Sudo ltrace | Ryan's CTF [15] Strings wont help you

Key Takeaways

this challenge from Ryan Nicholson's cap from flag competition is called strings won't help you for 100 points in the extreme category it says determine the password that the program asks for and receive the flag recover the flag so it gives us a show that we can connect to credentials to login with CTF 9 and challenge 9 if we check in our home directory we have a file program ok we still don't have the file command whatever let's run the program and it says cat root md5 hash permission denied that's weird enter the password for the flag please sub nope try again I was originally weirded out by why we're getting a permission denied notion thing here for root md5 if I check out this program it's not a set UID binary so it's very strange but it's owned by root and everyone can run it but I'm not able to open up this file that's in the root home directory so I checked out what I can run with sudo or with root privileges and it says these user may run the following commands no password competitor program ok we see that here and L Trace that was really weird so I figured all right let's sudo L trace and the program and this will show us ok what is it which is actually trying to happen here looks like it tries to read this file md5 hash and it gets this md5 hash cool it enters the password for the flag as we input it so please sub and then it tries to oh it uses some bash code to determine the md5 sum of that get the actual hash and it tries to compare that you can see strcmp with the hash that it read out of md5 hash so all we need is to figure out what this hash is originally what the real plane tax is from that write like that should be our goal here because please sub is not the correct password but whatever yields this hash is the correct password so let's go ahead and try and crack this I'll google it or a crack station whatever we need to do to actually I don't need command-line I just need the actual thing whatever we need to do to crack this hash let's paste it in here run through that stupid CAPTCHA and the hash is supposedly Big Bang one okay so back to our program here now we can run program again we'll have to sudo it because so we can read that proper hash file and then we'll enter Big Bang three one and it says okay sweet that was the flag that's here's what you need a foo material I that wasn't a set UID binary I thought that was kind of strange but I was going to use L trace and s trace to begin with so it's an interesting thing that those our noted in sudo that we would be able to run them so always always at least when you're in a shell try and run that basic enumeration sudo attack l lista well you can run without a password or anything also in the system you might have access to that's kind of a cool thing to note for a capture flag competitions and this one was just a simple okay reverse this hash pretty much what we did like in the beginner section hey I want to give a special shout out and some love the people that are willing to support me on patreon you guys are phenomenal I'm gonna do it I'm gonna run through hero Spencer Clark L Horowitz so hey Attila I'm sorry always put your name or Gaddafi and religious world's bastion of Harwich and Rob Timothy County Jacob hr1 FL Thomas for Rob Dacus JT ton Maurice contour oh it's Ben's Queenie William woodcomb Justin man Kim Bono pixel richard smith you guys are phenomenal hey $1 a month on patreon will give you a special shout-out just like this at the end of every video where I can butcher your name along with everyone else's $5 a month on patreon will give you early access to every video that I create before it's uploaded onto YouTube and if you did like this video please do press that like button maybe leave me a comment if you're willing to subscribe join us on discord linked to the server is in the description and you would be awesome if I could see some support on patreon you're the best guys see you soon