SU CTF 2014 - 2048 write-up

Question:

What is the ip of the victim? 

Falg is: md5(ip)

2048.tar.gz

Solution:

Scrolling down the code in IDA two funtions pop out:

• bot_run
• attack
  
  

there is a "system" call in the attack function which tries to run this command:

wget http://ctf.sharif.edu/{code}/target.txt

by more inspection  one must notice the binary MD5 must not change and the generated {code} is time-dependent. 

in check time function 

Calculates 52c35a80 = 1388534400 

-->  UNIX time --> Wednesday 1st January 2014 12:00:00 AM 

Set time, and got correct file:

http://ctf.sharif.edu:2048/7266de4447eba9a354622271cff2dde5/target.txt

target.txt contain an IP address which was 95.211.102.203 and the flag becomes 5cfed0f91a2b71a5d79aa681eaf10adb

happy hunting!