📔
Cyber Security Notes
  • Introduction
  • CVEs
    • CVE-2022-33106
  • Paper Reviews
    • Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice
  • Security Basics Notes
    • Identification, Authentication and Authorization
  • Enumeration and Initial Compromise
    • Methodology
    • Footprinting
    • Network Protocols
      • FTP
      • SMB
      • DNS
      • NFS
      • SMTP
      • IMAP/POP3
      • SNMP
      • MySQL
      • MSSQL
      • Oracle TNS
      • IPMI
    • Nifty One Liners
    • Brute-Force Web Pages
      • Hydra
    • Network Pentest
      • Quick SMB cheatsheet
      • SSH keypair basics
      • Compromise using SSH Key
      • Networking fundamentals Interview topics
      • nmap quick cheatsheet
      • Metasploit Quick Reference
    • Web Pentest
      • Web Pentest Interview top topics
      • Wordpress Exploitation
      • Joomla Exploitation
      • Login Bypass using Cookie Tampering/Poisoning
      • Subdomain Enumeration
      • CSRF mitigation
      • XSS mitigation
      • CSP bypass with JSONP
      • PHP Vulnerabilities
      • Python Serialization Vulnerabilities - Pickle
      • SQL Injections
        • SQLmap
      • SSTI
      • XSS
    • Buffer Overflow Prep
      • Understanding CPUs
      • Virtual Memory and Paging
      • Syscalls
      • Theorem Proving
      • Stripping readable function names
      • Insecure C functions
      • Stack Canaries
      • Linking - GOT,PLT
      • Return Oriented Programming
    • Active Directory - Basics
      • AD DS
      • Managing OUs
      • Group Policies
      • Authentications
      • Trees, Forests and Trusts
      • Kerberos
      • Attacking Kerberos
      • Priv Esc (Post Exploitation)
    • DNS/Domain Enum Masterguide
  • Post Exploitation
    • Shell Escape Techniques
    • Getting stable shell after compromise
    • Linux Privilege Escalation
      • Sudoers file
      • Sudoers entry - Yum
      • Wildcards - Basics
      • Wildcards - Chown
      • Wildcards - Tar
      • Linux Permissions & SUID/SGID/Sticky Bit
      • SUID - nmap
      • SUID - bash
      • SUID - man
      • NFS no_root_squash
      • SUID - pkexec
      • Bad permissions
    • Windows Privilege Escalation
      • SeImpersonatePrivilege Token Impersonation
      • Firefox Creds
      • Potatoes
      • Print Spooler Basics
      • Print Spooler CVE 2020-1030
      • SpoolFool
    • Data Exfiltration Post Exploitation
  • Port Forwarding Cheatsheet
  • Powershell Essentials
    • Powershell Basics
    • Powershell Enumeration
    • Powershell Port Scanner
    • Powershell One Liner Port Scanning
    • Powershell Port Scan in a given CIDR
  • Application Security
    • System Calls in Linux
    • Buffer Overflow Defenses
    • Format string vulnerabilities
    • Sample Github Actions
    • Basic Bugs in Demo Application
    • Using AFL++
  • Linux 64-bit Assembly
    • GDB Basics
      • My relevant GDB cheatsheet
      • Task 1 - Tamper strcmp logic
      • Breakpoints
      • Always starting with intel flavor
      • GDB TUI Mode
    • Basic Hello World Program
    • Registers in 64-bit
    • global directive
    • Reducing instructions and Removing NULL-> Optimizing memory in Assembly
    • Data Types
    • Endianness
    • Moving Data
    • push, pop, and the stack
    • Analysis - Writing data on memory location and referencing
    • Arithmetic Operations
    • Bitwise Logical Operations
    • Bit-Shifting Operations
    • Control Instructions
    • Loops
    • Procedures
    • Stack-Frames and Procedures
    • String Operations
    • Shellcoding basics
      • Introduction and Common Rules
      • Basic Shellcodes->Exit
      • Testing shellcode->Skeleton Code
      • Techniques-> JMP,CALL,POP
      • Techniques-> Stack
      • Techniques-> (64-bit only) RIP Relative Addressing
      • Shellcode 1 -> execve(/bin/sh) STACK PUSH
      • Shellcode 1 -> execve(/bin/sh) JMP CALL POP
      • Techniques-> XOR-Encoder
  • Cloud Security
    • Foundational Technology
    • Learning Through Project Omega
    • IAM Essentials
      • Deep dive into IAM - Part 1
    • Amazon S3
    • Risk Management & Data Controls
    • Enumeration
      • S3 - Enum Basics - PwnedLabs
      • S3 - Identify the AWS Account ID from a Public S3 Bucket
      • EBS - Loot Public EBS Volumes
      • S3- Exploit Weak Bucket Policies for Privileged Access
  • API Security
    • WSDL
  • Reverse Engineering
    • Some string Operations
    • Numbers and Inputs
    • Address inputs
    • Recursive Function
    • Crackme: level1
    • Crackme: level2
    • CTF: Memory Dereferencing
    • CTF: Monty Python
  • CTF Challenge Learnings
    • vsCTF 2024
      • Sanity Check
      • not-quite-caesar
      • Intro to reversing
    • NCL Individual 2024
      • Web Challenges
        • PiratePals
        • Pierre's Store
    • Pico CTF 2024
      • Web Exploitation
        • Bookmarklet
        • WebDecode
        • Unminify
        • Trickster
      • General Skills
        • Commitment Issues
        • Time Machine
        • Blame Game
        • Collaborative Development
        • Binary Search
        • Dont-you-love-banners
    • Sunshine CTF
      • Knowledge Repository
    • Amazon WiCys CTF
      • I am Lazy
      • Password Locker on the Web
      • Happy Birthday Card Generator
      • Bloggergate
      • simple offer
      • Bad Actor
      • Secret Server
      • Simple PCAP
      • Hidden Message
    • C code using getenv()
    • Command Injection with filter
    • Pwning
      • Shoddy_CMP
      • PLT_PlayIT
  • Applied Cryptography
    • Linear Congruential Generator
  • Tools for everything
Powered by GitBook
On this page

