{"id":43,"date":"2011-06-13T06:53:15","date_gmt":"2011-06-12T21:53:15","guid":{"rendered":"http:\/\/emeth.jp\/diary\/?p=43"},"modified":"2014-02-25T02:47:43","modified_gmt":"2014-02-24T17:47:43","slug":"defcon-19-ctf-binary-l33tness-100-writeup","status":"publish","type":"post","link":"https:\/\/emeth.jp\/diary\/2011\/06\/defcon-19-ctf-binary-l33tness-100-writeup\/","title":{"rendered":"DEFCON 19 CTF Binary L33tness 100 writeup"},"content":{"rendered":"

\u554f\u984c\u6587\uff1a Your journey begins
\n\u30d5\u30a1\u30a4\u30eb\u306f\u307e\u3068\u3081\u3066\u516c\u958b\u3057\u3066\u3044\u308b\u65b9\u304c\u3044\u308b\u306e\u3067\u305d\u3061\u3089\u3067\u3069\u3046\u305e<\/a>\u3002
\nb100\u3067\u59cb\u307e\u308b\u3084\u3064\u3067\u3059\u3002<\/p>\n

<\/p>\n

\u3053\u306e\u30d5\u30a1\u30a4\u30eb\u306f\u4f55\u3058\u3083\u308d\u306a\u3002<\/p>\n

\r\ntkito@ubuntu:~\/CTF19\/b100$ file b100_6817e51fa3b60f176b56\r\nb100_6817e51fa3b60f176b56: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU\/Linux 2.6.32, stripped\r\n<\/pre>\n
\u5b9f\u884c\u30d5\u30a1\u30a4\u30eb\u3060\u3068\u3044\u3046\u306e\u3067\u5b9f\u884c\u3057\u3066\u307f\u308b\u3002<\/p>\n
\r\ntkito@ubuntu:~\/CTF19\/b100$ chmod +x b100_6817e51fa3b60f176b56\r\ntkito@ubuntu:~\/CTF19\/b100$ .\/b100_6817e51fa3b60f176b56\r\n.\/b100_6817e51fa3b60f176b56 [1-11|all]\r\n<\/pre>\n
\u8a66\u3057\u306b\u30d1\u30e9\u30e1\u30fc\u30bf\u3068\u3057\u30661\u3092\u5165\u308c\u3066\u307f\u308b\u3068\u2026<\/p>\n
\r\ntkito@ubuntu:~\/CTF19\/b100$ .\/b100_6817e51fa3b60f176b56 1\r\nH4sICJmMlU0AA2JpbjItYQAAGYDmfzd6vK8nHAADiX4awcXXBwAAAAAAVgAAAAAAAABE\/zLqAD+RRYRoO97epg8j1uh8YELiOq3V\r\nAGLLApTK6rlYLEJUfbuFA7AjiEibibmCYY3LzZtNmjivC1gt6wA+ZbuLo8SkO\/lzVk2VQBa6XUP8kWbfjjMD5Gq5OLQ10TekvQDS\r\nPV+do8rAY6zuu1A21HFTamb8rvPM5dmHusPFPemVy\/FSwj8szTQ9k7LuEIDhBarqs4w36+p76Pcr3k+RF9pSx42qRV4ojtLjAbR3\r\n(\u4ee5\u4e0b\u7565)\r\n<\/pre>\n
\u53f3\u306b\u306f\u307f\u51fa\u3057\u3066\u3057\u307e\u3063\u3066\u3044\u308b\u306e\u306f\u6c17\u306b\u3057\u306a\u3044\u3002
\n\u3053\u3093\u306a\u611f\u3058\u3067\u3069\u308f\u30fc\u3063\u3068\u30c6\u30ad\u30b9\u30c8\u304c\u51fa\u529b\u3055\u308c\u308b\u304c\u3001\u3088\u304f\u898b\u308b\u3068\u7d75\u304c\u66f8\u3044\u3066\u3042\u308b\u3063\u307d\u3044\u3002
\n\u4e00\u90e8\u3092\u5207\u308a\u3060\u3057\u305f\u306e\u304c\u4ee5\u4e0b\u306e\u753b\u50cf\u3002
\n
\n\"\"
\n<\/a>
\n\u305a\u3063\u3068\u898b\u3066\u308b\u3068\u3061\u3087\u3063\u3068\u304d\u3082\u3044\u3002
\n\u3053\u3093\u306a\u306e\u304c14\u56de\u7e70\u308a\u8fd4\u3055\u308c\u3066\u3044\u308b\u3002
\n\u306a\u304a\u30011\uff5e11\u307e\u3067\u5168\u3066\u540c\u3058\u3088\u3046\u306a\u51fa\u529b\u304c\u5f97\u3089\u308c\u308b\u3002
\n\u69cb\u6210\u6587\u5b57\u3092\u898b\u3066\u307f\u308b\u3068\u3001\u30b9\u30da\u30fc\u30b9\u304c\u5165\u3063\u3066\u305f\u308a100\u6587\u5b57\u3067\u6539\u884c\u3055\u308c\u3066\u305f\u308a\u5f8c\u308d\u306e\u65b9\u306f\u30d1\u30c7\u30a3\u30f3\u30b0\u306a\u306e\u304b@\u3067\u66f8\u304b\u308c\u3066\u305f\u308a\u3057\u305f\u3051\u308c\u3069\u3001\u3069\u3046\u898b\u3066\u3082BASE64\u3067\u3059\u3002\u672c\u5f53\u306b\u3042\u308a\u304c\u3068\u3046\u3054\u3056\u3044\u307e\u3057\u305f\u3002
