PicoCTF - Static ain't always noise - general

pico

After the download two files take a look into the bash file .

#!/bin/bash



echo "Attempting disassembly of $1 ..."


#This usage of "objdump" disassembles all (-D) of the first file given by 
#invoker, but only prints out the ".text" section (-j .text) (only section)
#that matters in almost any compiled program...

objdump -Dj .text $1 > $1.ltdis.x86_64.txt


#Check that $1.ltdis.x86_64.txt is non-empty
#Continue if it is, otherwise print error and eject

if [ -s "$1.ltdis.x86_64.txt" ]
then
	echo "Disassembly successful! Available at: $1.ltdis.x86_64.txt"

	echo "Ripping strings from binary with file offsets..."
	strings -a -t x $1 > $1.ltdis.strings.txt
	echo "Any strings found in $1 have been written to $1.ltdis.strings.txt with file offset"



else
	echo "Disassembly failed!"
	echo "Usage: ltdis.sh <program-file>"
	echo "Bye!"
fi

Here you can see in the one comment :

#invoker, but only prints out the ".text" section (-j .text) (only section

Now we can simply understand what we need to do :

┌─[visith@parrot][~/CTF/picoctf/static_noise]
└──╼ $sudo ./ltdis.sh static -j
Attempting disassembly of static ...
Disassembly successful! Available at: static.ltdis.x86_64.txt
Ripping strings from binary with file offsets...
Any strings found in static have been written to static.ltdis.strings.txt with file offset

You can get two outputs :

┌─[visith@parrot][~/CTF/picoctf/static_noise]
└──╼ $ls
ltdis.sh  static  static.ltdis.strings.txt  static.ltdis.x86_64.txt

when you ‘cat’ the static.ltdis.strings.txt . You can see the flag like this :

6e8 Oh hai! Wait what? A flag? Yes, it's around here somewhere!
    7c7 ;*3$"
   1020 picoCTF{flag}
   1040 GCC: (Ubuntu 7.5.0-3ubuntu1~18.04) 7.5.0

Popular posts from this blog

Mustacchio - TryHackMe

Tech_Supp0rt: 1 - TryHackMe

Juicy Details - TryHackMe