Mic Check 10

Platform: spbctf | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-10 | Status: Solved Techniques: binary_patching, function_redirection, entry_point_modification

Summary

"Вызовите функцию, которая выдаст вам флаг" (Call the function that will give you the flag)

Mic Check 10 — spbctf

Description

"Вызовите функцию, которая выдаст вам флаг" (Call the function that will give you the flag)

A simple reverse engineering challenge where the goal is to call a hidden function that prints the flag. The main function doesn't accept any input, so traditional exploitation isn't possible — binary patching is required.

Binary Analysis

File: ELF 64-bit LSB executable, x86-64, dynamically linked, not stripped

Key strings found:

• "Nope, no flag for you using this function"
• "Go to another function" ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Symbols (via nm):

Vulnerability / Challenge

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This isn't a traditional exploitation challenge:

1. main() simply prints a message and returns — no user input, no buffer overflow
2. The flag-printing function yes_print_the_flag exists but is never called
3. The challenge is to redirect execution to the hidden function

Disassembly of main (0x400500):

• Prints "Nope, no flag for you using this function"
• Prints "Go to another function"
• Returns without any interaction

Disassembly of yes_print_the_flag (0x4004f0):

• Calls obfuscated_print_flag which contains Tigress-obfuscated code
• The obfuscated code constructs and prints the flag character by character ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Since there's no user input to exploit, the approach is to patch the binary to redirect execution from main to yes_print_the_flag.

Method 1: Binary Patching (Used)

Patch the beginning of main to jump to yes_print_the_flag:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Patch mc1 binary to redirect main -> yes_print_the_flag
"""

# Read original binary
with open('mc1', 'rb') as f:
    data = bytearray(f.read())

# Addresses from nm:
# main:               0x400500
# yes_print_the_flag: 0x4004f0
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Calculate file offset for main (assuming standard ELF layout)
# main is at 0x400500, text section typically starts at 0x400000
main_offset = 0x500  # Offset in file

# Patch: Replace first bytes of main with JMP to yes_print_the_flag
# JMP rel32: E9 xx xx xx xx
# Relative offset = target - (current + 5)
# 0x4004f0 - (0x400500 + 5) = -0x15 = 0xFFFFFFEB (signed)

# JMP -0x15 = E9 EB FF FF FF
patch = bytes([0xE9, 0xEB, 0xFF, 0xFF, 0xFF])
data[main_offset:main_offset+5] = patch

# Write patched binary
with open('mc1_patched', 'wb') as f:
    f.write(data)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Make executable
import os
os.chmod('mc1_patched', 0o755)

Method 2: GDB (Alternative)

 bash read-only • copy allowed Copy
gdb ./mc1
(gdb) break main
(gdb) run
(gdb) call yes_print_the_flag()

Method 3: Python ctypes (Alternative)

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import ctypes

lib = ctypes.CDLL('./mc1')
lib.yes_print_the_flag()

Method 4: Change ELF Entry Point (Alternative)

Modify the ELF header's e_entry field to point to yes_print_the_flag instead of _start.

Running the Patched Binary

 bash read-only • copy allowed Copy
chmod +x mc1_patched
./mc1_patched
spbctf{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Lessons Learned

• Not all pwn challenges require exploitation — sometimes binary patching is the intended solution
• Always check symbols with nm — even if main is useless, there might be hidden functions
• The flag confirms the approach: REDACTED — literally "jump to the needed function"
• Multiple approaches exist: GDB, ctypes, patching, entry point modification — choose the simplest
• Tigress obfuscation splits functions into many small pieces (_7_obfuscated_print_flag_*) making static analysis harder, but doesn't prevent calling the function ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