Files
ctf/2025/glacier/rev/c2/output_strace
2025-11-28 12:20:39 +01:00

209 lines
14 KiB
Plaintext

execve("./c2_client", ["./c2_client", "challs.glacierctf.com:13392"], 0x7ffec0bcc568 /* 82 vars */) = 0
brk(NULL) = 0x56381f8d9000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=188279, ...}) = 0
mmap(NULL, 188279, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fbaeac10000
close(3) = 0
openat(AT_FDCWD, "/usr/lib/libgcc_s.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=905800, ...}) = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbaeac0e000
mmap(NULL, 180712, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbaeabe1000
mmap(0x7fbaeabe5000, 143360, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0x7fbaeabe5000
mmap(0x7fbaeac08000, 16384, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x27000) = 0x7fbaeac08000
mmap(0x7fbaeac0c000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2a000) = 0x7fbaeac0c000
close(3) = 0
openat(AT_FDCWD, "/usr/lib/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360w\2\0\0\0\0\0"..., 832) = 832
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 896, 64) = 896
fstat(3, {st_mode=S_IFREG|0755, st_size=2145632, ...}) = 0
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 896, 64) = 896
mmap(NULL, 2169904, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbaea800000
mmap(0x7fbaea824000, 1511424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x24000) = 0x7fbaea824000
mmap(0x7fbaea995000, 454656, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x195000) = 0x7fbaea995000
mmap(0x7fbaeaa04000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x203000) = 0x7fbaeaa04000
mmap(0x7fbaeaa0a000, 31792, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fbaeaa0a000
close(3) = 0
mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbaeabde000
arch_prctl(ARCH_SET_FS, 0x7fbaeabde780) = 0
set_tid_address(0x7fbaeabdea50) = 79924
set_robust_list(0x7fbaeabdea60, 24) = 0
rseq(0x7fbaeabde680, 0x20, 0, 0x53053053) = 0
mprotect(0x7fbaeaa04000, 16384, PROT_READ) = 0
mprotect(0x7fbaeac0c000, 4096, PROT_READ) = 0
mprotect(0x5637f9ef2000, 20480, PROT_READ) = 0
mprotect(0x7fbaeac7f000, 8192, PROT_READ) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
getrandom("\xb5\x7c\x0e\xd9\x6a\xe0\x43\x77", 8, GRND_NONBLOCK) = 8
munmap(0x7fbaeac10000, 188279) = 0
poll([{fd=0, events=0}, {fd=1, events=0}, {fd=2, events=0}], 3, 0) = 0 (Timeout)
rt_sigaction(SIGPIPE, {sa_handler=SIG_IGN, sa_mask=[PIPE], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7fbaea83e4d0}, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
brk(NULL) = 0x56381f8d9000
brk(0x56381f8fa000) = 0x56381f8fa000
openat(AT_FDCWD, "/proc/self/maps", O_RDONLY|O_CLOEXEC) = 3
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
fstat(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
read(3, "5637f9e82000-5637f9ed9000 r-xp 0"..., 1024) = 1024
read(3, "-7fbaeaa12000 rw-p 00000000 00:0"..., 1024) = 1024
read(3, " /usr/lib/ld-linux-"..., 1024) = 567
lseek(3, 0, SEEK_CUR) = 2615
lseek(3, 2531, SEEK_SET) = 2531
close(3) = 0
sched_getaffinity(79924, 32, [0 1 2 3 4 5 6 7]) = 8
rt_sigaction(SIGSEGV, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
sigaltstack(NULL, {ss_sp=NULL, ss_flags=SS_DISABLE, ss_size=0}) = 0
mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fbaeac3b000
mprotect(0x7fbaeac3b000, 4096, PROT_NONE) = 0
sigaltstack({ss_sp=0x7fbaeac3c000, ss_flags=0, ss_size=8192}, NULL) = 0
rt_sigaction(SIGSEGV, {sa_handler=0x5637f9eb8900, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_SIGINFO, sa_restorer=0x7fbaea83e4d0}, NULL, 8) = 0
rt_sigaction(SIGBUS, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGBUS, {sa_handler=0x5637f9eb8900, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_SIGINFO, sa_restorer=0x7fbaea83e4d0}, NULL, 8) = 0
newfstatat(AT_FDCWD, "/etc/nsswitch.conf", {st_mode=S_IFREG|0644, st_size=359, ...}, 0) = 0
newfstatat(AT_FDCWD, "/", {st_mode=S_IFDIR|0755, st_size=4096, ...}, 0) = 0
openat(AT_FDCWD, "/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=359, ...}) = 0
read(3, "# Name Service Switch configurat"..., 4096) = 359
