实用工具binwalk

在刚刚结束的Ghost in shellcode 2013热身赛中，其中的第三题涉及到了有关压缩文件格式的问题。

原题在：http://ghostintheshellcode.com/2013-teaser/

第三题，给了一个bin文件，很容易猜到应该是从文件中提取信息。

首先利用file命令检测文件的magic，得到它是xz格式的压缩包。

解压后，继续file，得到以下信息：

gzip compressed data, was "43", from Unix, last modified: Fri Jan 11 07:54:03 2013

这里这个43其实是十分诡异的存在的，如果当时能够继续深思一下就好了。

随后我直接就gzip -d 进行解压缩，得到了一个纯数据文件。

检查内部的二进制数据，发现了tar压缩包的magic：ustar以及大量可读的文本。

后来查阅发现，是其中的html文件内容。

此时已经猜到了这里的tar文件被乱序了。当时只顾着分析gzip后的结果，而忘记了从原始gzip文件开始。

结束后，看到别人的writeup才恍然大悟，这是一道完全应该可以做出来的题目。

他们提到了一个工具binwalk，能够对binary文件中的不同部分，根据magic标示，分析文件。

我去下载然后编译运行了一下，效果确实不错。

DECIMAL         HEX             DESCRIPTION

-------------------------------------------------------------------------------------------------------

0               0x0             gzip compressed data, was "43", from Unix, last modified: Fri Jan 11 07:54:03 2013

956             0x3BC           gzip compressed data, was "38", from Unix, last modified: Fri Jan 11 07:54:03 2013

1912            0x778           gzip compressed data, was "45", from Unix, last modified: Fri Jan 11 07:54:03 2013

2868            0xB34           gzip compressed data, was "16", from Unix, last modified: Fri Jan 11 07:54:03 2013

3824            0xEF0           gzip compressed data, was "67", from Unix, last modified: Fri Jan 11 07:54:03 2013

4780            0x12AC          gzip compressed data, was "30", from Unix, last modified: Fri Jan 11 07:54:03 2013

5736            0x1668          gzip compressed data, was "03", from Unix, last modified: Fri Jan 11 07:54:03 2013

6286            0x188E          gzip compressed data, was "23", from Unix, last modified: Fri Jan 11 07:54:03 2013

7242            0x1C4A          gzip compressed data, was "9008", from Unix, last modified: Fri Jan 11 07:54:03 2013

7276            0x1C6C          gzip compressed data, was "53", from Unix, last modified: Fri Jan 11 07:54:03 2013

8232            0x2028          gzip compressed data, was "60", from Unix, last modified: Fri Jan 11 07:54:03 2013

9188            0x23E4          gzip compressed data, was "24", from Unix, last modified: Fri Jan 11 07:54:03 2013

10144           0x27A0          gzip compressed data, was "59", from Unix, last modified: Fri Jan 11 07:54:03 2013

11100           0x2B5C          gzip compressed data, was "11", from Unix, last modified: Fri Jan 11 07:54:03 2013

11441           0x2CB1          gzip compressed data, was "44", from Unix, last modified: Fri Jan 11 07:54:03 2013

12397           0x306D          gzip compressed data, was "70", from Unix, last modified: Fri Jan 11 07:54:03 2013

13353           0x3429          gzip compressed data, was "50", from Unix, last modified: Fri Jan 11 07:54:03 2013

14309           0x37E5          gzip compressed data, was "12", from Unix, last modified: Fri Jan 11 07:54:03 2013

14661           0x3945          gzip compressed data, was "00", from Unix, last modified: Fri Jan 11 07:54:03 2013

14792           0x39C8          gzip compressed data, was "42", from Unix, last modified: Fri Jan 11 07:54:03 2013

15748           0x3D84          gzip compressed data, was "75", from Unix, last modified: Fri Jan 11 07:54:03 2013

16426           0x402A          gzip compressed data, was "10", from Unix, last modified: Fri Jan 11 07:54:03 2013

16948           0x4234          gzip compressed data, was "9009", from Unix, last modified: Fri Jan 11 07:54:03 2013

16977           0x4251          gzip compressed data, was "15", from Unix, last modified: Fri Jan 11 07:54:03 2013

17933           0x460D          gzip compressed data, was "09", from Unix, last modified: Fri Jan 11 07:54:03 2013

18492           0x483C          gzip compressed data, was "40", from Unix, last modified: Fri Jan 11 07:54:03 2013

19448           0x4BF8          gzip compressed data, was "27", from Unix, last modified: Fri Jan 11 07:54:03 2013