\n\u3068\u3044\u3046\u308f\u3051\u3067\u30c7\u30b3\u30fc\u30c9\u3059\u308b\u3002
\n\u3061\u306a\u307f\u306b\u5404\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u5165\u308c\u305f\u969b\u306e\u51fa\u529b\u30921.txt\uff5e11.txt, all.txt\u3068\u3057\u3066\u4fdd\u5b58\u3057\u3066\u3044\u308b\u3002
\n\u4ee5\u4e0b1\uff5e11\u307e\u3067\u307e\u3068\u3081\u3066\u884c\u3051\u308b\u3068\u3053\u308d\u307e\u3067\u4e00\u6c17\u306b\u51e6\u7406\u3002<\/p>\n
\r\ntkito@ubuntu:~\/CTF19\/b100$ for i in `seq 1 11`; do base64 -id $i.txt > b100_1_`printf "%02d" $i`; done\r\ntkito@ubuntu:~\/CTF19\/b100$ file b100_1_*\r\nb100_1_01: gzip compressed data, was "bin2-a", from Unix, last modified: Fri Apr  1 01:28:09 2011\r\nb100_1_02: gzip compressed data, was "bin2-b", from Unix, last modified: Fri Apr  1 01:28:09 2011\r\nb100_1_03: gzip compressed data, was "bin2-c", from Unix, last modified: Fri Apr  1 01:28:09 2011\r\nb100_1_04: gzip compressed data, was "bin2-d", from Unix, last modified: Fri Apr  1 01:28:09 2011\r\nb100_1_05: gzip compressed data, was "bin2-e", from Unix, last modified: Fri Apr  1 01:28:09 2011\r\nb100_1_06: gzip compressed data, was "bin2-f", from Unix, last modified: Fri Apr  1 01:28:09 2011\r\nb100_1_07: gzip compressed data, was "bin2-g", from Unix, last modified: Fri Apr  1 01:28:09 2011\r\nb100_1_08: gzip compressed data, was "bin2-h", from Unix, last modified: Fri Apr  1 01:28:09 2011\r\nb100_1_09: gzip compressed data, was "bin2-i", from Unix, last modified: Fri Apr  1 01:28:09 2011\r\nb100_1_10: gzip compressed data, was "bin2-j", from Unix, last modified: Fri Apr  1 01:28:09 2011\r\nb100_1_11: gzip compressed data, was "bin2-k", from Unix, last modified: Fri Apr  1 01:28:09 2011\r\ntkito@ubuntu:~\/CTF19\/b100$ for i in `seq -w 1 11`; do gzip -cd b100_1_$i > b100_2_$i; done\r\ntkito@ubuntu:~\/CTF19\/b100$ file b100_2_*\r\nb100_2_01: 7-zip archive data, version 0.3\r\nb100_2_02: data\r\nb100_2_03: data\r\nb100_2_04: data\r\nb100_2_05: data\r\nb100_2_06: data\r\nb100_2_07: data\r\nb100_2_08: data\r\nb100_2_09: data\r\nb100_2_10: data\r\nb100_2_11: data\r\ntkito@ubuntu:~\/CTF19\/b100$ 7zr x b100_2_01\r\n\r\n7-Zip (A) 9.04 beta  Copyright (c) 1999-2009 Igor Pavlov  2009-05-30\r\np7zip Version 9.04 (locale=en_US.utf8,Utf16=on,HugeFiles=on,2 CPUs)\r\n\r\nProcessing archive: b100_2_01\r\n\r\nError: Can not open file as archive\r\n<\/pre>\n
1\u30682\uff5e11\u304c\u7121\u95a2\u4fc2\u306a\u308f\u3051\u304c\u306a\u3044\u3001\u3068\u8003\u3048\u3066\u7d50\u5408\u3059\u308b\u3053\u3068\u306b\u3057\u305f\u3002<\/p>\n
\r\ntkito@ubuntu:~\/CTF19\/b100$ cat b100_2_* > b100_3\r\ntkito@ubuntu:~\/CTF19\/b100$ file b100_3\r\nb100_3: 7-zip archive data, version 0.3\r\ntkito@ubuntu:~\/CTF19\/b100$ 7zr x b100_3\r\n\r\n7-Zip (A) 9.04 beta  Copyright (c) 1999-2009 Igor Pavlov  2009-05-30\r\np7zip Version 9.04 (locale=en_US.utf8,Utf16=on,HugeFiles=on,2 CPUs)\r\n\r\nProcessing archive: b100_3\r\n\r\nExtracting  bin2\r\n\r\nEverything is Ok\r\n\r\nSize:       980647\r\nCompressed: 514107\r\n<\/pre>\n
OK!