read(3, "", 4096) = 0
fstat(3, {st_mode=S_IFREG|0644, st_size=359, ...}) = 0
close(3) = 0
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0644, st_size=285, ...}, 0) = 0
openat(AT_FDCWD, "/etc/host.conf", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=73, ...}) = 0
read(3, "# Resolver configuration file.\n#"..., 4096) = 73
read(3, "", 4096) = 0
close(3) = 0
futex(0x7fbaeaa1072c, FUTEX_WAKE_PRIVATE, 2147483647) = 0
openat(AT_FDCWD, "/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=285, ...}) = 0
read(3, "# Generated by NetworkManager\nse"..., 4096) = 285
read(3, "", 4096) = 0
fstat(3, {st_mode=S_IFREG|0644, st_size=285, ...}) = 0
close(3) = 0
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=188279, ...}) = 0
mmap(NULL, 188279, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fbaeabb0000
close(3) = 0
openat(AT_FDCWD, "/usr/lib/libnss_mymachines.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=379936, ...}) = 0
mmap(NULL, 379896, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbaeab53000
mmap(0x7fbaeab57000, 266240, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0x7fbaeab57000
mmap(0x7fbaeab98000, 81920, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x45000) = 0x7fbaeab98000
mmap(0x7fbaeabac000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x59000) = 0x7fbaeabac000
close(3) = 0
openat(AT_FDCWD, "/usr/lib/libcap.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 {\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=43064, ...}) = 0
mmap(NULL, 45128, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbaeac2f000
mmap(0x7fbaeac32000, 20480, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7fbaeac32000
mmap(0x7fbaeac37000, 8192, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x8000) = 0x7fbaeac37000
mmap(0x7fbaeac39000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x9000) = 0x7fbaeac39000
close(3) = 0
mprotect(0x7fbaeac39000, 4096, PROT_READ) = 0
mprotect(0x7fbaeabac000, 12288, PROT_READ) = 0
prctl(PR_CAPBSET_READ, CAP_MAC_OVERRIDE) = 1
prctl(PR_CAPBSET_READ, 0x30 /* CAP_??? */) = -1 EINVAL (Invalid argument)
prctl(PR_CAPBSET_READ, CAP_CHECKPOINT_RESTORE) = 1
prctl(PR_CAPBSET_READ, 0x2c /* CAP_??? */) = -1 EINVAL (Invalid argument)
prctl(PR_CAPBSET_READ, 0x2a /* CAP_??? */) = -1 EINVAL (Invalid argument)
prctl(PR_CAPBSET_READ, 0x29 /* CAP_??? */) = -1 EINVAL (Invalid argument)
munmap(0x7fbaeabb0000, 188279) = 0
futex(0x7fbaeabaf358, FUTEX_WAKE_PRIVATE, 2147483647) = 0
rt_sigprocmask(SIG_BLOCK, [HUP USR1 USR2 PIPE ALRM CHLD TSTP URG VTALRM PROF WINCH IO], [], 8) = 0
openat(AT_FDCWD, "/run/systemd/machines/challs.glacierctf.com", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=188279, ...}) = 0
mmap(NULL, 188279, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fbaeabb0000
close(3) = 0
openat(AT_FDCWD, "/usr/lib/libnss_resolve.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=211304, ...}) = 0
mmap(NULL, 215400, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbaeab1e000
mmap(0x7fbaeab21000, 143360, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0x7fbaeab21000
mmap(0x7fbaeab44000, 45056, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x26000) = 0x7fbaeab44000
mmap(0x7fbaeab4f000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x30000) = 0x7fbaeab4f000
close(3) = 0
openat(AT_FDCWD, "/usr/lib/libm.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1100400, ...}) = 0
mmap(NULL, 1102152, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fbaea6f2000
mmap(0x7fbaea701000, 569344, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xf000) = 0x7fbaea701000
mmap(0x7fbaea78c000, 466944, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x9a000) = 0x7fbaea78c000
mmap(0x7fbaea7fe000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x10b000) = 0x7fbaea7fe000
close(3) = 0
mprotect(0x7fbaea7fe000, 4096, PROT_READ) = 0
mprotect(0x7fbaeab4f000, 12288, PROT_READ) = 0
munmap(0x7fbaeabb0000, 188279) = 0
futex(0x7fbaeab520e4, FUTEX_WAKE_PRIVATE, 2147483647) = 0
rt_sigprocmask(SIG_BLOCK, [HUP USR1 USR2 PIPE ALRM CHLD TSTP URG VTALRM PROF WINCH IO], [], 8) = 0
socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 3
