 Hello and welcome. This is part of a series. I hope you've watched the previous videos going through some of the capture the flags from Google 2018 again, they didn't ask me to do this. In fact, I've never even talked to live overflow But I came across This you know these capture the flags by watching live or flow I subscribed to him for two months now. His videos are great through him I found John Hammond and I've been watching his videos on this topic as well and he actually inspired me to start working on some of these and Try to write scripts that automate all of them But then also, you know walking through this one. I actually the script I it actually gives you little comments It goes through on what's happening. This one's actually pretty simple. So let's read, you know, the little Description here because there's usually clues in there and there definitely is with this one So there's gonna be attachment that we got a download here. So and attachments a binary file. So it says It's a media PC all fully purchased through the online subscription revolution empire. Give me that money The PC has a remote control service rang that looks like it was caught that they'll cause all kinds of problems Or that was written by someone who watched too many 90s movies You download the binary from the vendor and begin reversing it Nothing is the right way around okay, so that You begin reversing it obviously talking about reverse engineering it, but there's more to it And as you can see there's nothing the right way around that's that's our clue here That's the last little piece of information you need to solve this so let me go ahead and again, if you go to get lab comm forward slash malix 1000 forward slash capital CT F you can download all my scripts for these these capture the flags and They should automate and walk you through the project. So here I am. I've downloaded that. I'm in the folder for gatekeeper If you if I look there's one file in here if I run it It's going to tell me if we use the heck a hex editor or strings We'll see this and I'll go into that in more detail press empty to continue at first I thought it was worm one worm That appeared to be the password, but it's not then I saw the username is this here and And I tried that it didn't work, but then I looked at the clue nothing is right way around gives it away if you reverse this You get I got mad skills and that is our flag and here I pull it out using strings. So let's actually walk through this and my strip clears out So when you done the folders clear again So real quick, I'll go into the gatekeeper script here First thing we do is we download our script Unzip it and then I remove the original zip file just to keep things clean So let me go ahead and do that manually now so we can go through this step by step So I'll download that zip file. I'll unzip it and I'll remove the original zip file and That extracted a file. So this is my script here, but then there's a file here called gatekeeper skip Gatekeeper and if we run file on it, which will tell us what type of file it is We can see here that it is a dynamically linked executable for a 64-bit system a Linux system And so we know it's executable technically probably run this on my machine But I try not to get into the habit of running random applications I download from the internet on from strange sites. I mean it's put out by Google So I'm sure it's okay, but I'm still not going to do that and I don't need to Let me go ahead. You know, I've showed you strings if we run strings against that file hit enter It's going to give us all the You know ASCII characters so I'm assuming that if we were to actually run this program we'd probably see this header and That's telling you for using in password What you probably don't see and you can see here is verifying that Worm one and then it said incorrect username and then it gives this And we say correct so we can kind of determine then we can see our CFT Which would actually be something I would search for in here But it's it's saying CFT, but then it's looking for you know a string here a variable And just the process elimination again just looking at this. It's pretty straightforward I thought it was this and I thought it was that and Then I realized after the clue that this is it backwards So if we look at again my script gatekeeper.sh The command I run is strings on that and then I grep for username. I look for The line after that then I tail to just grab that line and then I reverse it and if we do that on the file boom we get Our phrase there and I actually end up throwing that into a variable called flag So let me go ahead and do that And now I can echo out CTF curly braces and that flag variable we just created and we have The flag that we can paste into the website. That one was pretty straight and simple for it's straightforward If you play around binary files, which I do I Over the many years I have done a lot of stuff and you can do so much with binaries find out so much about them Just by using strings or a hex editor like hex edit If I could type today hex edit or on that on this file here same thing I hit tab over here I can't forward slash CTF And so that will bring me down here That'd be the first thing I look for and here we can see that same section that we saw which strings And again just looking at this you can kind of tell that okay. That's these are all plain text stuff that obviously is elite speak for one worm and Then you can also tell that this kind of doesn't you know fall in place there and Again, we just reversed that with the re re v command and we have our key Our flag so that's it And I can clean up just by saying that and again my script does everything automated it downloads it It spits out the strings here. We can hit enter kind of walks you through I didn't do this with all the scripts where it actually I put Text here explaining the process. I just thought I'd do that for this one Just because it's kind of simple, but I thought I'd explain it and there we go We got our flag just by running that script and hitting enter a few times to continue. I Hope you enjoy this video. Hope you enjoy all the my videos I hope you don't enjoy all the ones in this series again I hope they visit my website films by Chris calm and go there It's Chris the K. There's a link in the description there You can search through my videos from all my websites for all my channels Basically my main channel which is on software my second channel which is on hardware if you join my videos thing about supporting over at patreon.com Ford slash metal x1000 there's link in the description of this video or on my website You can also donate through PayPal if you can't support financially think about liking sharing subscribing commenting I thank you for watching and enjoying this video. Hope you enjoyed it and as always I hope that you have a great day