# getit
> Open and read the flag file!
The provided file is an x86-64 binary that provides no output, ```file``` tells usthe following:
```getit: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked,interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.24,BuildID[sha1]=e389cd7a4b9272ba80f85d7eb604176f6106c61e, not stripped```
My next step was to ```strace``` the binary and see if it provides any clues.The following is the output:
```execve("./getit", ["./getit"], [/* 32 vars */]) = 0brk(NULL)                               = 0x167a000access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3fstat(3, {st_mode=S_IFREG|0644, st_size=163641, ...}) = 0mmap(NULL, 163641, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f0995db2000close(3)                                = 0open("/usr/lib/libc.so.6", O_RDONLY|O_CLOEXEC) = 3read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260\3\2\0\0\0\0\0"...,832) = 832fstat(3, {st_mode=S_IFREG|0755, st_size=1951744, ...}) = 0mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =0x7f0995db0000mmap(NULL, 3791152, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) =0x7f099581a000mprotect(0x7f09959af000, 2093056, PROT_NONE) = 0mmap(0x7f0995bae000, 24576, PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x194000) = 0x7f0995bae000mmap(0x7f0995bb4000, 14640, PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f0995bb4000close(3)                                = 0arch_prctl(ARCH_SET_FS, 0x7f0995db1440) = 0mprotect(0x7f0995bae000, 16384, PROT_READ) = 0mprotect(0x600000, 4096, PROT_READ)     = 0mprotect(0x7f0995dda000, 4096, PROT_READ) = 0munmap(0x7f0995db2000, 163641)          = 0brk(NULL)                               = 0x167a000brk(0x169b000)                          = 0x169b000open("/tmp/flag.txt", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 3fstat(3, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0write(3, "********************************"..., 44) = 44lseek(3, 30, SEEK_SET)                  = 30write(3, "5", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 24, SEEK_SET)                  = 24write(3, "a", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 25, SEEK_SET)                  = 25write(3, "e", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 32, SEEK_SET)                  = 32write(3, "1", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 40, SEEK_SET)                  = 40write(3, "8", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 36, SEEK_SET)                  = 36write(3, "3", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 28, SEEK_SET)                  = 28write(3, "2", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 17, SEEK_SET)                  = 17write(3, "7", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 34, SEEK_SET)                  = 34write(3, "2", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 39, SEEK_SET)                  = 39write(3, "5", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 16, SEEK_SET)                  = 16write(3, "2", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 33, SEEK_SET)                  = 33write(3, "1", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 19, SEEK_SET)                  = 19write(3, "f", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 26, SEEK_SET)                  = 26write(3, "b", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 5, SEEK_SET)                   = 5write(3, "f", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 3, SEEK_SET)                   = 3write(3, "r", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 29, SEEK_SET)                  = 29write(3, "d", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 27, SEEK_SET)                  = 27write(3, "f", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 31, SEEK_SET)                  = 31write(3, "9", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 4, SEEK_SET)                   = 4write(3, "i", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 8, SEEK_SET)                   = 8write(3, "F", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 15, SEEK_SET)                  = 15write(3, "9", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 37, SEEK_SET)                  = 37write(3, "c", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 42, SEEK_SET)                  = 42write(3, "}", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 14, SEEK_SET)                  = 14write(3, "5", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 41, SEEK_SET)                  = 41write(3, "9", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 2, SEEK_SET)                   = 2write(3, "a", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 23, SEEK_SET)                  = 23write(3, "8", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 21, SEEK_SET)                  = 21write(3, "f", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 0, SEEK_SET)                   = 0write(3, "S", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 10, SEEK_SET)                  = 10write(3, "b", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 20, SEEK_SET)                  = 20write(3, "c", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 7, SEEK_SET)                   = 7write(3, "T", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 11, SEEK_SET)                  = 11write(3, "7", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 1, SEEK_SET)                   = 1write(3, "h", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 13, SEEK_SET)                  = 13write(3, "c", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 6, SEEK_SET)                   = 6write(3, "C", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 38, SEEK_SET)                  = 38write(3, "6", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 18, SEEK_SET)                  = 18write(3, "5", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 35, SEEK_SET)                  = 35write(3, "2", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 12, SEEK_SET)                  = 12write(3, "0", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 22, SEEK_SET)                  = 22write(3, "a", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44lseek(3, 9, SEEK_SET)                   = 9write(3, "{", 1)                        = 1lseek(3, 0, SEEK_SET)                   = 0write(3, "********************************"..., 44) = 44close(3)                                = 0unlink("/tmp/flag.txt")                 = 0exit_group(0)                           = ?+++ exited with 0 +++```
Combing through the output, I noticed that the file mentioned in thedescription is located at ```/tmp/flag.txt```
```open("/tmp/flag.txt", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 3```
The binary then writes stars to the file, seeks to a location in the file andwrites a character - which we can safely assume is the flag contents. Aftereach ```lseek``` and ```write``` pair, the binary overwrites the flag withstars.
```write(3, "********************************"..., 44) = 44lseek(3, 30, SEEK_SET)                  = 30write(3, "5", 1)                        = 1```
We could read through the entire trace, keeping track of the file pointer andworking out where each character will be placed. I preferred to use some bashto speed up the process.
I started the binary in ```gdb``` and set a breakpoint on the ```write``` libccall. I then ran the binary until the first breakpoint and then executed thefollowing in my shell, in order to append the contents of flag.txt to my owntext file after each file modification:
```while inotifywait /tmp/flag.txt; do cat /tmp/flag.txt >> flag.txt; done```
After continuing the binary's execution after each breakpoint, a text filecontaining all of the characters in the flag was produced. Upon stripping thelines with only stars, I was left with the flag contents:
```*************************e***********************************************5************************************a*******************************************e*************************************************1**************************************************8**************************************3**********************************2*******************************7***********************************************************2***********************************************5*******************2***********************************************************1****************************f*************************************************b*********************f****************************************r********************************************************************d****************************************f**********************************************9***************i**********************************************F*************************************************9****************************************************************c***********************************************}**************5*********************************************************************9***a***************************************************************8****************************************f*********************S****************************************************b****************************************************c*****************************T**********************************************7********************************h******************************************************c***********************************C**************************************************************************6**********************5***********************************************************2*******************0****************************************************a*****************************{*********************************```
After putting the characters together in the correct order, I submitted the flagfor a juicy 50 points. :-)