TryHackMe - Classic Passwd Writeup
Tags: tryhackme, security, cybersecurity, ctf
Published: 2021-09-28 10:37:00

<a href="https://i.imgur.com/ld9qJRt.png" style="display: block; padding: 1em 0; text-align: center; "><img alt="" border="0" width="600" data-original-height="256" data-original-width="256" src="https://i.imgur.com/SfAaZVa.jpg"/></a>

## Intro
***"I forgot my password, can you give me access to the program?"***

In this TryHackMe room you will be tasked with cracking the password to a binary by bypassing the authentication sequence. There are multiple ways to solve this CTF, but I will go over a few of the ways I solved it.



## Scenario

*Practice your skills in reversing and get the flag bypassing the login.*

## Questions

## Task: What is the flag?

### Method 1: Convert the Hex Values to Decimal
To start things off, I pull the strings to find what catches my eye, scrolling through the strings I find *THM{ %d%d }*. After doing countless CTFs I already know that flags are typically formatted this way (e.g *flag{}, THM{}, htb{}*), *%d* is a string format that takes an argument and prints it as an integer we will see that later on in Ghidra. You can read more about %d [**here**](https://www.quora.com/What-does-d-mean-in-the-C-programming-language?share=1).
![img](https://i.imgur.com/5kVg9Dt.jpg)

After importing the file into Ghidra and head over to the main function we can see that two functions are called, ***vuln*** and ***gfl***. For this method I will only be focusing on the *gfl* function. Once in the function we can see the printf function where the flag and the hex arguments that are being formatted into the flag string with *%d*. If we convert the hex values to decimal (0x638a78 = ***65235128496***) and (0x2130 = ***8496***) then append them to the string we get the full flag ***THM{652351284968496}***.

![img](https://i.imgur.com/L8HOCH0.png)

---

### Method 2: ltrace

For the second method I use a command line debugging utility called [**ltrace**](https://www.man7.org/linux/man-pages/man1/ltrace.1.html). After running the binary through ltrace it will ask the user to input the username. After doing so we can see that there is a *strcmp* function called with compares the users input to the correct username (***AGB6js5d9dkG7***). We can test this by executing the binary again and using the same username from the comparison and we can see that it is valid and prints the flag.

![img](https://i.imgur.com/fDZNyVX.jpg)

---

### Method 3: Swap the Jump Instruction

The third method involves changing the jump instruction that leads to the "*Welcome*" message and the flag. In this method we will focus on the ***vuln*** function, this is where the user input is handled along with the if statement that handles the authentication. Below is the if statement and jump condition that handles the authentication. We can see that at address *00101261* there is a ***JNZ*** instruction which leads to the address *00101271* which prints the *Authentication Failure* message.

![img](https://i.imgur.com/ZTCB5j2.jpg)
![img](https://i.imgur.com/YjWOeKI.jpg)

We can bypass this by switching the JNZ condition to JZ and patching the binary, which will essentially have the opposite output than that of the original program. Take a look back at the *ltrace* screenshot, you can see that in the original binary for the first comparison the word "*test*" was entered and was compared with the expected input the program returned a status code of *51*. When the correct username is entered and compared the status code is 0. By swapping the jump condition, the user can input the wrong username, and the program will still print the *Welcome* message and flag. 
 
![img](https://i.imgur.com/pgkiWaw.jpg)
![img](https://i.imgur.com/FaKQM7F.jpg)

## I am actively looking for work, feel free to connect with me and lets talk business. Also feedback is appreciated! Thank you!

---

# Connect With Me :slightly_smiling_face: 

[![Website](https://img.shields.io/website?label=IAANSec&style=for-the-badge&url=https%3A%2F%2Fiaansec.com&color=green)](https://iaansec.com) [![Website](https://img.shields.io/website?label=dev.to&style=for-the-badge&url=https%3A%2F%2Fdev.to/l0wk3y&color=orange)](https://dev.to/l0wk3y) [![Website](https://img.shields.io/website?label=GitHub&style=for-the-badge&url=https%3A%2F%2Fgithub.com/l0wk3y&color=yellow)](https://github.com/L0WK3Y-IAAN) [![Website](https://img.shields.io/website?label=LinkedIn&style=for-the-badge&url=https%3A%2F%2Flinkedin.com/in/l0wk3yiaansec&color=blue)](https://www.linkedin.com/in/l0wk3yiaansec)