Home
System Hacking
๐ŸŽž๏ธ

slutter

Type
CTF
๋…„๋„
2025
Name
Nowruz 1404
๋ถ„์•ผ
Rev
์„ธ๋ถ€๋ถ„์•ผ
Flutter
์—ด
2025/03/20 04:32
1 more property

# Description

What do you do if you encounter Flutter on Linux?
Plain Text
๋ณต์‚ฌ

# ๋ถ„์„

slutter.zip ํŒŒ์ผ์„ ๋‹ค์šด๋กœ๋“œ ๋ฐ›์„ ์ˆ˜ ์žˆ๋‹ค.
ํ•ด๋‹น ํŒŒ์ผ์„ ๋‹ค์šด๋กœ๋“œ ๋ฐ›์•„ ์••์ถ•์„ ํ’€์–ด๋ณด๋ฉด ์•„๋ž˜์™€ ๊ฐ™์€ ํŒŒ์ผ ๊ตฌ์กฐ๋ฅผ ํ™•์ธํ•  ์ˆ˜ ์žˆ๋‹ค.
./ โ”œโ”€โ”€ data โ”‚ โ”œโ”€โ”€ flutter_assets โ”‚ โ”‚ โ”œโ”€โ”€ AssetManifest.bin โ”‚ โ”‚ โ”œโ”€โ”€ AssetManifest.json โ”‚ โ”‚ โ”œโ”€โ”€ FontManifest.json โ”‚ โ”‚ โ”œโ”€โ”€ NOTICES.Z โ”‚ โ”‚ โ”œโ”€โ”€ fonts โ”‚ โ”‚ โ”‚ โ””โ”€โ”€ MaterialIcons-Regular.otf โ”‚ โ”‚ โ”œโ”€โ”€ kernel_blob.bin โ”‚ โ”‚ โ”œโ”€โ”€ packages โ”‚ โ”‚ โ”‚ โ””โ”€โ”€ cupertino_icons โ”‚ โ”‚ โ”‚ โ””โ”€โ”€ assets โ”‚ โ”‚ โ”‚ โ””โ”€โ”€ CupertinoIcons.ttf โ”‚ โ”‚ โ”œโ”€โ”€ shaders โ”‚ โ”‚ โ”‚ โ””โ”€โ”€ ink_sparkle.frag โ”‚ โ”‚ โ””โ”€โ”€ version.json โ”‚ โ””โ”€โ”€ icudtl.dat โ”œโ”€โ”€ lib โ”‚ โ””โ”€โ”€ libflutter_linux_gtk.so โ””โ”€โ”€ slutter
Bash
๋ณต์‚ฌ
slutter ํŒŒ์ผ์„ ํ™•์ธํ•ด๋ณด๋ฉด ์•„๋ž˜์™€ ๊ฐ™์ด ELF ํŒŒ์ผ์ธ ๊ฒƒ์„ ์•Œ ์ˆ˜ ์žˆ๋‹ค.
file ./slutter ./slutter: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=c77dcc8e7423c8e589ceca8752cadcc937408f1d, for GNU/Linux 4.4.0, with debug_info, not stripped
Bash
๋ณต์‚ฌ
์‹คํ–‰ํ•ด๋ณด๋ฉด ์•„๋ž˜์™€ ๊ฐ™์ด 0x13371337๋ฒˆ ํด๋ฆญํ•˜๋ผ๊ณ  ๋œฌ๋‹ค.
ํด๋ฆญํ•˜๋ฉด 1์”ฉ ์ฆ๊ฐ€ํ•˜์ง€๋งŒ ๊ณ„์† ํ˜„์‹ค์ ์œผ๋กœ ํด๋ฆญ์„ ํ•˜๊ณ  ์žˆ์„ ์ˆ˜๊ฐ€ ์—†๋‹คโ€ฆ

