23 ms·
I was asked to crack a program in a job interview
- zellyn 12y agoIf this sounds fun, give microcorruption.com a try :-)
- jere 12y agoYes microcorruption was a lot of fun and the last part of this post reminds me very much of the last level. The nice thing about microcorruption was how you didn't need much more than familiarity with assembly and C (and language of choice in the end game). This interview challenge on the other hand... I wouldn't even know where to start.
- joezydeco 12y agoThat's some impressive work. But then... "The company send me another crack me for round 2 :) That's also interesting.." That wasn't enough to get the job?
- scintill76 12y agoThis is similar to about level 2 or 3, out of 5, of some cracks I've done for security CTF (capture the flag) competitions. Almost every competitive team/individual will solve this pretty easily, and I haven't even been in the elite competitions where it probably gets much harder. So, I would expect there are harder cracks or exploits, if the company wants to hire the best. By the way, if this sort of thing interests anyone, look into security CTF competitions. You'll probably have to read some tutorials to learn, but CTF's will give the opportunity to apply what you've learned.
- icebraining 12y agoHopefully not, I did a few similar crack-mes after reading just a couple of tutorials for dummies on the matter. On the Hack x Crack (awesome Spanish magazine from the early 2000s) forums, these were just the level 1 :) (I never did pass level 2)
- wyc 12y agoThis reminds me of the popular binary bomb lab offered in some computer architecture courses: http://csapp.cs.cmu.edu/public/labs.html http://csapp.cs.cmu.edu/public/labs.html
- doktrin 12y agoThese are fantastic labs. I took 15-213 at CMU while already working as a software developer. It was still tons of fun and quite educational.
- mathrat 12y agoHaha, if that's the one I remember you could completely trivialize that lab by fiddling with the program counter in gdb (skipping the line that sets off the bomb). Don't know if they were able to fix that in later versions of the lab. Good times, thanks for reminding me.
- elektronjunge 12y agoWhen I did that, it seemed like it was intentional. You could only get to the portions that signal success to the server by cracking parts of the bomb which was what we were graded on. The "don't let it explode" part was really the hey here's how you can use gdb to stop your program before it does anything serious.
- CocaKoala 12y agoYeah, I thought that's how everybody did it; when my class was assigned the project, we lost half a percentage point off our final grade for each time the bomb exploded. We very quickly learned to do things like "b explode_bomb".
- mathrat 12y agoSo if I recall, you were supposed to have to do a lot of investigative work to bypass stuff. There were several different "levels" that got progressively harder to crack. But there was nothing that stopped you from moving the program counter directly to the code that signals success. Which is what we did. Every level, exactly the same: fire it up, move program counter, send the success notice, finished!
- freehunter 12y agoReally nice overview of the process. I was hoping to get into debugging and breaking code, but my career took a wild turn away from that part of the job. It's still something I would like to learn, so I'm reading as much about it as I can. I'm going to take this way off topic here, but it's a curiosity of mine. Please don't take this as an insult; it seems to be very common and as a language learner myself I'm just wondering where it comes from. At first , it looks... analyze.Lets... debugger.Therefore , there... mode.In my opinion , Intel... So , those lines will basically scan the memory , if there is a 0xCC , it will crash your program and such ... Specifically in these examples, I'm seeing a missing space between a period and the next word, as well as a space before a comma. As English is one of my native languages, I'm not sure how people go about learning English or what resources are available to anyone learning English. I've noticed this with a lot of English as a second language speakers, and it doesn't seem to matter what their original language is. In this case, Spanish, but I've seen native Russian and Japanese speakers with the same thing. Can anyone tell me why this is?
- nobodysfool2 12y agopoor grammar instruction in school. A space is normally after a period even in russian.
- freehunter 12y agoAh, I thought it was something more than poor instruction. I participate in some foreign language pen-pal services and I see this a lot, more often than any other English grammar mistake.
- Swizec 12y agoAs far as I know, punctuation association rules are the same in all indo-european languages. Most of them bind to the left and have a space to the right. Emdash, and ... have two spaces, and endash and apostrophe have no spaces. But people struggle with this. I distinctly remembering practicing this in class when prepping for matura (Slovenian version of SATs) so I guess it isn't inherently obvious to everyone.