\n\u3061\u3083\u3063\u3061\u3083\u3068\u9032\u3093\u3067\u3044\u3053\u3046\u3002<\/p>\n
\r\ntkito@ubuntu:~\/CTF19\/b100$ file bin2\r\nbin2: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU\/Linux 2.6.32, not stripped\r\ntkito@ubuntu:~\/CTF19\/b100$ .\/bin2\r\nUzAgUzBSUlkgNDFOVCBOVVRIMU4gQlVUIDQgUDM0TlVUIFMwIFMwUlJZIDQxTlQgTlVUSDFOIEJVVCA0IFAzNE5VVCBTMCBTMFJS\r\nWSA0MU5UIE5VVEgxTiBCVVQgNCBQMzROVVQgUzAgUzBSUlkgNDFOVCBOVVRIMU4gQlVUIDQgUDM0TlVUIFMwIFMwUlJZIDQxTlQg\r\nTlVUSDFOIEJVVCA0IFAzNE5VVCBTMCBTMFJSWSA0MU5UIE5VVEgxTiBCVVQgNCBQMzROVVQgUzAgUzBSUlkgNDFOVCBOVVRIMU4g\r\n(\u4ee5\u4e0b\u7565)\r\n<\/pre>\n
\u307e\u305f\u304b\u3088\uff01
\n\u4eca\u5ea6\u306f\u3053\u3093\u306a\u7d75\u3002
\n\"\"<\/a>
\n\u304d\u3082\u3044\u3067\u3059\u3002
\n\u3084\u3063\u3071\u308aBASE64\u3063\u307d\u3044\u306e\u3067\u30c7\u30b3\u30fc\u30c9\u3002<\/p>\n
\r\ntkito@ubuntu:~\/CTF19\/b100$ .\/bin2 > b100_4.txt\r\ntkito@ubuntu:~\/CTF19\/b100$ base64 -id b100_4.txt > b100_4\r\ntkito@ubuntu:~\/CTF19\/b100$ file b100_4\r\nb100_4: Motorola S-Record; binary data in text format\r\n<\/pre>\n
\u77e5\u3089\u306a\u3044\u30d5\u30a9\u30fc\u30de\u30c3\u30c8\u3067\u306f\u3042\u308b\u3082\u306e\u306e\u3001\u30c6\u30ad\u30b9\u30c8\u30d5\u30a1\u30a4\u30eb\u3063\u307d\u3044\u306e\u3067\u4e2d\u8eab\u3092\u898b\u3066\u307f\u308b\u3002<\/p>\n
\r\ntkito@ubuntu:~\/CTF19\/b100$ cat b100_4\r\nS0 S0RRY 41NT NUTH1N BUT 4 P34NUT S0 S0RRY 41NT NUTH1N BUT 4 P34NUT S0 S0RRY 41NT NUTH1N BUT 4 P34NUT S0 S0RRY 41NT NUTH1N BUT 4 P34NUT\r\n(\u4ee5\u4e0b\u7565)\r\n<\/pre>\n
\u4f55\u3060\u308d\u3046\u3053\u308c\u306f\u3002
\nS0 S0RRY 41NT NUTH1N BUT 4 P34NUT<\/code>\u304c\u5ef6\u3005\u3068\u7e70\u308a\u8fd4\u3055\u308c\u3066\u3044\u308b\u3002
\nsorry\u3068\u304b\u8a00\u3063\u3066\u308b\u3057\u4f55\u304b\u3069\u3063\u304b\u3067\u9593\u9055\u3048\u305f\u306e\u3060\u308d\u3046\u3002
\n\u623b\u3063\u3066\u5225\u306e\u9053\u304c\u306a\u3044\u304b\u3069\u3046\u304b\u3055\u304c\u3059\u3053\u3068\u306b\u3057\u305f\u3002<\/p>\n
\u7d50\u679c\u30aa\u30fc\u30e9\u30a4\u3067\u306f\u3042\u3063\u305f\u304c\u3001\u2191\u306e\u5224\u65ad\u306f\u3088\u304f\u306a\u304b\u3063\u305f\u3002
\n\u4f55\u304c\u3088\u304f\u306a\u304b\u3063\u305f\u304b\u3068\u3044\u3046\u3068\u3001\u5f97\u3089\u308c\u305f\u8b0e\u306e\u6587\u5b57\u5217\u3092\u7121\u610f\u5473\u306a\u3082\u306e\u3060\u3068\u65ad\u3058\u3066\u3057\u307e\u3063\u305f\u3053\u3068\u3002
\n\u3082\u3057\u304b\u3057\u305f\u3089\u3053\u308c\u304c\u6c42\u3081\u308b\u3079\u304dKey\u3060\u3063\u305f\u304b\u3082\u77e5\u308c\u306a\u3044\u3002
\n\u30c0\u30e1\u3082\u3068\u3067\u56de\u7b54\u30dc\u30c3\u30af\u30b9\u306b\u5165\u529b\u3057\u3066\u307f\u308b\u304f\u3089\u3044\u306f\u3059\u308b\u3079\u304d\u3067\u3042\u3063\u305f\u3002
\n\u7d50\u8ad6\u304b\u3089\u8a00\u3046\u3068S0 S0RRY 41NT NUTH1N BUT 4 P34NUT<\/code>\u306fKey\u3067\u306f\u306a\u304b\u3063\u305f\u306e\u3067\u3088\u304b\u3063\u305f\u3002<\/p>\n
\u4e00\u756a\u6700\u521d\u307e\u3067\u623b\u3063\u3066\u3001\u653e\u7f6e\u3057\u3066\u3044\u305fall.txt\u3092\u51e6\u7406\u3057\u3066\u307f\u308b\u3002<\/p>\n