Was this helpful?

  1. Reverse Engineering

Recursive Function

PreviousAddress inputsNextCrackme: level1

Last updated 1 year ago

Was this helpful?

binary: recurse.bin (elf64)

Simplified code in C looks like:

int main(void)

{
  undefined8 var1;
  int a;
  int b;
  
  setup();
  printf("Enter your initial values: ");
  scanf("%d %d",&a,&b);
  if ((a == 0) || (b == 0)) {
    puts("Values must both be non-zero!");
    var1 = 1;
  }
  else {
    var1 = recurse(a,b,0,1);
    if ((int)var1 == 0) {
      puts("Nope!");
    }
    else {
      puts("Correct!");
      print_flag();
    }
    var1 = 0;
  }
  return var1;
}

  1. The application takes 2 numbers as input

  2. If the evaluation of recurse() is non-zero, the flag is printed

Inspecting the recurse function:

Simplified version:

undefined8 recurse(int a,int b)

{
  int iVar1;
  undefined8 uVar2;
  
  iVar1 = ((b + a) - 0) - 1;
  if ((0 == c_goal) && (b + a == sum_goal)) {
    uVar2 = 1;
  }
  else if ((0 < c_goal) && (((a < iVar1 || (b < iVar1)) || (0 < iVar1)))) {
    uVar2 = absolutely_not_useless_fn(b,b + a,0 + 1,iVar1);
  }
  else {
    uVar2 = 0;
  }
  return uVar2;
}

Now what is c_goal and sum_goal? Based on that I'll revise this code again

And then there is one more function used in the recurse code:

So, a lot of math is involved. I applied all these functions and replaced values and figured out some ranges of data that could fit the answer. Basically,

#include<stdlib.h>
#include<stdio.h>

int c_goal=16;
int sum_goal=116369;
int useful_variable=1020;
int another_useful_one=2010;

int absolutely_not_useless_fn(int, int, int, int);

int recurse(int a, int b, int c, int d){
        int i;
        int j;

        i = ((b+a)-c) - d;
        if((c == c_goal)&&(b+a==sum_goal)){
                j=1;
        }
        else if((c<c_goal)&&(((a<i || (b<i)) || (c<i)))){
                j = absolutely_not_useless_fn(b,b+a,c+1,i);
        }
        else{
                j=0;
        }
        return j;
}

int absolutely_not_useless_fn(int l, int m, int n, int o){
        useful_variable = (o+l) - n;
        another_useful_one = m+l;
        recurse(m,another_useful_one,n+1,((another_useful_one+useful_variable)/3)*2);
        return 1;
}

int main()
{
        int x;
        int num1=1, num2=1;
        //printf("Enter your initial values: ");
        //scanf("%d %d",&num1,&num2);
        for(num1=1;num1<=50;num1++){
                for(num2=1;num2<=50;num2++){
                        x=recurse(num1,num2,0,1);
                        if((int)x==0){
                                puts("Nope!");
                        }
                        else{
                                puts("Correct!");
                        }
                }
        }
        return 0;

}

  1. Range of input is between 1 and 50.

  2. Enough, I can't do so much math for this.

  3. I'll brute force :)

Takes input like this:

I can create a BASH one-liner to bruteforce this.

for i in {1..50}; do for j in {1..50}; do echo $i $j; echo $i $j | ./recurse.bin; done; done > output

So, correct values are 13 and 37