connect(3, {sa_family=AF_UNIX, sun_path="/run/systemd/resolve/io.systemd.Resolve"}, 42) = 0
sendto(3, "{\"method\":\"io.systemd.Resolve.Re"..., 104, MSG_DONTWAIT|MSG_NOSIGNAL, NULL, 0) = 104
mmap(NULL, 135168, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbaeabbd000
recvfrom(3, 0x7fbaeabbd010, 135152, MSG_DONTWAIT, NULL, NULL) = -1 EAGAIN (Resource temporarily unavailable)
ppoll([{fd=3, events=POLLIN}], 1, {tv_sec=119, tv_nsec=999564000}, NULL, 8) = 1 ([{fd=3, revents=POLLIN}], left {tv_sec=119, tv_nsec=974852424})
recvfrom(3, "{\"parameters\":{\"addresses\":[{\"if"..., 135152, MSG_DONTWAIT, NULL, NULL) = 130
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
close(3) = 0
munmap(0x7fbaeabbd000, 135168) = 0
socket(AF_INET, SOCK_STREAM|SOCK_CLOEXEC, IPPROTO_IP) = 3
connect(3, {sa_family=AF_INET, sin_port=htons(13392), sin_addr=inet_addr("34.185.202.132")}, 16) = 0
openat(AT_FDCWD, "/dev/null", O_RDONLY|O_CLOEXEC) = 4
pipe2([5, 6], O_CLOEXEC) = 0
pipe2([7, 8], O_CLOEXEC) = 0
prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=1024, rlim_max=512*1024}) = 0
prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=1024, rlim_max=512*1024}) = 0
prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=1024, rlim_max=512*1024}) = 0
prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=1024, rlim_max=512*1024}) = 0
prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=1024, rlim_max=512*1024}) = 0
prlimit64(0, RLIMIT_NOFILE, NULL, {rlim_cur=1024, rlim_max=512*1024}) = 0
mmap(NULL, 36864, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7fbaeac26000
rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
clone3({flags=CLONE_VM|CLONE_VFORK|CLONE_CLEAR_SIGHAND, exit_signal=SIGCHLD, stack=0x7fbaeac26000, stack_size=0x9000}, 88) = 79925
waitid(P_PID, 79925, NULL, WEXITED, NULL) = 0
munmap(0x7fbaeac26000, 36864) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=79925, si_uid=1000, si_status=127, si_utime=0, si_stime=0} ---
close(4) = 0
close(6) = 0
close(8) = 0
close(5) = 0
close(7) = 0
sendto(3, "CB\1\0\0\fcato@unknown\0001", 20, MSG_NOSIGNAL, NULL, 0) = 20
recvfrom(3, "CB\5\0\08ACK: Client 'cato@unknown'"..., 4096, 0, NULL, NULL) = 64
openat(AT_FDCWD, "/proc/self/status", O_RDONLY|O_CLOEXEC) = 4
statx(4, "", AT_STATX_SYNC_AS_STAT|AT_EMPTY_PATH, STATX_ALL, {stx_mask=STATX_BASIC_STATS|STATX_MNT_ID, stx_attributes=0, stx_mode=S_IFREG|0444, stx_size=0, ...}) = 0
read(4, "Name:\tc2_client\nUmask:\t0022\nStat", 32) = 32
read(4, "e:\tR (running)\nTgid:\t79924\nNgid:", 32) = 32
read(4, "\t0\nPid:\t79924\nPPid:\t79922\nTracer"..., 64) = 64
read(4, "000\nGid:\t1000\t1000\t1000\t1000\nFDS"..., 128) = 128
read(4, "79175\nKthread:\t0\nVmPeak:\t 524"..., 256) = 256
read(4, "mLib:\t 2768 kB\nVmPTE:\t 5"..., 512) = 512
read(4, "lationIndirectBranch:\tconditiona"..., 1024) = 515
read(4, "", 509) = 0
close(4) = 0
sendto(3, "CB\6\0\0\tflag.txt\1\0[", 17, MSG_NOSIGNAL, NULL, 0) = 17
recvfrom(3, "CB\7\0\0\24\312\303\317\316\206\337\322\321\302\313\307\306\216\327\332\311\0\0[\201\0\312", 4096, 0, NULL, NULL) = 28
openat(AT_FDCWD, "flag.txt", O_RDONLY|O_CLOEXEC) = 4
statx(4, "", AT_STATX_SYNC_AS_STAT|AT_EMPTY_PATH, STATX_ALL, {stx_mask=STATX_ALL|STATX_MNT_ID, stx_attributes=0, stx_mode=S_IFREG|0644, stx_size=50, ...}) = 0
read(4, "FLAG{This is a test flag for edu"..., 50) = 50
read(4, "", 32) = 0
close(4) = 0
openat(AT_FDCWD, "/dev/urandom", O_RDONLY|O_CLOEXEC) = 4
read(4, "J\341%\220\354*\0>", 8) = 8
close(4) = 0
openat(AT_FDCWD, "23425_4ae12590ec2a003e.enc", O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0666) = 4
write(4, "d\10\311\275\257\23\331\232-)R\335`HG\236\202\311\177\352\f\333\223\t\245\25\200\177\345\337\206\7"..., 56) = 56
close(4) = 0
sendto(3, "CB\5\0\0\nCRYPTO_ACK\0\25", 18, MSG_NOSIGNAL, NULL, 0) = 18
recvfrom(3, "CB\5\0\0\2OK\0\4", 4096, 0, NULL, NULL) = 10
sendto(3, "CB\377\0\0\0\0\0", 8, MSG_NOSIGNAL, NULL, 0) = 8
recvfrom(3, "Client disconnecting\n", 4096, 0, NULL, NULL) = 21
close(3) = 0
sigaltstack({ss_sp=NULL, ss_flags=SS_DISABLE, ss_size=8192}, NULL) = 0
munmap(0x7fbaeac3b000, 12288) = 0
exit_group(0) = ?
+++ exited with 0 +++