\r\ntkito@ubuntu:~\/CTF19\/b100$ base64 -id all.txt > b100_1_all\r\ntkito@ubuntu:~\/CTF19\/b100$ file b100_1_all\r\nb100_1_all: gzip compressed data, was "bin2-a", from Unix, last modified: Fri Apr  1 01:28:09 2011\r\ntkito@ubuntu:~\/CTF19\/b100$ gzip -cd b100_1_all > b100_2_all\r\ntkito@ubuntu:~\/CTF19\/b100$ file b100_2_all\r\nb100_2_all: 7-zip archive data, version 0.3\r\ntkito@ubuntu:~\/CTF19\/b100$ 7zr x b100_2_all\r\n\r\n7-Zip (A) 9.04 beta  Copyright (c) 1999-2009 Igor Pavlov  2009-05-30\r\np7zip Version 9.04 (locale=en_US.utf8,Utf16=on,HugeFiles=on,2 CPUs)\r\n\r\nProcessing archive: b100_2_all\r\n\r\nfile bin2\r\nalready exists. Overwrite with\r\nbin2?\r\n(Y)es \/ (N)o \/ (A)lways \/ (S)kip all \/ A(u)to rename all \/ (Q)uit? u\r\nExtracting  bin2\r\n\r\nEverything is Ok\r\n\r\nSize:       980647\r\nCompressed: 514107\r\ntkito@ubuntu:~\/CTF19\/b100$ cmp bin2 bin2_1\r\ntkito@ubuntu:~\/CTF19\/b100$\r\n<\/pre>\n
\u7d50\u5c40\u30011\uff5e11\u3068all\u3067\u306f\u5206\u5272\u3057\u3066\u3042\u308b\u304b\u3069\u3046\u304b\u3060\u3051\u3067\u5f97\u3089\u308c\u308b\u30d5\u30a1\u30a4\u30eb\u306f\u307e\u3063\u305f\u304f\u540c\u3058\u3067\u3042\u3063\u305f\u3002
\n\u3067\u306f\u3001\u30d0\u30a4\u30ca\u30ea\u306e\u4e2d\u306b\u30ad\u30fc\u304c\u96a0\u3055\u308c\u3066\u3044\u308b\u304b\u3082\u3057\u308c\u306a\u3044\u3068\u601d\u3044\u3001bin2\u306e\u4e2d\u3092strings\u3067\u898b\u3066\u307f\u305f\u3002<\/p>\n
\r\ntkito@ubuntu:~\/CTF19\/b100$ strings bin2 | less\r\n\/lib\/ld-linux.so.2\r\n__gmon_start__\r\nlibc.so.6\r\n_IO_stdin_used\r\nstdout\r\nfprintf\r\nstrcmp\r\n__libc_start_main\r\nGLIBC_2.0\r\nPTRh\r\nQVh`\r\n[^_]\r\nh3rr0m3y3n4m31zbr0br0gan\r\n(\u4ee5\u4e0bBASE64\u30c7\u30fc\u30bf\u3063\u307d\u304b\u3063\u305f\u306e\u3067\u898b\u308b\u306e\u3092\u4e2d\u6b62)\r\n<\/pre>\n
\u6ce8\u76ee\u90e8\u5206\u306f\u30b3\u30de\u30f3\u30c9\u884c\u4ee5\u5916\u306e\u30cf\u30a4\u30e9\u30a4\u30c8\u90e8\u3002
\n\u5b9f\u884c\u3055\u308c\u308b\u3068\u30c6\u30ad\u30b9\u30c8\u3092\u5410\u304d\u51fa\u3059\u3060\u3051\u3060\u3068\u601d\u3063\u3066\u3044\u305f\u30d7\u30ed\u30b0\u30e9\u30e0\u306b\u4f55\u6545\u304bstrcmp\u304c\u30ea\u30f3\u30af\u3055\u308c\u3066\u3044\u308b\u3002
\n\u3053\u308c\u306f\u3082\u3057\u3084\u3001\u7279\u5b9a\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u5165\u308c\u305f\u5834\u5408\u3068\u5165\u308c\u306a\u3044\u5834\u5408\u3068\u3067\u52d5\u4f5c\u304c\u5206\u304b\u308c\u308b\u306e\u3067\u306f\u306a\u3044\u3060\u308d\u3046\u304b\u3001strcmp\u306f\u30d1\u30e9\u30e1\u30fc\u30bf\u304c\u7279\u5b9a\u306e\u3082\u306e\u3067\u3042\u308b\u304b\u3069\u3046\u304b\u3092\u5224\u5b9a\u3059\u308b\u305f\u3081\u306b\u4f7f\u308f\u308c\u3066\u3044\u308b\u3093\u3060\u3001\u305d\u3046\u306b\u9055\u3044\u306a\u3044\u3001\u3068\u601d\u3063\u3066\u5468\u8fba\u3092\u3088\u304f\u898b\u308b\u3068\u3001BASE64\u30c7\u30fc\u30bf\u306e\u771f\u4e0a\u306b\u3042\u304b\u3089\u3055\u307e\u306b\u602a\u3057\u3044\u6587\u5b57\u5217\u304c\u3002
\n\u3053\u308c\u3092\u5b9f\u884c\u6642\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u3068\u3057\u3066\u5165\u308c\u3066\u307f\u308b\u3068\u2026<\/p>\n
\r\ntkito@ubuntu:~\/CTF19\/b100$ .\/bin2 h3rr0m3y3n4m31zbr0br0gan\r\n H4sICCNylU0AA2JpbjMAFJx\/YNXT\/8df55z3r\/v7ve1uu\/v9rtZaa613a1trrTqraGXq9kurVt6lMiRXJUM4+1GmkoswhLeESbglGcJZpYbkIgzxeUt8h3ARhvA9\/FfZ3b3nvF7P5+PR7e7WugUzwOfOdOumYboocREABNDMLty2eTGI\/6Sll60aNf5BeTBI\/\/0KYGvT\r\n HW15D0bz0gZQZ3nSYwWgtE\/9coUCRS8cMVu6nRpXzv5PVr7VtWfR46NWVlx+rOubxRMmrDz54n0rvjxxa8H9jTs\/zi+gG4s\/Weo17mmEFzO+UyAy8god1v8y6+QXwVv+13pT7LedNSkAxvRnVha7dWiBkXBw4AIypBuu4rN2Tt2BKSBmXZjEf1Q\/mwC7\/\/4O3vmfx\/jr\r\n oQ3f\/t598uVr\/32mcc\/vgXdH1rznZTN\/m3HHa5f+M93ZjBHkZQ1dhmD\/mdtGqetOv\/1l+mUnClatPtnb+17R0eev+Xfv64OMd97cte7fwuf3fHTmkxHrZn2y\/c69t9\/9ctmZujeK9m9ZlDTopoZjz516tjs65rmJ7NNfD7e9qt5R8f3s34s3vDLlpjPOF0T152qrznz5\r\n(\u4ee5\u4e0b\u7565)\r\n<\/pre>\n