- meepmorp 12y ago> Here is the first thing i typed in the terminal root@lisa:~# ./CrackTheDoor Um. I see at least one security issue already.
- odonnellryan 12y agoCould have been a VM! I'd assume it was.
- meepmorp 12y agoI did assume that, but it still seems like bad practice.
- icebraining 12y agoOr even a livecd with no other storage attached.
- antocv 12y agoExcept it may flash your bios or reflash any of your PCI cards and persist there.
- scott_karana 12y agoNot sure why you're getting downvoted, but debugging a "crack me" app while running as root is probably a bad idea. Even if this is inside a VM, it might give the wrong message to someone wanting to try this for themselves.
- ryan-c 12y agoI've played in many CTFs and written challenges for a few. Unpleasant surprises in the binaries, especially when run as root aren't uncommon.
- eyeareque 12y agoYou could also attack the VM: http://www.cvedetails.com/vulnerability-list/vendor_id-93/product_id-20406/Oracle-Vm-Virtualbox.html http://www.cvedetails.com/vulnerability-list/vendor_id-93/pr...
- pkaye 12y agoI don't know where you find candidates that can even approach this level of skill or desire to solve puzzles. Most people I interview struggle with a few lines C program coding.
- drinchev 12y agoYeah that's why I was always thrilled with (cr|h)ackers. Back in the time when I was young actually this word ( hacker ) meant something completely different than what it is now. I think people like this have a talent in another direction, compared to programmers. Something like : "As much as I am good in making programs I am not good at all in reverse engineering them."
- dllthomas 12y agoWhat kinds of positions are you interviewing for?
- pkaye 12y agoFirmware engineers. Basically C programming and working close to the hardware.
- dllthomas 12y agoHmm, as andrewljohnson said, I expect that the posting impacts who applies, but I would expect that to disproportionately turn up applicants who can write C. Another dynamic at play is the fact that those who don't have useful skills apply more often as they continue to be out of work, that doubtless accounts for some of it. Still a bit strange.
- pkaye 12y agoSome examples of coding questions I've asked in the past: reverse a string in place. Ones count of an integer. I'm testing if they understand pointers and bit manipulations for example. These should be answerable in 5 minutes max in 5 lines of C code. The incorrect answers candidates generate surprise me.
- professorwimpy 12y ago"Now, I have been told that the best crackers in the world can do this in 60 minutes. Unfortunately, I need someone who can do it in 60 seconds."
- jsaxton86 12y agoDoes this guy have any idea how hard it is to come up with good interview questions? By posting the question and solution online (complete with an md5sum and everything!), he has ruined the question, and his employer will now need to spend a significant amount of time coming up with another way to evaluate candidates.
- lotsofcows 12y agoAh, the good old security through obscurity technique!
- mahmoudimus 12y agoI have a pretty cool crackme that I programmed and I wanted to offer it as a puzzle to some candidates, but without the proper reverse engineering tools, I think most candidates would really struggle -- especially if you're looking for just general developers. Haven't given it much thought past this.
- Ysx 12y agoIf it's no relevance to the job, you're only testing that they share your interests.
- eru 12y agoWhich might be a useful tool to attract candidates, but not to select them. (Compare exploratory data analysis.)
- alimoeeny 12y agoIf you are hiring a "general developer" it may not be the best idea to test them this way.
- imaginenore 12y agoIf we asked questions like that at our interviews, it would take us 10 years to hire one candidate. Most people fail at basic basic stuff.
- doktrin 12y agoAre you hiring security engineers? I would think stuff like this would be expected knowledge in the field.
- jonahx 12y agowhat's a good, simple intro to the basics of this kind of cracking for someone who is an experienced programmer, knows some C, etc, but has little system level or assembly experience?
- nesyt 12y agoThe bomb lab discussed elsewhere in this comment thread.