์‚ฝ์งˆ

1.
์•ฑ์ด๋ฉด string์œผ๋กœ ๋ฐ•ํ˜€์žˆ๋‹ค๊ณ  ์ƒ๊ฐํ–ˆ๋‹ค.
โ†’ gdb๋กœ attach ํ›„ memory dumpํ›„ ํ™•์ธํ•ด๋ดค์ง€๋งŒ ์—†์Œ
2.
linux์—์„œ cheat engine ๊ฐ™์€๊ฑธ๋กœ memory value ๋ณ€์กฐ
โ†’ memory์—์„œ ๊ฒ€์ƒ‰์€ ๋˜๋Š”๋ฐ ๋ณ€๊ฒฝํ•ด๋„ ์•„๋ฌด๋Ÿฐ ๋ณ€ํ™”๊ฐ€ ์ผ์–ด๋‚˜์ง€ ์•Š์Œ

Flutter Debug Mode

Flutter๊ฐ€ Debug ๋ชจ๋“œ์—์„œ๋Š” ์ปดํŒŒ์ผ์„ ํ•  ๋•Œ kernel_blob.bin์„ ๋‚จ๊ธด๋‹ค๊ณ  ํ•œ๋‹ค.
์ฆ‰ kernel_blob.bin ํŒŒ์ผ์— ์†Œ์Šค์ฝ”๊ฐ€ ๋‚จ์•„์žˆ๋‹ค๊ณ  ํ™•์ธํ–ˆ๊ณ  ์šฐ๋ฆฌ๋Š” ์•ž์—์„œ tree ๋ช…๋ น์–ด๋ฅผ ํ†ตํ•ด์„œ kernel_blob.bin ํŒŒ์ผ์ด ์กด์žฌํ•˜๋Š” ๊ฒƒ์„ ํ™•์ธํ–ˆ๋‹ค.

extract string

kernel_blob.bin์—์„œ string์„ ์ถ”์ถœํ•œ๋‹ค.
strings kernel_blob.bin > strings.txt
Bash
๋ณต์‚ฌ
์†Œ์Šค์ฝ”๋“œ๊ฐ€ ์ถ”์ถœ๋œ๋‹ค.
์ด์ œ ์ € ๋ฌธ์ž์—ด์„ ์ฐพ์•„๋ณธ๋‹ค.
Ctrl + F๋กœ โ€œpush this buttonโ€ ๊ฒ€์ƒ‰ ํ›„ ์œ„ ์•„๋ž˜๋ฅผ ๋ณด๋ฉด flag๊ฐ€ ๋ฐ•ํ˜€์žˆ๋‹ค.
if (_counter == 0x13371337) { flag = [ 70, 77, 67, 84, 70, 123, 100, 49, 68, 95, 121, 48, 117, 95, 117, 53, 51, 95, 56, 108, 117, 55, 55, 51, 82, 95, 48, 82, 95, 119, 104, 52, 55, 63, 125 ]; }
Bash
๋ณต์‚ฌ
์›ƒ๊ธด์ ์€ ์ง„์งœ 0x13371337๋ฒˆ ํด๋ฆญํ–ˆ์–ด๋„ ํ’€๋ ธ๋‹ค๋Š” ๊ฒƒ์ด๋‹ค.
python ์ฝ”๋“œ๋กœ ๋ณตํ˜ธํ™”ํ•ด๋ณด๋ฉด flag๋ฅผ ์–ป์„ ์ˆ˜ ์žˆ๋‹ค.
[print(chr(i),end='') for i in [70, 77, 67, 84, 70, 123, 100, 49, 68, 95, 121, 48, 117, 95, 117, 53, 51, 95, 56, 108, 117, 55, 55, 51, 82, 95, 48, 82, 95, 119, 104, 52, 55, 63, 125]]
Python
๋ณต์‚ฌ

# Flag

FMCTF{d1D_y0u_u53_8lu773R_0R_wh47?}
Plain Text
๋ณต์‚ฌ

Reference