\u3060\u3081\u3060\u3063\u305f\u304b\uff01
\n\u3068\u601d\u3063\u3066\u3057\u307e\u3063\u305f\u304c\u3088\u304f\u898b\u308b\u3068\u30011\u884c\u306e\u9577\u3055\u306f\u9055\u3046\u3057\u6587\u5b57\u5217\u3082\u7570\u306a\u308b\u3057\u3067\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u5165\u308c\u306a\u3044\u5834\u5408\u3068\u9055\u3046\u51fa\u529b\u3067\u3042\u308b\u3053\u3068\u306f\u660e\u3089\u304b\u3002
\n\u63cf\u304b\u308c\u3066\u3044\u308b\u7d75\u306f\u3053\u3093\u306a\u3082\u306e\u3002
\n\"\"<\/a>
\nKI\u2606MO\u2606I\u2606YO\uff01
\n\u6bce\u5ea6\u304a\u306a\u3058\u307fBASE64\u306b\u3057\u304b\u898b\u3048\u306a\u3044\u306e\u3067\u3001\u51e6\u7406\u3092\u9032\u3081\u3066\u3044\u304f\u3002<\/p>\n
\r\ntkito@ubuntu:~\/CTF19\/b100$ .\/bin2 h3rr0m3y3n4m31zbr0br0gan > b100_5.txt\r\ntkito@ubuntu:~\/CTF19\/b100$ base64 -id b100_5.txt > b100_5\r\ntkito@ubuntu:~\/CTF19\/b100$ file b100_5\r\nb100_5: gzip compressed data, was "bin3", from Unix, last modified: Thu Mar 31 23:35:15 2011\r\ntkito@ubuntu:~\/CTF19\/b100$ gzip -cd b100_5 > b100_6\r\ntkito@ubuntu:~\/CTF19\/b100$ file b100_6\r\nb100_6: lzop compressed data - version 1.030, LZO1X-999, os: Unix\r\ntkito@ubuntu:~\/CTF19\/b100$ lzop -d -o b100_7 b100_6\r\ntkito@ubuntu:~\/CTF19\/b100$ file b100_7\r\nb100_7: compress'd data 16 bits\r\ntkito@ubuntu:~\/CTF19\/b100$ compress -cd b100_7 > b100_8\r\ntkito@ubuntu:~\/CTF19\/b100$ file b100_8\r\nb100_8: gzip compressed data, was "bin3", from Unix, last modified: Thu Mar 31 07:10:38 2011\r\ntkito@ubuntu:~\/CTF19\/b100$ gzip -cd b100_8 > b100_9\r\ntkito@ubuntu:~\/CTF19\/b100$ file b100_9\r\nb100_9: ARC archive data, uncompressed\r\ntkito@ubuntu:~\/CTF19\/b100$ arc x b100_9\r\nExtracting file: bin3\r\ntkito@ubuntu:~\/CTF19\/b100$ mv bin3 b100_10\r\ntkito@ubuntu:~\/CTF19\/b100$ xz -cd b100_10 > b100_11\r\ntkito@ubuntu:~\/CTF19\/b100$ file b100_11\r\nb100_11: rzip compressed data - version 2.1 (276265 bytes)\r\ntkito@ubuntu:~\/CTF19\/b100$ rzip -d -o b100_12 b100_11\r\ntkito@ubuntu:~\/CTF19\/b100$ file b100_12\r\nb100_12: gzip compressed data, from Unix, last modified: Thu Mar 31 23:10:06 2011\r\ntkito@ubuntu:~\/CTF19\/b100$ gzip -cd b100_12 > b100_13\r\ntkito@ubuntu:~\/CTF19\/b100$ file b100_13\r\nb100_13: POSIX tar archive (GNU)\r\ntkito@ubuntu:~\/CTF19\/b100$ tar xvf b100_13\r\nbin3\r\ntkito@ubuntu:~\/CTF19\/b100$ mv bin3 b100_14\r\ntkito@ubuntu:~\/CTF19\/b100$ file b100_14\r\nb100_14: lzop compressed data - version 1.030, LZO1X-999, os: Unix\r\ntkito@ubuntu:~\/CTF19\/b100$ lzop -d -o b100_15 b100_14\r\ntkito@ubuntu:~\/CTF19\/b100$ file b100_15\r\nb100_15: bzip2 compressed data, block size = 900k\r\ntkito@ubuntu:~\/CTF19\/b100$ bzip2 -cd b100_15 > b100_16\r\ntkito@ubuntu:~\/CTF19\/b100$ file b100_16\r\nb100_16: 7-zip archive data, version 0.3\r\ntkito@ubuntu:~\/CTF19\/b100$ 7zr x b100_16\r\n\r\n7-Zip (A) 9.04 beta  Copyright (c) 1999-2009 Igor Pavlov  2009-05-30\r\np7zip Version 9.04 (locale=en_US.utf8,Utf16=on,HugeFiles=on,2 CPUs)\r\n\r\nProcessing archive: b100_16\r\n\r\nExtracting  bin3\r\n\r\nEverything is Ok\r\n\r\nSize:       272781\r\nCompressed: 274332\r\ntkito@ubuntu:~\/CTF19\/b100$ mv bin3 b100_17\r\ntkito@ubuntu:~\/CTF19\/b100$ file b100_17\r\nb100_17: ARJ archive data, v11, slash-switched, original name: , os: Unix\r\ntkito@ubuntu:~\/CTF19\/b100$ arj x b100_17\r\nARJ32 v 3.10, Copyright (c) 1998-2004, ARJ Software Russia. [18 Dec 2009]\r\n\r\nCan't find b100_17.arj\r\n\r\nFound     1 error(s)!