Grinch Attack

Platform: CUSTOM | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: hash_identification, hint_interpretation, single_char_bruteforce, static_analysis

Summary

Walkthrough of the CUSTOM Reversing Grinch Attack. Task: Reverse ELF binary with SHA256 hash verification. Solution: Identified Wham! from Last Christmas song reference in description, bruteforced special character (~) to find complete answer.

Description

Является ли песня «Last Christmas» самой популярной рождественской песней?

Is 'Last Christmas' the most popular Christmas's song?

Files: grinch_attack (ELF 64-bit binary)

Analysis

Step 1: Initial Analysis

The binary is an ELF 64-bit executable. Running strings revealed interesting strings:

The hint for the task in the description.Good luck
6abe48fdc061c32682db70edc6aea5d2eccbe4a7ed0579324f1370eca5a33c4e
a51d01f815964002e2ddcc2b778ce44a10a3fb50eadaac2ef4d6e24df9e466d4
You are right but maybe you need something special?
Congratulations,you got it
The flag is grodno{%s}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Two SHA256 hashes and a hint about "something special".

Step 2: Reverse Engineering

Decompilation via radare2 revealed the logic:

1. The program reads user input
2. Computes SHA256 hash of the input
3. Compares with hash a51d01f815964002e2ddcc2b778ce44a10a3fb50eadaac2ef4d6e24df9e466d4 → outputs "You are right but maybe you need something special?"
4. Compares with hash 6abe48fdc061c32682db70edc6aea5d2eccbe4a7ed0579324f1370eca5a33c4e → outputs the flag with user input

Step 3: Cracking the First Hash

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The description asks about the song "Last Christmas". This song was performed by Wham!

Verification:

 bash read-only • copy allowed Copy
echo -n "Wham!" | sha256sum
# a51d01f815964002e2ddcc2b778ce44a10a3fb50eadaac2ef4d6e24df9e466d4

Match! But the program says "maybe you need something special" - a special character is needed.

Step 4: Finding the Special Character

Bruteforce all ASCII characters appended to "Wham!":

 bash read-only • copy allowed Copy
for i in {0..127}; do
  char=$(printf "\\x$(printf '%02x' $i)")
  word="Wham!$char"
  hash=$(echo -n "$word" | sha256sum | cut -d' ' -f1)
  if [ "$hash" = "6abe48fdc061c32682db70edc6aea5d2eccbe4a7ed0579324f1370eca5a33c4e" ]; then
    echo "FOUND: char $i ($(printf '%c' $i))"
  fi
done

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Result: character 126 (~ tilde).

 bash read-only • copy allowed Copy
echo -n "Wham!~" | sha256sum
# 6abe48fdc061c32682db70edc6aea5d2eccbe4a7ed0579324f1370eca5a33c4e

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# Run the binary with the correct input
echo "Wham!~" | ./grinch_attack

Output:

The hint for the task in the description.Good luck
Congratulations,you got it
The flag is grodno{REDACTED}

Lessons

1. Description = hint: "Last Christmas" → Wham! (the song's performer)
2. "Something special" in CTF: usually means special characters
3. Single character bruteforce: when you have a partial answer, try appending characters
4. Strings first: often reveals program logic without deep reverse engineering ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering hash_identification, hint_interpretation, single_char_bruteforce, static_analysis was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-01-10 • CUSTOM • Grinch Attack • Difficulty: Easy