# Admin UI2
[pwn-re - 0pt.]
*That first flag was a dud, but I think using a similar trick to get the full binary file might be needed here. There is a least one password in there somewhere. Maybe reversing this will give you access to the authenticated area, then you can turn up the heat… literally.*
-----
### *Show me the mon^w code*
At this point, we must already have noticed that directory traversal is possible.   Since we can, let's use Linux's [process information pseudo-filesystem](http://lmgtfy.com/?q=man+5+proc) facility to grab an image of the executable.  ```% printf "2\n../../../proc/self/exe\n" | nc mngmnt-iface.ctfcompetition.com 1337 > main.elf% file main.elfmain.elf: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=e78c178ffb1ddc700123dbda1a49a695fafd6c84, not stripped```
Fine, the binary wasn't stripped... Let's search for a flag. 
```% nm main.elf | grep FLAG0000000041414a40 r _ZL4FLAG0000000041414a2c r _ZL9FLAG_FILE```
The *_ZL4FLAG* symbol is a likely candidate. Let's grab its value.
```% gdb -batch -ex 'file ./main.elf' -ex 'x/s _ZL4FLAG'0x41414a40 <_ZL4FLAG>:  "\204\223\201\274\223\260\250\230\227\246\264\224\260\250\265\203\275\230\205\242\263\263\242\265\230\263\257\363\251\230\366\230\254\370\272/bin/sh"```
-----
### *await(ASCIIize(&_ZL4LFLAG[0]));*
Setting a watchpoint in gdb fucks up, and the binary wasn't stripped, so let's use a disassembler. It's straightforward enough.
In the *secondary_login* routine, we see how a *password* buffer is filled: - A call to *scanf* attempts to extract up to 127 characters from the standard input, terminating at the first null.  -  Right after this is a loop that XORs each of the previously extracted character with the value 0xFFFFFFC7, then stores the lowest byte back in-place.  - *_ZL4FLAG* and *password* are then compared; the *secondary login* succeeds iif they match.
Since the exclusive-or operation is reversible, we can recover the flag by xor'ing the contents _ZL4FLAG with a truncation of previous value (0xC7).
```>>> "".join([chr(ord(x)^int("0xC7", 16)) for x in list('\204\223\201\274\223\260\250\230\227\246\264\224\260\250\265\203\275\230\205\242\263\263\242\265\230\263\257\363\251\230\366\230\254\370\272/bin/sh')]).split("}")[0]+'}''CTF{Two_PasSworDz_Better_th4n_1_k?}'```
I thought there was a flag?