\r\ntkito@ubuntu:~\/CTF19\/b100$ mv b100_17 b100_17.arj\r\ntkito@ubuntu:~\/CTF19\/b100$ arj x b100_17\r\nARJ32 v 3.10, Copyright (c) 1998-2004, ARJ Software Russia. [18 Dec 2009]\r\n\r\nProcessing archive: b100_17.arj\r\nArchive created: 2011-03-31 23:01:36, modified: 2011-03-31 23:01:36\r\nExtracting bin3-a                      OK        \r\nExtracting bin3-b                      OK        \r\nExtracting bin3-c                      OK        \r\n     3 file(s)\r\ntkito@ubuntu:~\/CTF19\/b100$ file bin3-*\r\nbin3-a: ELF 32-bit LSB executable, Intel 80386, version 1 (GNU\/Linux), statically linked, stripped\r\nbin3-b: data\r\nbin3-c: data\r\n<\/pre>\n
\u7389\u306d\u304e\u306e\u76ae\u3092\u5265\u304f\u3088\u3046\u306b\u5e7e\u91cd\u306b\u3082\u91cd\u306a\u3063\u305f\u30a2\u30fc\u30ab\u30a4\u30d6\u306e\u6bbb\u3092\u4e00\u3064\u4e00\u3064\u5916\u3057\u3066\u3044\u304d\u3001\u3088\u3046\u3084\u304fELF\u306b\u305f\u3069\u308a\u7740\u3044\u305f\u3002
\n\u3053\u306e\u3088\u3046\u306b\u4f55\u91cd\u306b\u3082\u30a2\u30fc\u30ab\u30a4\u30d6\u306e\u6bbb\u3067\u8986\u308f\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u306e\u3053\u3068\u3092\u30a2\u30fc\u30ab\u30a4\u30d6\u30de\u30c8\u30ea\u30e7\u30fc\u30b7\u30ab\u3068\u547c\u3076\u3088\u3046\u306b\u63d0\u6848\u3057\u3088\u3046\u304b\u3068\u601d\u3063\u305f\u304c\u3001\u4f7f\u3044\u3069\u3053\u308d\u304cCTF\u304f\u3089\u3044\u3057\u304b\u306a\u3044\u306e\u3067\u653e\u7f6e\u3002
\n\u4f55\u306f\u3068\u3082\u3042\u308c\u5b9f\u884c\u30d5\u30a1\u30a4\u30eb\u306b\u305f\u3069\u308a\u7740\u3044\u305f\u306e\u3067\u5b9f\u884c\u3057\u3088\u3046\u3001\u305d\u3046\u3057\u3088\u3046\u3002<\/p>\n
\r\ntkito@ubuntu:~\/CTF19\/b100$ chmod +x bin3-a\r\ntkito@ubuntu:~\/CTF19\/b100$ .\/bin3-a\r\nSegmentation fault\r\n<\/pre>\n
\u5358\u4f53\u3067\u306f\u30c0\u30e1\u306a\u3053\u3068\u304c\u308f\u304b\u3063\u305f\u306e\u3067\u30ec\u30c3\u30c4\u7d50\u5408\u3002<\/p>\n
\r\ntkito@ubuntu:~\/CTF19\/b100$ cat bin3-* > bin3\r\ntkito@ubuntu:~\/CTF19\/b100$ chmod +x bin3\r\ntkito@ubuntu:~\/CTF19\/b100$ .\/bin3\r\n-=-=-=-=-=-=-=-=- Wh4t W1ll B3 R3v34l3d? -=-=-=-=-=-=-=-=-\r\n.key the is This\r\n-=-=-=-=-=-=-=-=- Wh4t W1ll Be R3v34l3d? -=-=-=-=-=-=-=-=-\r\n<\/pre>\n
“What Will Be Revealed?”\u3068\u8a00\u308f\u308c\u3066\u3082\u3053\u3093\u306a\u3093\u3058\u3083\u308f\u304b\u3089\u306a\u3044\u306e\u3067strings\u3092\u4ed5\u639b\u3051\u3066\u307f\u308b\u3002<\/p>\n
\r\ntkito@ubuntu:~\/CTF19\/b100$ strings bin3 | less\r\n(\u4e2d\u7565)\r\nTh1s1zt3hK3yk3yk33H33H33H33.N0t!\r\nt00rongD1DNTg1ve\r\ncanthisbethekeybecauseitissuchalongstringandddteklikeslongstrings?\r\nl33tsp33k1z0ut.RealTalkIsIn.\r\nh1tth3r04dj4ck3ndd0nty3wc0m3b4ckn0m0ren0m0R3n0M0R3N0M0R3!\r\nk3ysk3yst3hmm4g1c4lfr3wtthm0r3y3we4tth3mt3hm0r3y3wr00t\r\n5tunt1n1z4h4b1tput171nth3a1r\r\n! is i upside down!i!i!\r\nA complete statement can also be the key to victory.\r\nThis is the key.\r\n.key the is This\r\nCan y3w feel it coming in the air tonight?\r\nRandom thoughts give way to random problems give way to random solutions\r\nLorem Ipsum is a bitch.\r\n(\u4ee5\u4e0b\u7565)\r\n<\/pre>\n
\u3042\u308b\u308f\u3042\u308b\u308f\u602a\u3057\u3044\u6587\u5b57\u5217\u306e\u5c71\u304c\u3002
\n\u3068\u308a\u3042\u3048\u305a\u3053\u306e\u3042\u305f\u308a\u306e\u3092\u3044\u304f\u3064\u304b\u56de\u7b54\u3068\u3057\u3066\u5165\u308c\u3066\u307f\u305f\u3051\u3069\u30c0\u30e1\u3002
