Practical Binary Analysis Ch. 5 CTF: Lvl 4
This is my writeup for Level 4 of the Practical Binary Analysis CTF challenge. Unlike the others, this flag was incredibly obvious and easy to retrieve, so I won’t waste any time going into unecessary details and just get straight to the point
Fourth Flag: lvl4
Passing the lvl3 flag
Clearly it is telling us to inspect what the program seems to do while running. This means examining any syscalls or external library calls it makes. Let’s first start with strace:
Nothing particularly sticks out to me here. Maybe ltrace will have some more useful info?
Well that seems quite obvious… it seems that the flag is simply set by the program in an environment variable. Let’s pass it to the oracle to see what happens. And sure enough…
It works. Definitely thought it was going to be another red-herring, but it seems it was just that simple. The final flag was