# Level 09

## how to login

username: level09

password: 25749xKZ8L7DkSCwJkT9dyv6f

## Goal

run `getflag` as user `flag09`

## Actually doing something

```bash
level09@SnowCrash:~$ ll
total 24
dr-x------ 1 level09 level09  140 Mar  5  2016 ./
d--x--x--x 1 root    users    340 Aug 30  2015 ../
-r-x------ 1 level09 level09  220 Apr  3  2012 .bash_logout*
-r-x------ 1 level09 level09 3518 Aug 30  2015 .bashrc*
-rwsr-sr-x 1 flag09  level09 7640 Mar  5  2016 level09*
-r-x------ 1 level09 level09  675 Apr  3  2012 .profile*
----r--r-- 1 flag09  level09   26 Mar  5  2016 token
```

seems we need to do the same as last level 
lets have fun hehe

```bash
level09@SnowCrash:~$ ./level09 
You need to provied only one arg.
level09@SnowCrash:~$ ./level09 AAA
ABC
level09@SnowCrash:~$ ./level09 AAAAAAAAA
ABCDEFGHI
```

What happens if I give it a REALLY LONG argument ?

```bash
level09@SnowCrash:~$ ./level09 $(python -c "print('A' * 1000)")
ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~��������������������������������������������������������������


123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~��������������������������������������������������������������


123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~��������������������������������������������������������������


123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~��������������������������������������������������������������
```

Alright lets open this bad boy under Ghidra

Woops after reading the code, it seems that it specifically tells you to not reverse it.

Looking a the files a bit closer, we can actually read the token file...

```bash
level09@SnowCrash:~$ ll token
----r--r-- 1 flag09  level09   26 Mar  5  2016 token
level09@SnowCrash:~$ cat token
f4kmm6p|=pnDBDu{
```

trying to directly use this as the password doesnt work, but when looking at the output of the binary, it seems that the does weird stuff to the input, lets try to run it through.


```bash
level09@SnowCrash:~$ ./level09 `cat token`
f5mpq;vE{{TSW
level09@SnowCrash:~$ su -c getflag flag09
Password: 
su: Authentication failure
```

Doesnt work.

Then lets try to reverse the effect of the binary ?

It looks like it does something like this:
> for every character in input
>    output (character+idx) % 255

let do a script that does:
> for every character in input
>    output (character-idx) % 255

we run it and we get
```bash
❯ ./levels/09/script.py <files/token
f3iji1ju5yuevaus41q1afiuq
```
lets try this one

```bash
level09@SnowCrash:~$ su -c getflag flag09
Password: 
Check flag.Here is your token : s5cAJpM8ev6XHw998pRWG728z
```

Perfect !