\n\u4f55\u56de\u304bbin3\u3092\u5b9f\u884c\u3057\u3066\u307f\u305f\u3068\u3053\u308d\u3001\u3053\u306e\u602a\u3057\u3044\u6587\u5b57\u5217\u306e\u5c71\u304b\u3089\u79d2\u5909\u308f\u308a\u30671\u3064\u3092\u9078\u629e\u3057\u3066\u8868\u793a\u3057\u3066\u3044\u308b\u3088\u3046\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u3063\u305f\u3002
\n\u5c71\u306e\u4e2d\u306b\u4f55\u56de\u5b9f\u884c\u3057\u3066\u3082\u51fa\u529b\u3055\u308c\u306a\u3044\u6587\u5b57\u5217\u304c\u3042\u3063\u3066\u305d\u308c\u304cKey\u306a\u306e\u3067\u306f\u306a\u3044\u304b\u3068\u601d\u3063\u305f\u304c\u3001\u3082\u3057\u305d\u3093\u306a\u7b54\u3048\u3060\u3063\u305f\u5834\u5408\u3001\u30b3\u30fc\u30c9\u89e3\u6790\u3067\u304d\u306a\u3044\u81ea\u5206\u306b\u306f\u304a\u624b\u4e0a\u3052\u306a\u306e\u3067\u305d\u308c\u306f\u306a\u3044\u3082\u306e\u3068\u3057\u3066\u9032\u3081\u308b\u3053\u3068\u306b\u3057\u305f\u3002
\nstrings\u306e\u51fa\u529b\u3092\u773a\u3081\u3066\u3044\u308b\u3068\u3001\u6700\u5f8c\u306e\u65b9\u3001\u30a8\u30e9\u30fc\u30e1\u30c3\u30bb\u30fc\u30b8\u7528\u306e\u5b9a\u578b\u6587\u30a8\u30ea\u30a2\u306e\u5f8c\u306b\u660e\u3089\u304b\u306b\u30a8\u30e9\u30fc\u30e1\u30c3\u30bb\u30fc\u30b8\u3067\u306f\u306a\u3044\u3001\u3057\u304b\u3057\u610f\u5473\u306e\u3042\u308b\u6587\u5b57\u5217\u304c\u3042\u3063\u305f\u3002<\/p>\n
\r\nstack smashing detected\r\n*** %s ***: %s terminated\r\nzPLR\r\nWhere we're going we don't need... roads.\r\nCAk[S\r\n<\/pre>\n
\u3053\u3044\u3064\u306f\u602a\u3057\u3044\u3001\u3068\u601d\u3063\u3066\u3053\u308c\u3092\u56de\u7b54\u3057\u3066\u307f\u305f\u3068\u3053\u308d\u3001\u898b\u4e8b\u6b63\u89e3\uff01
\n\u3068\u3044\u3046\u308f\u3051\u3067Key\u306f\u3001Where we're going we don't need... roads.<\/code>\u3067\u3057\u305f\u3002
\n\u3061\u306a\u307f\u306bBack to the Future\u304b\u3089\u306e\u5f15\u7528\u3060\u305d\u3046\u3067\u3002<\/p>\n
\u611f\u60f3\uff1a
\n\u30d0\u30a4\u30ca\u30ea\u89e3\u6790\u554f\u984c\u306a\u306e\u3067\u3001\u3082\u3057\u304b\u3057\u305f\u3089\u30b3\u30fc\u30c9\u89e3\u6790\u306e\u77e5\u8b58\u304c\u5fc5\u8981\u306a\u306e\u3067\u306f\u306a\u3044\u304b\u3068\u5371\u60e7\u3057\u3066\u3044\u305f\u304c\u3001\u305d\u306e\u5fc5\u8981\u306f\u306a\u304b\u3063\u305f\u3088\u3046\u3067\u52a9\u304b\u3063\u305f\u3002
\n\u554f\u984c\u3092\u89e3\u3044\u3066\u3044\u308b\u9593\u306f\u30d1\u30ba\u30eb\u3092\u89e3\u3044\u3066\u3044\u308b\u3088\u3046\u306a\u611f\u899a\u3067\u697d\u3057\u304b\u3063\u305f\u3002
\n\u7279\u306b\u3001\u6b63\u89e3\u30eb\u30fc\u30c8\u3078\u306e\u9053\u3092\u898b\u3064\u3051\u305f\u3068\u304d\u306f\u3088\u3063\u3057\u3083\uff01\u3068\u3061\u3087\u3063\u3068\u58f0\u3092\u4e0a\u3052\u3066\u3057\u307e\u3063\u305f\u3002<\/p>\n
\u3057\u304b\u3057\u3001\u89e3\u3051\u3066\u3088\u304b\u3063\u305f\u3002
\n1\u554f\u3082\u89e3\u3051\u306a\u3044\u304b\u3082\u3057\u308c\u306a\u3044\u3068\u601d\u3063\u3066\u3044\u305f\u3068\u306f\u3044\u3048\u3001\u672c\u5f53\u306b1\u554f\u3082\u89e3\u3051\u306a\u304b\u3063\u305f\u3089\u305d\u306e\u304c\u3063\u304b\u308a\u5ea6\u306f\u30cf\u30f3\u30d1\u306a\u304b\u3063\u305f\u3002
\n\uff08Retro Revisited 100\u306f\u9664\u304f\uff09
\n\u3053\u308c\u3092\u89e3\u3044\u305f\u5f8c\u3001Forensics\u306e100\u306b\u3082\u6311\u6226\u3057\u305f\u3082\u306e\u306e\u3001\u8a70\u307e\u3063\u3066\u3057\u307e\u3063\u305f\u305f\u3081\u3001\u8003\u3048\u308b\u306e\u3092\u3084\u3081\u3066\u3057\u307e\u3063\u305f\u3002<\/p>\n
\u4ed6\u306e\u4eba\u306ewriteup\u306fGrab Bag 100, Retro Revisited 100, Binary L33tness 100, Forensics 100\u3092\u898b\u305f\u3002