20225           0x4F01          gzip compressed data, was "08", from Unix, last modified: Fri Jan 11 07:54:03 2013

20771           0x5123          gzip compressed data, was "63", from Unix, last modified: Fri Jan 11 07:54:03 2013

21182           0x52BE          gzip compressed data, was "01", from Unix, last modified: Fri Jan 11 07:54:03 2013

21564           0x543C          gzip compressed data, was "66", from Unix, last modified: Fri Jan 11 07:54:03 2013

22520           0x57F8          gzip compressed data, was "18", from Unix, last modified: Fri Jan 11 07:54:03 2013

23476           0x5BB4          gzip compressed data, was "57", from Unix, last modified: Fri Jan 11 07:54:03 2013

24432           0x5F70          gzip compressed data, was "21", from Unix, last modified: Fri Jan 11 07:54:03 2013

25388           0x632C          gzip compressed data, was "47", from Unix, last modified: Fri Jan 11 07:54:03 2013

26344           0x66E8          gzip compressed data, was "04", from Unix, last modified: Fri Jan 11 07:54:03 2013

26885           0x6905          gzip compressed data, was "9005", from Unix, last modified: Fri Jan 11 07:54:03 2013

27843           0x6CC3          gzip compressed data, was "32", from Unix, last modified: Fri Jan 11 07:54:03 2013

28799           0x707F          gzip compressed data, was "41", from Unix, last modified: Fri Jan 11 07:54:03 2013

29755           0x743B          gzip compressed data, was "55", from Unix, last modified: Fri Jan 11 07:54:03 2013

30711           0x77F7          gzip compressed data, was "36", from Unix, last modified: Fri Jan 11 07:54:03 2013

31667           0x7BB3          gzip compressed data, was "33", from Unix, last modified: Fri Jan 11 07:54:03 2013

32623           0x7F6F          gzip compressed data, was "80", from Unix, last modified: Fri Jan 11 07:54:03 2013

33579           0x832B          gzip compressed data, was "9006", from Unix, last modified: Fri Jan 11 07:54:03 2013

33613           0x834D          gzip compressed data, was "69", from Unix, last modified: Fri Jan 11 07:54:03 2013

34569           0x8709          gzip compressed data, was "52", from Unix, last modified: Fri Jan 11 07:54:03 2013

35525           0x8AC5          gzip compressed data, was "89", from Unix, last modified: Fri Jan 11 07:54:03 2013

36481           0x8E81          gzip compressed data, was "9007", from Unix, last modified: Fri Jan 11 07:54:03 2013

36515           0x8EA3          gzip compressed data, was "84", from Unix, last modified: Fri Jan 11 07:54:03 2013

37471           0x925F          gzip compressed data, was "82", from Unix, last modified: Fri Jan 11 07:54:03 2013

38427           0x961B          gzip compressed data, was "76", from Unix, last modified: Fri Jan 11 07:54:03 2013

38877           0x97DD          gzip compressed data, was "25", from Unix, last modified: Fri Jan 11 07:54:03 2013

39833           0x9B99          gzip compressed data, was "06", from Unix, last modified: Fri Jan 11 07:54:03 2013

40379           0x9DBB          gzip compressed data, was "88", from Unix, last modified: Fri Jan 11 07:54:03 2013

41335           0xA177          gzip compressed data, was "26", from Unix, last modified: Fri Jan 11 07:54:03 2013

42291           0xA533          gzip compressed data, was "29", from Unix, last modified: Fri Jan 11 07:54:03 2013

43247           0xA8EF          gzip compressed data, was "9002", from Unix, last modified: Fri Jan 11 07:54:03 2013

44205           0xACAD          gzip compressed data, was "14", from Unix, last modified: Fri Jan 11 07:54:03 2013

45161           0xB069          gzip compressed data, was "31", from Unix, last modified: Fri Jan 11 07:54:03 2013

46117           0xB425          gzip compressed data, was "83", from Unix, last modified: Fri Jan 11 07:54:03 2013

47073           0xB7E1          gzip compressed data, was "34", from Unix, last modified: Fri Jan 11 07:54:03 2013

48029           0xBB9D          gzip compressed data, was "86", from Unix, last modified: Fri Jan 11 07:54:03 2013

48985           0xBF59          gzip compressed data, was "51", from Unix, last modified: Fri Jan 11 07:54:03 2013

49941           0xC315          gzip compressed data, was "13", from Unix, last modified: Fri Jan 11 07:54:03 2013

50897           0xC6D1          gzip compressed data, was "54", from Unix, last modified: Fri Jan 11 07:54:03 2013