- nekitamo 12y agohttps://tuts4you.com/ https://tuts4you.com/ The lena151 tutorials are especially good: https://tuts4you.com/download.php?list.17 https://tuts4you.com/download.php?list.17
- tomsthumb 12y agocrackmes.de and exploit exercises VMs
- bubblicious 12y agoI would really suggest purchasing a good book about it. From my point of view, I would go for "Hacking: The Art of Exploitation, 2nd Edition" from Jon Erickson which goes in depth about how to crack programs using gdb and other tools. It's really a wonderful book if you want to learn more about the world of cracking in general, and it doesn't require much prior security experience. Quick link to Amazon: http://www.amazon.com/Hacking-The-Art-Exploitation-Edition/dp/1593271441 http://www.amazon.com/Hacking-The-Art-Exploitation-Edition/d...
- FLUX-YOU 12y agoI've done some of this book. It's good, but you're better off knowing the basics before trying to really learn from it I think. I only knew a little C when I started, so I only got about 4 or 5 chapters after much googling before I drowned. Learn some ASM and get familiar with gdb before attempting
- 12y ago
- davidgerard 12y agoReal-life tests are THE best thing to send job candidates. It scales well (you don't have to spend personal hours on them) and you get real information. This applies even to sysadmins. We have a favourite: set up a VM with a slightly-broken application in a slightly-broken Apache and Tomcat, and get them to ssh in and document the process of fixing it. Even people who aren't a full bottle on Tomcat will give useful information, because we get an insight into their thought processes. I recommend this to all. (I note we've just done a round of interviews where we get a nice-looking CV and conduct a technical grilling. Hideous waste of time for everyone involved. All CVs should be regarded, on the balance of probabilities, as works of fiction. Do a remote self-paced test like this. You won't regret it.)
- deleted 12y ago[deleted]
- josh33 12y agoThe risk is if someone publishes a tutorial with the secrets on the web.
- peterwaller 12y agoBut presumably that happens some time down the road long after you have made your decision. Either that, or said secrets are published and heard about by an audience which are tuned to hear about interesting things quickly, who may also be what you're after.
- davidgerard 12y agoIn this case, being able to Google how to fix a slightly-misconfigured Apache and Tomcat counts as passing the test with flying colours. Becoming a Google-Certified [whatever] Engineer at the drop of a hat is something we regard as a serious positive in a sysadmin. Open book tests are never easy.
- fsniper 12y agoSomeone still calling sysadmins instead of devops in HackerNews is a rare thing. :) I know many so called sysadmins who could not pass this test in a reasonable time. Sometimes people without even basic script-fu or networking knowledge are considered sysadmins. And this drives me crazy.
- deleted 12y ago[deleted]
- raverbashing 12y agoVery nice My approach would be to disassemble, then try to find the strings in the program and see where they're being used and processed. And kill the CC thing by hexediting the file
- aabajian 12y agoThis is totally nostalgic of the "binary bomb" assignment in CS 107 @ Stanford. You have to run the program from Stanford's network. There are 6 levels and each level has a password you have to enter. If you enter the wrong password, the course server is notified, and a point is deducted from your grade. The correct way to solve each level is to disassemble the program and figure out what it's doing. Here's Google's cache of this page: http://webcache.googleusercontent.com/search?q=cache:uGbSzpZhmGsJ:web.stanford.edu/class/cs107/assign5.html+&cd=1&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:uGbSzpZ... ...there's even a secret level in the binary.
- iliis 12y agoWe did that in our second year and it was awesome. I don't know if it was the same binary but it was well made. The first password was very easy (just a constant string) and it got progressively harder from there. At the end we had to step through some recursive algorithm and you learned to read assembly almost as well as normal code. And the server for submitting the passwords didn't filter the username so you could enter arbitrary HTML into the high-score...
- sbisker 12y agoIs this company ok with this being posted? If so, they should say what company they are, because being associated with a clever puzzle like this is great for recruiting (even if it's not being used anymore). Unless they have their own reasons for remaining quiet (government? :)). If not, they should probably take it down, as having the solutions posted would ruin the evaluative value of what must have taken a very long time to make.
- AlyssaRowan 12y agoCrackmes (as they're known) can be kind of fun. The late Katja Kladnik once sent me a diskful of 'crackme' virii. I tried to deadlist one of them; it infected me when I did, and dared me to try a less obvious approach. Mangled symbol table => buffer overflow in debugger => arbitrary code. Sneaky.
- voltagex_ 12y agodeadlist?
