I did the usual actions of running strings and strace but found nothing interesting. I then ran it and found I needed to provide a key. Randomly typing got me nowhere so I opened Ghidra.
I saw that the application checks the length of your argument and does a comparision. But against what? Their is some proccessing that is done on the string “sup3r_s3cr3t_k3y_1337” each character is shifted by 0x22.
We see that an additional buffer local_88 is made up of different values, your input is then xor’ed against abstack40 to check if it matches local_88.
We need to provide and input that satisfies input XOR abstack40 = local_88 we can calculate the required input with another xor input = abstack40 XOR local_88. I transplanted some code and calulated the required input.
#include <stdio.h>
int main(int argc, char *argv[])
{
int local_88 [24];
local_88[0] = 0x37;
local_88[1] = 0x3f;
local_88[2] = 0x2f;
local_88[3] = 0x76;
local_88[4] = 0x2b;
local_88[5] = 0x62;
local_88[6] = 0x28;
local_88[7] = 0x21;
local_88[8] = 0x34;
local_88[9] = 0xf;
local_88[10] = 0x77;
local_88[11] = 0x62;
local_88[12] = 0x48;
local_88[13] = 0x27;
local_88[14] = 0x75;
local_88[15] = 8;
local_88[16] = 0x56;
local_88[17] = 0x6a;
local_88[18] = 0x68;
local_88[19] = 0x4e;
local_88[20] = 0x68;
int abStack40 [24];
for(int i = 0; i < 0x15; i++)
{
abStack40[i] = "sup3r_s3cr3t_k3y_1337"[i] - 0x22;
}
//print abStack40
for(int i = 0; i < 0x15; i++)
{
printf("%x\n", abStack40[i]);
}
//xor abstack with local_88
for(int i = 0; i < 0x15; i++)
{
abStack40[i] = abStack40[i] ^ local_88[i];
}
//print the values as characters
for(int i = 0; i < 0x15; i++)
{
printf("%c", abStack40[i]);
}
}
Using the output as argument gives the the desired responce!
