Backdoor CTF 2014 - Binary 100
An ELF64 binary that generates its password from a Unix timestamp. Given a 20-minute creation window, we brute-force all possible timestamps with a short Python script.
Task
This file was created sometime between 14th March 2014, 8:20 PM, and 14th March 2014, 8:40 PM (Indian Standard Time).
We receive a file called bin100.
Analysis
Running the binary without arguments tells us it expects a password:
./bin100
# You did not specify any password as part of the argument. Try again.
Two approaches come to mind: disassemble and find the comparison, or deduce the password from the creation time hint. The time-based hint is too specific to be a coincidence, so let's explore that first.
Checking the binary's imports in a disassembler reveals a function called passwordFromUnixTimestamp(long):
The disassembly shows it takes a long integer, streams it through a stringstream, and passes the result to an MD5 function (_z3md5ss):
So the password is the MD5 hash of a Unix timestamp. The binary was created between 8:20 PM and 8:40 PM IST, which in UTC is:
03/14/2014 @ 2:50:00 PM UTC → Unix timestamp: 1394808600
That gives us a 20-minute window, or 1200 possible timestamps.
Solution
Script to try each timestamp in the window:
import subprocess
import os
import hashlib
def computeMD5hash(string):
m = hashlib.md5()
m.update(string.encode('utf-8'))
return m.hexdigest()
start_timestamp = 1394808600
for i in range(0, 1200):
print("trying with timestamp %d" % start_timestamp)
execute = "./bin100 " + computeMD5hash(str(start_timestamp))
os.system(execute)
start_timestamp += 1
Running it eventually prints the flag:
Flag
Flag: 94958e1c10707728ef965fe850eb98a1