It's a 32bits elf binary of some version of vsftpd, where it have been added a backdoor, they don't specify is an authentication backdoor, a special command or other stuff.
I started looking for something weird on the authentication routines, but I didn't found anything significant in a brief period of time, so I decided to do a bindiff, that was the key for locating the backdoor quickly. I do a quick diff of the strings with the command "strings bin | sort -u" and "vimdiff" and noticed that the backdoored binary has the symbol "execl" which is weird because is a call for executing elfs, don't needed for a ftp service, and weird that the compiled binary doesn't has that symbol.
Looking the xrefs of "execl" on IDA I found that code that is a clear backdoor, it create a socket, bind a port and duplicate the stdin, stdout and stderr to the socket and use the execl:
There are one xrefs to this function, the function that decides when trigger that is that kind of systems equations decision:
The backdoor was not on the authentication, it was a special command to trigger the backdoor, which is obfuscated on that systems equation, it was no needed to use a z3 equation solver because is a simple one and I did it by hand.
The equation:
cmd[0] = 69
cmd[1] = 78
cmd[1] + cmd[2] = 154
cmd[2] + cmd[3] = 202
cmd[3] + cmd[4] = 241
cmd[4] + cmd[5] = 233
cmd[5] + cmd[6] = 217
cmd[6] + cmd[7] = 218
cmd[7] + cmd[8] = 228
cmd[8] + cmd[9] = 212
cmd[9] + cmd[10] = 195
cmd[10] + cmd[11] = 195
cmd[11] + cmd[12] = 201
cmd[12] + cmd[13] = 207
cmd[13] + cmd[14] = 203
cmd[14] + cmd[15] = 215
cmd[15] + cmd[16] = 235
cmd[16] + cmd[17] = 242
The solution:
cmd[0] = 69
cmd[1] = 75
cmd[2] = 79
cmd[3] = 123
cmd[4] = 118
cmd[5] = 115
cmd[6] = 102
cmd[7] = 116
cmd[8] = 112
cmd[9] = 100
cmd[10] = 95
cmd[11] = 100
cmd[12] = 101
cmd[13] = 106
cmd[14] = 97
cmd[15] = 118
cmd[16] = 117
cmd[17] = 125
The flag:
EKO{vsftpd_dejavu}
The binary:
https://ctf.ekoparty.org/static/pre-ekoparty/backdoor
The binary:
https://ctf.ekoparty.org/static/pre-ekoparty/backdoor
- Hack Tools Mac
- Hacker Security Tools
- How To Make Hacking Tools
- Hacking Tools For Games
- Pentest Tools Website
- Beginner Hacker Tools
- Hack Website Online Tool
- Tools 4 Hack
- Hack Tools For Ubuntu
- Hacking Tools
- Usb Pentest Tools
- Hacking Tools Software
- Hacker Tools For Pc
- Hack Tool Apk
- Hacking Tools Pc
- Pentest Tools Website Vulnerability
- Pentest Tools Tcp Port Scanner
- Hacker Tools Linux
- Hacking Tools Pc
- Pentest Tools Alternative
- Hacker Tools For Mac
- Hacking Tools For Windows Free Download
- Hacker Tools Linux
- Pentest Tools Apk
- Pentest Tools Alternative
- Hacker Tools For Ios
- Physical Pentest Tools
- Pentest Tools Apk
- Hacker Tools Apk Download
- Pentest Tools Website Vulnerability
- Hacking Tools For Pc
- Hack Apps
- Hacks And Tools
- How To Install Pentest Tools In Ubuntu
- Hacking Tools
- Nsa Hack Tools
- Hack Tools Download
- Growth Hacker Tools
- How To Install Pentest Tools In Ubuntu
- Hacking Tools
- Hack Tool Apk No Root
- Pentest Tools For Mac
- Tools For Hacker
