Backdoor CTF 2014 - Binary 100

An ELF64 binary that generates its password from a Unix timestamp. Given a 20-minute creation window, we brute-force all possible timestamps with a short Python script.

Task

This file was created sometime between 14th March 2014, 8:20 PM, and 14th March 2014, 8:40 PM (Indian Standard Time).

We receive a file called bin100.

Analysis

Running the binary without arguments tells us it expects a password:

./bin100
# You did not specify any password as part of the argument. Try again.

Two approaches come to mind: disassemble and find the comparison, or deduce the password from the creation time hint. The time-based hint is too specific to be a coincidence, so let's explore that first.

Checking the binary's imports in a disassembler reveals a function called passwordFromUnixTimestamp(long):

writeup2.png

The disassembly shows it takes a long integer, streams it through a stringstream, and passes the result to an MD5 function (_z3md5ss):

writeup1.png

So the password is the MD5 hash of a Unix timestamp. The binary was created between 8:20 PM and 8:40 PM IST, which in UTC is:

03/14/2014 @ 2:50:00 PM UTC → Unix timestamp: 1394808600

That gives us a 20-minute window, or 1200 possible timestamps.

Solution

Script to try each timestamp in the window:

import subprocess
import os
import hashlib

def computeMD5hash(string):
    m = hashlib.md5()
    m.update(string.encode('utf-8'))
    return m.hexdigest()

start_timestamp = 1394808600

for i in range(0, 1200):
    print("trying with timestamp %d" % start_timestamp)
    execute = "./bin100 " + computeMD5hash(str(start_timestamp))
    os.system(execute)
    start_timestamp += 1

Running it eventually prints the flag:

writeup3.png

Flag

Flag: 94958e1c10707728ef965fe850eb98a1