Official Golfer - Part 1 Discussion

HTB Content Challenges
1

Official discussion thread for Golfer - Part 1. Please do not post any spoilers or big hints.

2

I have honestly no idea where to start here. Is there a serious way to get the flag or did you just use what is easily visible and brute forced it?

3

The challenge is located in the section “reversing”. A typical solution path for the “reversing” challenges: find out the language used e.g. high level, low level, byte code, compiled code, … Next you can try to read and understand the code. Another option is to run the code and trace the code flow.

4

For me personally it sounds like a stego crack-the-code style challenge.

Having solved it, I still don’t understand the logic behind.

5

Yes, you are right. This challenge has also a stego aspect. The code which prints outs the flag exists but not so easy to read.

6

I had to use IDA to get the binary to disassemble properly. Once the binary is disassembled, you’ll have to look up Linux system calls to understand the logic, but it’s straightforward.

7

Any help here would be appreciated. I have been able to continue execution using edb past the first few steps by changing the z flag and changing the int 0x80 calls to nops, but I do not know what I need to be looking for or editing beyond that. I have looked at this in edb, ghidra, and ida free but I’m not sure what exactly I am looking at with the disassembled code. The top of the stack is set to a specific value and EAX seems to be set to the same during execution which usually ends in the program ending. I am stuck!!

8

Any nudges? I’ve had no luck with ghidra or ida, and I’ve gone pretty deep trying to manipulate the hexcode with bless and this site but no luck.

9

Hint: Analyze the code from the first byte to the last one (e.g. with ghidra). Make sure it’s disassembled properly (in ghidra, manual steps might be necessary)

11

This challenge has two solutions and brute-force is unintended way

12

use Radar2 , u’ll see that the code jump to an exit , make it not to do, for example use NOPs

1 Like
13

I would welcome some help.
It seems I need to mess with the elf format yet my attempts failed.
Help would be much appreciated.
my contact details for help, if its not allowed here:
rmjhin@gmail.com

15

hey i found the exit instruction, change it to NOPs
when i run the program segfault, did you manage to make the program print the flag?
ps: already constracted the correct flag

16

Yeah , when patch it , it prints the flag