HTB

Behind The Scenes

David Johnson

02 Mar 2023 — 1 min read

The first thing I did was to open up Ghidra and decompile the binary then look
around. I usually start by looking at the main function and that's what I
did here. I noticed something a little odd, there was a function called
invalidInstructionException. I wanted to look at this closer so I clicked
onit to see the intruction. What I saw was UD2. I had not encountered this
before so I Googled it and saw this:

Generates an invalid opcode. This instruction is provided for software
testing to explicitly generate an invalid opcode. The opcode for this
instruction is reserved for this purpose. Other than raising the invalid
opcode exception, this instruction is the same as the NOP instruction.

https://mudongliang.github.io/x86/html/file_module_x86_id_318.html

This tells me that it is for testing and is the same as a NOP instruction. One
of the other. The next thing I saw was an issue that was opened in Ghidra's
github. As I read this I realised that it was the exact same thing I was working
on and there was a clue provieded there. First of all I didn't realise that
below the UD2 was not decompiled. I also learned that I can change the UD2
to the NOP and then the code below could be decompiled.

You can edit your own x86 slaspec and replace ud2 instruction with a "nop" pcode instruction.

and

You can edit your own x86 slaspec and replace ud2 instruction with a "nop" pcode instruction.

https://github.com/NationalSecurityAgency/ghidra/issues/4113

To replace the UD2 with NOP right click on it and scroll down and find
Patch Instruction for click on the UD2 and use the Crtl-Shift-g keyboard
shortcut. Do this everywhere you see a UD2 instruction.

With all the UD2 instructions pached with NOP instructions and the code
disassembled we can now look at what is going on. We can see there are several
if statements and each one is a string compirison. If we take each of those strings
and combine it we get the password or in this case the flag.

Supporting the Security Parthenon: How the Five Pillars of Information Security Work Together and Why Authorization Deserves Its Place

Like the pillars of the great Parthenon the five pillars of information security hold up and support a comprehensive security program. In this essay I will discuss the five pillars and how they are connected by providing specific examples of how they support and rely on each other within a

Firewalls, IDS, IPS and Nmap

To prevent unathorized access and malitious attacks on a network system administrators have a few options in their arsinal. Firewalls and Intrusion Detection/Prevention Systems are the main line of defense in this situation. These defenses are effective when configured properly. However, every defense has its weakness. Understanding the limitations

Golden Ticket

Golden Ticket This document covers how to create a Golden Ticket. An Active Directory Domain server is required for this to work. Connected clients are useful but not required. Creating the Ticket To create a Golden Ticket the NT Hash for KRBTGT will need to be aquired as well as

Bash Breakout

Breaking out of a restricted shell is a significant step in ethical hacking and penetration testing. However, sometimes you find yourself in a limited or non-interactive shell environment where essential features like command history navigation and screen clearing don't work. In such cases, upgrading to a fully interactive

Read more

Supporting the Security Parthenon: How the Five Pillars of Information Security Work Together and Why Authorization Deserves Its Place

Firewalls, IDS, IPS and Nmap

Golden Ticket

Bash Breakout