- ShaneOG 12y agoUsing a disassembler to get the "source" (deadlist) assembly code rather than stepping through with a debugger. The portions of assembly code in the article are deadlists This thread is bringing back a lot of memories :)
- creamyhorror 12y agoYour comment prompted me to look up Katja Kladnik. I hadn't expected her to have passed in (edited) 1995. http://spth.virii.lu/coderz1/lucky.html http://spth.virii.lu/coderz1/lucky.html http://www.st-news.com/rex.htm#lucky http://www.st-news.com/rex.htm#lucky The e-zine this is from (http://spth.virii.lu/coderz1/ http://spth.virii.lu/coderz1/ / http://vxheavens.com/vx.php?fid=177 http://vxheavens.com/vx.php?fid=177) was pretty interesting, too. Harks back to the time of small, independent online communities with dark webpage backgrounds.
- AlyssaRowan 12y agoI miss her. :(
- enjoy-your-stay 12y agoLooks like he was doing this on Linux. A quick experiment shows me that you can call ptrace(PTRACE_TRACEME,..) on OSX multiple times without it failing (the constant is actually PT_TRACE_ME on darwin). I wonder if that's the same for all BSDs ? Interesting and educational writeup though, and just the thing to get me tinkering myself!
- justincormack 12y agopresumably it was a linux binary...
- userbinator 12y agoIf you want to try cracking one yourself, there are plenty of crackmes at http://crackmes.de/ http://crackmes.de/
- ckaygusu 12y agoI also tried to crack exactly this program a while ago. The company (I believe it is MilSoft, one of the most reputable software companies in Turkey) sent this challenge to university students to hire a part-time CS student. Nevertheless, this was the first time I've ever attempted to crack something and while I had little to no idea what was going on, it was a very thrilling experience. I think I went on 14 hours without taking a break. I began by trying to run the program in GDB, got SIGSEGV'd. Afterwards I inspected the faulty address and tried to avoid it by changing its value, instead it crashed at somewhere else. After trying this hopeless catch-and-run for several hours, I decided I needed a better disassembly tool and went on to IDA Pro. This particular program contains a trick that intrigued me very much, and it is the reason why I was getting SIGSEGV'd at different locations when altering the program code. The main payload of this program is simply XOR-encrypted by some key. The whole thing begins by decrypting the payload and then begins its execution as normal. The gist is, the particular key that encrypted the main payload is the decryption code itself (for the unacquainted, assembly code is also just a byte stream). Here, this exact part: 0x804762d: mov $0xaa,%dl 0x804762f: mov $0x8048480,%edi 0x8047634: mov $0x8048cbc,%ecx 0x8047639: mov %edi,0x80476f3 0x804763f: mov %ecx,0x80476f7 0x8047645: sub %edi,%ecx 0x8047647: mov $0x804762f,%esi 0x804764c: push $0x80476c1 0x8047651: pusha 0x8047652: mov $0x55,%al 0x8047654: xor $0x99,%al 0x8047656: mov $0x8047656,%edi 0x804765b: mov $0x80476e5,%ecx 0x8047660: sub $0x8047656,%ecx 0x8047666: repnz scas %es:(%edi),%al 0x8047668: je 0x804770a 0x804766e: mov %edi,0x80476eb 0x8047674: popa 0x8047675: add 0x80476eb,%edx 0x804767b: ret As far as I can remember, the key was a bit more than that, but I'm sure it was including this part. At the end of every iteration (of something involving this loop which I can't precisely recall now) the program checks whether it is running under debug mode (essentially makes a PTRACE call and reads its output, the OP also talks about it) If this is the case, it makes a jump to random address, so even if you are just neatly watching the program run under debug mode, you weren't going to achieve anything. The next thing that occured to me is to manipulate how PTRACE returns its value, but I thought it would involve some kernel code fiddling and running the program under the modified kernel, which is WAY beyond my ability for now. I didn't know how to do it, but later by some very stupid trick I managed to pass this decryption part and the program made a jump to something like "__glibc_start". I needed to save the altered program and run it under gdb again (I don't remember why), but I was using the trial version of IDA Pro which prohibits me of such a thing. After making a few more desperate attempts I gave up. But this "using the code as the key".. I think spending 14 hours to see this done was well worth it.
