Reverse Engineer a simple binary
Budget: $10 – $30 USD
You are working at a company called ‘OurCompany’. Your supervisor has come to you because he heard you took a class on Reverse Engineering. Apparently, they found some anomalous outbound traffic on the network late at night. They ran wireshark to capture the traffic and found TCP connections that contained binary blobs being sent to an IP address in an eastern European country. When they examined the machine where the traffic was coming from, they found a binary running. They have provided you with:
A copy of the binary
The payloads of a few of the binary blobs they saw
By payload, I mean the contents of the socket connection with all the TCP/IP information stripped
“TheBoss” wants to know what is going on. What was this program doing? What information is in these binary blobs that appear to be random data with no patterns/signatures.
You have been provided with the files ‘binary’, ‘bin1’, ‘bin2’, and ‘bin3’. The ‘binary’ file is the executable. The other bin files were pulled from wireshark and are the payloads of the communication that was viewed.
Please answer the following questions/perform the following tasks:
1. Provide what shared objects this binary imports (ie what external libraries are used?)
2. Examine the binary and determine how the binary blobs are being sent – what internet address are they being sent to?
3. How are the binary blobs being created?
4.What format, if any, are they in?
5.What is the algorithm being used to create them?
6.What are the inputs are used in the identified algorithm?
7.Write a C program that can decode these binary blobs
Provide your C code with instructions on how to compile/use it – make sure it works on the class VMs
Provide the information that you have decoded from the binary blobs – What is it?
8. How does the program gather the data to put into the binary blobs? What mechanism is used? Are there any signatures you can look for to detect this on other hosts on your network?
*The algorithm you find must be implemented in C! You may not use ‘system’, ‘exec’ or other such functions to call command line/shell utilities or pass scripting commands to various parsers!
*Please include screenshots/documentation to back up your findings!
I will provide Username and Password on how to access for the binaries. it can be accessed using Terminal/putty
A copy of the binary
The payloads of a few of the binary blobs they saw
By payload, I mean the contents of the socket connection with all the TCP/IP information stripped
“TheBoss” wants to know what is going on. What was this program doing? What information is in these binary blobs that appear to be random data with no patterns/signatures.
You have been provided with the files ‘binary’, ‘bin1’, ‘bin2’, and ‘bin3’. The ‘binary’ file is the executable. The other bin files were pulled from wireshark and are the payloads of the communication that was viewed.
Please answer the following questions/perform the following tasks:
1. Provide what shared objects this binary imports (ie what external libraries are used?)
2. Examine the binary and determine how the binary blobs are being sent – what internet address are they being sent to?
3. How are the binary blobs being created?
4.What format, if any, are they in?
5.What is the algorithm being used to create them?
6.What are the inputs are used in the identified algorithm?
7.Write a C program that can decode these binary blobs
Provide your C code with instructions on how to compile/use it – make sure it works on the class VMs
Provide the information that you have decoded from the binary blobs – What is it?
8. How does the program gather the data to put into the binary blobs? What mechanism is used? Are there any signatures you can look for to detect this on other hosts on your network?
*The algorithm you find must be implemented in C! You may not use ‘system’, ‘exec’ or other such functions to call command line/shell utilities or pass scripting commands to various parsers!
*Please include screenshots/documentation to back up your findings!
I will provide Username and Password on how to access for the binaries. it can be accessed using Terminal/putty