›

Eat the Cake! by Little Pwnie

Padovah4ckPadovah4ck
in Challenges

Hi everyone ,
I've been trying for days this reverse challenge..
and it is obvious there is something that I can't catch!

I've used all "convention" tool : OllyDbg, Immunity Denugger, WinDbg, IDA..
I've also tried objdump to disassemble and mingw tools on linux ..

Am i on the right track? Any hint toward what I'm missing?

thanks,
p4d0vh4ck

Tagged:

Comments

  • jwstonejwstone

    I am having trouble as well. It does seem packed. Not sure if I correctly unpacked it.

  • decartdecart
    edited January 2018

    SPOILER

    decart

  • imA5imA5

    You've practically told them the solution...

  • decartdecart

    Sorry, if it's a spoiler please remove it... Just wanted to give them some directions, could've gone a bit far...

    decart

  • cyb3rs4k1cyb3rs4k1

    Hi. A little hint should be useful.

  • nihilliannihillian

    I solved it using Ollydbg, I am the noobest guy around here maybe, still I think it's kinda too easy for 60 points. You can't expect the password to be in plaintext format, just a little knowledge about assembly instructions is enough to get it.

  • lucazzzlucazzz

    I've just a question about the final password to retrieve: is it really 15 characters?

  • NarmuNarmu

    It doesn't run after unpacking it, is it supposed to do that?

  • gavzgavz
    edited June 2018

    try unpack on windows 7 if doesn't run after unpacking

  • gavzgavz

    @lucazzz said:
    I've just a question about the final password to retrieve: is it really 15 characters?

    Yes

  • NarmuNarmu
    edited June 2018

    @gavz I tried unpacking it on Windows 7 still not running...

  • linoslinos
    edited June 2018

    If it's supposed to work with upx, it doesnt on Windows 7. The produced binary is not unpacked properly. Is this normal? Should I try to unpack manually?

  • linoslinos

    Solved it. No need to manually unpack. If upx doesnt cut it for you, try some other tools.
    Pretty straight forward after unpacking.

  • gavzgavz
    edited August 2018

    @Narmu said:
    @gavz I tried unpacking it on Windows 7 still not running...

    tested on windows 8.1

  • NarmuNarmu

    @gavz thanks I figured it out, it was about which unpacker to use

  • gavzgavz

    @Narmu said:
    @gavz thanks I figured it out, it was about which unpacker to use

    I do not remember how i it unpack:
    1. upx.exe -d on VM windows 8.1 or windows 7 or
    2. through Ollydbg

  • LVx0LVx0

    I'm afraid I've been wasting my time on this challenge, so I'd appreciate some advice: how do you know if it's unpacked correctly? If it runs in the debugger, and it shows the ASCII strings that print out, etc., is it correct?

  • LVx0LVx0

    I finally solved this challenge. It just wasn't quite as straightforward as I expected from reading this thread. Feel free to DM for hints.

  • LVx0LVx0

    Oops so I spoke too soon. Turns out that two of the digits I only got because of guessing correctly.

  • chpppppchppppp

    I am a total RE noob - Could anyone PM me or post here some links to help solve this challenge?

    Appreciate everyones help! Thanks!

  • ydrahydrah
    edited January 24

    Hi all, can someone PM me ? I unp****d using PE********. Now I am reversing, I think it is checking multiple bytes in the provided string, but not all of them...Do I have to guess the bytes which are not compared ?

    EDIT -> This box involves some guesswork from what I understand, solved it but 1-2 digits had to be guessed. Did anyone solve it without guessing ?

  • portos060474portos060474

    I have trouble with it also...
    1. is not working after unpack
    2. the password check in the code reveals incomplete flag...

    Any suggestions? Thanks!

  • opt1kzopt1kz
    edited February 24

    For everyone having issues after unpacking: https://digital-forensics.sans.org/blog/2014/02/17/malware-analysis-and-aslr-on-windows-8-1

    TL/DR: Disable ASLR on the binary.

    Having said that, you can complete this challenge through static analysis alone. I used IDA. If your password is missing characters, you haven't examined the program's control flow carefully enough. Not sure how much more I can say without spoiling.

    opt1kz

  • portos060474portos060474

    solved, by guessing few letters :))

  • m4rc1nm4rc1n

    Type your comment> @portos060474 said:

    solved, by guessing few letters :))

    I used IDA and Im missing four letters. Obvious ones do not work -:(

    m4rc1n

Sign In to comment.