- fsniper 12y agoThe post started very well but with the first screen shot, my mind started tingling: What the heck a security engineer is doing in a root shell? An unknown binary sent via an email is run in a root shell. There is also no mention of email source tracking. Hey you are a security engineer you know about weakness of smtp right? Even if this is a virtual machine, I would really reconsider employment of him or sit down and do a serious talking about this blog post if I were the employer. I could not continue reading the post before ranting about it.
- runamok 12y agoIs it really that probable that an email was sent to him from the company he is applying to and someone spoofed that to send him malware? I agree with the root point only because the company could have easily done something like `echo "I just rm -rf'ed your / because you ran me as root"` as part of the test. Why would you consider it still an issue if it was a VM he used only for this purpose?
- fsniper 12y agoWell, email is the primary threat distribution medium right now. So If a security engineer do not show scepticism about an unsigned, unencrypted email from an unverified source, I get picky. Looking from probability perspective, yes you are right, this is a low threat vector. Also I consider working root in a vm an issue because security 101 lesson 1 is "avoid privileged accounts as much as possible". Why not work in a unprivileged shell account and use sudo whenever needed? VMs are not bullet proof and they can leak memory, can make host machine unstable or even crash it. There are hardly any poc's out there but VM's may be exploited to switch context to host machine. Aside from these low probable threats, while working with unknown originated binaries, losing your whole work is a big probability. In this case it would not matter if you are inside a vm or not. VM's can be recovered but lost time can not be.
- claar 12y ago"Security 101" isn't all that relevant when you actually understand the threat vectors. If you can't create a clean, isolated, snapshot'd VM for this sort of playing, you have no business applying for this sort of job.
- estefan 12y agoI remember fravia and +orc back in the day... I think he passed away, but there are still archives online: http://www.woodmann.com/fravia/ http://www.woodmann.com/fravia/ I spent hours starring at softice & winice, and learning x86 asm
- superuser2 12y agoThis is Intro to Systems homework at UChicago (the course is heavily based on CMU's equivalent.) You're given a personalized binary that asks for a series of passwords to complete each level. If you get a password wrong, it phones home to a server run by the professor and decrements your grade. The point is to teach you to reason about assembly using GDB. You can pretty trivially set a breakpoint at the phoning-home routine so that you never actually lose any points; then it's just a question of thinking and reading hard enough before the deadline arrives. Levels range from very simple string comparison, to arithmetic, to pretty weird tricks. It was about the most memorable homework assignment I've ever done.
- TheCapn 12y agoHow did it identify you as a student? Couldn't you alter the routine to bomb someone else's grade?
- D5AA96 12y agoThat's how you get extra credit.
- superuser2 12y agoYou get a customized binary tied in a server-side database to your campus single-sign-on identity. Everyone gets different passwords, and the passwords are validated server-side to make sure you didn't just GOTO the success reporting routine. There could easily have been a secret embedded in each bomb, reported on defusal or detonation, to prevent people from detonating each other. The project was graded on an absolute rather than relative scale, so there was little incentive to spend time on something other than defusing your own bomb. (The project was called "the binary bomb." We all had a great time telling our friends that we were up all night at the library defusing a bomb.)
- x1798DE 12y agoDo you know if they did anything to mitigate replay attacks? If not, you could potentially capture someone's first call-hope and replay it until they fail. Presumably no one would want to, but people still like messing with one another for fun. Also, if you discover a vulnerability like that, you could plausibly claim that someone exploited it to bomb your grade, particularly if you used it against a bunch of people.
- diminoten 12y agoHow the hell do I have a job? I can't even follow most of this...
- fastball 12y agoAgh wHy is thE capitalization & puncuation. so inconsistent?
- javajosh 12y agoSo the only way for programs to get data from the outside world is to poll with system calls? I always thought that programs defined a "holding area" that the kernel would write into when it had data - the program still might poll, but it's polling (potentially very small, perhaps a single register) local data rather than making a system call.
