EBCTF Finals 2013 – Bin200

For this challenge you’re given a simple win32 executable. A strings dump shows it’s a Perl2EXE binary. Additionally, we can see there is a referenced string “RunPerl.” Jumping to where it is referenced, we see other strings that make it clear this is an imported function from “p2x5123.dll”

RunPerl code section

We set our breakpoint and run to it. Following the call, we enter the p2exe dll. In IDA’s module list, we can see that this dll is located in a temporary folder. Running it through PEID we can see it is UPX-packed, but that’s fine as we are performing dynamic analysis. We follow the execution path through the DLL without stepping, and we can see that eventually it prints a message that says “Debug mode enabled.” We figure debug info is helpful, and we insert a 1 into the memory address designated as the debug flag. Stepping through, we see some code that references file extensions, and then jumps over a large block of file-writey-looking-code(we can see this through strings in the referenced functions). We decide to nop the jz.

Extension Check Code Section

With this jz nopped…

1
2
3
4
5
6
7
8
9
10
11
12
13
14
P2X: Debug mode enabled - V090508
P2X: Expanded module filename = C:\Users\qt\Downloads\ebCTF_BIN200.exe
GetTempDir: returning C:\Users\qt\AppData\Local\Temp/p2xtmp-6436
ISEXT_Init: filename = p2x_stub.lib
ISEXT_Init: mkdir C:\Users\qt\AppData\Local\Temp/p2xtmp-6436
ISEXT_Init: mkdir C:\Users\qt\AppData\Local\Temp/p2xtmp-6436/Tk
ISEXT_Init: filename = p2x_header.pm
ISEXT_Init: filename = p2x_pre_exec_message
ISEXT_Init: filename = p2x_trial_message
ISEXT_Init: filename = p2x_exec_command
ISEXT_Init: filename = p2x_info.pm
ISEXT_Init: filename = _main.pl
ISEXT_Init: filename = P2XDLL/p2x5123.dll
P2X: ISEXT_Init done

We can browse to our tmp directory and see all the files written. There’s a bunch of p2x junk, and then _main.pl. The code from _main.pl is below, and the flag is obvious(view raw if your resolution is too thin).

