task4

Platform: CUSTOM | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: disassembly, function_pointer_hijack, modulo_computation, static_analysis

Summary

Walkthrough of the CUSTOM Reversing task4. Task: 32-bit ELF binary reads integer and calls it as function pointer. Solution: Find printflag address (0x0804867f = 134514303), enter it to trigger flag generation via modulo-indexed function table

Description

Download binary: task4 (ELF) / task4.exe (Windows PE32). Enter the magic number, and app will print the flag.

English summary: A 32-bit ELF binary prompts for a "magic number". The goal is to find the correct number that makes the program print the flag.

Analysis

Binary reconnaissance

 bash read-only • copy allowed Copy
$ file task4
task4: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, 
       interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, not stripped
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

$ strings task4 | grep -E "(Flag|flag|string)"
Flag{
This is my string.Possible this is flag

The binary is not stripped, revealing useful symbols:

• main - entry point
• printflag - the target function
• function1 through function14 - helper functions

Main function vulnerability

Disassembly of main reveals a critical vulnerability:

 asm read-only • copy allowed Copy
main:
    push   %ebp
    mov    %esp,%ebp
    sub    $0x18,%esp
    lea    -0xc(%ebp),%eax      ; local variable for input
    push   %eax
    push   $0x804889e           ; "%d" format string
    call   scanf
    add    $0x10,%esp
    mov    -0xc(%ebp),%eax      ; load user input into EAX
    call   *%eax                ; CALL the input as address!
    mov    $0x0,%eax
    leave
    ret

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key vulnerability: The program reads an integer via scanf("%d") and directly uses it as a function pointer with call *%eax. There is NO validation — the user controls where execution jumps.

printflag function analysis

The printflag function at address 0x0804867f:

1. Prints "Flag{" prefix
2. Constructs the string "This is my string.Possible this is flag" on the stack
3. Has a function pointer table with 14 entries (function1 through function14)
4. For each character in the string:
   • Computes ASCII_value % 14 using compiler-optimized division
   • Uses the result as an index into the function table
   • Calls the corresponding function
5. Prints "}" suffix ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Each functionN prints a single character:

• function1 → '1', function2 → '2', ..., function9 → '9'
• function10 → 'a', function11 → 'b', function12 → 'c', function13 → 'd', function14 → 'e'

The modulo operation uses the compiler optimization pattern:

 asm read-only • copy allowed Copy
imul   $0x93,%eax,%eax    ; multiply by magic constant
shr    $0x8,%eax          ; shift right
; ... additional adjustments for division by 14

Solution

Step 1: Find the magic number

The magic number is simply the address of printflag: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 bash read-only • copy allowed Copy
$ objdump -t task4 | grep printflag
0804867f g     F .text  00000143 printflag

Address: 0x0804867f = 134514303 in decimal

Step 2: Verify the flag generation

 python read-only • copy allowed Copy
#!/usr/bin/env python3
# Simulate the flag generation algorithm

s = 'This is my string.Possible this is flag'
chars = ['1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e']

result = 'Flag{'
for c in s:
    idx = ord(c) % 14
    result += chars[idx]
result += '}'

print(result)
# Output: Flag{REDACTED}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 3: Get the flag

 bash read-only • copy allowed Copy
$ echo 134514303 | ./task4
Flag{REDACTED}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering disassembly, function_pointer_hijack, modulo_computation, static_analysis was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2020-01-01 • CUSTOM • task4 • Difficulty: Easy