Защищенный банк (Protected Bank)

Platform: duckerz | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: Windows | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: strings_extraction, binary_analysis

Summary

File: protected_bank.exe (Windows PE32+ executable)

Защищенный банк (Protected Bank) — duckerz

Description

Я забыл свой пин-код, но мне очень нужны деньги, помоги мне пожалуйста

(I forgot my pin code, but I really need money, please help me)

File: protected_bank.exe (Windows PE32+ executable)

Analysis

1. File Identification

 bash read-only • copy allowed Copy
file protected_bank.exe

protected_bank.exe: PE32+ executable (console) x86-64, for MS Windows

The file is a 64-bit Windows console executable.

2. String Search

For simple reverse engineering tasks, the first step is always to try extracting readable strings from the binary: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
strings protected_bank.exe | grep -iE "pin|flag|DUCKERZ|password"

Result:

To withdraw money, enter your pin: 
DUCKERZ{REDACTED}
Incorrect password

The flag was found in plaintext directly in the executable!

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# Simplest solution - extracting strings from the binary

# Identify file type
file protected_bank.exe

# Search for flag among strings
strings protected_bank.exe | grep -E "DUCKERZ\{.*\}"

Alternative Method (Python)

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import re
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

with open('protected_bank.exe', 'rb') as f:
    data = f.read()

# Search for flag pattern
pattern = rb'DUCKERZ\{[^}]+\}'
match = re.search(pattern, data)

if match:
    print(f"Flag: {match.group().decode()}")

Flag Analysis

The flag contains a hint about the solution method:

• REDACTED = "strings solve" (leetspeak)
• th1s_B1NK = "this bank"

The task author clearly hints that the challenge is solved using the strings utility.

Why This Works

In this case, the bank's "protection" is fictitious:

1. The program simply compares the entered PIN with a hardcoded value
2. The flag is stored as a regular string in the data section of the executable
3. No encryption or obfuscation is applied ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This is a classic beginner task demonstrating that:

• Storing secrets in plaintext in binaries is bad practice
• The strings utility is the first tool when analyzing unknown files

Lessons

1. Always start with strings - it takes seconds and often yields results
2. Read the flag - authors often leave hints in the flag itself
3. Simple tasks = simple solutions - don't overcomplicate if the task is marked as easy

References

• strings man page
• file command ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