Security Forem

Hitanshu Gedam
Hitanshu Gedam

Posted on

picoCTF bbbbloat writeup

We are given a binary file here in this challenge. I used wget to download it in the pico webshell, and also downloaded it in my Windows laptop.
I make the file executable using the chmod +x bbbbloat. From the downloaded file on my Windows laptop, I head over to Dogbolt and upload the file there:

dogbolt

I keep scrolling down the decompiled code in order to find something interesting. I found the above code of interest.
This code checks if the variable local_48 equals 0x86187, and if so, it sets local_44 to 0xd2c49, then calls a function FUN_00101249 with arguments 0 and the address of local_38, expecting it to return a dynamically allocated string. It stores the result in local_40, prints the string to standard output followed by a newline, and then frees the allocated memory to avoid a memory leak. The function likely generates or retrieves a string (e.g., a message or flag) when the specific condition is met.
Next, I head over to RapidTables
for converting Hex to Decimal (because when I tried to run the executable bbbbloat file on webshell, it asked me to guess its favourite number i.e. for an integer input)

rapidtables

0x86187 = 549255 (in decimal)

I input that number after executing the bbbbloat file:

input

And there we have our flag!

Top comments (0)