First Steps

Platform: scarlet | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: static_binary_analysis, strings_extraction

Summary

Task: Find the flag hidden in a binary. Solution: Use strings command to extract plaintext flag from .rodata section of an unstripped ELF executable.

First Steps — Scarlet CTF

Description

Find the flag hidden in the binary!

Binary download: https://ctf.rusec.club/uploads/329ee5e4be8febdda5bfb2af0aaa2d2011f207ff37cc05405687132876517d4f/first_steps

Analysis

File Identification

 bash read-only • copy allowed Copy
$ file first_steps
first_steps: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, not stripped

Key characteristics:

• ELF 64-bit — standard Linux executable
• PIE executable — Position Independent Executable
• not stripped — symbols not removed (simplifies analysis)
• dynamically linked — uses dynamic libraries ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

String Search

Since the binary is not obfuscated or packed, the first step is searching for strings:

 bash read-only • copy allowed Copy
$ strings first_steps | grep -iE "RUSEC|flag"
RUSEC{REDACTED}

Flag found in plaintext!

Additional Strings

 bash read-only • copy allowed Copy
$ strings first_steps
...
Challenge Authored by @s0s.sh - https://s0s.sh/
RUSEC{REDACTED}
I was up late last night exploring the .rodata section, but I seem to have lost my flag!
I'm sure it's around here somewhere... Can you find it for me? <3
...

The binary itself contains a hint: the flag is located in the .rodata section (read-only data), where string constants are stored in ELF files. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# Simplest solution - string extraction

# Download the binary
wget -q "https://ctf.rusec.club/uploads/329ee5e4be8febdda5bfb2af0aaa2d2011f207ff37cc05405687132876517d4f/first_steps"

# Search for the flag
strings first_steps | grep "RUSEC{"

Alternative Methods

 bash read-only • copy allowed Copy
# Via objdump - view .rodata section
objdump -s -j .rodata first_steps | grep -A5 -B5 RUSEC

# Via xxd + grep
xxd first_steps | grep -i rusec

# Via radare2
r2 -c "iz~RUSEC" first_steps

Theory

The .rodata Section

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

In ELF files, the .rodata section (read-only data) contains:

• String literals
• Constants
• Jump tables

This is the first place to look for "forgotten" flags in simple reverse tasks.

The strings Command

strings extracts sequences of printable characters from binary files:

• By default, searches for strings of length >= 4 characters
• -n N — minimum string length
• -a — scan the entire file

Task Author

Challenge Authored by @s0s.sh ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