- shabble 12y agoLargely, yes. Which is why strace is so useful as a debugging tool. It's also why you want to do buffered IO (read/write in kB at a time) to minimise call overhead. There is mmap[1] (controlled, unsurprisingly, by syscalls), which will give you a memory region that may be updated transparently for you by the kernel, but in general, it's all syscalls. The other nice thing about the syscall interface is that it gives the kernel an opportunity to suspend the calling process and schedule something else if it can't fulfill their request right now (hence, blocking IO), so you're not actually polling. Of course, a preeemptive scheduler (like everything actually is) can step in and suspend you anyway, but the syscall is a nice place to do it cooperatively. [1] https://en.wikipedia.org/wiki/Mmap https://en.wikipedia.org/wiki/Mmap
- turtles 12y agoSimilarly, I had to debug a vulnerability and write an exploit for a vulnerability in adobe reader for a job interview. :)
- aceperry 12y agoThis reminds me of a scene from the movie "Swordfish", starring Hugh Jackman, John Travolta, and Halle Berry. :-)
- trase1 12y agonice
- Ben-G 12y agoAre there any good resources to learn what is necessary to solve this puzzle?
- tomrod 12y agoThat, my friends, was a powerful blogpost. Raw, exuberant, and purposeful. I learned much.
- marincounty 12y agoI've always believed a test a a fair way of hiring. It takes "the good ole boy", and the whole "my friend is brilliant" out of the equation. Personally, I've never liked, actually despised, the whole networking thing.
- ck2 12y agoThen gets fired for revealing the answer to the only test they have. Just kidding, congrats!
- acjohnson55 12y agoBack when I was in high school, I had a Palm IIIxe. This was the days before app markets and nearly everybody who made PalmOS apps tried to sell them as shareware with a price of $20-50 -- well beyond what I could afford as a broke high school student. Fortunately, I had learned Z80 assembly programming my TI-83, which had led me to dabble in 68k assembly when I bought a TI-89. I never mastered 68k the way I did Z80, but I knew enough to find the routines that ran the registration key check when the OK button was pressed, and by trial and error, I'd invert conditional jumps until I found the one that would turn a failed registration attempt into a success. Then I'd hex edit the binary to make the switch. Worked like a charm about 80% of the time!
- skizm 12y agoShould have sent them a password locked program called *DoorHasBeenCracked". The only thing it does is post passwords to an http server that you control. There is a good chance they try their own password on it. New school phishing attack. /s
- notfoss 12y agoIgnoring the /s tag, it sounds apt for a hollywood movie or a sci-fi show, but in reality it will most likely be run on an unnetworked VM. But funny nonetheless :P
- mariuolo 12y agoYou know that by publishing this now YOU will have to write the challenge programme for the next candidate, right?;)
- notfoss 12y agoIt's a wonder he wasn't under an NDA or something.
- harshil93 12y agoThis reminds of this quora post. A nice one for beginners like me. The guy reverse engineered Sublime Text to remove the nagware of registration. https://ericjang.quora.com/Reverse-Engineering-Apps-a-Step-by-Step-Beginners-Guide-3 https://ericjang.quora.com/Reverse-Engineering-Apps-a-Step-b... PS- You should buy ST, it is one of the best code editors out there in the market.
- h43k3r 12y agoThanks for this. A good read for those who have never used such tools.
- sayginbican 12y agoDude?? Did you wait until you go to Spain to post this? Still, it is very fun to read this post and comments here. Actually, I prepared these two crackmes in order to arrange a small competition among universities at Turkey. But, they became very good interview questions also. It's really good to read these responses. Cracking ability is really rare in CS student community in Turkey. Our intention was increase awareness. Reading these comments showed me it was a really good step.
- m00dy 12y agoMa mannn :)) i was just kinda bored here , that's why i posted that blog i hoped you liked it , it's getting viral :))
- joeblau 12y agoI love the way the way m00dy dissected the problem. About 2 months ago, I was watching some advanced LLDB videos from Apple and they went into a lot of the tricks detailed in this post for setting breakpoints and debugging a program. That being said, some of the knowledge about halting commands and configuring gdb to ignore debug mode are just some things only a pro would know. Great job and thanks for the great read.
- ohshout 12y agowhy doesn't the author use objdump so there is no need to bypass ptrace()?
- terminado 12y agoPassword variables stored as constants? In MY binary? It's more likely than you think!