Repository navigation
Home
Several standard Linux binary analysis tools are used throughout this exercise.
This chapter provides a brief explanation of each tool and the flags used during the analysis process.
The readelf utility is used to display information about ELF (Executable and Linkable Format) binaries. It is commonly used for inspecting sections, headers, symbols, and raw binary data.
readelf -x .rodata level0| Flag | Description |
|---|---|
-x |
Displays the hexadecimal dump of a specified section. |
.rodata |
Refers to the read-only data section, which typically contains static strings and constants. |
The .rodata section frequently stores output strings such as:
No !
Access granted
Password:
Locating these strings helps identify important execution paths within the binary.
The grep utility is used to search for matching text patterns within command output or files.
readelf -x .rodata level0 | grep "No !"objdump -d level0 | grep 080484a4| Flag | Description |
|---|---|
-A<number> |
Displays lines after the match. |
-B<number> |
Displays lines before the match. |
-i |
Performs case-insensitive matching. |
-n |
Displays line numbers. |
objdump -d level0 | grep 080484a4 -A20 -B20This command displays 20 lines before and after the matching address in order to provide assembly context.
The objdump utility is used to display information about object files and executables. It is especially useful for disassembling binaries into assembly instructions.
objdump -d level0| Flag | Description |
|---|---|
-d |
Disassembles executable sections into assembly code. |
Disassembly allows the program logic to be inspected directly.
Conditional jumps, comparisons, function calls, and hardcoded values can all be identified through assembly analysis.
Typical instructions encountered include:
cmp eax, 0x1a7
je 0x080484f0In this example:
-
cmpperforms a comparison -
jeperforms a jump if the comparison succeeds
The compared value may represent the expected password or key.
scp copies files between hosts on a network. It uses ssh for data transfer, and uses the same authentication and provides the same security as a login session.
scp -P 4242 level00@10.245.254.235:/home/users/level00/level00 .| Flag | Description |
|---|---|
-P |
Define the port to be used for ssh transfer. |
To dissassemble the file with third party software it needs to be transfered to the host system.
Ghidra is a software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate. In this project it is mainly used to decompile the explotation binary and quickly find vulnerabilities due to unrpotected function usage or logical flaws.
https://github.com/nationalsecurityagency/ghidra https://snapcraft.io/install/ghidra/debian
On opening create a project and then chose the Code Browser (first icon in tool chest)
Afterwards the file to exploit needs to be imported and decompiled. We get the assembly code and and an example c code for the imported binary.
