TryHackMe- Compiled
Tags: community, cybersecurity, learning, c
Published: 2024-03-29 21:27:30

> Strings can only help you so far.

Honestly, I really enjoyed this introduction. Simply did.

Hey!👋 Do you want to have a grasp of reverse engineering? Then continue to read this post about [TryHackMe Compiled challenge](https://tryhackme.com/r/room/compiled).🫶

After downloading the file, the first step was to rename the file- to ease my work 😺. 
Then, my Sherlock Holmes spirit made me want to find out what type of file was that.👇

![file](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u5hayjs8vcumld9ty6hm.png) 
We can see it is an **E**xecutable and **L**inker **F**ile. 
After that, I want to give it 777 rwx rights, in order to be able to execute it.

![777](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t8ehz9qsnabum58tobqe.png)

Let's run it.🤓

![run](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/69lre1zh7570lozm7m6q.png)

It's asking us for a password. My first instinct is to try a buffer overflow. 🐸


![buffer](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k1a65t2ul10y5cc5b12u.png)

Let's try to see if the password is hidden somewhere in the strings.

![strings](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/18d2uzlpbdj77qrtquad.png)

Somewhere there is written Password and it seems we have a great hint.

Let's see what our beloved software reverse engineering framework [Ghidra](https://github.com/NationalSecurityAgency/ghidra) has to show.


![decompile](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4tw5weztmltl1my4t90d.png)

We'll work only with Decompile part, as the Defined Strings tab show us the same content as earlier ☝️.

🎯Now, let's break the code down:

1. We are asked to provide an input
2. The input shall contain DoYouEven and a string (that's why we have **%s**❗).  
Given that at the end we have CTF, the requested password _should_ end with CTF. The input is **stored** in local_28. local_28 in our case is an array of **32** char elements. (look at the char local_28 [32] declaration)💡 _local_28_ is the name assigned to the array.

3. The condition (-1 < iVar1) checks if iVar1 is greater than -1.
4. strcmp compares the string in local_28 with "__dso_handle" 
5. if both conditions (point 3 and point 4) are true, then the message "Try again!" is returned
6. strcmp compares the string in local_28 with "_init".
7. if the strings are identical, then message "Correct!" is printed.

strcmp is a function used to compare strings.
strcmp returns 0 when the strings are identical.❗

_Addendum to point 2_😺:
We can break DoYouEven%sCTF into 2 parts:

- DoYouEven
- %sCTF

The scan function (**__isoc99_sscanf("DoYouEven%sCTF", local_28**) extracts the portion of local_28 between DoYouEven and the first occurence of CTF. Also, **%s** captures any character, but does not take into account the whitespace❕

Let's test it do a test with the string containing CTF: 

![test](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5dnid4ovm4dkje098n2b.png)

and now the string without CTF
![pass](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/yfi176v3rfive83791s6.png)

Bingo!🤩 We got our answer!