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
#!/usr/bin/perl
print "\n[*] ebCTF BIN 200\n".
" No comment...\n\n";
$secret = "Sup3RSeCr3tStuFf!";
print "[*] What is the secret? ";
$answer = <STDIN>;
chomp($answer);
if ($answer eq $secret) {
print "\n[*] Yes, that is correct! However that was not the goal of this challenge.\n".
" Did you know that compiled code does not contain any comments?\n";
} else {
print "\n[*] Isn't that cute...but it is WRONG!.\n";
}
# W e l l , w e l l, i t s e e m s t h e r e a c t u a l l y i s a c o m m e n t . . .
#
# .----------------. .----------------. .----------------. .----------------.
#| .--------------. | .--------------. | .--------------. | .--------------. |
#| | _________ | | | ______ | | | ______ | | | _________ | |
#| | |_ ___ | | | | |_ _ \ | | | .' ___ | | | | | _ _ | | |
#| | | |_ \_| | | | | |_) | | | | / .' \_| | | | |_/ | | \_| | |
#| | | _| _ | | | | __'. | | | | | | | | | | | |
#| | _| |___/ | | | | _| |__) | | | | \ `.___.'\ | | | _| |_ | |
#| | |_________| | | | |_______/ | | | `._____.' | | | |_____| | |
#| | | | | | | | | | | | |
#| '--------------' | '--------------' | '--------------' | '--------------' |
# '----------------' '----------------' '----------------' '----------------'
# .----------------. .----------------. .----------------. .----------------.
#| .--------------. | .--------------. | .--------------. | .--------------. |
#| | _________ | | | __ | | | _________ | | | ________ | |
#| | |_ ___ | | | | .' _/ | | | |_ ___ | | | | |_ ___ `. | |
#| | | |_ \_| | | | | | | | | | |_ \_| | | | | | `. \ | |
#| | | _| | | | < < | | | | _| _ | | | | | | | | |
#| | _| |_ | | | | |_ | | | _| |___/ | | | | _| |___.' / | |
#| | |_____| | | | `.__\ | | | |_________| | | | |________.' | |
#| | | | | | | | | | | | |
#| '--------------' | '--------------' | '--------------' | '--------------' |
# '----------------' '----------------' '----------------' '----------------'
# .----------------. .----------------. .----------------. .----------------.
#| .--------------. | .--------------. | .--------------. | .--------------. |
#| | ______ | | | ________ | | | ______ | | | ____ | |
#| | |_ _ \ | | | |_ ___ `. | | | |_ _ \ | | | .' '. | |
#| | | |_) | | | | | | `. \ | | | | |_) | | | | | .--. | | |
#| | | __'. | | | | | | | | | | | __'. | | | | | | | | |
#| | _| |__) | | | | _| |___.' / | | | _| |__) | | | | | `--' | | |
#| | |_______/ | | | |________.' | | | |_______/ | | | '.____.' | |
#| | | | | | | | | | | | |
#| '--------------' | '--------------' | '--------------' | '--------------' |
# '----------------' '----------------' '----------------' '----------------'
# .----------------. .----------------. .----------------. .----------------.
#| .--------------. | .--------------. | .--------------. | .--------------. |
#| | ______ | | | ______ | | | _______ | | | ______ | |
#| | / ____ `. | | | .' ___ | | | | | ___ | | | | .' ____ '. | |
#| | `' __) | | | | / .' \_| | | | |_/ / / | | | | (____) | | |
#| | _ |__ '. | | | | | | | | / / | | | '_.____. | | |
#| | | \____) | | | | \ `.___.'\ | | | / / | | | | \____| | | |
#| | \______.' | | | `._____.' | | | /_/ | | | \______,' | |
#| | | | | | | | | | | | |
#| '--------------' | '--------------' | '--------------' | '--------------' |
# '----------------' '----------------' '----------------' '----------------'
# .----------------. .----------------. .----------------. .----------------.
#| .--------------. | .--------------. | .--------------. | .--------------. |
#| | ______ | | | ____ | | | _________ | | | __ | |
#| | .' ____ '. | | | .' __ '. | | | |_ ___ | | | | / \ | |
#| | | (____) | | | | | (__) | | | | | |_ \_| | | | / /\ \ | |
#| | '_.____. | | | | .`____'. | | | | _| | | | / ____ \ | |
#| | | \____| | | | | | (____) | | | | _| |_ | | | _/ / \ \_ | |
#| | \______,' | | | `.______.' | | | |_____| | | ||____| |____|| |
#| | | | | | | | | | | | |
#| '--------------' | '--------------' | '--------------' | '--------------' |
# '----------------' '----------------' '----------------' '----------------'
# .----------------. .----------------. .----------------. .----------------.
#| .--------------. | .--------------. | .--------------. | .--------------. |
#| | _______ | | | _______ | | | __ | | | ______ | |
#| | | ___ | | | | | _____| | | | / | | | | |_ _ \ | |
#| | |_/ / / | | | | |____ | | | `| | | | | | |_) | | |
#| | / / | | | '_.____''. | | | | | | | | | __'. | |
#| | / / | | | | \____) | | | | _| |_ | | | _| |__) | | |
#| | /_/ | | | \______.' | | | |_____| | | | |_______/ | |
#| | | | | | | | | | | | |
#| '--------------' | '--------------' | '--------------' | '--------------' |
# '----------------' '----------------' '----------------' '----------------'
# .----------------. .----------------. .----------------. .----------------.
#| .--------------. | .--------------. | .--------------. | .--------------. |
#| | _________ | | | _____ | | | __ | | | ________ | |
#| | |_ ___ | | | | / ___ `. | | | / | | | | |_ ___ `. | |
#| | | |_ \_| | | | |_/___) | | | | `| | | | | | | `. \ | |
#| | | _| _ | | | .'____.' | | | | | | | | | | | | | |
#| | _| |___/ | | | | / /____ | | | _| |_ | | | _| |___.' / | |
#| | |_________| | | | |_______| | | | |_____| | | | |________.' | |
#| | | | | | | | | | | | |
#| '--------------' | '--------------' | '--------------' | '--------------' |
# '----------------' '----------------' '----------------' '----------------'
# .----------------. .----------------. .----------------. .----------------.
#| .--------------. | .--------------. | .--------------. | .--------------. |
#| | __ | | | ______ | | | ______ | | | _ _ | |
#| | / | | | | / ____ `. | | | .' ____ \ | | | | | | | | |
#| | `| | | | | `' __) | | | | | |____\_| | | | | |__| |_ | |
#| | | | | | | _ |__ '. | | | | '____`'. | | | |____ _| | |
#| | _| |_ | | | | \____) | | | | | (____) | | | | _| |_ | |
#| | |_____| | | | \______.' | | | '.______.' | | | |_____| | |
#| | | | | | | | | | | | |
#| '--------------' | '--------------' | '--------------' | '--------------' |
# '----------------' '----------------' '----------------' '----------------'
# .----------------. .----------------. .----------------. .----------------.
#| .--------------. | .--------------. | .--------------. | .--------------. |
#| | __ | | | _______ | | | ____ | | | ______ | |
#| | / \ | | | | _____| | | | .' __ '. | | | .' ____ \ | |
#| | / /\ \ | | | | |____ | | | | (__) | | | | | |____\_| | |
#| | / ____ \ | | | '_.____''. | | | .`____'. | | | | '____`'. | |
#| | _/ / \ \_ | | | | \____) | | | | | (____) | | | | | (____) | | |
#| ||____| |____|| | | \______.' | | | `.______.' | | | '.______.' | |
#| | | | | | | | | | | | |
#| '--------------' | '--------------' | '--------------' | '--------------' |
# '----------------' '----------------' '----------------' '----------------'
# .----------------. .----------------. .----------------.
#| .--------------. | .--------------. | .--------------. |
#| | ____ | | | ____ | | | __ | |
#| | .' '. | | | .' '. | | | \_ `. | |
#| | | .--. | | | | | .--. | | | | | | | |
#| | | | | | | | | | | | | | | | > > | |
#| | | `--' | | | | | `--' | | | | _| | | |
#| | '.____.' | | | '.____.' | | | /__.' | |
#| | | | | | | | | |
#| '--------------' | '--------------' | '--------------' |
# '----------------' '----------------' '----------------'