- Pentest Tools Find Subdomains
- Hacker Tools Windows
- Hacking Tools For Kali Linux
- Hacking Apps
- Hack Tool Apk No Root
- What Is Hacking Tools
- New Hack Tools
- Hacker Tools For Windows
- Pentest Tools Website
- Pentest Tools For Ubuntu
- Pentest Tools For Windows
- Pentest Tools Github
- Hacker Security Tools
- Hacking Tools Download
- Easy Hack Tools
- Hacker Tools Github
- Hacking Tools 2020
- Hacker Tools 2020
- Pentest Tools Subdomain
- Hacker Tools Apk Download
- Pentest Tools Linux
- Pentest Box Tools Download
- Hack Tools For Ubuntu
- Pentest Tools Url Fuzzer
- What Is Hacking Tools
- Growth Hacker Tools
- Hacking Tools For Windows 7
- Hacking App
- Hacking Tools Usb
- Physical Pentest Tools
- Hacker Tools 2020
- Hacking Tools For Mac
- Nsa Hacker Tools
- Hackrf Tools
- Hacker Tools Apk
- Hack Tool Apk
- Hack Tools Mac
- Pentest Tools Free
- Pentest Tools Apk
- Hacking App
- Install Pentest Tools Ubuntu
- Hacker Tools For Mac
- Hack Apps
- Hack Tools For Games
- Pentest Tools Website Vulnerability
- Hacking Tools For Games
- Pentest Automation Tools
- Bluetooth Hacking Tools Kali
- Hacking Tools For Kali Linux
- Hacking Tools Online
- World No 1 Hacker Software
- How To Install Pentest Tools In Ubuntu
- Hack Tools Mac
- Top Pentest Tools
- Hacker Tools For Ios
- Hack Tools Download
- Hacking Tools And Software
- Hack And Tools
- What Are Hacking Tools
- Hacking Tools And Software
- Hacking Tools For Windows 7
- Hacking Tools For Windows
- Hacking Tools For Mac
- Pentest Tools Find Subdomains
- Pentest Tools Alternative
- Hacks And Tools
- Pentest Tools Kali Linux
- Hacking Tools Name
- How To Hack
- Nsa Hacker Tools
- Hacker Tools Free Download
- Hack Tools Pc
- Nsa Hacker Tools
- Hacker Tools For Mac
- Hacking Tools For Pc
- World No 1 Hacker Software
- Termux Hacking Tools 2019
- Hacking Tools 2020
- Hacking Tools For Windows Free Download
- Hacker Hardware Tools
- Pentest Tools Linux
- Top Pentest Tools
- Pentest Automation Tools
- Hack Tools For Games
- Hacker Tools Github
- Hacking Tools For Windows 7
- Hacking Tools Kit
- Pentest Tools Framework
- What Are Hacking Tools
- Hacking Tools For Mac
- Underground Hacker Sites
- Hacking Tools Download
- Pentest Tools Find Subdomains
- Pentest Automation Tools
- Hackrf Tools
- Hacker Tools Mac
- Hacker Tool Kit
- Kik Hack Tools
- Hacking Tools Hardware
- Pentest Recon Tools
- Pentest Tools For Mac
- Hacker Search Tools
- Pentest Tools Free
- Pentest Tools For Android
- Hack Tools Github
- Hack Tools
- Hackrf Tools
- Pentest Tools Website Vulnerability
- Top Pentest Tools
- Pentest Tools Tcp Port Scanner
- Pentest Tools Open Source
- Hack Rom Tools
- Pentest Tools Download
- Hacking Tools Free Download
- Hacking Tools Usb
- Easy Hack Tools
- Hacking Tools For Mac
- Hack Tools Pc
- Kik Hack Tools
- Pentest Tools
- Hacking Tools Windows
- Termux Hacking Tools 2019
- Tools For Hacker
- Kik Hack Tools
- Hacking Apps
- Tools Used For Hacking
- Pentest Tools Url Fuzzer
- Pentest Tools Subdomain
- Hack Tools
- Hacking Tools Free Download
- Hack Tools For Pc