decimal is -889262067.

chmod +x crackme8
./crackme8 -889262067

Finish