Writeup to the FLARE-ON 5 challenge
Tags: Infosec, Ctf, Flare On, Python, Reverse Engineering

Writeup to the FLARE-ON 5 challenge

Contents

Introduction dem contests Epilogue Acknowledgements

Introduction

On the 15th of August 2018, FireEye launched their fifth annual FLARE-ON competition, in where contestants are given six weeks to work out the flags to a number of reverse engineering problems. Sadly, I was only able to work out three flags out of the total twelve reverse engineering problems. My reasons *cough* excuses *wheeze* as to why this is are as follows:

I’m a n00b at reversing. This is unacceptable, I gotta stop killing brain cells with silly stuff on the internet, and start going through the FLARE-ON archives and reading up on RCE literature (more on that later). I just found out about the contest on the 22nd of September, which was like five weeks after the thing got started. At the moment, I’m looking for a job. A lot of my time is spent studying for certifications and doing volunteer work that’ll (hopefully) land me a position in helldesk (which is still better than nothing).

This is just neophyte postmortem. The methods that I used to work out a flag for each given problem lacked finesse and elegance. A far more accurate and comprehensive discussion of the solutions are provided by Nick Harbour and the FLARE-ON team themselves.

Not bad for a n00b 😊

dem contests

Rigging the registration

The first one was pretty easy. I just downloaded the 7-Zip archive and extracted the MinesweepChampionshipRegistration.jar file. I literally just looked up “online Java decompiler” and uploaded the JAR file to the it and got InviteValidator.java

Contents of “InviteValidator.java”

It took me about two seconds to work out that the flag is: GoldenTicket2018@flare-on.com

Ultimate Minesweeper

I downloaded the 7-Zip archive for this challenge, extracted it and got an .NET assembly called UltimateMinesweeper.exe . After a few hours of experimenting with different possible solutions, I discovered a technique that got me the flag.

Ultimate Minesweeper has about 30-by-30 squares, resulting in a total of 900 squares. The player has to work out all non-mine riddled squares. If a square with a mine was selected, the game would exit.

Assuming that there are three non-mine riddled squares (which is the case) and that my maths are correct, then the probability of selecting the correct squares by mere chance is:

sampling without replacement

… fat chance! 😲

Ultimate Minesweeper really lived up to its name, in the sense that the only way to beat it was to cheat. I opened up the UltimateMinesweeper.exe assembly in dnSpy and came up with a kludge-like solution. I navigated to the SquareRevealedCallback function and removed a bit of code that closed the game when an mine square was selected.

what I “edited out”

me patching ultimate minesweeper irl ;-)

I then saved the module to UltimateMinesweeperHaxxed.exe and proceeded to click on many of the squares like mad with my laptop’s touchscreen, eventually revealing the “non-mine” squares, which is basically the solution.

They didn’t call it “Ultimate Minesweeper” for nothin’

I then opened up the original UltimateMinesweeper.exe assembly and clicked on the non-mine squares and finally got the flag.

Hey, how do you think white people get ahead? 😉

FLEGGO

I downloaded FLEGGO.7z and extracted its contents. FLEGGO.zip came out, so I extracted that and got this:

Wow, that’s a lot of binaries to examine!

I turned to the wisdom of Twitter users, and searched for #flareon5 FLEGGO

One user tweeted out a one-liner for the *NIX shell

Another user tweeted out a directory listing image files, with parts of each image’s filename redacted.

A third user suggested that the contender use FireEye’s FLOSS tool.

A fourth user suggested that an OCR script ought to be deployed to automate… something.

Finally, a fifth Twitter user made it all clear for me. They said that each pictured had a number, which is associated with the order of a character in the console output when running wine <exectuable> .

Like with Ultimate Minesweeper, it took me a while to work out a solution, and it eventually came to me. Each executable asks for a password, which can be extracted via the command strings -e l <executable name>

Extracting the “password” from a FLEGGO executable

In all cases, the password is the very last string outputted on the terminal (in this particular case, it’s ZImIT7DyCMOeF6 ). I then used WINE to run an executable, which resulted in some console output and the following image:

Ohai Mr. LEGO man

On the last line, the console output associated a letter (“w” in this case) to the image.

The last line of the console prints the image’s filename, followed by “=>”, which is followed up by a letter (in this case, “w”). On the LEGO image, the top-left corner has a number on it. The letter “w” is just a bigger part of the flag’s string, and the number (seven “7” in this case) indicates its place.

Now I just have to automate the first part of this. I wrote a Python script that for each binary will extract the password with the strings command, then will run the binary in question, input its associated password, and finally extract a cropped version of the image.

It’s almost like @th3j35t3r wrote this XD

There are forty-nine (49) executable modules, and therefore forty-nine characters and images extracted in total. The script outputted each image’s filename and it’s associated character. I then organised them in a spreadsheet, with the place on the first column and the letter on a second column. Finally, I manually put the flag together by putting an associated letter with its place as defined by the top-left corner number, and finally got the flag mor3_awes0m3_th4n_an_awes0me_p0ssum@flare-on.com

Epilogue

Even though I didn’t get to finish all the challenges, I had fun doing this, and it made me think critically. I had to think “outside the box” and differently from standard DFIR and RCE techniques which typically involves an analyst documenting the behaviour of a programme.

I can’t wait for next year’s tournament! I’m gonna hit the books, reverse engineer everything in sight (whist following copyright laws 😉) and go over FLARE-ON and other CTF archives!

Further Reading

Like I mentioned in the Introduction, I need to read up on RCE literature. Here are some books that myself and others can use to hopefully conquer the next FLARE-ON challenge:

Reversing: Secrets of Reverse Engineering by Eldad Eilam (ISBN-13: 978–0764574818) https://www.amazon.com/Reversing-Secrets-Engineering-Eldad-Eilam/dp/0764574817

Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation by Bruce Dang (ISBN-13: 978–1118787311) https://www.amazon.com/Practical-Reverse-Engineering-Reversing-Obfuscation/dp/1118787315/

Practical Malware Analysis: A Hands-On Guide to Dissecting Malicious Software 1st Edition by Andrew Honig and Michael Sikorski (ISBN-13: 978–1593272906) https://www.amazon.com/Practical-Malware-Analysis-Hands-Dissecting/dp/1593272901/

The IDA Pro Book: The Unofficial Guide to the World’s Most Popular Disassembler Second Edition by Chris Eagle (ISBN-13: 978–1593272890) https://www.amazon.com/IDA-Pro-Book-Unofficial-Disassembler/dp/1593272898/

xchg rax,rax 1st Edition by xorpd (ISBN-13: 978–1502958082) https://www.amazon.com/xchg-rax-xorpd/dp/1502958082/

Malware Data Science: Attack Detection and Attribution by Joshua Saxe and Hillary Sanders (ISBN-13: 978–1593278595) https://www.amazon.com/Malware-Data-Science-Detection-Attribution/dp/1593278594/

Acknowledgements

I’d like to thank the aforementioned Twitter users for indirectly helping me solve the FLEGGO challenge.