Prompt

We need to break into a program that the hackers have created. You will need to provide the identifier, 7074, as the only argument to the program.

Walk-Through

This challenge involves using a disassembler to exploit a compiled binary. Compiled binaries consist of machine code instructions which can be represented as an assembly language, examples of assembly languages include X86/X64, ARM, MIPS, PowerPC, and more. One possible tool to use is the gdb program on Linux.

A Linux binary is provided and the user is tasked with extracting the secret flag. This can be solved by disassembling the main function using the disassemble main command in gdb, which reveals a call to gets.

If you analyze both binaries, you may notice differences between the two. These differences will be discussed later in the walkthrough.

‣

Open dropdown for output of RE1_32bit Binary in gdb:

If reading instructions is not your strong suite, that’s okay. You can alternatively use a tool like ghidra to help you with the software reverse engineering process.

Create a new project and import the binary into ghidra. Once imported, you can right click on the file to open it in the default tool - Code Browser. Ghidra will then prompt you to analyze the file.

After the file has been analyzed, you’ll find some new items for you to explore. To start, locate the Symbol Tree on the left hand sidebar.

The Symbol Tree contains a listing of all the C Symbols. You’ll find a folder that lists the Functions in this file. In C, the primary function that gets executed is the main function, (which was analyzed above using gdb) the ghidra decompiled version appears on the right hand side of the Ghidra Code Browser.

If you analyze the 64 bit binary in ghidra, you may notice it is slightly different:

‣

Open the dropdown for output of the 64 bit binary main function in ghidra

Certain symbols such as local variable names are often not included in compiled binaries, so those variable names are often replaced with placeholders such as “local_32”. Renaming the variables based on the assembly instructions or the decompiled source code logic can help organize the process for better interpretation of the decompiled source code.

After renaming the variables based on their logic and functionality, it can look something like this:

Based on the disassembly for the 32-bit binary, it can be inferred that the original code looks something along these lines:

Let’s return to the importance of gets. gets is a function that is known to commonly have issues with buffer overflows. The disassembly also reveals the size of the buffer (30 bytes in the 32-bit binary) which can be exploited by inputting more than that amount. This is because entering more data than the space allocated to store the input causes the data to overwrite the pass variable— the variable that controls whether you pass the check or not.

In the 64-bit version of this program, you may notice that the buffer size is shown as 44 bytes. The stack alignment requirements for the 64-bit programs and the 32-bit programs differ. It is possible that the compiler is rounding the total stack frame size up and this has added extra padding near the input buffer. Regardless, we know that gets is vulnerable and will overflow.

Thus, entering at least 1 byte more than the 30-byte buffer size into the password prompt will overflow the input buffer, overwriting the value of pass. Any additional ASCII character as the 31st byte would make the pass variable a non-zero value, causing the program to print the flag.

Solution

There are a couple of solutions paths. First, you could use gdb or ghidra to disassemble the flag function (fg) and this may reveal some parts of the flag.

Next, you could run the binary using a command

Questions

1. What is the flag hidden in the program?

©️ 2026 Cyber Skyline. All Rights Reserved. Unauthorized reproduction or distribution of this copyrighted work is illegal.