PicoCTF - Static ain't always noise - general
After the download two files take a look into the bash file .
#!/bin/bash
echo "Attempting disassembly of $1 ..."
#This usage of "objdump" disassembles all (-D) of the first file given by
#invoker, but only prints out the ".text" section (-j .text) (only section)
#that matters in almost any compiled program...
objdump -Dj .text $1 > $1.ltdis.x86_64.txt
#Check that $1.ltdis.x86_64.txt is non-empty
#Continue if it is, otherwise print error and eject
if [ -s "$1.ltdis.x86_64.txt" ]
then
echo "Disassembly successful! Available at: $1.ltdis.x86_64.txt"
echo "Ripping strings from binary with file offsets..."
strings -a -t x $1 > $1.ltdis.strings.txt
echo "Any strings found in $1 have been written to $1.ltdis.strings.txt with file offset"
else
echo "Disassembly failed!"
echo "Usage: ltdis.sh <program-file>"
echo "Bye!"
fi
Here you can see in the one comment :
#invoker, but only prints out the ".text" section (-j .text) (only section
Now we can simply understand what we need to do :
┌─[visith@parrot]─[~/CTF/picoctf/static_noise]
└──╼ $sudo ./ltdis.sh static -j
Attempting disassembly of static ...
Disassembly successful! Available at: static.ltdis.x86_64.txt
Ripping strings from binary with file offsets...
Any strings found in static have been written to static.ltdis.strings.txt with file offset
You can get two outputs :
┌─[visith@parrot]─[~/CTF/picoctf/static_noise]
└──╼ $ls
ltdis.sh static static.ltdis.strings.txt static.ltdis.x86_64.txt
when you ‘cat’ the static.ltdis.strings.txt . You can see the flag like this :
6e8 Oh hai! Wait what? A flag? Yes, it's around here somewhere!
7c7 ;*3$"
1020 picoCTF{flag}
1040 GCC: (Ubuntu 7.5.0-3ubuntu1~18.04) 7.5.0