Static ain't always noise

static-aint-always-noise.md

picoCTF: Static ain't always noise

picoCTF's Static ain't always noise was very easy since I was well-acquainted with Linux distros. Two files were provided:

• ltdis.sh
• static

ltdis.sh

ltdis.sh is a shell script written in Bash for the disassembly of compiled code.

#!/bin/bash

echo "Attempting disassembly of $1 ..."

#This usage of "objdump" disassembles all (-D) of the first file given by 
#invoker, but only prints out the ".text" section (-j .text) (only section
#that matters in almost any compiled program...

objdump -Dj .text $1 > $1.ltdis.x86_64.txt

#Check that $1.ltdis.x86_64.txt is non-empty
#Continue if it is, otherwise print error and eject

if [ -s "$1.ltdis.x86_64.txt" ]
then
	echo "Disassembly successful! Available at: $1.ltdis.x86_64.txt"

	echo "Ripping strings from binary with file offsets..."
	strings -a -t x $1 > $1.ltdis.strings.txt
	echo "Any strings found in $1 have been written to $1.ltdis.strings.txt with file offset"

else
	echo "Disassembly failed!"
	echo "Usage: ltdis.sh <program-file>"
	echo "Bye!"
fi

In the shell script, I found $1 which indicated that I may have only needed to pass the other file to the shell script.

static

True to its name, static was a bunch of unreadable binary code.

Disassembly

$ sh ltdis.sh static   
Attempting disassembly of static ...
Disassembly successful! Available at: static.ltdis.x86_64.txt
Ripping strings from binary with file offsets...
Any strings found in static have been written to static.ltdis.strings.txt with file offset

static.ltdis...

After disassembly, two .txt files appeared.

$ ls -lA
-rwxr-x--- 1 1000 1000  785 Jan 11 15:28 ltdis.sh
-rwxr-x--- 1 1000 1000 8376 Jan 11 15:27 static
-rw-r--r-- 1 1000 1000 1683 Jan 11 15:34 static.ltdis.strings.txt
-rw-r--r-- 1 1000 1000 6497 Jan 11 15:34 static.ltdis.x86_64.txt

So I grepped the first .txt file for a string which contained pico, and immediately found the flag:

$ cat static.ltdis.strings.txt | grep pico
1020 picoCTF{d15a5m_t34s3r_ccb2b43e}