\n\u9006\u306b\u8a00\u3046\u3068\u305d\u306e\u4ed6\u306e\u306f\u898b\u3066\u3044\u306a\u3044\u305f\u3081\u3001\u307e\u3060\u7b54\u3048\u3092\u77e5\u3089\u306a\u3044\u72b6\u614b\u3067\u6311\u6226\u3067\u304d\u308b\u3002
\n\uff08\u30d5\u30a1\u30a4\u30eb\u304c\u3042\u308b\u3082\u306e\u306b\u9650\u5b9a\u3055\u308c\u308b\u3051\u308c\u3069\uff09
\n\u4eca\u5ea6\u306e\u9031\u672b\u8fba\u308a\u306b\u6642\u9593\u304c\u3042\u3063\u305f\u3089\u4ed6\u306e\u554f\u984c\u3082\u3084\u3063\u3066\u307f\u3088\u3046\u304b\u306a\u3068\u601d\u3063\u305f\u308a\u3057\u3066\u3044\u308b\u3002
\n\u3059\u3050\u306b\u304a\u624b\u4e0a\u3052\u306b\u306a\u308b\u53ef\u80fd\u6027\u304c\u9ad8\u3044\u3051\u308c\u3069\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
\u554f\u984c\u6587\uff1a Your journey begins \u30d5\u30a1\u30a4\u30eb\u306f\u307e\u3068\u3081\u3066\u516c\u958b\u3057\u3066\u3044\u308b\u65b9\u304c\u3044\u308b\u306e\u3067\u305d\u3061\u3089\u3067\u3069\u3046\u305e\u3002 b100\u3067\u59cb\u307e\u308b\u3084\u3064\u3067\u3059\u3002<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"cybocfi_hide_featured_image":"","footnotes":""},"categories":[1],"tags":[8,7],"class_list":["post-43","post","type-post","status-publish","format-standard","hentry","category-1","tag-ctf","tag-defcon"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"DEFCON 19 CTF Binary L33tness 100 writeup | \u611a\u884c\u9332 the Next Generation","description":"","canonical_url":"https:\/\/emeth.jp\/diary\/2011\/06\/defcon-19-ctf-binary-l33tness-100-writeup\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ja_JP","og:site_name":"\u611a\u884c\u9332 the Next Generation | \u305f\u3060\u306e\u65e5\u8a18\u3068\u8a00\u3044\u5f35\u308b\u3002","og:type":"article","og:title":"DEFCON 19 CTF Binary L33tness 100 writeup | \u611a\u884c\u9332 the Next Generation","og:url":"https:\/\/emeth.jp\/diary\/2011\/06\/defcon-19-ctf-binary-l33tness-100-writeup\/","og:image":"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2020\/09\/original.jpg","og:image:secure_url":"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2020\/09\/original.jpg","og:image:width":500,"og:image:height":500,"article:published_time":"2011-06-12T21:53:15+00:00","article:modified_time":"2014-02-24T17:47:43+00:00","twitter:card":"summary","twitter:site":"@tkito","twitter:title":"DEFCON 19 CTF Binary L33tness 100 writeup | \u611a\u884c\u9332 the Next Generation","twitter:creator":"@tkito","twitter:image":"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2020\/09\/original.jpg"},"aioseo_meta_data":{"post_id":"43","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"location":null,"local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2020-12-21 05:49:45","updated":"2025-06-04 08:19:53","seo_analyzer_scan_date":null},"_links":{"self":[{"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/posts\/43","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/comments?post=43"}],"version-history":[{"count":59,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/posts\/43\/revisions"}],"predecessor-version":[{"id":153,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/posts\/43\/revisions\/153"}],"wp:attachment":[{"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/media?parent=43"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/categories?post=43"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/tags?post=43"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}