51853           0xCA8D          gzip compressed data, was "37", from Unix, last modified: Fri Jan 11 07:54:03 2013

52809           0xCE49          gzip compressed data, was "48", from Unix, last modified: Fri Jan 11 07:54:03 2013

53765           0xD205          gzip compressed data, was "61", from Unix, last modified: Fri Jan 11 07:54:03 2013

54721           0xD5C1          gzip compressed data, was "28", from Unix, last modified: Fri Jan 11 07:54:03 2013

55104           0xD740          gzip compressed data, was "77", from Unix, last modified: Fri Jan 11 07:54:03 2013

56060           0xDAFC          gzip compressed data, was "9003", from Unix, last modified: Fri Jan 11 07:54:03 2013

57018           0xDEBA          gzip compressed data, was "65", from Unix, last modified: Fri Jan 11 07:54:03 2013

57974           0xE276          gzip compressed data, was "39", from Unix, last modified: Fri Jan 11 07:54:03 2013

58930           0xE632          gzip compressed data, was "78", from Unix, last modified: Fri Jan 11 07:54:03 2013

59886           0xE9EE          gzip compressed data, was "46", from Unix, last modified: Fri Jan 11 07:54:03 2013

60842           0xEDAA          gzip compressed data, was "19", from Unix, last modified: Fri Jan 11 07:54:03 2013

61798           0xF166          gzip compressed data, was "20", from Unix, last modified: Fri Jan 11 07:54:03 2013

62754           0xF522          gzip compressed data, was "68", from Unix, last modified: Fri Jan 11 07:54:03 2013

63710           0xF8DE          gzip compressed data, was "58", from Unix, last modified: Fri Jan 11 07:54:03 2013

64666           0xFC9A          gzip compressed data, was "35", from Unix, last modified: Fri Jan 11 07:54:03 2013

65622           0x10056         gzip compressed data, was "9004", from Unix, last modified: Fri Jan 11 07:54:03 2013

66580           0x10414         gzip compressed data, was "62", from Unix, last modified: Fri Jan 11 07:54:03 2013

67536           0x107D0         gzip compressed data, was "79", from Unix, last modified: Fri Jan 11 07:54:03 2013

68492           0x10B8C         gzip compressed data, was "49", from Unix, last modified: Fri Jan 11 07:54:03 2013

69448           0x10F48         gzip compressed data, was "05", from Unix, last modified: Fri Jan 11 07:54:03 2013

69961           0x11149         gzip compressed data, was "56", from Unix, last modified: Fri Jan 11 07:54:03 2013

70917           0x11505         gzip compressed data, was "72", from Unix, last modified: Fri Jan 11 07:54:03 2013

71873           0x118C1         gzip compressed data, was "9001", from Unix, last modified: Fri Jan 11 07:54:03 2013

72831           0x11C7F         gzip compressed data, was "71", from Unix, last modified: Fri Jan 11 07:54:03 2013

73787           0x1203B         gzip compressed data, was "17", from Unix, last modified: Fri Jan 11 07:54:03 2013

74743           0x123F7         gzip compressed data, was "74", from Unix, last modified: Fri Jan 11 07:54:03 2013

75699           0x127B3         gzip compressed data, was "9000", from Unix, last modified: Fri Jan 11 07:54:03 2013

76657           0x12B71         gzip compressed data, was "02", from Unix, last modified: Fri Jan 11 07:54:03 2013

77175           0x12D77         gzip compressed data, was "07", from Unix, last modified: Fri Jan 11 07:54:03 2013

77717           0x12F95         gzip compressed data, was "22", from Unix, last modified: Fri Jan 11 07:54:03 2013

78673           0x13351         gzip compressed data, was "85", from Unix, last modified: Fri Jan 11 07:54:03 2013

79629           0x1370D         gzip compressed data, was "81", from Unix, last modified: Fri Jan 11 07:54:03 2013

80585           0x13AC9         gzip compressed data, was "73", from Unix, last modified: Fri Jan 11 07:54:03 2013

81541           0x13E85         gzip compressed data, was "64", from Unix, last modified: Fri Jan 11 07:54:03 2013

82100           0x140B4         gzip compressed data, was "87", from Unix, last modified: Fri Jan 11 07:54:03 2013

看到这些输出，也就对开始的那个莫名的“43”有所想法了，其实就是很多gzip文件被连接在了一起，但是标准的gz格式是不支持多个文件混在一起解压的，导致了解压后的文件全部输出到了一起，顺序就丢失了。