👨‍💻
f3dai blog
  • 🧑about
  • Articles
    • ✨Artificial Intelligence
      • Using Gemini to query MITRE ATT&CK
      • Mapping AI safety regulation
      • Poisoning Models
      • Threat modelling generative AI
      • o1 coding capabilities
      • Multi-agent adversarial AI systems
      • Deep reinforcement learning for red teaming
    • ⚙️ICS / OT
      • Consequence-driven Cyber-informed Engineering (CCE)
      • Energy plant cyber simulation
      • OT threat landscape
    • ☁️Cyber engineering
      • Building a cyber lab
        • 1️⃣Design
        • 2️⃣Deploy
        • 3️⃣Test
        • 4️⃣Automating
      • Threat modelling
      • Automating incident response
    • 🚩Capture The Flag
      • Hackthebox - Golfer - Reversing
      • Hackthebox - Behind the Scenes - Reversing
      • Hackthebox - Bypass - Reversing
      • Harder - TryHackMe Walkthrough
    • 🎓Career
      • Domains and roles
Powered by GitBook
On this page

Was this helpful?

  1. Articles
  2. Capture The Flag

Hackthebox - Golfer - Reversing

PreviousCapture The FlagNextHackthebox - Behind the Scenes - Reversing

Last updated 1 year ago

Was this helpful?

Downloaded an ELF file.

Opened in Ghidra. Saw an entry point, seemed like a simple program with a couple of sys calls.

There is entry and FUN_0800012f which is an undefined function (FUN_*).

FUN_0800012f() is called about 21 times, so it could be spelling out the flag?

golfer

Each function references registers. If you double click them it will take you to the data.

Took me a while to realise but I had to convert the bytes into chars by right clicking > data > char.

If you follow the given sequence in the undefined function, it will spell out the following flag:

HTB{y0U_4R3_a_g0lf3r}

🚩