Static ain't always noise

• Description: Can you look at the data in this binary: static? This BASH script might help!
• Difficulty: Easy

---

🔎 Solution

The challenge provides 2 files: a program file and a Bash script. The Bash script is designed to disassemble a binary executable and extract readable strings from it.
After granting execute permissions to the script and running it with the binary file as an argument, it generates 2 output files: static.ltdis.strings.txt and static.ltdis.x86_64.txt.

┌──(kali㉿kali)-[~/Desktop]
└─$ chmod +x ./ltdis.sh 
                                                                                                             
┌──(kali㉿kali)-[~/Desktop]
└─$ ./ltdis.sh static 
Attempting disassembly of static ...
Disassembly successful! Available at: static.ltdis.x86_64.txt
Ripping strings from binary with file offsets...
Any strings found in static have been written to static.ltdis.strings.txt with file offset

By inspecting the contents of static.ltdis.strings.txt, you can discover the flag.

┌──(kali㉿kali)-[~/Desktop]
└─$ cat static.ltdis.strings.txt 
    238 /lib64/ld-linux-x86-64.so.2
    361 libc.so.6
    36b puts
    370 __cxa_finalize
    37f __libc_start_main
    391 GLIBC_2.2.5
    39d _ITM_deregisterTMCloneTable
    3b9 __gmon_start__
    3c8 _ITM_registerTMCloneTable
    660 AWAVI
    667 AUATL
    6ba []A\A]A^A_
    6e8 Oh hai! Wait what? A flag? Yes, it's around here somewhere!
    7c7 ;*3$"
   1020 picoCTF{d15a5m_t34s3r_ae0b3ef2}

Another way to solve this challenge is by using the strings command in combination with grep to search for the keyword picoCTF directly within the static file. This approach also reveals the flag.

┌──(kali㉿kali)-[~/Desktop]
└─$ strings static | grep "picoCTF"          
picoCTF{d15a5m_t34s3r_ae0b3ef2}

🚩Flag

picoCTF{d15a5m_t34s3r_ae0b3ef2}