TryHackMe — ‘Compiled’ Challenge
Hey everyone! I’m hashkam (my TryHackMe username!) and this is a short walk-through of the extremely small challenge on TryHackMe called ‘Compiled’.
Let’s proceed with the steps (which aren’t many to be honest!)……
Firstly, when I downloaded the task files, I just got a single file with .compiled extension.
I first tried reading the contents, which was simply gibberish (as expected).
Then I tried extracting the actual text from it using ‘strings’ command. Even this didn’t really give much of a clue.
Upon running the file, after giving it execution permissions, we are prompted for a password.
Then I tried to find some details about the file using the ‘file’ command. Even this doesn’t really help much except for tell us that the binary code is unstripped and that the code has been interpeted. These are a few positive signs since unstripped code is more likely recoverable through reverse engineering.
One of the tools used for reverse engineering binary files to get a look at their underlying code is Ghidra.
So I import the file into Ghidra and simply let it analyze the code. Then from the list of functions available, we first go to the most important function — the ‘main’ function.
Inside the main function we see that there is indeed a raw string being used for comparison in the password, but it’s also got a small sub-string added in the middle.
So for now, the password should be something like ‘DoYouEven<xyz>CTF’. As we scan the code more closely, and follow the line of execution, we see that <xyz> is extracted and compared against ‘_init’.
Get hashkam’s stories in your inbox
Join Medium for free to get updates from this writer.
Now there’s an ‘_init’ function listed within the function list, so I checked that out first, but it had nothing (………of much importance or understanding to me). Also (it clicked to me a second later), local28 variable isn’t being compared against the _init function’s return value, but against a string literal called ‘_init’.
Soooo I simply (gambled, honestly), added the function’s name as it is into the password string. Aaaaaannnnnddd……(drumrolls)………It didn’t work! Really disappointing.
But (not very correct, but works) I compared the characters shown for the expected answer string on TryHackMe, and noticed that after the underscore there’s only 4 characters. So, I (haters will call it guesswork) made another attempt at the password, this time losing the ‘CTF’ at the end……………Which worked! so VOILA!
And then I inputted the same string for the answer in TryHackMe, and the challenge was cleared!
I know my writeup isn’t very professional sounding, and god knows how many mistakes it might have since I’m still a beginner at this stuff and attempting to solve challenges for the first time now. I welcome any corrections to my logic since, although my steps worked, I wasn’t very sure and clear of what I was doing, so it can be a bit wobbly.
I’ll continue writing more blogs solving different challenges, rooms or modules (whatever the heck each platform calls them), and posting here so check out my other stuff as well!
