CodeLocked involves a door lock on a webpage. Putting in the correct 8 digit code will provide the flag, but the function to check it is handled in web assembly. We'll use a plugin to Ghidra to get the code decompiled very nicely, figure out the pin, and show how that pin is used to calculate the flag. We'll also buteforce the pin in the JavaScript console in the Chrome dev tools.
Ghidra Wasm Plugin: github.com/nneonneo/ghidra-wa...
Hacky Easter: 23.hackyeaster.com/
Challenge: ch.hackyeaster.com:2311/ (should be up through late June 2023)
☕ Buy Me A Coffee: www.buymeacoffee.com/0xdf
[00:00] Introduction
[00:55] Challenge introduction
[01:34] Site in Chrome dev tools
[06:10] Downloading web assembly
[06:33] Preparing Ghidra
[08:48] Analysis of check function to get pin
[11:26] Decrypting flag buffer with pin
[17:43] Brute-forcing pin
[20:18] Conclusion
#ctf #HackyEaster