This challenge was really fun, because it required us to go back to basics. It's a 64-bit binary, so (our version of) IDA's hexrays decompiler couldn't decompile it. Additionally, to add some old-school flavor, (our version of) FLAIR choked on Debian Wheezy's 64-bit libraries, so we didn't even apply flirt sigs. The result was some fun, old-school binary reversing! It turned out not to be very difficult, but still super fun.
When running the binary, it's pretty clear that it decrypts and dumps a file, then launches vlc to play it. Here's the output of a given run:
When running the binary, it's pretty clear that it decrypts and dumps a file, then launches vlc to play it. Here's the output of a given run:
$ echo asdf | ./securefilelock
Welcome to Secure File Lock
Playing 'Ethereal Awakening' by Project Divinity (CC BY-NC-SA 2.5)
Please enter your password. (max length = 32):
Processing.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
And here it is with some strace goodness:
$ echo asdf | ./securefilelock
Welcome to Secure File Lock
Playing 'Ethereal Awakening' by Project Divinity (CC BY-NC-SA 2.5)
Please enter your password. (max length = 32):
Processing.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
yans@lath|~/code/security/mozilla/sfl$ echo asdf | strace ./securefilelock
execve("./securefilelock", ["./securefilelock"], [/* 40 vars */]) = 0
uname({sys="Linux", node="lath", ...}) = 0
brk(0) = 0x1028000
brk(0x10291a0) = 0x10291a0
arch_prctl(ARCH_SET_FS, 0x1028880) = 0
brk(0x104a1a0) = 0x104a1a0
brk(0x104b000) = 0x104b000
fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 5), ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f53755e8000
write(1, "Welcome to Secure File Lock\n", 28Welcome to Secure File Lock
) = 28
write(1, "Playing 'Ethereal Awakening' by "..., 67Playing 'Ethereal Awakening' by Project Divinity (CC BY-NC-SA 2.5)
) = 67
write(1, "Please enter your password. (max"..., 47Please enter your password. (max length = 32):
) = 47
fstat(0, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f53755e7000
read(0, "asdf\n", 4096) = 5
write(1, "Processing......................"..., 680Processing.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
) = 680
getpid() = 7048
open("/tmp/sf.z6GiAx", O_RDWR|O_CREAT|O_EXCL, 0600) = 3
fcntl(3, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
fstat(3, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f53755e6000
lseek(3, 0, SEEK_CUR) = 0
write(3, "QT>+\t2\f\36v?k^iX\35\5I\302\f'\10cjnH~\ndhw\r+"..., 6680576) = 6680576
write(3, "H3,\27\230A\n\333l~'l#\205\4]NL,b\23\340PQ\365\354\212\205\246\333 \363"..., 1604) = 1604
close(3) = 0
execve("/usr/bin/vlc", ["/usr/bin/vlc", "--play-and-exit", "/tmp/sf.z6GiAx"], [/* 40 vars */]) = -1 ENOENT (No such file or directory)
exit_group(0) = ?
We can clearly see it writing the file and calling vlc, and by looking at IDA, we can quickly see the decryption loop at 00000000004011A7:
 |
| decryption loop |
It's an xor. So now we just need to figure out what the key is, and we got the challenge. That turned out to be another fun part. As you can see in the loop above, it's looping over the file_contents (the encrypted file in .data) of length file_length (a value in .data), the value of which is 6682180. So we're looking for a 6682180-byte version of 'Ethereal Awakening' by Project Divinity. As luck would have it, googling for the name and the number produced a few results, one of which was some random torrent. We grabbed the encrypted file from memory, downloaded the torrent (file available here), and came up with the key "yciNhAh" by xoring the encrypted file with the original. Of course, we could have just xored the header (49 44 33 03 00 00 00), but what's the fun in that?
by Zardus (noreply@blogger.com) at January 26, 2012 12:35 PM
